674 lines
24 KiB
JavaScript
674 lines
24 KiB
JavaScript
|
// proxy.js —— 全局 / 系统代理：内置 sing-box，把「要密码的上游 SOCKS5」转成
|
|||
|
|
// ① 系统代理：本地 mixed 端口(不要密码) + 设置 macOS/Windows 系统代理指过来；
|
|||
|
|
// ② 全局 TUN：创建虚拟网卡接管整机流量(需管理员权限，启动时弹一次密码框)。
|
|||
|
|
// macOS 系统代理不会发送用户名/密码，所以必须走本地中转——这正是本模块存在的原因。
|
|||
|
|
const { app, safeStorage } = require("electron");
|
|||
|
|
const { spawn, execFile } = require("child_process");
|
|||
|
|
const { promisify } = require("util");
|
|||
|
|
const fs = require("fs");
|
|||
|
|
const net = require("net");
|
|||
|
|
const path = require("path");
|
|||
|
|
const http = require("http");
|
|||
|
|
|
|||
|
|
const pExecFile = promisify(execFile);
|
|||
|
|
|
|||
|
|
// —— 运行时状态（内存）——
|
|||
|
|
let state = {
|
|||
|
|
mode: "off", // off | system | global
|
|||
|
|
child: null, // sing-box 子进程(系统模式) 或 osascript/powershell 提权进程(全局模式)
|
|||
|
|
localPort: 0, // 系统模式本地 mixed 端口
|
|||
|
|
services: [], // macOS：已设置系统代理的网络服务名，停止时逐一还原
|
|||
|
|
onChange: null, // 状态变化回调(通知前端 + 托盘)
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
function setOnChange(cb) {
|
|||
|
|
state.onChange = cb;
|
|||
|
|
}
|
|||
|
|
function emit() {
|
|||
|
|
if (typeof state.onChange === "function") {
|
|||
|
|
try {
|
|||
|
|
state.onChange(status());
|
|||
|
|
} catch {}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// 路径：sing-box 二进制 / 运行时目录 / 配置文件
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
function resDir() {
|
|||
|
|
// 打包后二进制在 resources/singbox；开发时在项目 resources/singbox
|
|||
|
|
return app.isPackaged
|
|||
|
|
? path.join(process.resourcesPath, "singbox")
|
|||
|
|
: path.join(__dirname, "..", "..", "resources", "singbox");
|
|||
|
|
}
|
|||
|
|
function binPath() {
|
|||
|
|
const plat = process.platform;
|
|||
|
|
let sub;
|
|||
|
|
let name = "sing-box";
|
|||
|
|
if (plat === "darwin") sub = process.arch === "arm64" ? "darwin-arm64" : "darwin-x64";
|
|||
|
|
else if (plat === "win32") {
|
|||
|
|
sub = "windows-x64";
|
|||
|
|
name = "sing-box.exe";
|
|||
|
|
} else {
|
|||
|
|
throw new Error("全局代理暂只支持 macOS 与 Windows");
|
|||
|
|
}
|
|||
|
|
return path.join(resDir(), sub, name);
|
|||
|
|
}
|
|||
|
|
function binExists() {
|
|||
|
|
try {
|
|||
|
|
return fs.existsSync(binPath());
|
|||
|
|
} catch {
|
|||
|
|
return false;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
function runtimeDir() {
|
|||
|
|
const d = path.join(app.getPath("userData"), "proxy-runtime");
|
|||
|
|
fs.mkdirSync(d, { recursive: true });
|
|||
|
|
return d;
|
|||
|
|
}
|
|||
|
|
function cfgPath() {
|
|||
|
|
return path.join(app.getPath("userData"), "proxy.json");
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// 配置持久化（proxyStr 用 safeStorage 加密）
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
function enc(s) {
|
|||
|
|
if (!s) return "";
|
|||
|
|
try {
|
|||
|
|
if (safeStorage.isEncryptionAvailable()) return "v1:" + safeStorage.encryptString(s).toString("base64");
|
|||
|
|
} catch {}
|
|||
|
|
return "b64:" + Buffer.from(s, "utf-8").toString("base64");
|
|||
|
|
}
|
|||
|
|
function dec(s) {
|
|||
|
|
if (!s) return "";
|
|||
|
|
try {
|
|||
|
|
if (s.startsWith("v1:")) return safeStorage.decryptString(Buffer.from(s.slice(3), "base64"));
