txlyre

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

d291e1c5ee Bump Go toolchain and x dependencies Refresh the Go toolchain from 1.26.5 to 1.26.6 and update the related x/* and protobuf dependency set in go.mod/go.sum. This keeps the project aligned with the current patch releases and ensures the module graph matches the expected transitive versions.
ecadfd0e60 fix(clients): stop recomputing the summary badges from the client_stats snapshot (#6169) * fix(clients): stop recomputing the summary badges from the client_stats snapshot pickClientsSummary's coverage guard (serverSummary.total > allClientStats.length) only catches a net shortfall: an orphaned client_traffics row and a client still missing one can cancel out, or an orphan surplus alone can pass uncaught, and either way the guard fails to fall back (#6116). client_paging.go's q.summary() already derives the same bucket counts with clients as the driving table (LEFT JOIN client_traffics), so it cannot miscount either shape regardless of how the row got there, and listQuery already polls it every 5s — the same cadence client_stats ticks on. The client-side recompute bought no fresher a number than the server already provides on its own poll, only a window to get one wrong, so this drops it: the summary badges now always read serverSummary directly. allClientStats, computeClientsSummary, pickClientsSummary and sameSummaryInputs are removed as dead code along with it; the per-row live traffic patch in applyClientStatsEvent is untouched, since it reads the same snapshot by email match rather than by count and was never exposed to this class of bug. * fix(clients): force a refetch on window focus and drop a stale comment Review feedback on PR #6169: listQuery combines staleTime: Infinity with refetchInterval: 5000, which pauses while the tab is hidden. The WS-driven per-row traffic patch in applyClientStatsEvent has no such visibility gating, so on a background tab a row's live numbers keep moving while the summary badges above them freeze at whatever they were before the tab was hidden, and staleTime: Infinity blocks refetchOnWindowFocus from closing that gap on return. Before this PR the client-side recompute this branch removed happened to paper over the same underlying gap; now that it's gone, the gap is directly visible. refetchOnWindowFocus: 'always' forces exactly one refetch on refocus, ignoring staleTime, without touching the interval/staleTime pairing that governs the rest of this query's behavior. Separately, useInbounds.ts still referenced computeClientsSummary by name in a comment explaining bucket priority; that function no longer exists after this PR. Dropped the comment rather than repoint it, per the repo's no-//-comment convention.
d05e44e401 fix(outbound): import Hysteria2 salamander properly from standard obfs params (#6166) * fix(outbound): import Hysteria2 salamander from standard obfs params The outbound share-link importers only reconstructed salamander from the private fm=<json> finalmask dump. Every standard Hysteria2 link — and this panel's own generator (internal/sub) since it stopped emitting fm= — carries the obfuscation as the standard obfs=salamander & obfs-password=<pw> pair, which the importers ignored. As a result, importing a normal Hysteria2 link (pasted into the outbound form or pulled from a subscription) silently dropped the salamander config and produced an outbound that negotiates plain QUIC against a server expecting obfuscation. Parse the standard obfs/obfs-password pair in both the Go importer (internal/util/link, used by subscription + JSON import) and the frontend form parser (outbound-link-parser.ts), folding it into finalmask.udp. A salamander mask already supplied via fm= still wins, so 3x-ui→3x-ui links are unchanged. Co-Authored-By: Claude Opus 4.8 <[email protected]> * fix(outbound): address review — mport hop, password-less fm mask, tests Follow-up to the automated PR review on #6166: - Import the Hysteria2 UDP port-hopping range from the standard `mport` param (finalmask.quicParams.udpHop.ports) in both importers — the same class of gap as salamander: the subscription generator emits `mport` standalone and no `fm=`, so port hopping was silently lost on import. An `fm=`-supplied udpHop still wins. - When `fm=` carries a salamander mask without a usable password, fill it in from the obfs pair instead of treating the empty mask as authoritative (would otherwise enable obfuscation with an empty password). - Trim the duplicated rationale comments to two lines each. - Tests: collapse the four per-case Go functions into table-driven subtests; cover the obfs_password/obfsPassword aliases, case-insensitive obfs value, append-onto-non-salamander-udp, password-less-fm fill, and the mport paths; assert the fm-wins masks stay length 1 in both suites. Co-Authored-By: Claude Opus 4.8 <[email protected]> --------- Co-authored-by: Claude Opus 4.8 <[email protected]> Co-authored-by: Sanaei <[email protected]>
9165ab67eb fix(install): preserve custom bin/ files (e.g. hand-added geoip) across updates (#6152) * fix(install): preserve custom bin/ files (e.g. hand-added geoip) across updates Every reinstall/update wipes /usr/local/x-ui/ wholesale and re-extracts the release tarball, which only ships known assets (xray/mtg binaries, the bundled geoip*/geosite*.dat sets). A user-reported real incident: a hand-placed custom geoip file referenced from a routing rule via "ext:<file>:<code>" got silently deleted on update, and Xray refused to start at all afterward ("failed to open <file>: no such file or directory"), taking down every inbound until the file was manually restored from the user's own backup. install_x-ui now backs up the old bin/ before the wipe and restores, after extraction, only the files the fresh release doesn't provide -- bundled assets still get the newer per-release copy, nothing custom silently disappears. Verified in isolation: standard files (geoip.dat, the xray binary) end up as the fresh release's copy; a custom file absent from the release survives untouched. Co-Authored-By: Claude Sonnet 5 <[email protected]> * fix: harden the bin/ snapshot-and-restore against the review round on #6152 - Replace the mktemp+cp snapshot with a same-filesystem mv of bin/ aside: an unchecked mktemp failure previously made the very next line copy bin/'s contents into "/" (empty custom_bin_backup + trailing slash), and a silently-ignored cp failure (stderr redirected, exit code never checked) could leave a truncated custom geo file that gets "restored" as if it were intact. A rename is atomic and needs no extra disk space, removing both failure modes at once; if it fails, back off cleanly and say so instead of proceeding as if a backup exists. - Add a trap so an interrupted update (Ctrl-C, signal) between the backup and the restore doesn't leave the snapshot (which contains bin/config.json and every mtproto client's FakeTLS secret) sitting around indefinitely; the two exit-path cleanups this replaces are gone since the trap now covers those exits too. - Move the restore below the arm arch-rename/chmod block instead of before it, so xray-linux-arm32/mtg-linux-arm already exist under their final names and don't get needlessly restored-then-overwritten and misreported as "custom". - Exclude bin/config.json and bin/mtproto/*.toml from the restore: those are the panel's own generated runtime state (internal/xray/process.go, internal/mtproto/manager.go), not admin-placed files, and restoring a stale one only resurrects dead state or recreates bin/mtproto/ with the wrong (more permissive) directory mode. - Match symlinks in the restore's find, not just plain files -- cp -a already preserves them in the snapshot, but the restore loop was silently dropping them, which is exactly the failure mode (a geo file symlinked in from elsewhere) this PR set out to fix. - Quote the two new xui_folder expansions. - Extend the non-interactive smoke test to reinstall over an existing install with a sentinel file in bin/, asserting it survives and that the bundled geoip.dat is still the release's own copy -- the update path this PR touches had no CI coverage at all before this. Co-Authored-By: Claude Sonnet 5 <[email protected]> --------- Co-authored-by: Claude Sonnet 5 <[email protected]>
Просмотр сравнение для этих 4 коммитов »

