txlyre

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

264f61eb90 Merge pull request #6161 from PathGao/feat-sidebar-pinning feat(ui): let users pin the sidebar
ac584cfc90 fix(ui): reserve space for pinned sidebar Keep page content accessible when the desktop sidebar remains expanded and cover the complete pin lifecycle.
91c5d7b19f style(ui): preserve sidebar header spacing Keep the original title alignment while fitting the pin with the existing header actions.
b2fe233108 fix(ui): align sidebar pin controls Keep the pin with the expanded header actions and center the collapsed version link with the navigation rail.
5373786faa feat(ui): let users pin the sidebar Restore a persistent expanded-sidebar choice while preserving the compact hover rail as the default.
对比 5 次代码提交 »

20 小时之前

txlyre 从镜像同步了 dependabot/go_modules/google.golang.org/grpc-1.83.0 分支的代码到 txlyre/3x-ui

916db9b9e6 chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
c377dca27c v3.6.0
c56f6447a8 chore: refresh dependencies and modernize Go test idioms Frontend deps: @hookform/resolvers 5.4.3 -> 5.5.7, Storybook 10.5.4 -> 10.5.5 across the four packages we declare, globals 17.7.0 -> 17.8.0, and jsdom 29.1.1 -> 30.0.1. The jsdom major replaces its CSS and selector stack -- @asamuzakjp/css-color 5 -> 6, @asamuzakjp/dom-selector 7 -> 8, undici 7 -> 8, nwsapi and generational-cache folded into their parents, whatwg-url 17 nested underneath. Nothing in the Vitest suites reaches those directly and the whole frontend gate (typecheck, lint, tests, build, Storybook compile) is green. Panel frontend version to 0.6.0. Backend deps: mattn/go-sqlite3 1.14.48 -> 1.14.49 and valyala/fasthttp 1.72.0 -> 1.73.0, plus the golang.org/x/exp and genproto/googleapis/rpc indirect bumps that came with them. Go tests: modernize -fix output, covering range-over-int, sync.WaitGroup.Go in place of manual Add/Done pairs, maps.Copy, and Go 1.26 new(expr) for pointer-to-value in the forwarded-trust table. The storedAs helper is deleted instead of being left behind a //go:fix inline directive -- keeping it that way fails govet on the one call site the rewrite did not reach, and every caller now takes new(...) directly. Behaviour is unchanged. DnsTab: the hosts-sync effect tested dns while declaring dnsEnabled in its dependency array. Both carry the same truth value, so this is exhaustive-deps hygiene rather than a behaviour change.
66740b7ef4 fix(frontend): preserve edited server drafts (#6156) * fix(frontend): preserve edited server drafts * fix(frontend): retain Xray server projections * fix(frontend): keep draft controls internal * fix(frontend): rehydrate saved redacted settings * fix(frontend): order saved draft hydration * fix(frontend): preserve draft baselines on security saves --------- Co-authored-by: PathGao <[email protected]>
8d02ae28f5 fix(frontend): preserve theme body classes (#6157) * fix(storybook): preserve preview body classes * fix(frontend): retain theme body classes * fix(storybook): mirror panel theme attributes * test(storybook): cover theme switches * test(storybook): strengthen theme DOM coverage * fix(frontend): preserve message container classes --------- Co-authored-by: PathGao <[email protected]>
对比 10 次代码提交 »

20 小时之前

txlyre 从镜像同步了新的引用 dependabot/go_modules/google.golang.org/grpc-1.83.0 到 txlyre/3x-ui

20 小时之前

txlyre 从镜像同步了 v3.6.0 分支的代码到 txlyre/3x-ui

1 天之前

txlyre 从镜像同步了新的引用 v3.6.0 到 txlyre/3x-ui

1 天之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

c377dca27c v3.6.0
c56f6447a8 chore: refresh dependencies and modernize Go test idioms Frontend deps: @hookform/resolvers 5.4.3 -> 5.5.7, Storybook 10.5.4 -> 10.5.5 across the four packages we declare, globals 17.7.0 -> 17.8.0, and jsdom 29.1.1 -> 30.0.1. The jsdom major replaces its CSS and selector stack -- @asamuzakjp/css-color 5 -> 6, @asamuzakjp/dom-selector 7 -> 8, undici 7 -> 8, nwsapi and generational-cache folded into their parents, whatwg-url 17 nested underneath. Nothing in the Vitest suites reaches those directly and the whole frontend gate (typecheck, lint, tests, build, Storybook compile) is green. Panel frontend version to 0.6.0. Backend deps: mattn/go-sqlite3 1.14.48 -> 1.14.49 and valyala/fasthttp 1.72.0 -> 1.73.0, plus the golang.org/x/exp and genproto/googleapis/rpc indirect bumps that came with them. Go tests: modernize -fix output, covering range-over-int, sync.WaitGroup.Go in place of manual Add/Done pairs, maps.Copy, and Go 1.26 new(expr) for pointer-to-value in the forwarded-trust table. The storedAs helper is deleted instead of being left behind a //go:fix inline directive -- keeping it that way fails govet on the one call site the rewrite did not reach, and every caller now takes new(...) directly. Behaviour is unchanged. DnsTab: the hosts-sync effect tested dns while declaring dnsEnabled in its dependency array. Both carry the same truth value, so this is exhaustive-deps hygiene rather than a behaviour change.
66740b7ef4 fix(frontend): preserve edited server drafts (#6156) * fix(frontend): preserve edited server drafts * fix(frontend): retain Xray server projections * fix(frontend): keep draft controls internal * fix(frontend): rehydrate saved redacted settings * fix(frontend): order saved draft hydration * fix(frontend): preserve draft baselines on security saves --------- Co-authored-by: PathGao <[email protected]>
8d02ae28f5 fix(frontend): preserve theme body classes (#6157) * fix(storybook): preserve preview body classes * fix(frontend): retain theme body classes * fix(storybook): mirror panel theme attributes * test(storybook): cover theme switches * test(storybook): strengthen theme DOM coverage * fix(frontend): preserve message container classes --------- Co-authored-by: PathGao <[email protected]>
2c943da3e0 fix(frontend): keep DNS hosts synchronized (#6158) * fix(frontend): keep DNS hosts synchronized * fix(frontend): preserve incomplete DNS hosts * fix(frontend): reset DNS host drafts when disabled * fix(frontend): clear DNS host drafts when disabled --------- Co-authored-by: PathGao <[email protected]>
对比 7 次代码提交 »

