wangjia/pangolin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 22 Wiki Activity
238 Commits 7 Branches 47 Tags
e4db3beba66e694d09526b5ea7fcbe323ca0372a
Commit Graph

238 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
wangjia e4db3beba6 Merge branch 'main' into feature/pangolin-ios
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
# Conflicts:
#	client/lib/bridge/vpn_bridge_provider.dart
#	docs/index.html
 2026-06-23 10:05:20 +08:00
wangjia e25649cd27 feat(client/ios): iPad tablet 正式适配——断点≥900 对齐设计源 + tablet golden 回归闸 
- form_factor 触屏 tablet 阈值 600→900,对齐 design/ui_kits/tablet(1180×820 横屏
  侧栏):iPad 横屏/12.9″竖屏走侧栏,标准/11″竖屏回落 mobile 底 Tab,避免双栏挤压
- form_factor_test 补全断点边界(900/899)与各 iPad 尺寸用例
- 新增 tablet_pages_golden_test:四视图×明暗×中英 12 张 golden,注入演示数据
  (6 节点/周流量/30 天用量)让 2 列网格与周柱满渲染,作回归闸
- design/CONTRACT.md:tablet 像素契约(取自 tabapp.jsx)+ 逐屏验收清单
- 真机 iPad mini 6 视觉签核通过;141 测试全绿

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-23 10:00:14 +08:00
wangjia 11ee3342bf feat(client/ios): 补齐 App 图标(iPhone+iPad 全尺寸,去 alpha) 
iOS AppIcon.appiconset 只有 Contents.json、无任何 PNG → 桌面图标空白。
以 design 单源 assets/app-icon.svg(去圆角 rx=0 全幅方形)经 qlmanage 渲染 1024,
flutter_launcher_icons 铺开 21 张全尺寸(含 iPad 76/83.5)并去 alpha(App Store 合规)。
新增 dev_dep flutter_launcher_icons + 配置块,改图标重渲源图后 dart run 即可。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-23 00:39:37 +08:00
wangjia bd984feff9 fix(client/ios): iOS 接通原生隧道——切真桥 + save-before-start + DNS matchDomains 
根因:iOS 端 vpn_bridge_provider 把 iOS 归入'其他平台 → VpnBridgeMock',
整个 App 用假桥,伪造已连接状态与写死的 URLTest 延迟(18/32/54ms),从不调用
B1/C1 打通的原生 NEPacketTunnelProvider。表现为 UI 显示已连接但流量全直连
(apple 通/google 被墙、RTT 20ms),设备日志无任何隧道/sing-box/节点痕迹。

三处修复:
1. vpn_bridge_provider.dart: iOS → VpnNativeBridge(真原生 MethodChannel)。
2. VpnManager.start(): 先 saveToPreferences+重载(首启触发系统授权、持久化配置)
   再 startVPNTunnel,否则对未持久化 manager 调用抛 NEVPNError。对齐 macOS。
3. PacketTunnelProvider.openTun: DNS 补 matchDomains=[""],强制所有 DNS 走隧道,
   iOS 不设会把隧道 DNS 当补充解析器、查询仍走系统直连 DNS 致污染打不开站点。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-23 00:28:53 +08:00
wangjia 9b365c7e1c fix(client/ios): PacketTunnel 引入 Generated.xcconfig 注入版本号 
扩展 Info.plist 的 CFBundleVersion=$(FLUTTER_BUILD_NUMBER) 因 target 未引
Flutter 的 Generated.xcconfig 而展开为空串,iOS 装机校验 MissingBundleVersion
(code 33) 拒绝安装。给 PacketTunnel 三个 build config 加 baseConfiguration
Reference 指向 Generated.xcconfig(纯 Flutter 变量,无 Pods,不破坏 OTHER_LDFLAGS=""),
使扩展版本号 = 主 App = 1.0.0(1),满足 App Extension 版本须与 host app 一致的上架要求。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 23:59:05 +08:00
wangjia d4d211124c Merge: Android 官方穿山甲启动图标(自适应)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 23:42:57 +08:00
wangjia f3f91cc0ff feat(android): 启动图标改用官方穿山甲(自适应图标) 
前景 path 取自官方 client/assets/logo-mark-white.svg(原样,非重绘),仅加 Android 安全区居中;