|
|||
|
|
if (s.startsWith("b64:")) return Buffer.from(s.slice(4), "base64").toString("utf-8");
|
|||
|
|
} catch {}
|
|||
|
|
return "";
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
let conf = null;
|
|||
|
|
function defaultConf() {
|
|||
|
|
return { proxyStr: "", localPort: 0, appliedPort: 0 };
|
|||
|
|
}
|
|||
|
|
function loadConf() {
|
|||
|
|
if (conf) return conf;
|
|||
|
|
try {
|
|||
|
|
const raw = JSON.parse(fs.readFileSync(cfgPath(), "utf-8"));
|
|||
|
|
raw.proxyStr = raw.proxyStr ? dec(raw.proxyStr) : "";
|
|||
|
|
conf = { ...defaultConf(), ...raw };
|
|||
|
|
} catch {
|
|||
|
|
conf = defaultConf();
|
|||
|
|
}
|
|||
|
|
return conf;
|
|||
|
|
}
|
|||
|
|
function saveConf() {
|
|||
|
|
const out = { ...conf, proxyStr: enc(conf.proxyStr) };
|
|||
|
|
const p = cfgPath();
|
|||
|
|
fs.mkdirSync(path.dirname(p), { recursive: true });
|
|||
|
|
fs.writeFileSync(p, JSON.stringify(out, null, 2));
|
|||
|
|
try {
|
|||
|
|
fs.chmodSync(p, 0o600);
|
|||
|
|
} catch {}
|
|||
|
|
}
|
|||
|
|
function getConfig() {
|
|||
|
|
loadConf();
|
|||
|
|
return { proxyStr: conf.proxyStr, localPort: conf.localPort || 0 };
|
|||
|
|
}
|
|||
|
|
function setConfig({ proxyStr, localPort } = {}) {
|
|||
|
|
loadConf();
|
|||
|
|
if (proxyStr !== undefined) conf.proxyStr = String(proxyStr || "").trim();
|
|||
|
|
if (localPort !== undefined) conf.localPort = parseInt(localPort, 10) || 0;
|
|||
|
|
saveConf();
|
|||
|
|
return getConfig();
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// 解析上游代理字符串：支持
|
|||
|
|
// host:port:user:pass / host:port / socks5://user:pass@host:port
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
function parseProxy(str) {
|
|||
|
|
str = String(str || "").trim();
|
|||
|
|
if (!str) return null;
|
|||
|
|
const m = str.match(/^socks5?:\/\/(?:([^:@/]+):([^@/]+)@)?([^:/@]+):(\d+)/i);
|
|||
|
|
if (m) return { host: m[3], port: parseInt(m[4], 10), user: m[1] || "", pass: m[2] || "" };
|
|||
|
|
const parts = str.split(":");
|
|||
|
|
if (parts.length === 4 && /^\d+$/.test(parts[1])) {
|
|||
|
|
return { host: parts[0], port: parseInt(parts[1], 10), user: parts[2], pass: parts[3] };
|
|||
|
|
}
|
|||
|
|
if (parts.length === 2 && /^\d+$/.test(parts[1])) {
|
|||
|
|
return { host: parts[0], port: parseInt(parts[1], 10), user: "", pass: "" };
|
|||
|
|
}
|
|||
|
|
return null;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// 找空闲端口（优先用用户指定端口，占用则随机取）
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
function findFreePort(preferred) {
|
|||
|
|
return new Promise((resolve) => {
|
|||
|
|
const tryListen = (port, fallback) => {
|
|||
|
|
const srv = net.createServer();
|
|||
|
|
srv.once("error", () => {
|
|||
|
|
if (fallback) tryListen(0, false);
|
|||
|
|
else resolve(0);
|
|||
|
|
});
|
|||
|
|
srv.listen(port, "127.0.0.1", () => {
|
|||
|
|
const p = srv.address().port;
|
|||
|
|
srv.close(() => resolve(p));
|
|||
|
|
});
|
|||
|
|
};
|
|||
|
|
tryListen(preferred || 0, !!preferred);
|
|||
|
|
});
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// sing-box 配置生成
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
function outbounds(p) {
|
|||
|
|