1 天之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

af5a8e5d40 fix(database): create SQLite backup snapshots online (#6137) * fix(database): snapshot SQLite backups online Use SQLite's online backup API for downloadable backups and SQLite migration exports instead of checkpointing then reading the live database file. The regression test validates a backup made while writes continue. * style(database): group SQLite driver imports * fix(database): bound online backup retries Use a single backup step and a bounded connection-acquisition/retry context. Tighten temporary-file cleanup and regression assertions while removing the unused checkpoint helper. * test(database): cover existing backup destinations * fix(database): harden SQLite snapshot lifecycle Sweep interrupted snapshot directories at SQLite startup, keep rollback-journal backups incremental, and make caller-owned cleanup explicit. Reuse one scheduled Telegram snapshot across administrators and make the direct SQLite driver dependency explicit. --------- Co-authored-by: PathGao <[email protected]>
ad288a7ecc fix(sub): honor trustedProxyCIDRs before forwarded URLs (#6135) * fix(sub): honor trustedProxyCIDRs before forwarded URLs * fix(sub): avoid unused trust-setting lookups Skip the trustedProxyCIDRs lookup when no forwarded header can affect a subscription URL. Keep the shipped proxy default in one exported setting constant and document the subscription-link behavior for custom proxy boundaries. * fix(frontend): meet config text contrast requirements Keep compact configuration text readable in the light theme and satisfy the Storybook accessibility check. --------- Co-authored-by: PathGao <[email protected]>
ad5f2a28cb fix(xray): synchronize lifecycle state (#6138) * fix(xray): synchronize lifecycle snapshots Protect process replacement and result caching with a lifecycle state object, so read paths keep one process snapshot while restarts swap state safely. Bound version probing to prevent a stalled binary from holding the restart lock. * test(xray): cover concurrent lifecycle reads Exercise status, result, and traffic reads while the managed process is replaced, so the race detector guards the lifecycle snapshot boundary. * fix(xray): guard process config snapshots Synchronize hot-applied config snapshots, keep Telegram reads on one lifecycle snapshot, and strengthen lifecycle timeout and concurrency regression coverage. --------- Co-authored-by: PathGao <[email protected]>
e467b25f03 fix(sub): coalesce external subscription refreshes (#6139) * fix(sub): coalesce external subscription refreshes Limit concurrent cache misses to one upstream request per URL and evict the oldest entries once the cache reaches its bounded capacity. * fix(sub): preserve shared stale refresh results Release every in-flight waiter on panic or error, carry the leader outcome to waiters, and strengthen cache capacity and stale fallback coverage. --------- Co-authored-by: PathGao <[email protected]>
03cc80bb9e fix(mtproto): synchronize child-process lifecycle (#6141) * fix(mtproto): synchronize child-process state Use lifecycle snapshots around the mtg command, completion signal, and exit error so Wait cannot race status and shutdown reads. * test(mtproto): cover concurrent process exit * test(mtproto): cover lifecycle field synchronization --------- Co-authored-by: PathGao <[email protected]>
对比 7 次代码提交 »

1 天之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

87ebcc7a6f feat(ui): tag settings that sit at their shipped default value (#6128) * feat(ui): tag settings that sit at their shipped default value A field showing 2096 reads identically whether the install never set it or the operator saved 2096 — newcomers cannot tell which knobs they have touched, and after the cleared-port fix (#6121) a port can never visually return to an unset state. Add a small grey tag next to numeric settings whose current value equals the shipped default. The tag deliberately compares values, not provenance: a stored 2096 and a fallback 2096 behave identically, so they read identically, and the tag reacts live as the user types. The backing endpoint filters defaultValueMap through the AllSetting field set, so per-install material (secret, panelGuid, node mTLS keys) and redacted credential fields never leave the server; a test pins that. Co-Authored-By: Claude Fable 5 <[email protected]> * fix(ui): keep the default tag out of the accessible name, pin the defaults contract From review, in order of severity: The badge was rendered inside the element whose id feeds the control's aria-labelledby, so a visible tag changed every field's accessible name ('Panel Port Default'). The title text now carries the id on its own span and the badge sits beside it. The same default values live in three places: the Go defaultValueMap, the frontend AllSetting class, and the tag's verdict. A new contract test parses the Go map's string literals and asserts every shared key matches the AllSetting class default through the tag's own comparison — and on first run it caught two real drifts (tgEnabledEvents / smtpEnabledEvents defaulted to '' in the class but 'login.attempt,cpu.high' on the server), now aligned. matchesFactoryDefault no longer coerces blank or unparsable defaults (Number('') is 0; a junk string is not false). The Go tests are table-driven t.Run subtests and gained the structural invariant: every returned key is an AllSetting json tag outside the credential deny-list. The service doc comment now describes the projection mechanism instead of overclaiming; the i18n key is re-indented and placed at the head of pages.settings in all 13 locales; the fetch falls back to {} when validation fails; and smtpPort gets the tag so plain numeric settings-list fields are covered uniformly. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
55f0281692 chore(lint): forbid the Number-or-clamp idiom in direct-write settings pages (#6129) * chore(lint): forbid the Number-or-clamp idiom in direct-write settings pages Follow-up promised in #6127's review thread: the settings and xray pages write numeric changes straight into state, so a regressed handler silently ships the cleared-port bug again. A scoped no-restricted-syntax rule now rejects Number(...) || N inside an onChange attribute in those directories, pointing at onNumber(). The one remaining match, the Telegram notify interval, moves onto the helper with its floor intact: clearing now keeps the stored count instead of writing 1, and Math.max still clamps typed values. Form modals that stage values behind Zod keep their deliberate clear-means-zero semantics; the rule deliberately does not apply there. Co-Authored-By: Claude Fable 5 <[email protected]> * chore(lint): widen the numeric-clamp guard to the shapes that actually drift From review: the rule matched only the Number-or-literal shape, while two semantically identical ternary sites already lived inside its own directories, so 'zero suppressions' reflected the selector's narrowness rather than a clean subtree. The rule now catches the ternary typeof form and the nullish-coalescing form too, is anchored to InputNumber elements so its message can never point a ChangeEvent handler at a number-typed helper, and documents the extracted-handler shape it cannot see. The xray form modals stage values behind Zod like the clients modals do, so a follow-up config object exempts them explicitly instead of the comment claiming they were never in scope. BasicsTab's Happy Eyeballs try-delay — the one genuine direct-write ternary — moves onto onNumber: clearing keeps the stored delay instead of writing 0, and 0 stays reachable by typing it. The Telegram interval gains precision={0} so a typed decimal cannot compose an @every value its own parser rejects on reload. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
bcd71c9296 chore(build): stop shipping production sourcemaps inside the binary (#6131) * chore(build): stop shipping production sourcemaps inside the binary Everything under internal/web/dist is embedded into the release binary via embed.FS, and sourcemap: true put 112 .map files — 18MB, 72% of dist — inside every build users download. Nothing consumes them there: the panel never references them and npm run dev serves its own maps regardless of this flag. dist drops from 25MB to 6.7MB; flip the flag locally when a production bundle needs debugging. Co-Authored-By: Claude Fable 5 <[email protected]> * chore(build): gate production sourcemaps behind XUI_SOURCEMAP From review: hard-coding false made the documented debugging path an edit to a tracked file, and the XUI_DEBUG serve-from-disk flow lost maps with no zero-diff way back. XUI_SOURCEMAP=true at build time restores them; the default stays off. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
33f72f8f4a fix(api): authenticate GET /panel/api/openapi.json + pin the route registry to the router (#6133) * test(web): pin the endpoints.ts registry to the actual Gin routes endpoints.ts is a hand-maintained registry and nothing checked it against the router: an omitted API route silently vanishes from the generated OpenAPI docs, and an entry for a removed route documents an endpoint that 404s. Two new tests construct the real router against a throwaway DB and diff the /panel/api surface both ways. The check found one gap on arrival: GET /panel/api/openapi.json — the endpoint that serves the docs — was itself undocumented. Registered. Co-Authored-By: Claude Fable 5 <[email protected]> * fix(api)+test: authenticate openapi.json, fold the two route-contract tests into one Three things from the review, in severity order. The bot found that GET /panel/api/openapi.json was registered on the base-path group one line before the /panel/api group installs checkAPIAuth, so Gin's snapshot of the parent chain meant the whole admin API surface plus build version was fetchable without a session — while this very PR was about to document it as auth-required. Move the registration inside the authed api group. Verified: unauthenticated it now 404s exactly like server/status (was 200), and a logged-in session still serves it 200, so the docs page is unaffected. The existing api_docs_test.go already checked the forward direction by regex-scanning controller source against a hand-maintained per-file path switch — which is why it missed this web.go-registered route, and whose fall-through default silently mis-paths any unlisted controller file. The new router-based test is a strict superset, so fold in the extra surface it guarded (/login, /logout, /csrf-token, /getTwoFactorEnable, /ws) and delete the old test rather than run two. Harden the endpoints.ts parser: pair each method with the next path sequentially instead of a brace-crossing regex, and fail loudly when the parsed count doesn't match the declared method fields. Construct the server once across both subtests, cancel it, and restore the previous global on cleanup. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
ea35884390 chore(i18n): delete 230 dead translation keys and guard against new ones (#6132) * chore(i18n): delete 230 dead translation keys and guard against new ones The 13 locale files carried 230 keys (11% of the set) that nothing in the frontend or Go sources references — leftovers of renamed features (the email notifier reuses tgbot.messages.* for subjects, the old email.subject*/title* set was orphaned; likewise menu.*, the clients bulk-copy strings, and the secAlert* family). Nothing detected this: a missing key falls back to en-US and an unused key fails nothing. A new test now fails the build when an en-US key has no reference in frontend/src or internal Go sources (dynamic keys are covered by harvesting concatenation and template-literal prefixes), and pins that all 13 locales carry exactly the en-US key set, so parity drift surfaces at test time instead of as a silent fallback. Each locale shrinks by the same 230 keys; net -2,900 lines across the translation set. Co-Authored-By: Claude Fable 5 <[email protected]> * fix(i18n): restore the 29 live remarkVars keys, match whole tokens, unmask 9 more From review: the template-literal harvester required the prefix to end on a dot, so pages.hosts.remarkVars.desc${token} harvested nothing and all 29 desc* tooltip keys were wrongly deleted — and the guard shared the flawed logic, so CI stayed green while the Hosts page would have shown raw key names in 13 languages. Restored from the parent commit; the harvester now requires at least one dot but not a trailing one. Also from review: references are matched as whole dotted tokens instead of substrings (a dead key can no longer hide behind a longer sibling — that unmasked 9 more genuinely dead keys, each verified by hand before deletion), and the test excludes itself from the scan so its own prose cannot whitelist a subtree. Net: -210 keys per locale instead of the previous -230. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
对比 5 次代码提交 »

