feat(client/macos): P1 原生隧道——PacketTunnel 系统扩展可加载 + libbox 运行
经长链路排查(同机对照可工作的 Tailscale),修复 macOS 系统扩展 realize 失败(OSSystemExtensionErrorDomain code=4)与 libbox 运行时崩溃,使内嵌 sing-box 的系统扩展能在 macOS 15 上激活并启动隧道。 系统扩展 realize(三个叠加根因): - 扩展自包含:PacketTunnel 加 OTHER_LDFLAGS="" 切断对项目级 CocoaPods 链接 标志的继承(原会把 flutter_secure_storage 链进扩展);Libbox.xcframework 改纯 Link(静态),从 Embed Frameworks 移除冗余内嵌 - bundle 名 = 标识符:PRODUCT_NAME 设为 com.pangolin.pangolin.PacketTunnel - 扩展 Info.plist 补 NSSystemExtensionUsageDescription(网络扩展类别强制要求) - App Group 改 macOS 原生格式 BYL4KQHMTN.com.pangolin.pangolin;NEMachServiceName 以其为前缀;扩展补 network.client/server;get-task-allow=false + 签名加 --timestamp - CFBundleVersion 随构建递增(否则 sysextd 视为同版本不更新) libbox 运行时: - startOrReloadService(options:) 传 nil 致空指针 SIGSEGV → 传 LibboxOverrideOptions() - 默认接口监控阻塞到首个 path 更新再返回,修 "no available network interface" 配套: - scripts/local_test.sh:build/sign/notarize/copy/run 一条龙(Developer ID + 公证) - client/macos/sign_libbox.sh:构建期以 Developer ID 重签内嵌 Libbox - VpnChannel:401 自动刷新 token、详尽 os_log;auth/api 统一走 kApiBaseUrl - docs/macos-sysext-realize-troubleshooting.html:完整踩坑复盘 WIP / 临时(后续清理): - 隧道运行时仍在排查:剥离远程 rule-set 后 sing-box 启动卡点未定位 - 含临时诊断代码:main.swift stderr 重定向、box.log 输出、rule-set 剥离、debug 日志 - api_config 仍指向联调节点,发版前还原 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
This commit is contained in:
wangjia
@@ -16,7 +16,7 @@ import 'dart:io' show Platform;
|
||||
/// P1 方案B 开关:macOS 是否走原生 System Extension(VpnNativeBridge)而非 PoC 的
|
||||
/// sudo 子进程(DesktopVpnBridge)。默认 false——待 PacketTunnel target/签名就绪、
|
||||
/// 原生侧联调通过后置 true。见 docs/p1-macos-system-extension.md。
|
||||
const bool kUseNativeVpnMacOS = false;
|
||||
const bool kUseNativeVpnMacOS = true;
|
||||
|
||||
/// 全局单例 VpnBridge。Ref 生命周期内不变。
|
||||
final vpnBridgeProvider = Provider<VpnBridge>((ref) {
|
||||
|
||||
@@ -7,6 +7,7 @@ import '../l10n/app_text.dart';
|
||||
import '../pangolin_theme.dart';
|
||||
import '../state/account_providers.dart';
|
||||
import '../state/app_providers.dart';
|
||||
import '../state/auth_provider.dart';
|
||||
import '../state/navigation_provider.dart';
|
||||
import '../widgets/account_screens.dart';
|
||||
import '../widgets/app_top_bar.dart';
|
||||
@@ -93,7 +94,13 @@ class AccountPage extends ConsumerWidget {
|
||||
]),
|
||||
const SizedBox(height: 16),
|
||||
_Card(children: [
|
||||
_NavRow(icon: PangolinIcons.logOut, title: t.signOut, danger: true, onTap: () {}),
|
||||
_NavRow(
|
||||
icon: PangolinIcons.logOut,
|
||||
title: t.signOut,
|
||||
danger: true,
|
||||
// 清除本地令牌 → authProvider 置未登录 → 根据登录态回登录页。
|
||||
onTap: () => ref.read(authProvider.notifier).logout(),
|
||||
),
|
||||
]),
|
||||
],
|
||||
);
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
// api_config.dart — 控制面 API 基址单源。
