wangjia/pangolin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 22 Wiki Activity
198 Commits 7 Branches 47 Tags
7a4d0cf7cd329a0d847b033a7bc5e528bfb569dc
Commit Graph

198 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
wangjia 7a4d0cf7cd fix(diag): host 参数走 base64 避免 GFW 拦明文敏感词诊断请求 
控制面跑明文 HTTP 在国外 IP 上,白盒诊断请求 URL 里出现 google/youtube 等 GFW
敏感词时被墙重置(返回空)→ 出海段拿不到、报告显示「—」。改:host 用 base64url
传(host_b64),响应也回 b64、不回明文,明文里无敏感词(不影响真实加密隧道流量)。

- diag.go: EgressTiming 支持 ?host_b64=,解码后查白名单,响应 echo b64
- vpn_whitebox.py: node_egress 用 base64url 编码 host

验证:cara(墙内)google/youtube 出海段从 None → 8-9ms,与 github/cloudflare 一致。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 14:34:05 +08:00
wangjia a19406d041 feat(test): VPN 黑盒/白盒测试工具 + 索引页 + 链路时序图与阶段拆解 
- vpn_test.py(黑盒):站点矩阵连通/延迟(TLS 握手口径)/吞吐,落 tests/vpn/runs/
  并重建 index.html 索引(内嵌 meta、file:// 直开);索引含 cara→LA→Google 时序图
  + 步骤表
- vpn_whitebox.py(白盒):双 IP-echo 判国内是否被隧道 + 五段拆解;经控制面
  /v1/diag/egress 取出海段,自动算「接入段=整轮−出海段」,报告出「阶段拆解」表
  (对应时序图 橙=接入 / 绿=出海)
- tests/vpn/: runs 与生成的 index.html 为本地工件(.gitignore),README 说明用法
- docs/: vpn-testing-research.md(调研)+ vpn-test-plan.md(黑盒/白盒方案)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 14:12:46 +08:00
wangjia bc890974c0 fix(server): 补 #5 国内分流的 DNS 面 + 链路诊断端点(#12) 
#5 只分了数据面(geoip/geosite-cn 路由 direct),DNS 仍 final:remote 全量经隧道
解析 → 国内域名解析到非 CN IP、漏过 geoip-cn 又走隧道(白盒实测国内 TLS
1000-1660ms;修后 ~50ms)。

- clientconfig.go: 开分流时 dns.rules 加 {rule_set:[geosite-cn]→local},国内域名
  用 local(223.5.5.5)直连解析 → 拿到真 CN IP → geoip-cn 命中直连
- main.go: PANGOLIN_PUBLIC_URL 缺失时启动告警(空则分流静默跳过,是隐蔽坑)
- nodes.go: connect 渲染加可观测日志(split_cn/rules_base/split_active/bytes)
- diag.go: 新增只读端点 GET /v1/diag/egress?host=X,节点侧量出海段耗时(白名单
  防 SSRF、只回耗时数字),供白盒拆「接入段 vs 出海段」

验证:go test(splitCN 开渲染 dns.rules→local、关无 dns.rules)+ go vet;cara
实测国内 TLS 1000ms+→~50ms、接入段占 TLS 握手 ~98%。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 14:12:31 +08:00
wangjia 43b25c8aa0 feat: 国内流量直连分流(geoip-cn / geosite-cn)— #5
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
国内 IP/域名直连(不走隧道)→ 省流量 + 国内访问快;非国内走代理。

- clientconfig.go: BuildClientConfig 加 ClientConfigOpts{SplitCN,RulesBaseURL};
  开启时 route 加 {rule_set:[geoip-cn,geosite-cn]→direct} + 定义 rule_set
  (remote .srs,download_detour:direct 直连下载)
- rules.go: 控制面静态服务 /v1/rules/{name}.srs(白名单防穿越)——自托管避免
  GitHub 在国内被墙的鸡生蛋;客户端反正连控制面,可达性有保证
- nodes.go ConnectNode: 读 ?split_cn → opts;NodeAPI 加 rulesBaseURL
  (PANGOLIN_PUBLIC_URL);main.go 挂 /v1/rules 路由 + RulesHandler
- 客户端: connect_api splitCN→?split_cn=1;connection_provider 传 smartRoute 偏好
- deploy/single-node: 拉 geoip-cn/geosite-cn.srs 到 $DATA_DIR/rules +
  设 PANGOLIN_PUBLIC_URL/PANGOLIN_RULES_DIR