2 天之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

17e6b5a460 inbounds: allow custom monthly traffic reset days (#6071)
34d2591e50 fix (install.sh): use realpath instead of script name (#6075) * fix (install.sh): use realpath instead of script name ###Description: During arch() sctipt tries to delete itself in case no compatible arch found. This may lead to unexpected file deletion if executed outside root dir; also cur_dir is declared but doesn't seem to be used anywhere ###Way to reproduce: ```bash cd "/some/other_dir_with_install_sh" /3x-ui/project/dir/install.sh ``` * fix(install): quote the script path before the self-delete realpath was handed an unquoted $0, so a script living under a path that contains spaces was split into several arguments: realpath printed a partial path plus an error, and rm -f then targeted a name matching nothing at all. The unsupported-arch branch silently kept the script it means to remove — the very case the surrounding fix exists for.
ca6955d88b feat(ui): validate the REALITY client version range at save time (#6126) * feat(ui): validate the REALITY client version range at save time The impossible range from PR #6125 — a max below the effective minimum — could still be saved; the tooltip only helps a user who hovers it. Add save-time validation mirroring xray-core's parser (up to three dot-separated parts, each 0-255) on both fields, plus a cross-field check that a non-empty max is not below a non-empty min. Errors are field-level i18n keys following the REALITY target precedent, so the modal stays open and points at the offending field instead of storing a config that rejects every client. A malformed min is reported by its own field and skipped by the max comparison, so the user sees one precise error per field. Co-Authored-By: Claude Fable 5 <[email protected]> * fix(ui): reject untrimmed client versions and revalidate max on min edits From review: the validators trimmed but the save path ships the value verbatim, and xray-core's part parser accepts no surrounding whitespace — so a green form could still save a config the core refuses to load. Reject any value that differs from its trimmed form. Also revalidate the max field after a min edit when max already shows an error, so correcting the min clears the stale cross-field message without waiting for the next submit. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
411271b454 refactor(ui): share one onNumber handler for numeric setting inputs (#6127) * refactor(ui): share one onNumber handler for numeric setting inputs The Number(v) || 0 idiom in InputNumber onChange handlers is the root pattern behind the cleared-port bug (#6121): AntD reports a cleared field as null, and || 0 turns that into a stored zero or a min-clamp. The port fields got an inline null-guard; the other sixteen numeric settings kept the idiom, so every new field is a chance to reintroduce the bug. Extract the guard into onNumber(apply): null, empty and NaN change events are ignored so a cleared field snaps back to its stored value on blur, and numeric events pass through unchanged. Convert all sixteen sites in the settings and xray pages. Two sites keep their deliberate different semantics: smtpPort falls back to 587 on clear, and the Telegram notify interval clamps through Math.max. For the non-port fields this changes clearing from storing 0 to keeping the stored value; zero remains reachable by typing it. Co-Authored-By: Claude Fable 5 <[email protected]> * refactor(ui): fold the remaining hand-rolled numeric guards into onNumber From review: ObservatorySettingsTab's sampling field hand-rolled the same ignore-null semantic and smtpPort kept a fallback-to-587 on clear that nothing documents as intentional and that silently overwrites a configured non-standard port — both now go through the shared helper, leaving the Telegram interval clamp as the one deliberate exception. Also from review: narrow the helper to numbers only (no stringMode input exists in the repo, and the string branch codified a guarantee the number-typed callback cannot honour), soften the docblock to describe behavior rather than promise prevention, add a GeneralTab component test covering the clear-vs-typed-zero semantics, and assert the blur snap-back in both settings tests so a display/state desync cannot ship unnoticed. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
e862d81c60 fix(sub): omit hyphen for empty remark variables (#6101) * fix(sub): omit hyphen for empty remark variables The default INBOUND-EMAIL template left a leading hyphen when an inbound had no remark after display remarks became template-driven in b0c1156dd. Treat a hyphen between adjacent variables as their separator and drop it when it would lead the output or when the value after it is empty, so an empty variable in the middle of a template still leaves a single separator between its neighbours. Literal leading hyphens written into the template are preserved. * fix(sub): elide the remark separator after leading decoration The separator between two adjacent tokens was kept as soon as any text had reached the segment, so a template opening with decoration still rendered "🌐-john" for an inbound with no remark. Track whether a token has produced a value rather than testing the accumulated output, so the hyphen is elided for any prefix that carries no token value of its own, and the builder is no longer rescanned once per token.
对比 15 次代码提交 »