|
||||
//
|
||||
// 历史上各 service/provider 各自重复声明 _kApiUrl；统一收敛到这里,
|
||||
// 由 --dart-define=PANGOLIN_API_URL 注入(默认本地 8080)。
|
||||
// 由 --dart-define=PANGOLIN_API_URL 注入。
|
||||
// TODO(联调临时): 默认值改成测试节点,避免 release 构建漏传 dart-define;发版前改回 localhost 或正式控制面域名。
|
||||
const String kApiBaseUrl = String.fromEnvironment(
|
||||
'PANGOLIN_API_URL',
|
||||
defaultValue: 'http://localhost:8080',
|
||||
defaultValue: 'http://103.119.13.48:8080',
|
||||
);
|
||||
|
||||
@@ -99,15 +99,20 @@ class AuthApi {
|
||||
|
||||
Future<http.Response> _post(String path, Map<String, dynamic> body) async {
|
||||
final uri = Uri.parse('$baseUrl$path');
|
||||
print('>>>AUTHLOG POST $uri (baseUrl=$baseUrl) 发起...');
|
||||
final sw = Stopwatch()..start();
|
||||
try {
|
||||
return await _client
|
||||
final resp = await _client
|
||||
.post(
|
||||
uri,
|
||||
headers: {'Content-Type': 'application/json'},
|
||||
body: jsonEncode(body),
|
||||
)
|
||||
.timeout(const Duration(seconds: 15));
|
||||
print('>>>AUTHLOG POST $uri -> HTTP ${resp.statusCode} (${sw.elapsedMilliseconds}ms)');
|
||||
return resp;
|
||||
} on Exception catch (e) {
|
||||
print('>>>AUTHLOG POST $uri 失败 (${sw.elapsedMilliseconds}ms): ${e.runtimeType}: $e');
|
||||
throw AuthApiException(
|
||||
statusCode: -1,
|
||||
messageZh: '网络请求失败，请检查连接后重试',
|
||||
|
||||
@@ -12,6 +12,7 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
|
||||
import '../bridge/vpn_bridge.dart';
|
||||
import '../bridge/vpn_bridge_provider.dart';
|
||||
import '../l10n/app_text.dart';
|
||||
import '../services/api_config.dart';
|
||||
import '../services/connect_api.dart';
|
||||
import 'app_providers.dart';
|
||||
import 'auth_provider.dart';
|
||||
@@ -25,12 +26,7 @@ const _kDeviceId = String.fromEnvironment(
|
||||
defaultValue: 'mac-001',
|
||||
);
|
||||
|
||||
// ── API base URL ─────────────────────────────────────────────────
|
||||
|
||||
const _kApiUrl = String.fromEnvironment(
|
||||
'PANGOLIN_API_URL',
|
||||
defaultValue: 'http://localhost:8080',
|
||||
);
|
||||
// API base URL 统一用 api_config.dart 的 kApiBaseUrl(单一来源,勿再重复声明)。
|
||||
|
||||
// ── 连接阶段枚举 ──────────────────────────────────────────────────
|
||||
|
||||
@@ -103,7 +99,6 @@ class ConnectionController extends StateNotifier<ConnectionState> {
|
||||
Future<void> _connect() async {
|
||||
state = const ConnectionState(phase: VpnPhase.connecting);
|
||||
|
||||
final token = _ref.read(authProvider).accessToken ?? '';
|
||||
final node = _ref.read(effectiveNodeProvider);
|
||||
final zh = _ref.read(localeProvider) == AppLang.zh;
|
||||
|
||||
@@ -119,14 +114,7 @@ class ConnectionController extends StateNotifier<ConnectionState> {
|
||||
}
|
||||
|
||||
try {
|
||||
_api?.dispose();
|
||||