背景为 app-icon.svg 的橙色渐变(#C8794A→#9E5630);删除占位三角 drawable/ic_launcher.xml。

Vivo X200/华为 DCO-AL00 真机验证图标显示正常。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 23:42:18 +08:00
wangjia 76d8e57a44 build(client/ios): B1 完成——PacketTunnel 链接 libbox+系统框架,iOS 构建打通 
- PacketTunnel 链 Libbox.xcframework(静态,只Link不Embed)+ NetworkExtension
  + SystemConfiguration + libresolv.tbd + UIKit(libbox iOS 引用 UIApplication);
  OTHER_LDFLAGS="" 切 CocoaPods 继承,FRAMEWORK_SEARCH_PATHS 指 Frameworks/
- 桥接头手动声明 sockaddr_ctl/ctl_info(iOS SDK 无 kern_control.h,稳定内核 ABI)
- 部署目标 iOS 12→14(os.Logger 需 14;低版老机不再兼容,用户拍板)
- 修预存脚手架坑: Podfile 删悬空 RunnerTests; Info.plist 移出 Resources(双产出);
  Runner 构建阶段重排(Embed App Extensions 前置, Thin Binary 殿后) 解依赖环
- 验证: flutter build ios 通过, C1 Provider 编译通过, otool -L 扩展零外部 @rpath

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 22:20:49 +08:00
wangjia 381a621d77 feat(client/ios): Provider 对齐 macOS libbox 集成(CommandServer+utun fd)+ 内存监控 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-22 20:58:03 +08:00
wangjia 33a3508489 build(client/ios): 引入 iOS libbox 框架 + gitignore 排除产物 2026-06-22 20:52:28 +08:00
wangjia 99695e8861 test(client): 锁定 form_factor 断点(iPad→tablet, iPhone→mobile) 2026-06-22 20:51:34 +08:00
wangjia 867107515d Merge: Android 客户端端到端连通 MVP(Task 1-7)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
Flutter Android 接入内嵌 sing-box(libbox)隧道,Vivo X200/Android16 真机验证科学上网通过。

切节点(Task9)/KillSwitch(Task10)为后续。
 2026-06-22 20:48:08 +08:00
wangjia d0919943f5 fix(android): 真机连通修复——补 ACCESS_NETWORK_STATE + 砍 IPv6 zone(Task 7) 
Vivo X200(Android 16)真机实测两处运行期崩溃并修复:

- DefaultNetworkMonitor 用 ConnectivityManager 需 ACCESS_NETWORK_STATE 权限(缺则 SecurityException)

- getInterfaces 返回的 IPv6 link-local 含 zone(%rmnet_data0),sing-box netip.ParsePrefix panic;substringBefore('%') 砍掉

真机端到端连通已由用户验证通过。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 20:43:49 +08:00
wangjia c1fddcdf99 docs(android): 修正工具链记录(降Go保pin→SagerNet gomobile fork+5层环境修复) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 20:05:50 +08:00
wangjia 126c06833d feat(android): libbox 隧道重写对接真实 1.13.12 API,APK 编译通过(Task 5) 
原生层照 PoC 旧/想象 API 写,与真实 sing-box 1.13.12 libbox 差距是架构级:

- 包名 libbox(非 go.libbox);无 BoxService,改 Libbox.setup + CommandServer 模型

- PangolinVpnService 重写:实现完整 PlatformInterface(15法)+CommandServerHandler

- 新增 DefaultNetworkMonitor(上报默认接口,缺则报 no available network)

- openTun 适配真实 TunOptions(RoutePrefixIterator/getMTU/StringBox DNS)