2 часов назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

0a30a03cb7 refactor(frontend): remove unused response envelope schema (#6204) Co-authored-by: n0ctal <293235942+[email protected]>
286a93474d refactor(frontend): remove unreachable barrel modules (#6205) Co-authored-by: n0ctal <293235942+[email protected]>
238e4bb314 refactor(tgbot): share numeric keypad transitions (#6211) Co-authored-by: n0ctal <293235942+[email protected]>
4a5f6771b3 fix(nodes): report probe heartbeat persistence failures (#6207) Co-authored-by: n0ctal <293235942+[email protected]>
64f4f0746c fix(warp): surface update-clock persistence failures (#6209) Co-authored-by: n0ctal <293235942+[email protected]>
Просмотр сравнение для этих 6 коммитов »

1 день назад

txlyre синхронизированные коммиты с copilot/fix-review-comment-3774434337 на txlyre/3x-ui из зеркала

8d692214c5 Initial plan
4a5f6771b3 fix(nodes): report probe heartbeat persistence failures (#6207) Co-authored-by: n0ctal <293235942+[email protected]>
64f4f0746c fix(warp): surface update-clock persistence failures (#6209) Co-authored-by: n0ctal <293235942+[email protected]>
79ef85b59f refactor(frontend): remove unused legacy utilities (#6206) Co-authored-by: n0ctal <293235942+[email protected]>
5b80d4562d chore(docs): bump docs dependencies Update fumadocs-core/mdx/ui to 16.14.3, lucide-react to 1.31.0, @types/node to 26.2.0, typescript-eslint to 8.67.0, esbuild to 0.28.2, shiki to 4.4.3, and various other transitive dependencies.
Просмотр сравнение для этих 10 коммитов »

1 день назад

txlyre синхронизированные новые ссылки copilot/fix-review-comment-3774434337 к txlyre/3x-ui из зеркала

1 день назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

5b80d4562d chore(docs): bump docs dependencies Update fumadocs-core/mdx/ui to 16.14.3, lucide-react to 1.31.0, @types/node to 26.2.0, typescript-eslint to 8.67.0, esbuild to 0.28.2, shiki to 4.4.3, and various other transitive dependencies.

1 день назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

e2f75acad2 chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#6212) Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.19.1 to 1.19.2. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.19.1...v1.19.2) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
69a8237581 fix(i18n): localize Chinese Xray labels (#6202) * fix(i18n): localize Traditional Chinese Xray labels Several navigation, outbound, balancer, VPN, and DNS labels still displayed their English source text in the zh-TW interface. Translate the non-protocol labels while retaining established Xray terminology. * fix(i18n): localize Simplified Chinese Xray labels Mirror the reviewed Xray UI coverage in zh-CN so the same labels no longer fall back to English there. Signed-off-by: 陳廷安 <73953029+[email protected]> --------- Signed-off-by: 陳廷安 <73953029+[email protected]> Co-authored-by: Sanaei <[email protected]>
f3f57e66f5 fix(frontend): wait out Collapse fade before a11y scan in ConfigBlock story Collapse animates opacity in over motionDurationMid; the Collapsed story's play function only waited for visibility, so the addon-a11y color-contrast check could sample a mid-fade, lower-contrast frame and fail flakily in CI. Wait for the panel's opacity to settle to 1 first.
8a8da88548 fix(frontend): isolate swagger deps from main vendor chunk Keep swagger-ui-react and its transitive dependencies in the lazy swagger chunk so the initial panel bundle stays smaller. This avoids eager loading the OpenAPI UI on first paint while keeping the API docs route unchanged.
1f846c3cb2 fix(frontend): clean test validation output
Просмотр сравнение для этих 7 коммитов »

2 дней назад

txlyre синхронизированные и удаленные ссылки dependabot/npm_and_yarn/frontend/npm_and_yarn-37951cc692 на txlyre/3x-ui из зеркала