验证:go test(splitCN 开/关渲染 + RulesHandler 白名单/404)+ flutter analyze +
shellcheck;不需要节点。订阅链接暂用默认 opts、DNS 分流为后续增强。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 20:34:00 +08:00
wangjia cf2bd93c93 feat(server): agent 热重载 sing-box(SIGHUP)替代全量重启(#3) 
sing-box 支持 SIGHUP 热重载(cmd_run.go:进程内 check()验证→close 旧实例→
start 新实例;坏配置保留旧实例继续跑、不断网)。原 agent 用 systemctl restart
(全量重启:断所有连接 + 坏配置让 sing-box 起不来全断)。

- Restarter 接口加 Reload;SystemdRestarter.Reload 取 MainPID(systemctl show
  -p MainPID)发 SIGHUP——agent 与 sing-box 同 pangolin 用户,免 polkit/不改 unit;
  PID 取不到或发信号失败回退 Restart
- SingBox.started:首次/进程未起走 Restart(冷启动),之后配置变更走 Reload
- noopRestarter/fakeRestarter 补 Reload;加 TestWriteAndRestartFirstColdThenReload

价值:切节点/续期/加删用户不整进程重启、不全断流;坏配置不至于打死节点。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 19:36:46 +08:00
wangjia c1a52d4fc2 docs: 新节点重建 + 避风控 checklist 
固化首个 VPS 被支付风控暂停的教训(非流量检测,是新号+信用卡+地理画像+
未及时处理验证)+ 脚本化重建步骤(bootstrap→single-node→自编 v2ray_api
sing-box→ufw→enroll→客户端 dart-define)+ 重建后备份 DB + 接 P1 实测。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 19:24:59 +08:00
wangjia 2a4d6c9648 build(client/macos): Runner 开启 Hardened Runtime(公证前置)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
PacketTunnel 已有 ENABLE_HARDENED_RUNTIME;给 Runner 的 Debug/Release 也补上。
Developer ID 分发 + 公证要求 Hardened Runtime。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 16:04:53 +08:00
wangjia fb1ef9ba01 feat(client/macos): OSSystemExtensionRequest 激活 sysext
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
VpnChannel.activateSystemExtensionIfNeeded 实装:start 前请求系统加载/更新
PacketTunnel sysext;首启弹「隐私与安全性」待用户允许(await 阻塞到批准,
扩展没加载隧道起不来)。SysExtActivationDelegate 处理 finish/fail/replace。

至此 macOS 原生 VPN 栈构建完整:Runner 嵌入 sysext 到
Contents/Library/SystemExtensions,编译全过。运行待:sysext 签名放行 +
systemextensionsctl developer on(或 Developer ID 公证)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 15:54:14 +08:00
wangjia f2a4290602 feat(client/macos): PacketTunnel 转 System Extension(构建通过)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
macOS 站外加载隧道必须 sysext(appex 仅 App Store 可加载)。转换:
- productType app-extension→system-extension;产物 .appex→.systemextension
- 嵌入路径 PlugIns→Contents/Library/SystemExtensions(SYSTEM_EXTENSIONS_FOLDER_PATH)
- main.swift 入口(NEProvider.startSystemExtensionMode + dispatchMain;sysext 是
  可执行程序,需显式 main 而非 appex 的 NSExtensionMain)
- Info.plist 加 NEMachServiceName;entitlement 换回 packet-tunnel-provider-systemextension

CFBundlePackageType 自动 SYSX,Build Succeeded(关签名)。运行还需 Developer ID
签名 + systemextensionsctl developer on + OSSystemExtensionRequest 激活。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 15:51:29 +08:00
wangjia 6a9a7c424e feat(client/macos): 主 app VPN 接线编译通过 — VpnChannel 入 Runner target
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- VpnChannel.swift 加入 Runner target(Compile Sources)
- Logger→NSLog(Runner 部署目标 10.15,os.Logger 需 11)+ 去掉未用的
  SystemExtensions import
- 至此原生 VPN 控制链路全编译通过:主 app(NETunnelProviderManager 启停/
  状态)+ 扩展(libbox)。kUseNativeVpnMacOS 仍 false(待隧道能跑切换)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 15:43:42 +08:00
wangjia c8df031741 feat(client/macos): 解开 VpnChannel 注册(主 app 接 NETunnelProviderManager)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
MainFlutterWindow 启用 VpnChannel.register —— Flutter 经 pangolin/vpn 通道
启停 PacketTunnel(NETunnelProviderManager)。需 VpnChannel.swift 已入 Runner
target 的 Compile Sources。kUseNativeVpnMacOS 仍为 false(待隧道能跑再切)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 15:36:38 +08:00
wangjia 665d4a949d build(client/macos): PacketTunnel appex target + libbox/系统框架链接
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
Xcode 工程持久化:
- 新增 PacketTunnel App Extension target(嵌入 Runner,Packet Tunnel provider)
- 链接 Libbox.xcframework(Embed & Sign)+ SystemConfiguration/AppKit/
  libresolv(Do Not Embed,libbox 内部系统代理/网络监控/DNS 依赖)
- NetworkExtension 改 Do Not Embed(系统框架不可嵌入重签)