- 统计/切节点经 CommandClient(uplinkTotal/selectOutbound);MainActivity 接线

构建环境矩阵打通:Gradle 8.7(Java21)+声明式插件迁移+AGP 8.6+Kotlin 2.2.0+占位图标

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 19:28:24 +08:00
wangjia 53a2ee0b74 docs(client/ios): plan 增 HTML 阅读版 + 登记索引(双产物:.md 执行/.html 阅读) 2026-06-22 19:27:45 +08:00
wangjia e11c06225d plan(client/ios): iOS+iPad 支持实施计划(6 阶段/12 任务,TestFlight 里程碑) 
A 补 libbox / B Xcode 接线 / C Provider 重写对齐 macOS / D 真机连通+内存双闸 /
E iPad 横竖屏适配 / F TestFlight 分发。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 19:22:05 +08:00
wangjia 84912f4dea docs(client/ios): iOS+iPad 支持设计方案(TestFlight 里程碑)+ 新建 docs 索引 
五条工作线:libbox iOS 框架 / Provider 对齐 macOS 修复 / App Group IPC /
iPad 布局横屏适配 / TestFlight 分发;头号风险 NE ~50MB 内存红线设双闸。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 19:06:20 +08:00
wangjia 2a8426c357 fix(android/kernel): 补 -checklinkname=0 ldflags + JDK 自动探测,构建出 40MB libbox.aar 
对齐 sing-box build_libbox sharedFlags 的 -ldflags(含 -checklinkname=0 放行

badlinkname 的 //go:linkname;-trimpath/-buildvcs=false/版本戳);

JDK 自动选 Android Studio JBR(macOS /usr/bin/javac 仅桩)。Task 2 完成:

三 ABI(arm64/armeabi-v7a/x86_64) libgojni.so 齐。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 18:59:14 +08:00
wangjia f298b207fe fix(android/kernel): gomobile 改用 SagerNet fork v0.1.12 + 补 linkname tags 
原 pin golang.org/x/mobile@v0.0.0-20240604...70c4c5da7d30 是失效 revision;