2 дней назад

txlyre синхронизированные коммиты с dependabot/npm_and_yarn/frontend/npm_and_yarn-37951cc692 на txlyre/3x-ui из зеркала

e2ac7a85d3 chore(deps): bump dompurify Bumps the npm_and_yarn group with 1 update in the /frontend directory: [dompurify](https://github.com/cure53/DOMPurify). Updates `dompurify` from 3.4.12 to 3.4.13 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](https://github.com/cure53/DOMPurify/compare/3.4.12...3.4.13) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.13 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
ece1655939 fix(docs): prevent theme switch hydration mismatch
cb902314db fix(docs): restore theme switch without runtime warnings Move html/body shell and global css to root app layout to avoid hydration/script warnings from nested document nodes. Disable provider theme injection and add a custom script-free theme switch in shared layout slots. Also migrate docs search static client initializer to ZBSearch (initDB), add zbsearch dependency, and align docs lint tooling with ESLint 9 compatibility so npm run lint passes.
7eacce6a46 chore(frontend): resolve the high-severity brace-expansion advisory (#6180) npm audit --omit=dev --audit-level=high is a CI gate and it currently fails on main: swagger-ui-react pulls @swagger-api/apidom-reference, which pins minimatch, which resolves brace-expansion to 5.0.8 — the range covered by GHSA-rgw5-rvv9-x895. Pin the patched 5.0.9 through the existing swagger-ui-react overrides block rather than globally: minimatch@3 under eslint-plugin-jsx-a11y still needs the 1.x line, and a blanket override would force v5 there too.
199ddaf485 chore(deps-dev): bump brace-expansion (#6172) Bumps the npm_and_yarn group with 1 update in the /frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Просмотр сравнение для этих 10 коммитов »

5 дней назад

txlyre синхронизированные новые ссылки dependabot/npm_and_yarn/frontend/npm_and_yarn-37951cc692 к txlyre/3x-ui из зеркала

5 дней назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

ece1655939 fix(docs): prevent theme switch hydration mismatch
cb902314db fix(docs): restore theme switch without runtime warnings Move html/body shell and global css to root app layout to avoid hydration/script warnings from nested document nodes. Disable provider theme injection and add a custom script-free theme switch in shared layout slots. Also migrate docs search static client initializer to ZBSearch (initDB), add zbsearch dependency, and align docs lint tooling with ESLint 9 compatibility so npm run lint passes.
7eacce6a46 chore(frontend): resolve the high-severity brace-expansion advisory (#6180) npm audit --omit=dev --audit-level=high is a CI gate and it currently fails on main: swagger-ui-react pulls @swagger-api/apidom-reference, which pins minimatch, which resolves brace-expansion to 5.0.8 — the range covered by GHSA-rgw5-rvv9-x895. Pin the patched 5.0.9 through the existing swagger-ui-react overrides block rather than globally: minimatch@3 under eslint-plugin-jsx-a11y still needs the 1.x line, and a blanket override would force v5 there too.
199ddaf485 chore(deps-dev): bump brace-expansion (#6172) Bumps the npm_and_yarn group with 1 update in the /frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
d142307366 chore(deps-dev): bump postcss (#6173) Bumps the npm_and_yarn group with 1 update in the /docs directory: [postcss](https://github.com/postcss/postcss). Updates `postcss` from 8.5.21 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.21...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Просмотр сравнение для этих 5 коммитов »

1 неделя назад

txlyre синхронизированные и удаленные ссылки dependabot/npm_and_yarn/frontend/npm_and_yarn-84557ebc70 на txlyre/3x-ui из зеркала

1 неделя назад

txlyre синхронизированные и удаленные ссылки dependabot/npm_and_yarn/docs/npm_and_yarn-6b7f7a8c69 на txlyre/3x-ui из зеркала

1 неделя назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

3883882726 chore: bump frontend and Go dependencies Updates multiple frontend packages (antd, react-hook-form, storybook, vite, swagger-ui-react, playwright, typescript-eslint, etc.) and Go dependencies (gopsutil, gorm postgres driver, pion/transport, ugorji/codec, genproto, and others). Also replaces `__dirname` with `import.meta.dirname` in vite.config.js for ESM compatibility.