2 天之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

4605f00a15 fix(nodes): keep the credential-presence flag on the node heartbeat push The Nodes page cache is overwritten wholesale by the heartbeat websocket push, but the job broadcast a raw []*model.Node while the REST list returns []*service.NodeView. model.Node tags the api token json:"-" and carries no hasApiToken field, so every push stripped the flag the edit form reads to decide whether a token is already stored. One 5s tick after the page loaded, editing any non-mTLS node then failed with "Name, address, port and API token are required" — and stayed failed, because setQueryData refreshes dataUpdatedAt, so the query never goes stale and never refetches the intact REST payload. Broadcast the NodeView read contract instead.
dc6a16019e fix(xray): reject configs xray-core refuses, and check the fixtures against it The frontend's golden fixtures are the panel's model of an xray config, but nothing ever asked xray-core whether it would accept them: the snapshots only prove the Zod schemas agree with themselves. Building every fixture through the same config builders the panel hands its config to — conf.InboundDetourConfig for the full-config and AddInbound paths, conf.RouterConfig for ApplyRoutingConfig, conf.DNSConfig for the dns section — found seven the core refuses, three of them reachable from the panel's own UI. A refusal is not scoped to one inbound: the config fails to load and every inbound stays down. Hysteria: xray-core builds version 2 only, in both the protocol settings and the transport settings, but the inbound settings schema accepted any version from 1 up and its comment claimed upstream still supported v1. Both fixtures carried version 1. The schema now pins 2, GenXrayInboundConfig heals stored rows on the way out the way it already heals shadowsocks ciphers and wireguard peers, and the share link drops the dead hysteria:// scheme — the subscription server already emitted hysteria2:// for the same inbound. XHTTP uplinkDataPlacement: both transport forms offered "query", which the core has never accepted for that field (auto and body always, cookie and header in packet-up mode). Replaced with auto, which was missing, and the default label now names auto rather than body. FinalMask items: switching an item to the rand-driven array kind wrote packet:[] next to the rand. xray-core counts an empty array as a packet and every item kind is exclusive, so noise answers "len(item.Packet) > 0 && item.Rand.To > 0" and header-custom "exactly one item kind must be set". The editor now clears the packet, and GetXrayConfig strips the residue from rows already saved with it. The remaining four were stale fixtures: an xmc mask still on the usernames shape v26.7.28 replaced with profiles, a fragment mask with no length, and header-custom and noise items passing an array to the string packet kind — all shapes the panel's own editors cannot produce. golden_fixtures_xray_test.go keeps this from drifting again: every fixture in every category is built through xray-core on each run, with a self-signed pair standing in for the deployment certificate paths, so the next core bump reports which fixture it broke.
fea6a20f7c fix(xray): stop the runtime user API from crashing xray-core Exercising the whole XrayAPI surface against a real xray-core 26.7.28 (the version go.mod pins) turned up a way for ordinary panel activity to kill the core process, plus two smaller mismatches with what the core actually does. buildUserAccount picked the shadowsocks account type by falling through to a 2022 account whenever the cipher was not one of six hardcoded names. xray's legacy and 2022 inbounds cast the account they are handed without checking (proxy/shadowsocks/validator.go, proxy/shadowsocks_2022/inbound_multi.go), so the wrong type is not an error — it panics the core and drops every connection on the server. The fallback was reachable without any misconfiguration: autoRenewClients hands AddUser the client object straight out of the inbound's settings, where the cipher lives under "method", never "cipher", so every auto-renewed client on a legacy-cipher shadowsocks inbound took xray down. The xray-valid aead_* aliases hit it too. The cipher is now read from either key, matched with the same table (and case-insensitivity) the core's own conf package uses, and an unrecognized one is an error instead of a guess. The legacy shadowsocks validator is also the only one that accepts a second user under an email it already holds, and RemoveUser then drops just one of them — a disabled or expired client kept connecting. AddUser now drops the email first on that account type so a single removal fully revokes the client. GetTraffic skipped every stat the first time it saw it. xray creates a counter on a user's first use, so that dropped a new client's traffic for a whole polling interval, as did the counter reset after a core restart. Only the first poll of a process is a baseline now; later, unseen and rewound counters both count from zero. Also fixes three unchecked settings["method"].(string) assertions that panic the panel on a shadowsocks inbound whose settings carry no method, and bounds TestRoute's port so an out-of-range value cannot wrap into the uint32 the core is asked about. Tests: api_users_e2e_test.go drives add/remove for every protocol against a real core and asserts it survives each one (skipped unless XRAY_E2E_BINARY is set); the account-type, traffic-delta and renew paths get unit coverage.
7f7b7e16a4 feat(xray): update xray-core to v26.7.28 and adapt panel Bump xtls/xray-core to 5ca6f4b7d4dc (v26.7.28) and move the three binary pins (DockerInit.sh, the Linux and Windows URLs in release.yml) in lockstep so the in-process conf.Build() validation and the child binary agree. XMC finalmask (#6487) is the breaking change. The mask's `usernames` string list is gone, replaced by a required `profiles` array whose entries each need a 3-16 character [A-Za-z0-9_] username, a parseable UUID and both Mojang texture fields; the "default to Dream when empty" fallback was removed, so an xmc mask saved by an older panel now fails to build and takes the whole config down with it rather than degrading one inbound. The textures are a signed blob only Mojang's session server can issue, so a legacy username cannot be upgraded automatically. The panel now: - rejects an incomplete xmc mask at save time (AddInbound/UpdateInbound), pointing at the specific field that is missing; - drops only the offending mask when generating the core config, for rows that never went through the form (upgrade, node sync, restored backup, direct DB edit), warning which inbound lost its obfuscation instead of leaving every inbound offline; - carries legacy usernames into profile stubs in the finalmask form so the operator keeps their player names and sees exactly what still needs filling in, and edits profiles through a list editor. No destructive DB migration: unlike the removed shadowsocks ciphers there is no valid replacement to rewrite to, and dropping the mask from stored rows would discard the operator's hostname and password for config they can still repair. The generation-time strip already prevents the startup failure. Also track the core's xmux maxConnections fallback, lowered from 6 to 3 for anti-TSPU, in the fresh-XMUX seed so a new panel config matches what the core would pick on its own. TUN gained a `desc` key and random utunN naming, but the Go validator no longer accepts TUN inbounds and the panel only renders legacy saved rows, so nothing there needs adapting. The remaining commits are REALITY log-warning wording, gRPC/XHTTP localAddr accuracy and a routing tweak, none of which change the JSON config surface. Tests cross-check the panel's profile predicate against conf.XMCProfile.Build() so a future core release that tightens or relaxes the rules fails loudly rather than silently emitting configs the core refuses to start on.
对比 4 次代码提交 »