对照 sing-box v1.13.12 go.mod 与 cmd/internal/build_libbox,官方用

github.com/sagernet/gomobile@v0.1.12;补 badlinkname,tfogo_checklinkname0

以适配 Go 1.24 的 //go:linkname 限制。Task 2 blocker 修复。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 18:48:58 +08:00
wangjia 82741ce0c4 feat(android): Dart provider 接 Android→VpnNativeBridge(Task 4) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 18:48:58 +08:00
wangjia 64c427cf11 docs(android): Android 设计方案+KillSwitch 知识库(HTML)+文档索引+实现计划 
- docs/android-client-design.html / killswitch-design.html / index.html
- docs/superpowers/plans/2026-06-22-android-client.md
- todo/ KillSwitch 三端待办(#1 mac/#2 Android/#3 Windows)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 18:44:50 +08:00
wangjia eea851737f docs(client/windows): 合并后校正 README API 默认值说明(已随 main 改为测试节点)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 14:17:48 +08:00
wangjia ac0fc774cb Merge branch 'main' into feature/windows 2026-06-22 14:17:19 +08:00
wangjia 322d806876 fix+build(client/windows): 复查修缮——一键构建脚本 + 修 README dart-define 漏项 + 清 lint 
- 新增 client/windows/build.ps1：拉内核→带 --dart-define 构建→出安装包一键串联，
  规避 Release 漏 --dart-define 导致默认连 localhost、登录「网络请求失败」的坑。
- README：Release 命令补回 --dart-define 并加显式警告，指向一键脚本。
- 清 4 个 lint warning：desktop_vpn_bridge 多余 cast→pattern match、去多余非空断言；
  nav_sidebar 删未用 import；vpn_bridge_mock 加 killSwitchEnabled getter。
- 同步 window_manager/tray_manager/screen_retriever 插件注册生成文件(win+macos)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 14:17:13 +08:00
wangjia 98ba2b411e test: VPN 黑盒测试工具改用 Python(零依赖)+ HTML 报告 + 国内外站点矩阵 
- scripts/vpn_test.py:替换 vpn_test.sh。纯标准库(socket/ssl/urllib),覆盖国内外
  常见站点矩阵(google/youtube/github/x/fb/ig/wiki/cloudflare/openai/reddit;
  百度/腾讯/淘宝/京东/B站/微博/网易/知乎/阿里云),测连通+延迟+TTFB+DNS+出口IP+吞吐,
  本机连通性(tun/系统扩展),生成自包含 HTML 报告(-o)。
- 延迟标准 = TLS 握手耗时(ssl 握手,纯链路往返),报告里标注 "TTL=按 TLS 计算、非 IP TTL";
  TTFB 作参考。禁用 ping/tcp_connect(经 TUN 本地应答失真)。
- 删除 scripts/vpn_test.sh;文档引用同步更新为 .py。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
 2026-06-22 09:43:46 +08:00
wangjia 98e39629a6 docs: 固定延迟口径——延迟=TLS握手(time_appconnect),TTFB 作参考 
明确含义与区别:TLS 握手=纯网络链路往返(不含目标后端),跨站可比,作统一延迟基准;
TTFB=TLS握手+服务器处理,含站点因素,仅作体感参考。禁用 ping/tcp_connect 当延迟
(经 TUN 被本地应答)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
 2026-06-22 09:21:35 +08:00
wangjia d7c2e22e6f docs: Windows 客户端实现计划(plan) 
8 任务分解 + 完成定义,配套 spec(5c9731f)。subagent-driven 执行依据。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 09:18:04 +08:00
wangjia 4025ce341c build(client/windows): installer AppId 改为合法 GUID 
原 AppId 段含非 hex 占位(PANGOLIN0001);Inno 虽接受任意串,改为规范 GUID 更清晰。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 09:17:31 +08:00
wangjia 8fcc4e8b75 docs+test: VPN 测试方案(黑盒+白盒)+ 修正延迟测量方法 
- docs/vpn-test-plan.md:黑盒+白盒两方向测试方案。白盒细化:链路五段拆解、
  协议/出站选择(Clash API)、接入段 vs 出海段分段 RTT、连接/流量、稳定性
  (长跑/Kill switch/GFW 三元组封锁与被动探测/热重载)。含初轮报告:cara 黑盒
  15 PASS;吞吐 国内直连 74Mbps vs 国外经隧道 ~10-17Mbps(瓶颈在出海段)。
- scripts/vpn_test.sh:修正延迟测量——经 TUN 代理时 ping/tcp_connect 被隧道本地
  应答(2-4ms 假象),改用 TLS 握手(time_appconnect)/ TTFB 作为真实 RTT。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
 2026-06-22 09:17:00 +08:00
wangjia ec0e3d1498 docs(client/windows): 更新 README — 真机构建验证 + 字体打包 + 安装包 + 踩坑 
记录:已真机 build 通过;ATL 前置;LNK1327/mt.exe(MANIFESTUAC)与 fetch SHA pin 排错;
flutter build + ISCC 出安装包步骤;待人工验证清单(运行期连通/托盘/卸载)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 09:08:19 +08:00
wangjia 18a8c9024c build(client/windows): Inno Setup 安装包脚本 + 简中语言包 
- pangolin.iss:打包 Release 全量(exe + flutter 运行时 + sing-box.exe + wintun.dll
  + data/字体),装到 Program Files\Pangolin,开始菜单/桌面快捷方式,卸载清理
  %LOCALAPPDATA%\Pangolin。
- 随仓库附带 ChineseSimplified.isl(本机 Inno Setup 未含官方简中包),.iss 相对引用,
  安装包自带中文向导。
- 已在 Windows 真机 ISCC 编译通过 → Output\pangolin-setup-1.0.0.exe(24MB)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 09:06:44 +08:00
wangjia 3b16e8ff36 fix(client/windows): 关闭链接器 UAC 清单注入(/MANIFESTUAC:NO) 
runner.exe.manifest 已声明 requireAdministrator;链接器默认还会注入 asInvoker 的
UAC 清单,两者 level 冲突 → mt.exe c1010001 → LINK LNK1327,Release 链接失败。
对 runner target 加 /MANIFESTUAC:NO,仅用 manifest 文件的 level。真机 build 通过。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 09:03:16 +08:00
wangjia 2d2baf887c docs+test: macOS 隧道踩坑复盘/规则 + VPN 测试调研 + 黑盒测试工具 
- docs/macos-sysext-realize-troubleshooting.html:补"运行时"章节(libbox 空指针、
  接口时序、队列死锁、DNS 劫持)+ 运行时 checklist。
- docs/vpn-testing-research.md:VPN 测试调研(行业方法论 + GFW 专项 + Pangolin
  分层测试项 + 三层测试工具设计)。
- CLAUDE.md:新增「client/ macOS 原生隧道」铁律章节(构建发版/系统扩展 realize 要求/
  libbox+NE 集成/配置由服务端渲染/已知坑)。
- scripts/vpn_test.sh:客户端侧黑盒测试工具(出口 IP/DNS/可达性/延迟/吞吐/IPv6 泄漏,
  PASS/WARN/FAIL,可远程跑)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
 2026-06-22 09:00:10 +08:00
wangjia cebc9a1c4f fix(client/macos+server): 隧道运行时打通——DNS 劫持 + 死锁/空指针修复 
接续 447f3f4(系统扩展可加载),修复"扩展能起但连上无法上网"的运行时问题,
现已在 macOS 15(cara)端到端连通:出口=节点 IP、国外站可达、DNS 经隧道解析。