1 неделя назад

txlyre синхронизированные коммиты с dependabot/npm_and_yarn/frontend/npm_and_yarn-84557ebc70 на txlyre/3x-ui из зеркала

2b83254733 chore(deps-dev): bump brace-expansion Bumps the npm_and_yarn group with 1 update in the /frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
3883882726 chore: bump frontend and Go dependencies Updates multiple frontend packages (antd, react-hook-form, storybook, vite, swagger-ui-react, playwright, typescript-eslint, etc.) and Go dependencies (gopsutil, gorm postgres driver, pion/transport, ugorji/codec, genproto, and others). Also replaces `__dirname` with `import.meta.dirname` in vite.config.js for ESM compatibility.
216d18b3c4 chore(vscode): fix Linux paths in the task and launch configs The "go: build" task hardcoded bin/3x-ui.exe, so building on Linux produced a binary carrying a Windows extension. It now emits bin/3x-ui and keeps the .exe name behind a windows override. The Postgres launch config prepended C:\Program Files\PostgreSQL\18\bin to PATH on every platform. Linux separates entries with ':', not ';', so that string fused into the first real PATH entry and clobbered it. Moved it into a windows block, which is where the pg_dump/pg_restore lookups in ServerService need it anyway.
2a8c3bc0db fix(clients): stop a stale IP row from blocking a client edit Saving a client walks every inbound it is attached to and calls UpdateInboundClient, which re-keys the client's email in inbound_client_ips to the spelling in the edited settings. The email match is EqualFold, so when an inbound's settings JSON drifted in case from the client record the panel issues a case-only rename of the tracking row. inbound_client_ips.client_email is unique and case-sensitive, and the IP-limit job keys its rows on whatever casing Xray reports, so both spellings can already be present. The rename then aborts the whole edit with "duplicate key value violates unique constraint uni_inbound_client_ips_client_email" — the client could not be saved at all, including when only adding an inbound to it. The caller only renames onto an identity no live client holds, so a row on the target email is stale IP tracking: delete it before renaming. The blob is rebuilt by the next scan anyway.
e71b75e99e docs(claude): correct enforced-guard claims and add the runtime dispatch rule Fact-checked every line of CLAUDE.md against the tree. Six claims were wrong, and two told an agent the opposite of the truth. The file said nothing checks endpoints.ts against the Go routes and nothing fails the build on a missing i18n key. Both guards exist and both run in make verify: TestRouteRegistryContract diffs the real router against the registry in both directions, and i18n-dead-keys.test.ts rejects a locale that misses an en-US key as well as an en-US key nothing references. An agent trusting the old text either skips a step it thinks is unenforced or is blindsided when a "silent" omission turns the suite red. The rest: the Go locale returns an empty string for an unknown key, not the raw key; mtg-multi is a prebuilt binary fetched at build time, not a Go dependency built from source; commits are type(area): summary, not <area>: summary, and perf is in active use; make verify is the fast gate, not a mirror of CI, which also runs race, vulncheck, a live-Postgres job where a SKIP is a failure, and a fuzz smoke. Add the five facts most likely to burn an agent, all reproduced before writing them down. A fresh clone has no internal/web/dist, so go build dies on the embed pattern while thirty-odd packages pass — it reads as a broken repo rather than a missing make dist-stub. Every state-changing inbound/client op must dispatch through runtime.Runtime; a direct xray/api.go call passes all local tests and silently breaks every multi-node install, which is exactly what a hard rule is for. Node 24 is required because make gen imports .ts directly. Postgres, xray e2e and scale tests skip themselves without their env vars. An endpoint change has a fourth step nothing checks: syncing docs/public/openapi.json. Definition of done loses its first step — verify's gen-check already runs gen and fails on a dirty generated diff.
Просмотр сравнение для этих 10 коммитов »

1 неделя назад

txlyre синхронизированные новые ссылки dependabot/npm_and_yarn/frontend/npm_and_yarn-84557ebc70 к txlyre/3x-ui из зеркала