至此 P1 隧道扩展编译+链接+签名全通(Build Succeeded)。Libbox.xcframework
本体不入 git(gitignore),按 scripts/build-libbox.sh 重编。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 15:33:15 +08:00
wangjia b621d1754a feat(client/macos): PacketTunnelProvider libbox 集成(编译+链接通过)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
CommandServer 装配(LibboxSetup→NewCommandServer→start→startOrReloadService)+
完整 LibboxPlatformInterface:openTun(TunOptions→NEPacketTunnelNetworkSettings,
getpeername+utun ctl_id 取 fd)、默认接口监控(NWPathMonitor)、接口枚举、socket
绑定;LibboxCommandServerHandler 回调。

gomobile 桥接要点:实现接口用 XxxProtocol、接口型参数/返回用 (any XxxProtocol)、
三个方法被 Swift 重命名(autoDetectControl/send/usePlatformAutoDetectControl)、
CTLIOCGINFO 按 _IOWR 定义计算。

链接需补系统框架:SystemConfiguration + AppKit + libresolv(libbox 内部
系统代理/网络监控代码引用)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 15:20:50 +08:00
wangjia 8367984e23 fix(client/macos): PacketTunnelProvider 改用 completion-handler 绕开 Swift 6.2 编译器崩溃
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
Swift 6.2.3 在为 async 重写的 startTunnel 生成 ObjC 桥接 thunk 时崩溃
(emitInjectLoadableEnum)。改用 completion-handler 形式(直接是 @objc 原型)
绕开。startTunnel/stopTunnel/handleAppMessage 三个 override 同步改。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 14:30:11 +08:00
wangjia 7e92a9a711 fix(client/macos): PacketTunnel 开发期用 appex NE 变体 packet-tunnel-provider
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
Xcode 把 target 建成 App Extension(.appex);sysext 变体 -systemextension 在
Apple Development 自动签名下签不了。开发期改用 appex 变体能编/签/本机调试;
上线转 System Extension + Developer ID 时再换回 -systemextension(注释已记)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 14:20:21 +08:00
wangjia 07272f5610 fix(client/macos): P1 骨架修正 — bundle id 统一 PacketTunnel + Info.plist 精简
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- VpnChannel/Provider: 扩展 bundle id 统一为 com.pangolin.pangolin.PacketTunnel
  (对齐 Xcode 新建 target 的实际 id)
- PacketTunnel/Info.plist: 去掉重复 CFBundlePackageType + 多余 NEMachServiceName,
  只保留 NEProviderClasses(其余标准键由 GENERATE_INFOPLIST_FILE 合并)
- .gitignore: 忽略 Frameworks/Libbox.xcframework(204MB,build-libbox.sh 产出)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 13:50:51 +08:00
wangjia da8f3a4fef feat(server): Hy2 自签 TLS 证书(方案①)— 补全 hysteria2 入站可用 
Hy2 跑在 QUIC 上、强制 TLS,需服务端证书(不像 REALITY 借大站证书)。此前
handler_grpc 只发 ListenPort、cert 路径为空 → hysteria2 入站起不来。改为节点自签:

- agentd/hy2cert.go: ensureSelfSignedCert 生成 ECDSA P-256 自签证书到
  /etc/sing-box/hy2.{crt,key}(幂等,缺失才生成;key 0600;SAN=reality SNI)
- singbox.go: writeAndRestart 渲染前对启用 hy2 的节点 ensure 证书并把
  CertPath/KeyPath 写回 hy2 配置
- httpapi/clientconfig.go: hy2 出站 TLS 加 insecure:true + server_name,收自签
  (两端自有,服务端鉴权靠 per-user 派生的 hy2 密码)

验证:单元测试(证书可被 crypto/tls 加载/幂等/0600)+ sing-box check 接受自签 hy2 入站。
注:节点实际启用 hy2 还需配 Hy2Port + 放行 UDP(单独步骤)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 12:12:35 +08:00
wangjia b25c8bbc2c feat(client/macos): P1 方案B 骨架 — System Extension + NETunnelProviderManager 接线
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
把 PoC 的 sudo sing-box 外部二进制换成自包含、免 root 的 NEPacketTunnelProvider
(System Extension)+ 嵌入 libbox 的生产架构铺好骨架(不破坏现有 PoC 构建)。