服务端(clientconfig.go):
- route.rules 首条加 {"action":"hijack-dns","port":[53]}(排在 LAN 直连规则前)。
  否则发往隧道 DNS(172.19.0.2:53)的查询被 172.16.0.0/12 吞去直连,域名解析失败。
  sing-box 1.13 按端口劫持(protocol:dns 需先 sniff,不稳)。

客户端——保留三个真 bug 修复:
- startTunnel 的 libbox 启动移到后台队列:避免在 provider 队列同步阻塞,与
  openTun→setTunnelNetworkSettings 回调三方死锁(隧道永远卡 connecting)。
- startOrReloadService(options:) 传非空 LibboxOverrideOptions():传 nil 致空指针 SIGSEGV。
- startDefaultInterfaceMonitor 阻塞到首个 path 更新再返回:修 "no available network interface"。
- 清除排障期临时诊断代码;CFBundleVersion 递增(sysextd 按版本去重)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
 2026-06-22 08:57:55 +08:00
wangjia 86157dfc99 fix(kernel): fetch 脚本改内置 SHA pin(sing-box 停发 checksums.txt)+修正 wintun SHA 
- sing-box v1.13 起 Release 不再发布 checksums.txt,原脚本下载它 404,桌面内核
  拉取全平台失效。改为脚本内置各压缩包 SHA256(case 表,版本不符即报错)。
- WINTUN_SHA256 原值(90a6c2..)错误,更正为 wintun-0.14.1.zip 官方哈希(07c256..)。
- 已在 macOS 验证 windows/amd64 全流程:sing-box.exe + wintun.dll 下载+校验+解压通过。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 07:58:03 +08:00
wangjia 7e7854427c docs(client): 修订 pangolin_theme 字体注释(改本地打包后过时描述) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 07:51:58 +08:00
wangjia 6fc032bac8 feat(client): 字体改本地打包(拉丁全量 + Noto Sans SC GB2312 子集) 
生产 PangolinFonts.useBundled=true,离线可用,不再运行时拉 google_fonts;
中文经 fontFamilyFallback=[Noto Sans SC] 兜底,子集外字符再兜系统 CJK 字体。
- 拉丁:Sora/Manrope/JetBrains Mono 静态权重(复用 test/fonts)。
- 中文:Noto Sans SC 变量字体 instance 到 Regular + subset 到 GB2312 6763 字
  (单权重,粗体引擎合成),client/fonts 合计约 3.4MB。
- tools/fonts/make-cjk-subset.sh 可复现生成(GB2312 字表无需联网)。
- 新增 test/unit/fonts_test.dart 锁定接线;golden 因 notdef 占位字形微调已更新。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-22 07:48:21 +08:00
wangjia 14498a3ccd feat(client/desktop): 设定窗口默认 920x640 / 最小宽 720 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-21 23:02:43 +08:00
wangjia 5c9731f3df docs: Windows 客户端 bring-up + 安装包设计方案(spec) 
brainstorming 定稿:真机测试 / MVP+Inno Setup 深度 / 子进程+UAC 数据面 /
复用 DesktopShell 原生标题栏 / 拉丁全量+Noto Sans SC 7000字子集打包。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-21 22:20:50 +08:00
wangjia dae321a3f0 fix(web): clay-500 品牌主色 #FF0000 → #B96A3D + 固定 next 14.2.35 
- token 重生成:--clay-500 品牌主色从占位红 #FF0000 还原为 clay #B96A3D
  (usercenter public + website tokens.gen)
- usercenter package-lock:next / eslint-config-next 从 <14.3.0 固定到 14.2.35