2 天之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

fd17255f1d Revert "fix(sub): keep the client identity on every subscription link (#6098)" This reverts commit c004c18d903bcc2b58602f71d411b024fe5ab60d. Showing {{EMAIL}}/{{USERNAME}} on the first subscription-body link only is intentional, not an oversight in 876d55f2. Restoring the behaviour and the tests that pin it. Making the identity tokens configurable is the sanctioned route for the operators asking for them on every link (#5935), rather than flipping the default for everyone.

3 天之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

8bc00d1e90 style: drop the line comments added with the triage fixes CLAUDE.md rules out // line comments in committed Go. The rationale they carried is in the commit messages for each fix; doc comments that already existed are kept, updated where the code they describe changed. Also replaces reflect.Ptr with reflect.Pointer and rewrites the YAML keyword alternation as a lookup table, both flagged by golangci-lint.
6f4cc1e53c fix(xray): emit an empty client array instead of null in the generated config (#6117) finalClients was a nil slice, so an inbound that has a clients key but whose clients are all filtered out — disabled by an admin, or cut by the traffic job for quota or expiry — was handed to xray-core as "clients": null. The panel already treats a stored null client list as invalid data and coerces it to [] at startup, and null is what reporters see in bin/config.json when they go looking for a connectivity problem, which sends the diagnosis after a serialization bug that is not there. Build the slice empty so the same state serializes as []. The reported inbound also needs the clients table to be in sync, which is a separate question still open on the issue.
0e69f64e56 fix(job): bound the traffic-notify POST so a stalled receiver can't wedge it (#6115) informTrafficToExternalAPI posted through the package-level fasthttp.Do, which carries no read or write deadline. Run() is scheduled @every 5s under cron.SkipIfStillRunning, so a receiver that accepts the connection and then neither answers nor closes did not just delay one notification — it held the job, and every following tick was skipped for the duration. What stops with it is more than counters: AddTraffic runs autoRenewClients and disableInvalidClients in the same call, so quota and expiry enforcement stall too, and an over-quota client keeps transiting for the whole hang. The online-client refresh and the websocket broadcasts sit later in the same tick. Give the endpoint its own client with read/write deadlines and a DoTimeout budget under the poll cadence, close the connection rather than pooling it for a call this infrequent, and skip the POST outright when there is nothing to report. Retries stay off: the payload carries per-tick deltas, so a resend after a failed response leg would double-count on the receiver. Verified against a listener that accepts and stalls: fasthttp.Do was still blocked after 8s, the new client returns at its 3s budget.
7fe9932d7b fix(sub): quote Clash scalars a YAML parser would read as numbers (#6104) A REALITY short-id like 2351e1 is valid hex, but as a bare YAML scalar the resolution rules read it as the float 23510. mihomo hex-decodes the resulting five-digit string, fails with "invalid REALITY short ID", and the whole provider loads zero nodes — one proxy takes the entire subscription down. The encoder quotes the forms it recognises (plain integers, hex, booleans) but not the exponent-float form, and its own parser reads that token back as a string, so nothing in a round-trip through it reveals the problem. Check the values against the resolution rules instead, and force quotes on any plain scalar that would resolve to a non-string. Applied to every string in the document rather than to short-id alone: the panel's own short-id generator emits random hex, and passwords, obfs- passwords and pre-shared keys reach the output the same way. Unambiguous values are untouched, so the document is otherwise byte-identical. The existing Clash tests assert on the config map, never on the serialized text, which is why this survived; the new tests assert on the output.
c004c18d90 fix(sub): keep the client identity on every subscription link (#6098) 876d55f2 put EMAIL/USERNAME in the same first-link-only bucket as the usage tokens, so a client attached to several inbounds got its email on whichever inbound sorted first and bare inbound names on all the rest. With the shipped default template ({{INBOUND}}-{{EMAIL}}|...) that makes every profile after the first indistinguishable between clients — the point of the token. The two are not alike: the usage block repeats identical numbers on every link, while the identity is what tells one imported profile from another. Restore identity on all body links and leave usage first-link-only. Reported again in #6029 and #5659, which asked for the same revert.
对比 8 次代码提交 »