_api = ConnectApi(baseUrl: _kApiUrl, authToken: token);
|
||||
final configJson = await _api!.fetchConfig(
|
||||
nodeId: node.uuid,
|
||||
deviceId: _kDeviceId,
|
||||
// smartRoute 偏好 → 国内分流(#5):国内 IP/域名直连,不走隧道。
|
||||
splitCN: _ref.read(settingsProvider).smartRoute,
|
||||
);
|
||||
final configJson = await _fetchConfigWithRefresh(node.uuid);
|
||||
// bridge.start() 不阻塞至连接建立；on 状态由 statusStream 回调驱动。
|
||||
await _bridge.start(configJson);
|
||||
} on ConnectApiException catch (e) {
|
||||
@@ -142,6 +130,33 @@ class ConnectionController extends StateNotifier<ConnectionState> {
|
||||
}
|
||||
}
|
||||
|
||||
/// 取配置;access token 过期(401)时用 refresh token 续期后**重试一次**。
|
||||
/// 续期失败(refresh 也过期 / 被拒)由 authProvider.refresh() 触发登出 → UI 回登录页。
|
||||
Future<String> _fetchConfigWithRefresh(String nodeUuid) async {
|
||||
Future<String> doFetch() {
|
||||
final token = _ref.read(authProvider).accessToken ?? '';
|
||||
_api?.dispose();
|
||||
_api = ConnectApi(baseUrl: kApiBaseUrl, authToken: token);
|
||||
return _api!.fetchConfig(
|
||||
nodeId: nodeUuid,
|
||||
deviceId: _kDeviceId,
|
||||
// smartRoute 偏好 → 国内分流(#5):国内 IP/域名直连,不走隧道。
|
||||
splitCN: _ref.read(settingsProvider).smartRoute,
|
||||
);
|
||||
}
|
||||
|
||||
try {
|
||||
return await doFetch();
|
||||
} on ConnectApiException catch (e) {
|
||||
if (e.statusCode == 401) {
|
||||
// token 过期 → 续期后重试一次;续期成功则用新 token 再取。
|
||||
final ok = await _ref.read(authProvider.notifier).refresh();
|
||||
if (ok) return await doFetch();
|
||||
}
|
||||
rethrow;
|
||||
}
|
||||
}
|
||||
|
||||
Future<void> _disconnect() async {
|
||||
_stopElapsed();
|
||||
try {
|
||||
|
||||
@@ -8,17 +8,14 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
|
||||
|
||||
import '../l10n/app_text.dart';
|
||||
import '../pangolin_theme.dart';
|
||||
import '../services/api_config.dart';
|
||||
import '../services/auth_api.dart';
|
||||
import '../state/auth_provider.dart';
|
||||
import 'pangolin_button.dart';
|
||||
import 'pangolin_icons.dart';
|
||||
import 'pangolin_logo.dart';
|
||||
|
||||
// API base URL（由 --dart-define 注入）
|
||||
const _kApiUrl = String.fromEnvironment(
|
||||
'PANGOLIN_API_URL',
|
||||
defaultValue: 'http://localhost:8080',
|
||||
);
|
||||
// API base URL 统一用 api_config.dart 的 kApiBaseUrl(单一来源,勿再重复声明)。
|
||||
|
||||
const _easeOut = Cubic(0.22, 1, 0.36, 1);
|
||||
|
||||
@@ -55,7 +52,7 @@ class _AuthScreenState extends ConsumerState<AuthScreen>
|
||||
duration: const Duration(milliseconds: 620),
|
||||
);
|
||||
|
||||
late final AuthApi _api = AuthApi(baseUrl: _kApiUrl);
|
||||
late final AuthApi _api = AuthApi(baseUrl: kApiBaseUrl);
|
||||
|
||||
bool get _emailValid => RegExp(r'\S+@\S+\.\S+').hasMatch(_email.text);
|
||||
|
||||
|
||||
Reference in New Issue
Block a user