1 неделя назад

txlyre синхронизированные коммиты с dependabot/npm_and_yarn/docs/npm_and_yarn-6b7f7a8c69 на txlyre/3x-ui из зеркала

0cb1b2778d chore(deps-dev): bump postcss Bumps the npm_and_yarn group with 1 update in the /docs directory: [postcss](https://github.com/postcss/postcss). Updates `postcss` from 8.5.21 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.21...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
3883882726 chore: bump frontend and Go dependencies Updates multiple frontend packages (antd, react-hook-form, storybook, vite, swagger-ui-react, playwright, typescript-eslint, etc.) and Go dependencies (gopsutil, gorm postgres driver, pion/transport, ugorji/codec, genproto, and others). Also replaces `__dirname` with `import.meta.dirname` in vite.config.js for ESM compatibility.
216d18b3c4 chore(vscode): fix Linux paths in the task and launch configs The "go: build" task hardcoded bin/3x-ui.exe, so building on Linux produced a binary carrying a Windows extension. It now emits bin/3x-ui and keeps the .exe name behind a windows override. The Postgres launch config prepended C:\Program Files\PostgreSQL\18\bin to PATH on every platform. Linux separates entries with ':', not ';', so that string fused into the first real PATH entry and clobbered it. Moved it into a windows block, which is where the pg_dump/pg_restore lookups in ServerService need it anyway.
2a8c3bc0db fix(clients): stop a stale IP row from blocking a client edit Saving a client walks every inbound it is attached to and calls UpdateInboundClient, which re-keys the client's email in inbound_client_ips to the spelling in the edited settings. The email match is EqualFold, so when an inbound's settings JSON drifted in case from the client record the panel issues a case-only rename of the tracking row. inbound_client_ips.client_email is unique and case-sensitive, and the IP-limit job keys its rows on whatever casing Xray reports, so both spellings can already be present. The rename then aborts the whole edit with "duplicate key value violates unique constraint uni_inbound_client_ips_client_email" — the client could not be saved at all, including when only adding an inbound to it. The caller only renames onto an identity no live client holds, so a row on the target email is stale IP tracking: delete it before renaming. The blob is rebuilt by the next scan anyway.
e71b75e99e docs(claude): correct enforced-guard claims and add the runtime dispatch rule Fact-checked every line of CLAUDE.md against the tree. Six claims were wrong, and two told an agent the opposite of the truth. The file said nothing checks endpoints.ts against the Go routes and nothing fails the build on a missing i18n key. Both guards exist and both run in make verify: TestRouteRegistryContract diffs the real router against the registry in both directions, and i18n-dead-keys.test.ts rejects a locale that misses an en-US key as well as an en-US key nothing references. An agent trusting the old text either skips a step it thinks is unenforced or is blindsided when a "silent" omission turns the suite red. The rest: the Go locale returns an empty string for an unknown key, not the raw key; mtg-multi is a prebuilt binary fetched at build time, not a Go dependency built from source; commits are type(area): summary, not <area>: summary, and perf is in active use; make verify is the fast gate, not a mirror of CI, which also runs race, vulncheck, a live-Postgres job where a SKIP is a failure, and a fuzz smoke. Add the five facts most likely to burn an agent, all reproduced before writing them down. A fresh clone has no internal/web/dist, so go build dies on the embed pattern while thirty-odd packages pass — it reads as a broken repo rather than a missing make dist-stub. Every state-changing inbound/client op must dispatch through runtime.Runtime; a direct xray/api.go call passes all local tests and silently breaks every multi-node install, which is exactly what a hard rule is for. Node 24 is required because make gen imports .ts directly. Postgres, xray e2e and scale tests skip themselves without their env vars. An endpoint change has a fourth step nothing checks: syncing docs/public/openapi.json. Definition of done loses its first step — verify's gen-check already runs gen and fails on a dirty generated diff.
Просмотр сравнение для этих 10 коммитов »