3 天之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

acbb879f80 refactor(ci): make the bot read-only except for PR conflict resolution The bot is meant to investigate and explain, not to write code. It could do considerably more than that: handle-pr-fix applied fixes and pushed them to any trusted author's PR, an @claude mention on a pull request could edit files, and an @claude mention on an issue opened a pull request against main. All of it is gone. Now every job that answers automatically runs with a contents: read token, so pushing is impossible rather than merely forbidden: - handle-pr-fix is deleted. handle-pr-review takes every pull request instead of only the ones from outside contributors, and it comments. - mention drops contents: write, the push-URL routing step, and the Edit tool. Its Bash allowlist is now an explicit read-only set - the gh subcommands it needs plus git log/show/diff/blame - so gh api, gh pr merge and gh pr create are no longer reachable. Asked for a fix, it now writes the change out in full instead of applying it. One narrow exception replaces all of that: resolve-conflicts. It runs only when the repository owner comments "resolve pr conflicts" on a pull request, and it may merge the base branch into that PR's head branch and resolve the conflicts, nothing else. It keeps both sides of every conflict, takes the base version of generated artifacts it cannot regenerate here, and aborts the merge rather than guess when a hunk needs a human. It never force-pushes, merges, or closes. Also removes the pull-request-opening step whose guard never worked: gh api prints the 404 body on stdout, so `ahead=$(gh api ... || echo 0)` became `{"message":"Not Found",...}0`, never equal to "0", and every reply-only mention run ended red on `gh pr create`. Uploads the handle-pr-review transcript the way handle-issue already does, so a run that dies inside the sandbox leaves evidence.
1358f65bec fix(ci): unbreak the issue-triage bot, which answered nothing Since 2026-07-20 every `issues` run reported success while posting no comment at all - #6094 through #6103 carry zero replies. The cause is the sandbox, not the prompt or the model. `handle-issue` and `handle-pr-review` pass allowed_non_write_users, which is what lets the bot run for reporters who have no write access. claude-code-action reacts to that input by turning subprocess isolation on and installing bubblewrap, and that sandbox cannot start on the runner: every Bash call dies during setup, before the command itself runs, with bwrap: Can't create file at /home/.mcp.json: Permission denied `gh` is reachable only through Bash, so the triage investigated the issue, wrote its reply to /tmp/comment.md, and could never post it. The action itself did not crash, so the job stayed green. Opt both jobs out with CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0. The scrub is a best-effort wipe of secrets from subprocess environments, not an access control; what actually bounds these jobs is unchanged - a contents: read token that cannot push, and a Bash allowlist holding only specific `gh issue`, `gh label`, `gh search` and `gh release` subcommands. Code changes stay confined to handle-pr-fix and mention, which only trusted actors and the owner can trigger. Add a step to each job that fails the run when no bot comment landed on the issue or pull request, so the next silent breakage shows up red instead of green, and lower retention-days to the repository maximum of 7 so the artifact upload stops warning.
f4e79e70ea chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms Frontend deps: @hookform/resolvers 5.4.0 -> 5.4.3 and react-hook-form 7.82.0 -> 7.83.0. The @typeschema/valibot override is what makes this installable at all. Resolvers 5.4.3 re-declares 25 optional peers for its validator matrix, and npm resolves them into the ideal tree even though none are used here; two of them contradict, since resolvers wants valibot ^1 while @typeschema/main -> @typeschema/valibot pins valibot ^0.39. Both target the same node_modules/valibot, so a plain npm update dies with ERESOLVE. The override settles that one edge and nothing extra lands in node_modules. Backend deps: telego 1.10.0 -> 1.11.1 (Telegram Bot API v10.2, additive only), klauspost/compress 1.19.1, plus the indirect bumps that came with them. VS Code tasks: the golangci-lint and modernize tasks assumed Windows PATH semantics, where PATH is a persistent user variable that every process inherits, so ~/go/bin was always visible. On Linux that directory is exported from ~/.bashrc, which the non-interactive `bash -c` behind a task never sources, and both tasks failed with exit 127. Adds linux/osx option blocks that prepend the Go bin directories and leaves the Windows path untouched, plus tasks to install the two tools; those are split because go install rejects packages from different modules in one invocation. Go sources: modernize -fix output, covering range-over-int, slices.Backward, maps.Copy, strings.CutPrefix and strings.SplitSeq. Behaviour is unchanged.
对比 3 次代码提交 »

5 天之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

edb487a005 chore(deps): migrate to react-router 8 and refresh frontend dependencies react-router-dom 7 is superseded by react-router 8, which folds the DOM bindings back into the core package. RouterProvider now comes from `react-router/dom`, while the hooks and `createBrowserRouter` move to `react-router`. Updates the nine importing modules and the router line in docs/architecture.md to match. Also refreshes antd, react-i18next, storybook, eslint, lint-staged and playwright to current patch/minor releases, and restores alphabetical order in devDependencies for the @vitest/browser-playwright and playwright entries. Bumps brace-expansion to 5.0.8, the only release outside the affected range of GHSA-mh99-v99m-4gvg (unbounded expansion length causing an OOM crash). `npm audit fix` could not apply this on its own: the lockfile pinned 5.0.7 and npm will not re-resolve a transitive-only dependency in place, so the entry was updated directly and reinstalled.
35cf6be6f9 fix(ci): keep the triage prompt under the 21000-char expression cap The previous commit pushed handle-issue's prompt to 21587 characters and GitHub stopped parsing the file: "(Line: 39, Col: 19): Exceeded max expression length 21000". Because the prompt interpolates ${{ }}, GitHub treats the whole block scalar as a single expression, and the cap applies per expression. The failure mode is quiet and total - no job fails, the workflow itself disappears, its registered name reverts from "Claude Bot" to the file path, and the only signal is a run attributed to the push with no jobs in it. Drop the hand-written stack description, repository map and runtime-fact list from that prompt and point at CLAUDE.md and docs/architecture.md instead. Both are maintained, both are already in the checkout, and the copy in the prompt had drifted from them anyway - it still described the mtg worker, omitted internal/tunnelmonitor/ and memory.high, and filed internal/web/runtime/ under "wiring". Only the support-facing facts that live in neither file are kept: the install one-liner, the random initial credentials, the distro-dependent env file, the Docker image and the capabilities fail2ban needs. handle-issue is now 15069 characters, and a header comment records the limit so the next edit does not rediscover it in production.
0f7329c3ce fix(ci): repair the Claude bot and narrow what it can reach Three problems, all in .github/workflows/claude-bot.yml. It was silently dead. No comment had been posted since 2026-07-20 while every run reported success: roughly twenty issues and pull requests each burned 18-56 turns and up to $2.59, ended with permission denials, and published nothing. Comment bodies are markdown, markdown is full of backticks, and inside a quoted `--body "..."` backticks are command substitution, so the write was rejected and a failed triage looked exactly like a clean one. The body now goes to /tmp through Write and out through --body-file, in every branch of both jobs, and each job re-reads the thread afterwards so a rejected write fails loudly instead of reporting success. The run transcript is kept as an artifact. It could reach much further than it claimed. Both jobs that any GitHub user can trigger declared themselves READ-ONLY in prose while holding Bash(gh:*), which is not a GitHub-scoped allowlist: `gh alias set --shell` runs its argument through sh -c and `gh extension install` fetches and executes code, both as single commands whose first token is gh. That is a general shell on a runner holding CLAUDE_CODE_OAUTH_TOKEN, which does not expire with the job. `gh api` accepted any method, issues: write is repo-scoped rather than issue-scoped, and `gh pr review --approve`, `gh pr close` and `gh pr checkout` were forbidden in prose only. Those two jobs now list the subcommands they actually run. The untrusted title and body are fenced in tags carrying github.run_id, unguessable at the time the issue is written, and the invariants an allowlist cannot express - one issue number, labels and title only, /tmp as the sole writable path, never $GITHUB_ENV - are stated explicitly. Both checkouts get persist-credentials: false. handle-pr-fix and mention keep their wildcards: only owners, members and collaborators can trigger them, and narrowing the maintainer's own path risks more than it protects. Its review hid findings and its triage quoted stale facts. "Prefer a few high-signal findings over many low-value ones" is read literally by Opus - it finds the bug, judges it below the stated bar and says nothing - while the Severity and Confidence tiers already existed to do that filtering. The review also never said that the working directory is the base revision, so it could assert that a case was unhandled in code the pull request had already rewritten, and label it confirmed, on an outside contributor's first patch. Four CLAUDE.md conventions were missing, each a guaranteed miss: openapigen's StructAllow allowlist, the layering rules including the runtime.Runtime dispatch requirement that silently breaks multi-node when bypassed, the assertion standard, and golden share-link fixtures regenerated to turn a red test green. On the triage side the invalid and duplicate branches were gated three times over and so never fired, leaving spam to collect a full investigation and a courteous reply; /etc/default/x-ui was given as the env file when it is distro-dependent, making the PostgreSQL migration advice a silent no-op on RHEL and Arch; an env list labelled "full" omitted XUI_PORT and the XUI_TUNNEL_HEALTH_* family; XTLS was offered as a security option the panel does not have. docs/architecture.md was invisible to both prompts despite being maintained and already in the checkout. From the bot's own output: it published a trigger only the maintainer can use, retitled issues without saying so, asked for screenshots it cannot open, and once invented a reason for a number it had miscounted. All four jobs move to Opus 5, at xhigh effort rather than max - the recommended tier for agentic work, and one below the overthinking that max invites on routine triage.
29557e2153 fix(sub): gate the VLESS flow in JSON subscriptions like raw and Clash links genVless emitted client.Flow unconditionally, while the raw link (service.go:806) and the Clash proxy (clash_service.go:251) both gate it behind vlessFlowAllowed. A flow_override left on client_inbounds after its inbound moved to a transport Vision cannot use -- ws, grpc, httpupgrade -- therefore survived only into the JSON subscription, handing that client an outbound xray-core rejects while its other two formats were correct. Apply the same gate at the call site, reading the network from the per-host stream so a host that rewrites the transport is judged on what it actually emits. Verified by seeding a flow_override on a ws+tls inbound: before, raw and Clash dropped the flow and JSON kept it.
0b60154383 fix(docs): force transitive sharp up to patched 0.35.3 sharp <0.35.0 inherits four libvips CVEs (GHSA-f88m-g3jw-g9cj). It comes in as an optional dependency of next, which still declares ^0.34.5 on its current release, so only an override reaches the fixed line. Brings libvips 8.18.3 via @img/sharp-libvips-* 1.3.2.
对比 8 次代码提交 »