const proxy = { type: "socks", tag: "proxy", server: p.host, server_port: p.port, version: "5" };
|
|||
|
|
if (p.user) {
|
|||
|
|
proxy.username = p.user;
|
|||
|
|
proxy.password = p.pass;
|
|||
|
|
}
|
|||
|
|
return [proxy, { type: "direct", tag: "direct" }];
|
|||
|
|
}
|
|||
|
|
function systemConfig(p, port) {
|
|||
|
|
return {
|
|||
|
|
log: { level: "warn" },
|
|||
|
|
inbounds: [{ type: "mixed", tag: "mixed-in", listen: "127.0.0.1", listen_port: port }],
|
|||
|
|
outbounds: outbounds(p),
|
|||
|
|
route: { final: "proxy" },
|
|||
|
|
};
|
|||
|
|
}
|
|||
|
|
function globalConfig(p, logPath) {
|
|||
|
|
return {
|
|||
|
|
// 让 sing-box 直接把日志写到文件(UTF-8)，不依赖 shell 重定向 → 中文路径无损、判断启动可靠
|
|||
|
|
log: { level: "info", output: logPath, timestamp: true },
|
|||
|
|
dns: {
|
|||
|
|
servers: [
|
|||
|
|
// 用 TCP-53 远程 DNS(经代理解析)——比 DoT(853) 更通用，避免代理不放行加密 DNS 导致全站解析失败
|
|||
|
|
{ type: "tcp", tag: "remote-dns", server: "8.8.8.8", detour: "proxy" },
|
|||
|
|
{ type: "local", tag: "local-dns" },
|
|||
|
|
],
|
|||
|
|
final: "remote-dns",
|
|||
|
|
strategy: "ipv4_only",
|
|||
|
|
},
|
|||
|
|
inbounds: [
|
|||
|
|
// gvisor 用户态协议栈：Windows 上比 system 栈更稳、兼容性好
|
|||
|
|
{ type: "tun", tag: "tun-in", address: ["172.19.0.1/30"], auto_route: true, strict_route: true, stack: "gvisor" },
|
|||
|
|
],
|
|||
|
|
outbounds: outbounds(p),
|
|||
|
|
route: {
|
|||
|
|
auto_detect_interface: true,
|
|||
|
|
default_domain_resolver: "local-dns",
|
|||
|
|
rules: [
|
|||
|
|
{ action: "sniff" }, // 嗅探协议，供下面识别 DNS / QUIC
|
|||
|
|
// 关键：把 DNS 查询劫持给 sing-box 自己用 TCP 解析。否则浏览器的 UDP DNS 被塞进 TUN → 交给只支持 TCP 的 SOCKS5 → 丢弃 → 全站解析失败 = 没网
|
|||
|
|
{ protocol: "dns", action: "hijack-dns" },
|
|||
|
|
{ port: 53, action: "hijack-dns" },
|
|||
|
|
// QUIC(HTTP/3, UDP 443)经只支持 TCP 的 SOCKS5 会全丢 → 直接拒绝，逼浏览器回落到 TCP
|
|||
|
|
{ network: "udp", port: 443, action: "reject" },
|
|||
|
|
],
|
|||
|
|
final: "proxy",
|
|||
|
|
},
|
|||
|
|
};
|
|||
|
|
}
|
|||
|
|
function writeCfg(name, obj) {
|
|||
|
|
const p = path.join(runtimeDir(), name);
|
|||
|
|
fs.writeFileSync(p, JSON.stringify(obj, null, 2));
|
|||
|
|
return p;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// macOS：系统代理设置 / 还原
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
async function macServices() {
|
|||
|
|
// 列出所有网络服务，去掉标题行与被禁用(带*)的
|
|||
|
|
const { stdout } = await pExecFile("networksetup", ["-listallnetworkservices"]);
|
|||
|
|
return stdout
|
|||
|
|
.split("\n")
|
|||
|
|
.slice(1)
|
|||
|
|
.map((s) => s.trim())
|
|||
|
|
.filter((s) => s && !s.startsWith("*"));
|
|||
|
|
}
|
|||
|
|
async function macSetSystemProxy(port) {
|
|||
|
|
const services = await macServices();
|
|||
|
|
const applied = [];
|
|||
|
|
for (const svc of services) {
|
|||
|
|
try {
|
|||
|
|
await pExecFile("networksetup", ["-setwebproxy", svc, "127.0.0.1", String(port)]);
|
|||
|
|
await pExecFile("networksetup", ["-setsecurewebproxy", svc, "127.0.0.1", String(port)]);
|
|||
|
|
await pExecFile("networksetup", ["-setsocksfirewallproxy", svc, "127.0.0.1", String(port)]);
|
|||
|
|
applied.push(svc);
|
|||
|
|
} catch {
|
|||
|
|
/* 某个服务设置失败(如未连接)则跳过 */
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
return applied;
|
|||
|
|
}
|
|||
|
|
