feat: 支持管理 token

feat: Surge 支持 Shadowsocks 2022(为了兼容 必须使用 `includeUnsupportedProxy` 参数或开启 `包含官方/商店版不支持的协议` 开关)

README.md

@@ -26,6 +26,8 @@ Core functionalities:
 
 ### Supported Input Formats
 
+> ⚠️ Do not use `Shadowrocket` to export URI and then import it as input. It is not a standard URI.
+
 - [x] URI(SS, SSR, VMess, VLESS, Trojan, Hysteria, Hysteria 2, TUIC v5, WireGuard)
 - [x] Clash Proxies YAML
 - [x] Clash Proxy JSON(single line)
@@ -33,7 +35,6 @@ Core functionalities:
 - [x] Loon (SS, SSR, VMess, Trojan, HTTP, SOCKS5, SOCKS5-TLS, WireGuard, VLESS, Hysteria 2)
 - [x] Surge (SS, VMess, Trojan, HTTP, SOCKS5, SOCKS5-TLS, TUIC, Snell, Hysteria 2, SSH(Password authentication only), External Proxy Program(only for macOS), WireGuard(Surge to Surge))
 - [x] Surfboard (SS, VMess, Trojan, HTTP, SOCKS5, SOCKS5-TLS, WireGuard(Surfboard to Surfboard))
-- [x] Shadowrocket (SS, SSR, VMess, Trojan, HTTP, SOCKS5, Snell, VLESS, WireGuard, Hysteria, Hysteria 2, TUIC)
 - [x] Clash.Meta (SS, SSR, VMess, Trojan, HTTP, SOCKS5, Snell, VLESS, WireGuard, Hysteria, Hysteria 2, TUIC)
 - [x] Stash (SS, SSR, VMess, Trojan, HTTP, SOCKS5, Snell, VLESS, WireGuard, Hysteria, TUIC, Juicity, SSH)
 - [x] Clash (SS, SSR, VMess, Trojan, HTTP, SOCKS5, Snell, VLESS, WireGuard)

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sub-store",
-  "version": "2.14.381",
+  "version": "2.14.413",
   "description": "Advanced Subscription Manager for QX, Loon, Surge, Stash and ShadowRocket.",
   "main": "src/main.js",
   "scripts": {
@@ -30,11 +30,10 @@
     "js-base64": "^3.7.2",
     "jsrsasign": "^11.1.0",
     "lodash": "^4.17.21",
+    "ms": "^2.1.3",
+    "nanoid": "^3.3.3",
     "request": "^2.88.2",
-    "requests": "^0.3.0",
+    "static-js-yaml": "^1.0.0"
-    "semver": "^7.3.7",
-    "static-js-yaml": "^1.0.0",
-    "uuid": "^8.3.2"
   },
   "devDependencies": {
     "@babel/core": "^7.18.0",

backend/src/constants.js

@@ -6,6 +6,7 @@ export const FILES_KEY = 'files';
 export const MODULES_KEY = 'modules';
 export const ARTIFACTS_KEY = 'artifacts';
 export const RULES_KEY = 'rules';
+export const TOKENS_KEY = 'tokens';
 export const GIST_BACKUP_KEY = 'Auto Generated Sub-Store Backup';
 export const GIST_BACKUP_FILE_NAME = 'Sub-Store';
 export const ARTIFACT_REPOSITORY_KEY = 'Sub-Store Artifacts Repository';

backend/src/core/proxy-utils/index.js

@@ -9,6 +9,7 @@ import {
     isNotBlank,
     ipAddress,
     getRandomPort,
+    numberToString,
 } from '@/utils';
 import PROXY_PROCESSORS, { ApplyProcessor } from './processors';
 import PROXY_PREPROCESSORS from './preprocessors';
@@ -209,8 +210,6 @@ function produce(proxies, targetPlatform, type, opts = {}) {
     );
 
     proxies = proxies.map((proxy) => {
-        proxy._subName = proxy.subName;
-        proxy._collectionName = proxy.collectionName;
         proxy._resolved = proxy.resolved;
 
         if (!isNotBlank(proxy.name)) {
@@ -267,7 +266,7 @@ function produce(proxies, targetPlatform, type, opts = {}) {
             proxies.length > 0 &&
             proxies.every((p) => p.type === 'wireguard')
         ) {
-            list = `#!name=${proxies[0]?.subName}
+            list = `#!name=${proxies[0]?._subName}
 #!desc=${proxies[0]?._desc ?? ''}
 #!category=${proxies[0]?._category ?? ''}
 ${list}`;
@@ -293,6 +292,7 @@ export const ProxyUtils = {
     getISO,
     MMDB,
     Gist,
+    download,
 };
 