6 天之前

txlyre 推送了 master 分支的代码到 txlyre/libqirt

0d5a57ea0a upd

6 天之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

cd674c8d4f feat(sub): expose live online status and add ?format=info endpoint Custom subscription templates only received the lastOnline timestamp, so template authors had to fake an online indicator by comparing it against the current time, and the page was a one-shot server render with no way to refresh usage without reloading the whole HTML. The template context (and window.__SUB_PAGE_DATA__) now carries isOnline, computed from the panel's own online-client tracking (local xray plus remote nodes) at render time. The subscription URL also answers ?format=info with the page view-model as JSON — minus the links, with emails deduplicated — so templates can poll live status cheaply. The shared view-model construction moved into buildSubPageData/subPageContext so the HTML page, the SPA payload and the info JSON cannot drift apart. Also documents the previously injected but undocumented announce template variable.

1 周之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

b319dd0c3a fix(panel): align telegram icon with its label in home card actions The .tg-icon override (display: inline-block; vertical-align: -2px) defeated the default .anticon flex centering that every other card action icon relies on, so the icon rendered ~2px below the @XrayUI text. Dropping the override lets AntD center it like its neighbors.
8ef2eec3d1 fix(hosts): assign group ids to imported hosts and repair empty ones Host rows created from a legacy streamSettings.externalProxy during inbound import got an empty group_id, and the one-time HostGroupIds seeder had already been gated off, so the UI rendered them under a synthetic fallback_<id> group the update/delete API could not resolve, failing every edit with "host group not found". Assign a real group id in externalProxyEntryToHost at creation, and replace the seeder with backfillEmptyHostGroupIds, an idempotent startup repair that runs on every boot so rows from older builds and restored backups are healed too. Also rename the leaked internal error "host group not found" to "host not found" since groups are not a user-facing concept.
941c6116a9 chore(openapi): regenerate schemas with int64 formats on node fields Output of make gen: the generator now stamps format int64 on the node status schema's 64-bit integer fields (timestamps, net counters, uptime), syncing the committed OpenAPI doc and generated schemas with the Go structs.
对比 3 次代码提交 »