async function macUnsetSystemProxy(services) {
|
|||
|
|
for (const svc of services || []) {
|
|||
|
|
for (const kind of ["-setwebproxystate", "-setsecurewebproxystate", "-setsocksfirewallproxystate"]) {
|
|||
|
|
try {
|
|||
|
|
await pExecFile("networksetup", [kind, svc, "off"]);
|
|||
|
|
} catch {}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// Windows：系统代理设置 / 还原（HKCU，无需管理员）
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
const WIN_INET = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings";
|
|||
|
|
// 通知 WinINET 代理设置已变更，让浏览器(Chrome/Edge 等)立即重新读取，而不是等重启
|
|||
|
|
async function winRefreshInet() {
|
|||
|
|
const ps =
|
|||
|
|
`$s='[DllImport("wininet.dll",SetLastError=true)]public static extern bool InternetSetOption(IntPtr h,int o,IntPtr b,int l);';` +
|
|||
|
|
`$t=Add-Type -MemberDefinition $s -Name W -Namespace I -PassThru;` +
|
|||
|
|
`$t::InternetSetOption([IntPtr]::Zero,39,[IntPtr]::Zero,0)|Out-Null;` + // INTERNET_OPTION_SETTINGS_CHANGED
|
|||
|
|
`$t::InternetSetOption([IntPtr]::Zero,37,[IntPtr]::Zero,0)|Out-Null`; // INTERNET_OPTION_REFRESH
|
|||
|
|
await pExecFile("powershell", ["-NoProfile", "-Command", ps]).catch(() => {});
|
|||
|
|
}
|
|||
|
|
async function winSetSystemProxy(port) {
|
|||
|
|
await pExecFile("reg", ["add", WIN_INET, "/v", "ProxyEnable", "/t", "REG_DWORD", "/d", "1", "/f"]);
|
|||
|
|
await pExecFile("reg", ["add", WIN_INET, "/v", "ProxyServer", "/d", `127.0.0.1:${port}`, "/f"]);
|
|||
|
|
// 排除本地地址直连
|
|||
|
|
await pExecFile("reg", ["add", WIN_INET, "/v", "ProxyOverride", "/d", "localhost;127.*;<local>", "/f"]).catch(() => {});
|
|||
|
|
await winRefreshInet();
|
|||
|
|
}
|
|||
|
|
async function winUnsetSystemProxy() {
|
|||
|
|
await pExecFile("reg", ["add", WIN_INET, "/v", "ProxyEnable", "/t", "REG_DWORD", "/d", "0", "/f"]).catch(() => {});
|
|||
|
|
await winRefreshInet();
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// 系统代理模式：启动本地 sing-box mixed + 设系统代理
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
async function startSystem(p) {
|
|||
|
|
const port = await findFreePort(conf.localPort || 0);
|
|||
|
|
if (!port) throw new Error("找不到可用的本地端口");
|
|||
|
|
const cfg = writeCfg("system.json", systemConfig(p, port));
|
|||
|
|
|
|||
|
|
const child = spawn(binPath(), ["run", "-c", cfg], { stdio: ["ignore", "pipe", "pipe"] });
|
|||
|
|
let stderr = "";
|
|||
|
|
child.stderr.on("data", (d) => (stderr += d.toString()));
|
|||
|
|
await new Promise((resolve, reject) => {
|
|||
|
|
let settled = false;
|
|||
|
|
child.on("error", (e) => {
|
|||
|
|
if (!settled) {
|
|||
|
|
settled = true;
|
|||
|
|
reject(e);
|
|||
|
|
}
|
|||
|
|
});
|
|||
|
|
child.on("exit", (code) => {
|
|||
|
|
if (!settled) {
|
|||
|
|
settled = true;
|
|||
|
|
reject(new Error(`sing-box 启动失败(${code})：${stderr.slice(0, 300)}`));
|
|||
|
|
}
|
|||
|
|
});
|
|||
|
|
// 轮询本地端口，通了就算启动成功
|
|||
|
|
const t0 = Date.now();
|
|||
|
|
const poll = () => {
|
|||
|
|
const s = net.connect(port, "127.0.0.1");
|
|||
|
|
s.on("connect", () => {
|
|||
|
|
s.destroy();
|
|||
|
|
if (!settled) {
|
|||
|
|
settled = true;
|
|||
|
|
resolve();
|
|||
|
|
}
|
|||
|
|
});
|
|||
|
|
s.on("error", () => {
|
|||
|
|
s.destroy();
|
|||
|
|