- PacketTunnel/:扩展 target 源 — PacketTunnelProvider(LibboxSetup→NewService→start,
  openTun 建 NEPacketTunnelNetworkSettings)、Info.plist(NEProviderClasses)、
  entitlements(packet-tunnel-provider-systemextension + App Group)
- Runner/VpnChannel.swift:主 app 经 NETunnelProviderManager 启停 + 状态/速率回传,
  对齐 Dart 侧 VpnNativeBridge 的 pangolin/vpn channel 契约
- vpn_bridge_provider.dart:kUseNativeVpnMacOS 开关(默认 false,联调通过后置 true)
- docs/p1-macos-system-extension.md:文件清单 + Xcode/签名步骤 + 待办
  (Team BYL4KQHMTN;Network Extensions 已确认自助开通、无需 Apple 审批)

非破坏:新源文件未入 build target、注册行/app-group entitlements 均注释、gate 默认 false。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 11:07:36 +08:00
wangjia 64a1a64c3f feat(server): 按用户精确统计流量 — agent 改读 v2ray_api StatsService 
节点 sing-box 编入 with_v2ray_api 后,每个 dp_uuid 有独立计数器
user>>>{dp_uuid}>>>traffic>>>uplink|downlink。agent 用 QueryStats(reset=true)
取窗口 delta,按用户精确上报(替代旧 clash 节点总量分摊:单用户准、多用户近似)。

- render.go: experimental.v2ray_api(loopback :19091)+ stats.users 列全部 dp_uuid
- v2rayapi/: vendor sing-box stats.pb.go(消息)+ 手写 client(用 v2ray 规范
  ServiceName 路径,绕开生成代码的 experimental.v2rayapi.* 误名)
- usage_v2ray.go: V2RayUsageSource,uplink/downlink 天然用户视角(无需 swap)
- agent.UseV2RayUsage() 取代 UseClashUsage();clash_api 保留作本地调试

节点需部署带 with_v2ray_api 的 sing-box(已编好 linux/amd64 二进制)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 10:18:33 +08:00
wangjia 236e33aef9 feat(scripts): P0 完成 — libbox 嵌入式核心构建脚本(方案B) 
scripts/build-libbox.sh:用 sagernet/gomobile fork v0.1.12 + sing-box v1.13.13
+ 官方 build_libbox,一键编出 Libbox.xcframework(Apple)/ Libbox.aar(Android)。
已本地跑通 macOS:双架构(arm64+x86_64)xcframework,Headers 暴露 LibboxNewService /
LibboxCommandClient(状态·速率)等 API。产物不入 git(~204MB),按需重编。
docs/vpn-core-embedding.md 标记 P0 完成。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 10:07:02 +08:00
wangjia 28dd28c285 docs: 嵌入 libbox + 系统 VPN API 替换 sudo sing-box 完整设计(方案B) 
调研 sing-box 官方客户端架构(libbox via gomobile + NE/VpnService),产出上线标准
的核心引擎嵌入设计:各平台机制、libbox 构建流水线、Flutter 集成改造、签名/权限/
公证门槛、分阶段迁移、风险。关键结论:中国 VPN 走 App Store 外分发 → macOS 必须用
System Extension(非 App Extension)+ Developer ID + 公证 + 申请 Apple NE 权限。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 09:53:39 +08:00
wangjia 3f62d54d23 fix(client): 关窗口缩托盘不退出 + 单实例(一机一进程)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- 关窗口托盘也消失:根因是 AppDelegate.applicationShouldTerminateAfterLast
  WindowClosed 返回 true → 关窗口即终止 app。改 false:关窗口只隐藏到托盘
  (配合 window_manager preventClose+hide),app 留在托盘。
- 单实例:main 启动先 ensureSingleInstance()——loopback 47654 端口锁;已有实例
  时连过去唤起其窗口显示,本进程 exit(0)。保证一机仅一个 pangolin 进程,
  重复启动只会前置已有实例。

flutter analyze 0 error;测试通过。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 09:34:12 +08:00
wangjia 31443d0fe7 fix(client): 退出 Pangolin 时拆隧道(停内核),不再残留 sing-box/TUN
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
此前真退出(托盘退出 / Cmd+Q)走 windowManager.destroy(),从不先停内核,
而 sing-box 是 sudo root 子进程不随父进程退出 → 孤儿 + TUN 残留,得手动 pkill。

- system_tray:托盘「退出」前 await onBeforeQuit()(停内核)再 destroy。
- main:PangolinApp→ConsumerStatefulWidget,AppLifecycleListener.onExitRequested
  在 Cmd+Q 时先停内核再退;_teardownVpn 调 vpnBridge.stop()(SIGTERM→sing-box,
  拆 TUN),带 3s 超时兜底。
- 关窗口→隐藏托盘的路径不拆(保持连接,符合常驻语义)。