1 周之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

c77608bc47 fix(nodes): make node API tokens write-only (#5613) * fix(nodes): make node API tokens write-only * fix(nodes): keep token optional on edit for write-only API tokens NodeView no longer returns apiToken, so the edit form must consume hasApiToken and not require re-entering the token. Relaxes the form validation on edit, adds a keep-current placeholder, and adds the i18n key to all 13 locales.
892c06c8bc Bug-label issue sweep: 16 fixes (#6083) * fix(xray): block private-range egress in default freedom finalRules (#6037) With domainStrategy AsIs the router never resolves domains, so a domain with a private A record (e.g. 127-0-0-1.nip.io) sails past the geoip:private routing block and freedom's allow-all finalRules let it reach loopback services such as the xray gRPC API and metrics listener. Prepend a block rule for geoip:private to the default template and add the FreedomFinalRulesPrivateEgressBlock seeder so existing installs still carrying the stock allow-only (or legacy private-only-allow) finalRules are upgraded in place; customized rules are left untouched. * fix(sub): version-gate unencrypted-outbound drops in outbound subscriptions (#6033) Commit d38c912d taught CheckXrayConfig to keep unencrypted vless/trojan outbounds when the running core predates the v26.7.11 rejection, but filterOutboundsRejectedByCore still consulted the embedded validator unconditionally, so outbound subscriptions kept silently dropping those outbounds even on downgraded cores. Apply the same shouldSkipLegacyUnencryptedOutboundRejection gate when filtering fetched subscription outbounds. * fix(xray): resolve geodata assets before building outbound configs (#5928) Saving routing or template settings validates each outbound through the embedded config loader, and a freedom outbound whose finalRules reference geoip:private opens geoip.dat during that build. Unlike ApplyRoutingConfig, ValidateOutboundConfig and AddOutbound never pointed the in-process loader at the bin folder, so xray-core resolved the file relative to the panel executable and saving failed with 'stat /usr/local/x-ui/geoip.dat: no such file or directory'. Call ensureXrayAssetLocation before both build paths. * fix(api): use a real i18n key in the client get handler (#5911) The client fetch endpoint localized its error prefix with the bare key 'get', which exists in no translation file, so every lookup of a deleted client's email logged 'message "get" not found in language ...' noise alongside the expected record-not-found warning. Reuse the same pages.inbounds.toasts.obtain key the sibling list handler uses. * fix(sub): carry host record Host header and path into Clash/JSON output (#5944) The raw-link path overrides the host/path share params from a Host record via applyEndpointHostPath, but the Clash and JSON renderers read the transport settings object, which applyHostStreamOverrides never touched — so a Host record's WebSocket Host header (and path) silently vanished from Clash/Mihomo and JSON subscriptions whenever the inbound's own ws settings left them empty. Inject hostHeader/path into the ws/httpupgrade/xhttp settings of the per-host stream, mirroring the raw-link override. * fix(metrics): accept Unicode outbound tags in the observatory (#5972) The observatory validator whitelisted ASCII word characters, so any outbound whose tag carries a flag emoji or other non-ASCII text was silently dropped from the metrics snapshot, delay history, and health notifications. The history store is an in-process map, so the strict charset bought nothing. Validate tags as non-empty, bounded, control-character-free UTF-8 instead, keeping spaces and emoji while still rejecting garbage input on the query path. * fix(database): default sqlite to WAL to stop background-job lock storms (#6057, #6068) With journal_mode=DELETE every write serializes the whole database and blocks readers, so under normal multi-job load (traffic sampling, node sync, mtproto reconcile) transactions regularly outwaited the 10s busy timeout and jobs failed with 'database is locked'. Move to WAL by default: readers no longer block writers and vice versa, which removes the observed contention while writer-writer access still serializes safely. The single-file-at-rest property is preserved where it matters — Checkpoint() now issues wal_checkpoint(TRUNCATE), so panel and Telegram backups read a complete main file, and sqlite folds the WAL back into the db on clean shutdown. XUI_DB_JOURNAL_MODE=DELETE restores the previous behavior for setups that copy the live file directly. * fix(database): strip finalmask.tcp from REALITY inbounds on upgrade (#6038) validateFinalMaskRealityCombo blocks saving finalmask.tcp together with REALITY because that combination crashes Xray-core 26.7.11 on the first connection (XTLS/Xray-core#6453), but it only runs on add/update. An inbound saved before the validator existed sailed through the upgrade untouched and took the core down at boot. Add the InboundRealityFinalmaskTcpStrip seeder: one-time scan that removes finalmask.tcp from REALITY inbounds (other finalmask transports survive), so upgraded panels start cleanly. * fix(xray): stop deleting hand-written direct routing rules on save (#6056) The DNS allow-rule sync recognized 'its' rules purely by shape (type=field, ip, port, outboundTag=direct, nothing else), so any manual rule of that shape — e.g. routing a LAN CIDR to a NAS port over direct — was silently stripped on every settings save. Mark managed rules with ruleTag=xui-dns-allow (round-tripped untouched by both xray-core and the Routing tab editor) and only strip rules that carry the tag. Untagged legacy managed rules are adopted when their exact ip-set/port matches a currently configured private DNS endpoint; anything else is left alone. A stale pre-tag managed rule whose DNS server was removed now lingers until deleted manually — the safe side of the trade against eating user rules. * fix(clients): resolve email lookups through client_inbounds after a move (#6059) GetClientInboundByEmail trusted the client_traffics.inbound_id pointer whenever that inbound still existed, but a client moved between inbounds leaves the row pointing at its old (still existing) inbound. The lookup then searched the wrong inbound's clients and failed with 'Client Not Found In Inbound For Email', which broke the Telegram bot's link and QR generation for moved clients. When the pointed-at inbound no longer carries the email, re-resolve through the authoritative client_inbounds link to the inbound that actually hosts the client. * fix(nodes): replicate inbound fallbacks to nodes (#5963) Fallbacks live in the inbound_fallbacks table and were only merged into settings by the master's local config builder; the runtime inbound pushed to nodes rebuilt settings without them, and the reconcile job additionally fingerprinted the raw DB row, so fallback edits neither reached nodes nor triggered a re-push. Inject settings.fallbacks in buildRuntimeInboundForAPI (mirroring the local builder, gated on inboundCanHostFallbacks) and make ReconcileNode push and fingerprint that same runtime-built payload, aligning the interactive and reconcile paths. * fix(database): survive PostgreSQL outages without a runaway restart loop (#6023) A PostgreSQL that was down or still starting made InitDB fail instantly; the process exited with a generic startup error and systemd restarted it every 5s forever, flooding the journal. Retry the initial postgres connection with backoff (~70s total) and log the real driver error on every attempt, and cap the systemd units with StartLimitIntervalSec/StartLimitBurst so a persistently unreachable database stops the unit instead of looping indefinitely. * fix(xray): force a full restart when REALITY stream settings change (#6010) A changed inbound is normally hot-swapped over gRPC as RemoveInbound + AddInbound, but xray-core does not reliably rebuild a REALITY listener's authenticator on a runtime re-add — key or shortId edits appeared applied yet clients kept authenticating against the old parameters until someone restarted the core manually, on nodes in particular. Treat any non-client change to an inbound that uses (or starts using) REALITY as not hot-appliable so the panel restarts the core instead. Client-only edits on REALITY inbounds keep flowing through the per-user AlterInbound path and still avoid restarts. * feat(sub): allow insecure TLS for outbound subscription fetches (#6067) An outbound subscription served over HTTPS with a self-signed or private-CA certificate could never be fetched: the fetch client had no TLS options, so refreshes died with 'x509: certificate signed by unknown authority' and there was nothing the admin could toggle. Add a per-subscription 'Allow insecure' switch (persisted as allow_insecure, default off) that sets InsecureSkipVerify on the fetch transport — including when the fetch is routed through the panel egress proxy. The SSRF-guarded dialer and redirect re-validation stay in force either way. * fix(reality): send PROXY protocol header in the target scanner when xver is set (#6082) The REALITY target scanner always probed with a plain TLS handshake, so a target fronted by an Nginx listener that requires the PROXY protocol (matching the inbound's xver>=1) reset the connection and the panel reported a false 'TLS handshake failed'. Thread the inbound's xver into the scan request and, when it is >=1, lead with the matching PROXY protocol header (v1 for xver 1, binary v2 for xver 2) built from the dialed connection's own address pair. Batch candidate scans against public sites are unaffected (xver 0). * fix(frontend): default sockopt fields when editing a stored inbound (#5956) Opening an existing inbound ran rawInboundToFormValues over the raw DB row, and only xhttpSettings was re-parsed through its Zod schema to fill defaults. A sockopt object saved before the TProxy control existed has no tproxy key, so the Select rendered blank; picking Off didn't help because the wire normalizer drops tproxy=off, recreating the missing key on the next edit. Re-parse streamSettings.sockopt through SockoptStreamSettingsSchema on load, mirroring the xhttpSettings handling, so absent keys (tproxy, tcpcongestion, …) get their schema defaults every time the form opens.
对比 2 次代码提交 »

1 周之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

16b9b3ce1c chore(deps): bump docs and frontend dependencies Routine minor/patch updates: Next.js 16.2.11 + eslint-config-next, fumadocs, React 19.2.8, Storybook 10.5.3, and assorted tooling. Docs stays on ESLint 9 (^9.39.5): eslint-config-next pulls in eslint-plugin-react 7.37.5, whose newest release still calls the context.getFilename API that ESLint 10 removed, so eslint crashes on every file under ESLint 10. The frontend workspace already ran ESLint 10 without eslint-plugin-react and is unaffected.

1 周之前

txlyre 推送了 master 分支的代码到 txlyre/qic

d8994c4a8a fix

1 周之前