if (Date.now() - t0 > 8000) {
|
|||
|
|
if (!settled) {
|
|||
|
|
settled = true;
|
|||
|
|
reject(new Error("sing-box 端口未就绪：" + stderr.slice(0, 200)));
|
|||
|
|
}
|
|||
|
|
} else setTimeout(poll, 300);
|
|||
|
|
});
|
|||
|
|
};
|
|||
|
|
poll();
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
// 端口通了 → 设系统代理
|
|||
|
|
let services = [];
|
|||
|
|
if (process.platform === "darwin") services = await macSetSystemProxy(port);
|
|||
|
|
else if (process.platform === "win32") await winSetSystemProxy(port);
|
|||
|
|
|
|||
|
|
state.mode = "system";
|
|||
|
|
state.child = child;
|
|||
|
|
state.localPort = port;
|
|||
|
|
state.services = services;
|
|||
|
|
conf.appliedPort = port;
|
|||
|
|
saveConf();
|
|||
|
|
child.on("exit", () => {
|
|||
|
|
// 子进程意外退出 → 复位（并尝试还原系统代理）
|
|||
|
|
if (state.child === child) {
|
|||
|
|
cleanupSystemProxy().catch(() => {});
|
|||
|
|
state.mode = "off";
|
|||
|
|
state.child = null;
|
|||
|
|
emit();
|
|||
|
|
}
|
|||
|
|
});
|
|||
|
|
emit();
|
|||
|
|
return status();
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
async function cleanupSystemProxy() {
|
|||
|
|
if (process.platform === "darwin") await macUnsetSystemProxy(state.services);
|
|||
|
|
else if (process.platform === "win32") await winUnsetSystemProxy();
|
|||
|
|
state.services = [];
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// 全局 TUN 模式：提权启动 sing-box（flag 文件做“可停止”，全程只弹一次密码）
|
|||
|
|
// 原理：提权 shell 里后台跑 sing-box，前台 while 循环盯住 flag 文件；
|
|||
|
|
// 我方(普通权限)删除 flag → 提权循环发现文件没了 → kill sing-box 退出。
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
function flagPath() {
|
|||
|
|
return path.join(runtimeDir(), "global.flag");
|
|||
|
|
}
|
|||
|
|
function stripAnsi(s) {
|
|||
|
|
return String(s).replace(/\x1b\[[0-9;]*m/g, "");
|
|||
|
|
}
|
|||
|
|
// 读日志：Windows 的系统错误常是 GBK 中文，UTF-8 读出来是乱码 → 检测到乱码就用 GBK 兜底
|
|||
|
|
function readLogSmart(logf) {
|
|||
|
|
let buf;
|
|||
|
|
try {
|
|||
|
|
buf = fs.readFileSync(logf);
|
|||
|
|
} catch {
|
|||
|
|
return "";
|
|||
|
|
}
|
|||
|
|
let s = buf.toString("utf-8");
|
|||
|
|
if (s.includes("�")) {
|
|||
|
|
for (const enc of ["gbk", "gb18030", "big5"]) {
|
|||
|
|
try {
|
|||
|
|
const d = new TextDecoder(enc).decode(buf);
|
|||
|
|
if (!d.includes("�")) {
|
|||
|
|
s = d;
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
} catch {}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
return stripAnsi(s);
|
|||
|
|
}
|
|||
|
|
// 盯 sing-box 日志判断启动成败（mac / Windows 通用）：
|
|||
|
|
// 出现 "sing-box started" → 成功；出现 FATAL → 失败；
|
|||
|
|
// 提权进程(仅 mac)提前退出且无 started → 取消授权；超时同理。
|
|||
|
|
function waitForStart(logf, timeoutMs, child, watchChildExit) {
|
|||
|
|
return new Promise((resolve) => {
|
|||
|
|
const t0 = Date.now();
|
|||
|
|
let childExited = false;
|
|||
|
|
if (watchChildExit && child) child.on("exit", () => (childExited = true));
|
|||
|
|
const tick = () => {
|
|||
|
|
const txt = readLogSmart(logf);
|
|||
|
|
if (/sing-box started/i.test(txt)) return resolve({ ok: true });
|
|||
|
|
const fatal = txt.match(/FATAL[^\n]*/i) || txt.match(/ERROR[^\n]*(bind|permission|denied|wintun|tun)[^\n]*/i);
|
|||
|
|
if (fatal) return resolve({ ok: false, reason: "引擎启动失败：" + fatal[0].trim().slice(0, 260) });