flutter analyze 0 error;116 tests passed。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 09:21:22 +08:00
wangjia 7827660a36 fix(client): 登录页 tab 滑块塌陷 + 滚动弹性(design-distill 校准)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- 胶囊 tab 活动滑块高度塌成 0(FractionallySizedBox 缺 heightFactor)→ 活动态
  不可见、和背景糊一起。补 heightFactor:1.0,滑块正常填满。
- 列表无弹性回弹:SingleChildScrollView 改 ClampingScrollPhysics,大窗口放得下
  就不滚(无上下拖动/滚动条),仅窗口过矮才滚。
- 加 auth_redesign golden(900x700 明/暗),按 design-distill 截图 diff 校准:
  与原型 design/preview/auth_redesign.html 对比,结构/位置/尺寸零偏移
  (残余差异为 headless 测试缺 CJK 字体的豆腐块,真 app 字体正常)。

flutter analyze 0 error;测试通过。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 08:25:56 +08:00
wangjia 9de3a6c743 feat(client): 登录/注册页重设计(居中卡片 + 暖光晕)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- auth_screen.dart 整体重排:暖色径向光晕背景 + 居中卡片;hero 用 clay 渐变
  app-icon(带光晕)+ 品牌 + 标语;胶囊分段 tab(滑块)替下划线;输入框聚焦态
  (accent 边 + ring 光环);主按钮微光;进入错落淡入动效。全部走 token。
- 注册第二步:已验证邮箱胶囊 + 「改邮箱」返回 + 设密码;验证码框无占位点。
- 逻辑零回归:登录/注册两段式、发码、邮箱预填、密码显隐、错误提示全保留。
- design/preview/auth_redesign.html:HTML 视觉原型(评审用,不进构建)。

flutter analyze 0 error;114 tests passed(auth 不在 golden 集,无 golden 变化)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 08:10:33 +08:00
wangjia dfc2df90c7 fix(client): 连接后延迟未探测时回退节点 TCP 探针(尽量不显示 —)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
连上后 urltest 头几分钟还没探过会显示 —;现回退用节点页的 TCP 探针 ping
(连接前测得、~真实 RTT),urltest 出值后再切换。stats 页已有同款回退。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 07:33:08 +08:00
wangjia 03e268edc5 fix: /v1/usage 401(统计页全0真因) + 连接页速度改动态字节单位
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- /v1/usage 一直 401:usage 包自定义了 ctxKey("user_id") 读 user id,但
  auth.RequireAuth 把 user id 存在 codes.CtxKeyUserID 下;Go context key 按
  「类型+值」比较,命名类型不同 → 取到 nil → 401 → 统计页本月流量/时长恒 0
  (而 /v1/me weekly 走 account.go 直查,有数,故只半边为 0)。改 usage 读
  codes.CtxKeyUserID(与 auth.UserIDFromContext 同键,/v1/me 已验证可用)。
  同时修好 /v1/ads/unlock(同一函数)。
- 连接页速度:Mb/s(兆比特,小流量显示 0.0)→ 动态字节单位 B/s·KB/s·MB/s·GB/s,
  小数据也看得清。

go build/test 通过;flutter analyze 0 error;114 tests passed。server 已部署。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 07:17:58 +08:00
wangjia e10f214dee feat(client): 系统托盘常驻 + 关闭窗口隐藏到托盘(桌面端)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- system_tray.dart:TrayService 用 tray_manager + window_manager。setPreventClose
  拦截关闭 → 隐藏到托盘(常驻保持隧道);托盘图标点击/「显示主界面」重新显示,
  「退出」真正退出。
- main() 改 async:桌面端 runApp 前 init 托盘;移动端/web 跳过(isDesktop 守卫)。
- 托盘图标复用 app_icon_32.png → assets/tray_icon.png。
- 新依赖:tray_manager / window_manager。

flutter analyze 0 error;114 tests passed。托盘为运行时/原生功能,需 release .app 验证。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 06:31:40 +08:00
wangjia aee9ba7b72 feat(client): 登录体验 — 记住邮箱 + 密码显隐 + 7天免登陆
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
1. 记住邮箱:登录页预填上次邮箱(TokenStore.saveLastEmail,登录/注册成功时存,
   退出登录不清除)。
2. 密码显隐:登录/注册密码框加眼睛按钮切换明文(PangolinIcons.eye/eyeOff)。
3. 7天免登陆:RootFlow 改为响应 authProvider——启动时有有效会话直接进主界面;
   AuthNotifier.refresh() 在服务端拒绝(refresh 过期/超 7 天)时 logout 回登录页,
   网络错误则保留会话。会话恢复期间显示极简启动屏。

flutter analyze 0 error;114 tests passed。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 06:28:49 +08:00
wangjia a6b35268ab feat(agent): #7 真实流量采集 — clash_api 节点总量 → usage_daily 
sing-box 该构建未编入 v2ray_api、clash /connections 也不暴露用户,故无法做
准确 per-user 计费。改取节点累计总量(clash downloadTotal/uploadTotal)做
窗口增量,按当前 dp_uuid 均摊上报(单用户=准确,多用户近似,已注释标注)。