1 неделя назад

txlyre синхронизированные новые ссылки dependabot/npm_and_yarn/docs/npm_and_yarn-6b7f7a8c69 к txlyre/3x-ui из зеркала

1 неделя назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

216d18b3c4 chore(vscode): fix Linux paths in the task and launch configs The "go: build" task hardcoded bin/3x-ui.exe, so building on Linux produced a binary carrying a Windows extension. It now emits bin/3x-ui and keeps the .exe name behind a windows override. The Postgres launch config prepended C:\Program Files\PostgreSQL\18\bin to PATH on every platform. Linux separates entries with ':', not ';', so that string fused into the first real PATH entry and clobbered it. Moved it into a windows block, which is where the pg_dump/pg_restore lookups in ServerService need it anyway.
2a8c3bc0db fix(clients): stop a stale IP row from blocking a client edit Saving a client walks every inbound it is attached to and calls UpdateInboundClient, which re-keys the client's email in inbound_client_ips to the spelling in the edited settings. The email match is EqualFold, so when an inbound's settings JSON drifted in case from the client record the panel issues a case-only rename of the tracking row. inbound_client_ips.client_email is unique and case-sensitive, and the IP-limit job keys its rows on whatever casing Xray reports, so both spellings can already be present. The rename then aborts the whole edit with "duplicate key value violates unique constraint uni_inbound_client_ips_client_email" — the client could not be saved at all, including when only adding an inbound to it. The caller only renames onto an identity no live client holds, so a row on the target email is stale IP tracking: delete it before renaming. The blob is rebuilt by the next scan anyway.
e71b75e99e docs(claude): correct enforced-guard claims and add the runtime dispatch rule Fact-checked every line of CLAUDE.md against the tree. Six claims were wrong, and two told an agent the opposite of the truth. The file said nothing checks endpoints.ts against the Go routes and nothing fails the build on a missing i18n key. Both guards exist and both run in make verify: TestRouteRegistryContract diffs the real router against the registry in both directions, and i18n-dead-keys.test.ts rejects a locale that misses an en-US key as well as an en-US key nothing references. An agent trusting the old text either skips a step it thinks is unenforced or is blindsided when a "silent" omission turns the suite red. The rest: the Go locale returns an empty string for an unknown key, not the raw key; mtg-multi is a prebuilt binary fetched at build time, not a Go dependency built from source; commits are type(area): summary, not <area>: summary, and perf is in active use; make verify is the fast gate, not a mirror of CI, which also runs race, vulncheck, a live-Postgres job where a SKIP is a failure, and a fuzz smoke. Add the five facts most likely to burn an agent, all reproduced before writing them down. A fresh clone has no internal/web/dist, so go build dies on the embed pattern while thirty-odd packages pass — it reads as a broken repo rather than a missing make dist-stub. Every state-changing inbound/client op must dispatch through runtime.Runtime; a direct xray/api.go call passes all local tests and silently breaks every multi-node install, which is exactly what a hard rule is for. Node 24 is required because make gen imports .ts directly. Postgres, xray e2e and scale tests skip themselves without their env vars. An endpoint change has a fourth step nothing checks: syncing docs/public/openapi.json. Definition of done loses its first step — verify's gen-check already runs gen and fails on a dirty generated diff.
Просмотр сравнение для этих 3 коммитов »