|
|||
|
|
if (childExited && Date.now() - t0 > 1500) {
|
|||
|
|
return resolve({
|
|||
|
|
ok: false,
|
|||
|
|
reason: txt ? "启动失败：" + txt.trim().slice(-260) : "已取消管理员授权，全局代理未启动。",
|
|||
|
|
});
|
|||
|
|
}
|
|||
|
|
if (Date.now() - t0 > timeoutMs) {
|
|||
|
|
return resolve({
|
|||
|
|
ok: false,
|
|||
|
|
reason: txt
|
|||
|
|
? "启动超时：" + txt.trim().slice(-260)
|
|||
|
|
: "未获得管理员授权(密码框 / UAC 被取消)，或引擎无法启动。",
|
|||
|
|
});
|
|||
|
|
}
|
|||
|
|
setTimeout(tick, 400);
|
|||
|
|
};
|
|||
|
|
tick();
|
|||
|
|
});
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
async function startGlobal(p) {
|
|||
|
|
const flag = flagPath();
|
|||
|
|
const logf = path.join(runtimeDir(), "global.log");
|
|||
|
|
const cfg = writeCfg("global.json", globalConfig(p, logf));
|
|||
|
|
// 先自检配置，避免弹了密码才发现配置错
|
|||
|
|
await pExecFile(binPath(), ["check", "-c", cfg]);
|
|||
|
|
try {
|
|||
|
|
fs.unlinkSync(logf); // 清掉上次日志，保证这次判断读到的是本次输出
|
|||
|
|
} catch {}
|
|||
|
|
fs.writeFileSync(flag, "run");
|
|||
|
|
|
|||
|
|
let child;
|
|||
|
|
if (process.platform === "darwin") {
|
|||
|
|
// 提权 bash：后台跑 sing-box(日志由 sing-box 自己写文件)，盯 flag；flag 删了或引擎挂了就退出
|
|||
|
|
const sh = path.join(runtimeDir(), "run-global.sh");
|
|||
|
|
fs.writeFileSync(
|
|||
|
|
sh,
|
|||
|
|
`#!/bin/bash
|
|||
|
|
"${binPath()}" run -c "${cfg}" &
|
|||
|
|
SB=$!
|
|||
|
|
while [ -f "${flag}" ]; do sleep 1; kill -0 $SB 2>/dev/null || break; done
|
|||
|
|
kill $SB 2>/dev/null
|
|||
|
|
wait $SB 2>/dev/null
|
|||
|
|
`
|
|||
|
|
);
|
|||
|
|
fs.chmodSync(sh, 0o755);
|
|||
|
|
const osa = `do shell script "/bin/bash '${sh}'" with administrator privileges`;
|
|||
|
|
child = spawn("osascript", ["-e", osa]);
|
|||
|
|
} else if (process.platform === "win32") {
|
|||
|
|
// PowerShell(Unicode 原生，兼容中文用户名路径)：提权后台跑 sing-box，盯 flag，删了就杀。
|
|||
|
|
// sing-box 自己把日志写进 log.output，不用 shell 重定向 → 避开 cmd 的 GBK 编码坑。
|
|||
|
|
const ps = path.join(runtimeDir(), "run-global.ps1");
|
|||
|
|
const psBody =
|
|||
|
|
"" + // UTF-8 BOM，保证 PowerShell 按 UTF-8 读取(路径含中文也不乱)
|
|||
|
|
`$ErrorActionPreference='SilentlyContinue'\r\n` +
|
|||
|
|
// 先杀掉上次残留的引擎(此脚本已提权，能杀掉之前遗留的管理员进程)，释放被占用的 wintun 网卡
|
|||
|
|
`Stop-Process -Name sing-box -Force\r\n` +
|
|||
|
|
`Start-Sleep -Milliseconds 800\r\n` +
|
|||
|
|
`$proc = Start-Process -FilePath '${binPath()}' -ArgumentList @('run','-c','${cfg}') -WindowStyle Hidden -PassThru\r\n` +
|
|||
|
|
`while (Test-Path '${flag}') { if ($proc.HasExited) { break }; Start-Sleep -Seconds 1 }\r\n` +
|
|||
|
|
`if (-not $proc.HasExited) { Stop-Process -Id $proc.Id -Force }\r\n` +
|
|||
|
|
`Stop-Process -Name sing-box -Force\r\n`;
|
|||
|
|
fs.writeFileSync(ps, psBody, "utf-8");
|
|||
|
|
// 非提权的外层 powershell 负责触发一次 UAC，把上面的脚本以管理员+隐藏窗口运行
|
|||
|
|
const outer = `Start-Process powershell -Verb RunAs -WindowStyle Hidden -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-File','${ps}'`;
|
|||
|
|
child = spawn("powershell", ["-NoProfile", "-Command", outer], { windowsHide: true });
|
|||
|
|
} else {
|
|||
|
|
throw new Error("全局代理暂只支持 macOS 与 Windows");
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// mac 的提权进程会随 sing-box 存活；win 的外层进程点完 UAC 立刻退出，故只在 mac 盯它早退
|
|||
|
|