- render.go:节点 sing-box 配置加 experimental.clash_api(loopback+secret)。
- ClashUsageSource:轮询 /connections 总量,delta + 重启回绕保护;clash 的
  up/down 是代理视角,对调为用户视角(下载→bytes_down)。
- SingBox.DpUUIDs() 供归属;Agent.UseClashUsage() 在 cmd/agent 接上。

已节点 live 验证:usage_daily 实时入库,下载增量正确落 bytes_down。
局限:多 dp_uuid 时均摊(准确计费需重编 sing-box 带 with_v2ray_api)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 06:01:24 +08:00
wangjia f35bbea0a0 fix(client): 连接后延迟用内核 urltest 实测 + 侧栏套餐到期日接真
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- 延迟:TCP 探针在隧道开启时会被路由进隧道而测不到(显示 —)。改为连接后
  (phase==on)取内核 statsStream 的 urltest delayMs 最小正值(代理真实 RTT),
  未连接时仍用节点 TCP 探针。连接页 _SpeedRow/_NodePill/_CurrentNodeCard
  与统计页平均延迟统一此口径。
- plan_badge_card(侧栏)接 me.expiresAt 显示真实到期日(原只显示「有效期至」
  无日期);account_page 之外漏改的最后一处。

flutter analyze 0 error;114 tests passed。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 00:44:46 +08:00
wangjia 93ec421c41 fix(plans): /v1/plans 500 修复 — plans 表无 name_zh/name_en 列
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
ListPlans 历来 SELECT name_zh/name_en,但 plans 表从未有这两列(各迁移/seed
均无)→ 该端点一直 500(无 live 测试故未暴露)。改为不查名称列(套餐名是 UI
文案,客户端 PlansScreen 按 code 取 l10n:free/pro/team)。价格等真实字段保留。

已在节点实测:/v1/plans 200,返回 free ¥0 / pro ¥25 / team ¥99。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 00:32:40 +08:00
wangjia 6ee7114ff8 feat(client): P6 设置项落地真实行为(#6 6F,本地部分)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- settings_provider:三开关 shared_preferences 持久化 + 副作用落地:
  killSwitch→VpnBridge.setKillSwitch(on:);autostart→桌面原生登录项
  (launch_at_startup);smartRoute 持久化为偏好(连接时作 split_cn,见 #5)。
- settings_page → ConsumerWidget,开关接 settingsProvider;协议标签
  WireGuard→REALITY/Hysteria2;版本号取 pubspec(package_info_plus)。
- 新依赖:shared_preferences / package_info_plus / launch_at_startup。

flutter analyze 0 error;114 tests passed;settings golden 重生成。
待办:#5 智能分流的 server 端 geoip-cn 下发 + autostart 真机验证(需 release .app)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 00:13:41 +08:00
wangjia ce5155d4ca feat(client): P5 连接页实时速度 + 连接错误冒泡 UI(#6 6E,并入 #4)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- vpnStatsProvider:暴露内核 statsStream(上/下行瞬时速率);连接页速度行
  下/上行改用实时数据(B/s→Mb/s),不再硬编码 86.4/12.1;延迟用实测节点 ping。
- ConnectionState 加 error 字段;_connect 失败不再静默回 off,而是按语言
  冒泡 ConnectApiException 文案;节点未就绪(无 uuid)给出提示并删除旧 1.2s
  mock 连接路径。
- 连接页 caption 下/桌面 pill 上方显示错误文案(红)。
- 重写 connection_controller_test 适配(无网络:未就绪→off+error)。

flutter analyze 0 error;114 tests passed。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 00:09:31 +08:00
wangjia f20eddad55 feat(client): P4 节点实测延迟/设备/套餐价/兑换/统计接真(#6 6D)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- latency_probe.dart:并行 TCP 握手实测各节点 per-client RTT(服务端无法代知)。
- nodes_provider:解析 /v1/nodes 的 host/port,后台测延迟回填 Node.ping;智能选择
  按实测最小;去掉 8 个伪造演示节点(空列表用中性占位,不再伪造服务器)。
- Node:+host/port/copyWith/pingLabel(未测显示 —);各端 ping 显示改 pingLabel。
- account_screens:PlansScreen 接 /v1/plans(价格 priceLabel + me 标当前档);
  DevicesScreen 接 /v1/me/devices + 移除 DELETE + last_seen;RedeemScreen 接
  /v1/redeem(成功刷新 me,失败显示后端文案)。
- stats_page:周柱接 me.weekly_gb,本月流量/时长接 usage(30),延迟用生效节点实测。
- 顺带补登记早前 log_time.dart 的删除(log.dart 重构遗漏 stage)。