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
 2026-06-21 21:34:22 +08:00
wangjia 833912bb58 chore: 移除废弃 skill .claude/skills/pangolin-design.md 
设计还原统一走全局 design-distill skill,项目内副本不再维护。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
 2026-06-21 21:34:22 +08:00
wangjia 447f3f494e feat(client/macos): P1 原生隧道——PacketTunnel 系统扩展可加载 + libbox 运行 
经长链路排查(同机对照可工作的 Tailscale),修复 macOS 系统扩展 realize
失败(OSSystemExtensionErrorDomain code=4)与 libbox 运行时崩溃,使内嵌
sing-box 的系统扩展能在 macOS 15 上激活并启动隧道。

系统扩展 realize(三个叠加根因):
- 扩展自包含:PacketTunnel 加 OTHER_LDFLAGS="" 切断对项目级 CocoaPods 链接
  标志的继承(原会把 flutter_secure_storage 链进扩展);Libbox.xcframework
  改纯 Link(静态),从 Embed Frameworks 移除冗余内嵌
- bundle 名 = 标识符:PRODUCT_NAME 设为 com.pangolin.pangolin.PacketTunnel
- 扩展 Info.plist 补 NSSystemExtensionUsageDescription(网络扩展类别强制要求)
- App Group 改 macOS 原生格式 BYL4KQHMTN.com.pangolin.pangolin;NEMachServiceName
  以其为前缀;扩展补 network.client/server;get-task-allow=false + 签名加 --timestamp
- CFBundleVersion 随构建递增(否则 sysextd 视为同版本不更新)

libbox 运行时:
- startOrReloadService(options:) 传 nil 致空指针 SIGSEGV → 传 LibboxOverrideOptions()
- 默认接口监控阻塞到首个 path 更新再返回,修 "no available network interface"

配套:
- scripts/local_test.sh:build/sign/notarize/copy/run 一条龙(Developer ID + 公证)
- client/macos/sign_libbox.sh:构建期以 Developer ID 重签内嵌 Libbox
- VpnChannel:401 自动刷新 token、详尽 os_log;auth/api 统一走 kApiBaseUrl
- docs/macos-sysext-realize-troubleshooting.html:完整踩坑复盘

WIP / 临时(后续清理):
- 隧道运行时仍在排查:剥离远程 rule-set 后 sing-box 启动卡点未定位
- 含临时诊断代码:main.swift stderr 重定向、box.log 输出、rule-set 剥离、debug 日志
- api_config 仍指向联调节点,发版前还原

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
 2026-06-21 21:18:33 +08:00
wangjia 43b25c8aa0 feat: 国内流量直连分流(geoip-cn / geosite-cn)— #5
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
国内 IP/域名直连(不走隧道)→ 省流量 + 国内访问快;非国内走代理。

- clientconfig.go: BuildClientConfig 加 ClientConfigOpts{SplitCN,RulesBaseURL};
  开启时 route 加 {rule_set:[geoip-cn,geosite-cn]→direct} + 定义 rule_set
  (remote .srs,download_detour:direct 直连下载)
- rules.go: 控制面静态服务 /v1/rules/{name}.srs(白名单防穿越)——自托管避免
  GitHub 在国内被墙的鸡生蛋;客户端反正连控制面,可达性有保证
- nodes.go ConnectNode: 读 ?split_cn → opts;NodeAPI 加 rulesBaseURL
  (PANGOLIN_PUBLIC_URL);main.go 挂 /v1/rules 路由 + RulesHandler
- 客户端: connect_api splitCN→?split_cn=1;connection_provider 传 smartRoute 偏好
- deploy/single-node: 拉 geoip-cn/geosite-cn.srs 到 $DATA_DIR/rules +
  设 PANGOLIN_PUBLIC_URL/PANGOLIN_RULES_DIR