// 开 wintun/utun 网卡可能较慢，给 40 秒；那句 "open interface take too much time" 只是 WARN，会继续尝试
|
|||
|
|
const res = await waitForStart(logf, 40000, child, process.platform === "darwin");
|
|||
|
|
if (!res.ok) {
|
|||
|
|
try {
|
|||
|
|
fs.unlinkSync(flag);
|
|||
|
|
} catch {}
|
|||
|
|
try {
|
|||
|
|
if (child) child.kill();
|
|||
|
|
} catch {}
|
|||
|
|
throw new Error(res.reason);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
state.mode = "global";
|
|||
|
|
state.localPort = 0;
|
|||
|
|
if (process.platform === "darwin") {
|
|||
|
|
// mac：提权进程存活即代理存活，它退出就复位状态
|
|||
|
|
state.child = child;
|
|||
|
|
child.on("exit", () => {
|
|||
|
|
if (state.child === child) {
|
|||
|
|
try {
|
|||
|
|
fs.unlinkSync(flag);
|
|||
|
|
} catch {}
|
|||
|
|
state.mode = "off";
|
|||
|
|
state.child = null;
|
|||
|
|
emit();
|
|||
|
|
}
|
|||
|
|
});
|
|||
|
|
} else {
|
|||
|
|
// win：外层进程已退出，靠 flag 文件控制生命周期
|
|||
|
|
state.child = null;
|
|||
|
|
}
|
|||
|
|
emit();
|
|||
|
|
return status();
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// 统一启动 / 停止
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
async function start(mode) {
|
|||
|
|
loadConf();
|
|||
|
|
if (!binExists()) throw new Error("缺少 sing-box 引擎文件，请重新安装本软件");
|
|||
|
|
const p = parseProxy(conf.proxyStr);
|
|||
|
|
if (!p) throw new Error("请先填写正确的代理地址，格式：host:port:user:pass");
|
|||
|
|
if (state.mode !== "off") await stop();
|
|||
|
|
if (mode === "system") return startSystem(p);
|
|||
|
|
if (mode === "global") return startGlobal(p);
|
|||
|
|
throw new Error("未知模式：" + mode);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
async function stop() {
|
|||
|
|
const prev = state.mode;
|
|||
|
|
if (prev === "system") {
|
|||
|
|
await cleanupSystemProxy();
|
|||
|
|
if (state.child) {
|
|||
|
|
try {
|
|||
|
|
state.child.kill();
|
|||
|
|
} catch {}
|
|||
|
|
}
|
|||
|
|
} else if (prev === "global") {
|
|||
|
|
// 删 flag → 提权循环自行 kill sing-box 并拆除 TUN
|
|||
|
|
try {
|
|||
|
|
fs.unlinkSync(flagPath());
|
|||
|
|
} catch {}
|
|||
|
|
// 兜底：等提权进程收尾
|
|||
|
|
await new Promise((r) => setTimeout(r, 1500));
|
|||
|
|
}
|
|||
|
|
state.mode = "off";
|
|||
|
|
state.child = null;
|
|||
|
|
state.localPort = 0;
|
|||
|
|
state.services = [];
|
|||
|
|
emit();
|
|||
|
|
return status();
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 退出前清理：确保不把系统代理 / TUN 残留给用户
|
|||
|
|
async function shutdown() {
|
|||
|
|
if (state.mode === "off") return;
|
|||
|
|
try {
|
|||
|
|
await stop();
|
|||
|
|
} catch {}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 启动时的残留清理：上次若崩溃遗留了「指向我们端口的系统代理」，且引擎已不在 → 关掉它，
|
|||
|
|
// 但不动用户自己(如 Clash)设的其它端口，避免误伤。
|
|||
|
|
async function cleanupStale() {
|
|||
|
|
loadConf();
|
|||
|
|
if (process.platform !== "darwin" || !conf.appliedPort) return;
|
|||
|
|
try {
|
|||
|
|
const services = await macServices();
|
|||
|
|
for (const svc of services) {
|
|||
|
|
const { stdout } = await pExecFile("networksetup", ["-getsocksfirewallproxy", svc]).catch(() => ({ stdout: "" }));
|
|||
|
|
if (/Enabled:\s*Yes/i.test(stdout) && stdout.includes("127.0.0.1") && stdout.includes(String(conf.appliedPort))) {
|
|||
|
|
await macUnsetSystemProxy([svc]);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