1 неделя назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

5bc81dfd1d fix(node): stop the node sync from deleting clients it never meant to A client that hit its quota or expiry was disabled, then destroyed on both panels a few seconds later. Five defects fed the same hard delete. ReconcileNode pushed buildRuntimeInboundForAPI, which strips disabled clients. Every other call site targets an in-memory Xray config, where dropping a user is harmless; a node target is a peer panel's DATABASE, so the node deleted the row, stopped reporting it, and the master mirrored that deletion back. Split the builder in two: buildInboundForNodePush injects fallbacks only, buildInboundForLocalRuntime adds the strip on top. The names now say which targets they are safe for. setRemoteTrafficLocked trusted a config_dirty the caller sampled before the snapshot round-trip. A client added inside that window commits on the same serialized writer and marks the node dirty, but the merge still treated the older snapshot as authoritative and deleted it. Re-read the flag inside the writer. In "selected" sync mode, FilterNodeSnapshot strips a deselected tag, but the sweep loaded every inbound with node_id set, so deselecting a tag read as "the node deleted it" and wiped an inbound the node still serves. Skip tags outside the node's managed set. A failed SyncInbound was logged and swallowed; on SQLite the transaction still commits, and the sweep then deleted the innocent clients whose links that failure had left unbuilt. Skip the sweep for such an inbound, and close the trigger: SyncInbound now stores the trimmed email it looks up by, and email validation rejects every unicode space rather than only U+0020. ClientService.Delete tombstones up front and deliberately keeps the record when an inbound fails, so the next attempt can retry the leftovers. The tombstone did not lift with it, so the next merge dropped the client from the synced settings and finished the deletion this path had refused. Add withdrawClientTombstones on every failure path, in BulkDelete too. Finally, make the sweep itself recoverable. "Ended the merge unattached" is true for a real remote deletion and equally true for a bad merge, so it now stamps sync_orphaned_at instead of deleting; any later merge that sees the client attached clears the mark, and a reaper removes only what stayed orphaned past the grace period. The traffic row survives that window too, or a reclaimed client would come back with its usage, quota and expiry reset. The mark is written by this sweep alone, so orphans from any other cause keep their existing manual-cleanup semantics.
f4b7b08e08 fix(ldap): stop auto-delete from wiping every client on an empty directory FetchVlessFlags returns (empty map, nil) whenever the bind succeeds but the search yields nothing usable — a renamed OU, a service account that lost read on the user attribute, a filter that stopped matching. The only guard on the destructive half of the sync was `err != nil`, so that answer was read as "every user is gone" and the job detached every client from the configured inbounds, once a minute, for as long as the directory stayed broken. Gate auto-delete behind autoDeleteSafeForFetch: refuse an empty fetch, and refuse one that collapsed below half of the last successful sync, which is a misconfigured directory far more often than real churn. Also stop splitCsv from defaulting an empty string to DefaultTruthyValues. That default belongs to the truthy-value setting, but splitCsv is also what parses ldapInboundTags, so an unconfigured tag list silently resolved to ["true","1","yes","on"]. It only ever bounded the blast radius by accident.
1ff90c5b66 docs(claude): bound comment length, fix size, and test value Three agent-facing rules, each written after the same mistake showed up in review. Comments were banned outright, which the codebase itself contradicts on almost every file — the ban pushed real invariants out of the code entirely. Allow them, but cap a block at 2 lines and spend those lines on the *why* a name cannot carry. Add a scope rule: the fix must be the smallest change that removes the root cause. A small bug does not earn new columns, jobs, abstractions or config; if it genuinely needs architecture, agree on that first instead of shipping it alongside the fix. Add two testing rules: a test must go red when its fix is reverted, and it must cover something that can actually break. A test that passes either way certifies nothing and is then cited as proof the fix works.
Просмотр сравнение для этих 3 коммитов »

1 неделя назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

138e1bd840 chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 (#6162) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
31c1eed5dc fix dead code, typo, and minor bugs in main.go, process.go and index.go (#6167) Fixes several small issues found during code review: - fix(xray): return explicit nil instead of stale err in getLogPath - fix(xray): remove duplicate doc comment on GetErrorLogPath - refactor: remove unreachable return after log.Fatalf (×4) - fix(cli): add missing newline to listen IP success message - fix(cli): typo "form" → "from" in migrate help text - refactor: simplify var+assign to short declaration for server/subServer - fix(controller): return error from getTwoFactorEnable instead of swallowing it
Просмотр сравнение для этих 2 коммитов »

2 недель назад