验证:go test(splitCN 开/关渲染 + RulesHandler 白名单/404)+ flutter analyze +
shellcheck;不需要节点。订阅链接暂用默认 opts、DNS 分流为后续增强。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 20:34:00 +08:00
wangjia cf2bd93c93 feat(server): agent 热重载 sing-box(SIGHUP)替代全量重启(#3) 
sing-box 支持 SIGHUP 热重载(cmd_run.go:进程内 check()验证→close 旧实例→
start 新实例;坏配置保留旧实例继续跑、不断网)。原 agent 用 systemctl restart
(全量重启:断所有连接 + 坏配置让 sing-box 起不来全断)。

- Restarter 接口加 Reload;SystemdRestarter.Reload 取 MainPID(systemctl show
  -p MainPID)发 SIGHUP——agent 与 sing-box 同 pangolin 用户,免 polkit/不改 unit;
  PID 取不到或发信号失败回退 Restart
- SingBox.started:首次/进程未起走 Restart(冷启动),之后配置变更走 Reload
- noopRestarter/fakeRestarter 补 Reload;加 TestWriteAndRestartFirstColdThenReload

价值:切节点/续期/加删用户不整进程重启、不全断流;坏配置不至于打死节点。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 19:36:46 +08:00
wangjia c1a52d4fc2 docs: 新节点重建 + 避风控 checklist 
固化首个 VPS 被支付风控暂停的教训(非流量检测,是新号+信用卡+地理画像+
未及时处理验证)+ 脚本化重建步骤(bootstrap→single-node→自编 v2ray_api
sing-box→ufw→enroll→客户端 dart-define)+ 重建后备份 DB + 接 P1 实测。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 19:24:59 +08:00
wangjia 2a4d6c9648 build(client/macos): Runner 开启 Hardened Runtime(公证前置)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
PacketTunnel 已有 ENABLE_HARDENED_RUNTIME;给 Runner 的 Debug/Release 也补上。
Developer ID 分发 + 公证要求 Hardened Runtime。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 16:04:53 +08:00
wangjia fb1ef9ba01 feat(client/macos): OSSystemExtensionRequest 激活 sysext
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
VpnChannel.activateSystemExtensionIfNeeded 实装:start 前请求系统加载/更新
PacketTunnel sysext;首启弹「隐私与安全性」待用户允许(await 阻塞到批准,
扩展没加载隧道起不来)。SysExtActivationDelegate 处理 finish/fail/replace。

至此 macOS 原生 VPN 栈构建完整:Runner 嵌入 sysext 到
Contents/Library/SystemExtensions,编译全过。运行待:sysext 签名放行 +
systemextensionsctl developer on(或 Developer ID 公证)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 15:54:14 +08:00
wangjia f2a4290602 feat(client/macos): PacketTunnel 转 System Extension(构建通过)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
macOS 站外加载隧道必须 sysext(appex 仅 App Store 可加载)。转换:
- productType app-extension→system-extension;产物 .appex→.systemextension
- 嵌入路径 PlugIns→Contents/Library/SystemExtensions(SYSTEM_EXTENSIONS_FOLDER_PATH)
- main.swift 入口(NEProvider.startSystemExtensionMode + dispatchMain;sysext 是
  可执行程序,需显式 main 而非 appex 的 NSExtensionMain)
- Info.plist 加 NEMachServiceName;entitlement 换回 packet-tunnel-provider-systemextension

CFBundlePackageType 自动 SYSX,Build Succeeded(关签名)。运行还需 Developer ID
签名 + systemextensionsctl developer on + OSSystemExtensionRequest 激活。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 15:51:29 +08:00
wangjia 6a9a7c424e feat(client/macos): 主 app VPN 接线编译通过 — VpnChannel 入 Runner target
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
- VpnChannel.swift 加入 Runner target(Compile Sources)
- Logger→NSLog(Runner 部署目标 10.15,os.Logger 需 11)+ 去掉未用的
  SystemExtensions import
- 至此原生 VPN 控制链路全编译通过:主 app(NETunnelProviderManager 启停/
  状态)+ 扩展(libbox)。kUseNativeVpnMacOS 仍 false(待隧道能跑切换)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 15:43:42 +08:00