} catch {}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// 测试连通性：临时起一个本地 mixed 口，经它请求取出口 IP
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
async function testProxy() {
|
|||
|
|
loadConf();
|
|||
|
|
if (!binExists()) throw new Error("缺少 sing-box 引擎文件");
|
|||
|
|
const p = parseProxy(conf.proxyStr);
|
|||
|
|
if (!p) throw new Error("代理地址格式不对，应为 host:port:user:pass");
|
|||
|
|
const port = await findFreePort(0);
|
|||
|
|
const cfg = writeCfg("test.json", systemConfig(p, port));
|
|||
|
|
const child = spawn(binPath(), ["run", "-c", cfg], { stdio: ["ignore", "ignore", "pipe"] });
|
|||
|
|
let stderr = "";
|
|||
|
|
child.stderr.on("data", (d) => (stderr += d.toString()));
|
|||
|
|
try {
|
|||
|
|
// 等端口就绪
|
|||
|
|
await new Promise((resolve, reject) => {
|
|||
|
|
const t0 = Date.now();
|
|||
|
|
const poll = () => {
|
|||
|
|
const s = net.connect(port, "127.0.0.1");
|
|||
|
|
s.on("connect", () => {
|
|||
|
|
s.destroy();
|
|||
|
|
resolve();
|
|||
|
|
});
|
|||
|
|
s.on("error", () => {
|
|||
|
|
s.destroy();
|
|||
|
|
if (Date.now() - t0 > 6000) reject(new Error("引擎未就绪：" + stderr.slice(0, 200)));
|
|||
|
|
else setTimeout(poll, 250);
|
|||
|
|
});
|
|||
|
|
};
|
|||
|
|
poll();
|
|||
|
|
});
|
|||
|
|
const ip = await httpGetViaProxy(port, "http://api.ipify.org/");
|
|||
|
|
return { ok: true, ip, proxy: `${p.host}:${p.port}` };
|
|||
|
|
} finally {
|
|||
|
|
try {
|
|||
|
|
child.kill();
|
|||
|
|
} catch {}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 经本地 HTTP 代理端口发一个 GET，返回响应体（用于取出口 IP）
|
|||
|
|
function httpGetViaProxy(port, targetUrl) {
|
|||
|
|
return new Promise((resolve, reject) => {
|
|||
|
|
const u = new URL(targetUrl);
|
|||
|
|
const req = http.request(
|
|||
|
|
{
|
|||
|
|
host: "127.0.0.1",
|
|||
|
|
port,
|
|||
|
|
method: "GET",
|
|||
|
|
path: targetUrl, // 绝对 URL → 走代理
|
|||
|
|
headers: { Host: u.host, "User-Agent": "codex-market", Connection: "close" },
|
|||
|
|
timeout: 15000,
|
|||
|
|
},
|
|||
|
|
(res) => {
|
|||
|
|
const chunks = [];
|
|||
|
|
res.on("data", (c) => chunks.push(c));
|
|||
|
|
res.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8").trim()));
|
|||
|
|
}
|
|||
|
|
);
|
|||
|
|
req.on("timeout", () => req.destroy(new Error("请求超时(15s)")));
|
|||
|
|
req.on("error", reject);
|
|||
|
|
req.end();
|
|||
|
|
});
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
// 状态
|
|||
|
|
// ---------------------------------------------------------------------------
|
|||
|
|
function status() {
|
|||
|
|
loadConf();
|
|||
|
|
const p = parseProxy(conf.proxyStr);
|
|||
|
|
return {
|
|||
|
|
mode: state.mode, // off | system | global
|
|||
|
|
running: state.mode !== "off",
|
|||
|
|
localPort: state.localPort || 0,
|
|||
|
|
binOk: binExists(),
|
|||
|
|
platform: process.platform,
|
|||
|
|
proxy: p ? { host: p.host, port: p.port, hasAuth: !!p.user } : null,
|
|||
|
|
hasConfig: !!p,
|
|||
|
|
};
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
module.exports = {
|
|||
|
|
getConfig,
|
|||
|
|
setConfig,
|
|||
|
|
start,
|
|||
|
|
stop,
|
|||
|
|
status,
|
|||
|
|
testProxy,
|
|||
|
|
shutdown,
|
|||
|
|
cleanupStale,
|
|||
|
|
setOnChange,
|
|||
|
|
};
|