flutter analyze 0 error;115 tests passed;受影响 4 golden 重生成。
本机设备高亮 + 真实 device id 随 P6(device_info_plus)落地。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 00:04:25 +08:00
wangjia bb39b36d84 feat(client): P3 账号/套餐视角/配额接真(#6 6C)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- account_providers:新增 meProvider(GET /v1/me,登录态变化自动重取)、
  plansProvider、usageProvider(family by days)。
- isFreePlanProvider 改为派生自 meProvider.plan(去掉可写演示开关)。
- quotaProvider:总额取 plans free.daily_minutes,今日剩余取 me.quota_today_min
  (后端已算好);adUnlocked 保留本地态(ad SDK 未接)。
- account_page:邮箱/套餐/到期接 me;删「演示:免费版视角」开关 + kDemoEmail;
  协议标签 WireGuard→REALITY/Hysteria2。
- 重写 quota_controller_test 为 provider 驱动;account/quota golden 重生成。

flutter analyze 0 error;113 tests passed。统计页(weekly/月流量/延迟)随 P4
一并接(其均延迟依赖 P4 实测探针)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 23:51:28 +08:00
wangjia 3d87bffbe9 feat(server): P2 后端补字段 — 套餐价格 + 节点 host(#6 6B) 
- 迁移 000014_plan_pricing(mysql+sqlite 双套):plans 加 price_cents/currency/
  period,seed pro=2500 team=9900(¥25/¥99);ListPlans 返回价格字段。
- /v1/nodes 暴露 host+port(取自 node.Endpoint,无 schema 变更),供客户端实测
  真实 per-client 延迟(服务端无法代知)。
- 修复 account.go 的 GetMe/weeklyGB 残留 MySQL 专属 UTC_DATE()/INTERVAL
  (#1 漏网):改 Go 端算日期传 ?,否则 SQLite 节点今日/周流量恒 0。
- sqlite 迁移 up/down 测试期望版本 13→14。

go build/vet 干净;sqlite 迁移 up/down + httpapi 测试通过。节点 tag 暂不加
(无真实数据,不造空字段;客户端将不显示伪造 tag)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 23:42:23 +08:00
wangjia ba53a0d478 feat(client): P1 真实数据接入地基(#6 6A)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- api_config.dart:API 基址单源(消除各处重复 _kApiUrl)
- api_client.dart:统一鉴权 HTTP 客户端,401→AuthNotifier.refresh→重试一次,
  错误统一 AuthApiException;+ 单测覆盖 401 刷新重试
- 模型 me/device/plan/usage_point(对齐后端 snake_case 契约)
- account_api.dart:/v1/me、/v1/plans、/v1/me/devices(列表+删)、/v1/usage、
  /v1/redeem、/v1/ads/unlock 封装
- auth_provider:注入 AuthApi + refresh();account_providers 装配 ApiClient/AccountApi
- 顺带修复 onboarding 提交遗留的测试 stub(_NullTokenStore 缺 isOnboarded/markOnboarded)

flutter analyze 0 error;114 tests passed。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 23:32:57 +08:00
wangjia 51a5170b9e feat(scripts): 新增 speedtest.sh 隧道测速/质量验证工具 
连上 pangolin 后一键测:出口IP确认 / 客户端→节点真实路径(绑en0绕隧道,
RTT+丢包) / 经隧道TTFB / Cloudflare 下行+上行带宽;--node 可 ssh 节点测
其自身出口带宽做理论上限对照。零依赖(curl+ping)。

实测节点(RackNerd 512MB/1核,LA):下行~22-24 / 上行~25 Mbps,RTT 298ms,
0% 丢包(晚高峰偶发瞬时丢包)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 22:48:44 +08:00
wangjia b9e5dbec9b refactor(client): 抽统一日志函数 logLine + 去掉重复时间戳
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- log_time.dart → log.dart:提供 logLine(tag, msg),格式 `[时:分:秒.毫秒] [tag] msg`,
  DesktopKernel / DesktopVpnBridge 散落的 print+拼接全部收敛到此。
- 下发配置 log.timestamp=false:sing-box 不再自带时间戳,避免一行打印两个时间
  (之前 `[22:10:35.213] [stderr] +0800 2026-06-18 22:10:35 ...` 重复)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 22:17:09 +08:00
wangjia 3a20a40101 fix(client-config): Hy2 未启用时不下发 hy2-out(消除 urltest 死成员探测) 
hy2_port 为空(当前默认,Hy2 证书未接)时,旧逻辑仍把 hy2-out 默认指向
REALITY 的 TCP 443 端口塞进 urltest 探测组,导致客户端持续探测一个无 Hy2
监听的死成员 → "connection reset by peer"。改为 hy2Enabled 才下发 hy2-out
并加入探测组;否则 outbounds/urltest 只含 reality-out。已校验下发配置。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 22:11:00 +08:00
wangjia df75d3a135 feat(client): 桌面端日志加本地时间戳前缀 [HH:MM:SS.mmm]
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
新增 log_time.dart(共享 logTime() helper),DesktopKernel / DesktopVpnBridge
所有日志行首打 [时:分:秒.毫秒],便于排查连接时序。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 21:56:38 +08:00
wangjia 52edb377e4 fix(client-config): 去掉 local DNS 的 detour:direct(sing-box 1.12 运行时 FATAL) 
sing-box 1.12 start-service 阶段拒绝 DNS server detour 到空 direct 出站
(FATAL: detour to an empty direct outbound makes no sense)。local DNS 去掉
detour 后走默认路由,功能不变。已在节点用 `sing-box run`(空 inbound 复现
start-service)实测启动无 FATAL —— sing-box check 抓不到这类运行时错。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 21:51:10 +08:00
wangjia bdf67cb56e fix(client-config): 加 route.default_domain_resolver(sing-box 1.12+ 必需) 
sing-box 1.13 对缺失 default_domain_resolver 直接 FATAL。加 {"server":"local"}
后,节点下发的整份客户端配置经 `sing-box check` 验证通过(无 FATAL/废弃)。
顺带 local_test.sh:免密已生效则跳过(不再反复要密码)+ --no-build 快速重跑。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 21:35:50 +08:00
wangjia df72ad60f4 fix: DNS 用 sing-box 1.12+ 新格式 + 引导仅首次显示
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- clientconfig/mockserver:客户端配置 DNS 从 legacy address 串格式改为
  type+server 新格式(sing-box 1.13 对 legacy DNS 直接 FATAL,导致连不上)
- 引导页只首次:TokenStore 加 markOnboarded/isOnboarded;main.dart 登录后
  若已引导过直接进主界面,不再每次都弹引导

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 21:20:11 +08:00
wangjia 25c7bd75aa feat(client+scripts): release 本地真测 — local_test.sh + 内核查找加 /opt/homebrew
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- scripts/local_test.sh:一键构建 release macOS 包 + 配 sing-box 免密 sudoers
  (TUN 需 root)+ 前台运行真身(日志直出),让本地测试 = release 线上行为
- kernel_process 二进制查找兜底加 /opt/homebrew/bin/sing-box(Apple Silicon
  brew),release 包从 Finder/直接启动也能找到内核,免设 PANGOLIN_SINGBOX_BIN

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 21:09:08 +08:00
wangjia 81e7b12061 feat(auth): 防账号枚举 — 已注册邮箱发"已注册"提醒,不内联暴露 
发码/注册都不再泄露"邮箱是否已注册"(对翻墙工具尤其敏感:已注册=该人是用户)。
- SendCode:邮箱已注册时不发验证码、改发"您已注册请直接登录"邮件,接口统一
  返回 204(注册/未注册无差别)→ 关掉发码侧枚举
- Register:命中已注册(ErrEmailTaken)改回通用 ErrCodeInvalid(与错码一致),
  不再返回"该邮箱已注册"→ 关掉注册侧枚举
- Mailer 接口加 SendAlreadyRegistered(SMTP + Log 两实现)
- 测试:DuplicateEmailConflict 改为断言"已注册不发码 + 强制码也只回通用错误";
  integration 同步

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 20:37:53 +08:00
wangjia d341c1c6e5 fix(client/auth): 验证码字段去掉点状占位(hintText 改空)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
'······' 占位被误以为是已填/遮蔽;验证码本就明文输入,清空占位更清晰。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 09:23:12 +08:00
wangjia 748a3b8a45 chore(client/macos): bundle id 改为 com.pangolin.pangolin
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
去掉 Vpn 后缀:macOS 主 app + RunnerTests + Debug/Release entitlements 的
keychain-access-groups 统一为 com.pangolin.pangolin(便于 Apple 签名注册)。
iOS/Android 暂未改(iOS 涉 App Group + PacketTunnel 扩展,需统一时单独处理)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 08:57:35 +08:00
wangjia a879494fe1 feat(monitor): 1 分钟采集 + 连续 N 次异常才告警(去抖)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
避免瞬时尖峰/部署窗口误报(此前 sing-box 部署期 activating 触发了一次误报)。
- 采集间隔 5min → 1min(MONITOR_INTERVAL_MIN=1)
- 新增 MONITOR_BREACH_RUNS=5:连续 5 次采样都异常才告警一次(状态存
  /var/lib/pangolin-monitor/breach_count);恢复后发一条恢复通知并清零
- 去掉 MONITOR_SEND_OK_PULSE(被去抖逻辑取代)
- 已在 racknerd 验证:连 4 次异常不报、恢复清零

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 08:05:09 +08:00