 function tryParse(parser, line) {
@@ -327,6 +327,12 @@ function formatTransportPath(path) {
 }
 
 function lastParse(proxy) {
+    if (typeof proxy.cipher === 'string') {
+        proxy.cipher = proxy.cipher.toLowerCase();
+    }
+    if (typeof proxy.password === 'number') {
+        proxy.password = numberToString(proxy.password);
+    }
     if (proxy.interface) {
         proxy['interface-name'] = proxy.interface;
         delete proxy.interface;
@@ -405,20 +411,7 @@ function lastParse(proxy) {
             proxy['h2-opts'].path = path[0];
         }
     }
-    if (proxy.tls && !proxy.sni) {
+
-        if (proxy.network) {
-            let transportHost = proxy[`${proxy.network}-opts`]?.headers?.Host;
-            transportHost = Array.isArray(transportHost)
-                ? transportHost[0]
-                : transportHost;
-            if (transportHost) {
-                proxy.sni = transportHost;
-            }
-        }
-        if (!proxy.sni && !isIP(proxy.server)) {
-            proxy.sni = proxy.server;
-        }
-    }
     // 非 tls, 有 ws/http 传输层, 使用域名的节点, 将设置传输层 Host 防止之后域名解析后丢失域名(不覆盖现有的 Host)
     if (
         !proxy.tls &&
@@ -445,6 +438,20 @@ function lastParse(proxy) {
             proxy[`${proxy.network}-opts`].path = [transportPath];
         }
     }
+    if (proxy.tls && !proxy.sni) {
+        if (!isIP(proxy.server)) {
+            proxy.sni = proxy.server;
+        }
+        if (!proxy.sni && proxy.network) {
+            let transportHost = proxy[`${proxy.network}-opts`]?.headers?.Host;
+            transportHost = Array.isArray(transportHost)
+                ? transportHost[0]
+                : transportHost;
+            if (transportHost) {
+                proxy.sni = transportHost;
+            }
+        }
+    }
     // if (['hysteria', 'hysteria2', 'tuic'].includes(proxy.type)) {
     if (proxy.ports) {
         proxy.ports = String(proxy.ports).replace(/\//g, ',');

backend/src/core/proxy-utils/parsers/index.js

@@ -316,7 +316,7 @@ function URI_VMess() {
                 );
             }
             // https://github.com/2dust/v2rayN/wiki/%E5%88%86%E4%BA%AB%E9%93%BE%E6%8E%A5%E6%A0%BC%E5%BC%8F%E8%AF%B4%E6%98%8E(ver-2)
-            if (proxy.tls && proxy.sni) {
+            if (proxy.tls && params.sni && params.sni !== '') {
                 proxy.sni = params.sni;
             }
             let httpupgrade = false;
@@ -391,12 +391,6 @@ function URI_VMess() {
                 } else {
                     delete proxy.network;
                 }
-
-                // https://github.com/MetaCubeX/Clash.Meta/blob/Alpha/docs/config.yaml#L413
-                // sni 优先级应高于 host
-                if (proxy.tls && !proxy.sni && transportHost) {
-                    proxy.sni = transportHost;
-                }
             }
             return proxy;
         }
@@ -537,14 +531,13 @@ function URI_VLESS() {
             if (Object.keys(opts).length > 0) {
                 proxy[`${proxy.network}-opts`] = opts;
             }
-        }
+            if (proxy.network === 'kcp') {
-
+                // mKCP 种子。省略时不使用种子，但不可以为空字符串。建议 mKCP 用户使用 seed。
-        if (proxy.tls && !proxy.sni) {
+                if (params.seed) {
-            if (proxy.network === 'ws') {
+                    proxy.seed = params.seed;
-                proxy.sni = proxy['ws-opts']?.headers?.Host;
+                }
-            } else if (proxy.network === 'http') {
+                // mKCP 的伪装头部类型。当前可选值有 none / srtp / utp / wechat-video / dtls / wireguard。省略时默认值为 none，即不使用伪装头部，但不可以为空字符串。
-                let httpHost = proxy['http-opts']?.headers?.Host;
+                proxy.headerType = params.headerType || 'none';
-                proxy.sni = Array.isArray(httpHost) ? httpHost[0] : httpHost;
             }
         }
 
@@ -898,18 +891,7 @@ function Clash_All() {
         if (['vmess', 'vless'].includes(proxy.type)) {
             proxy.sni = proxy.servername;
             delete proxy.servername;
-            if (proxy.tls && !proxy.sni) {
-                if (proxy.network === 'ws') {
-                    proxy.sni = proxy['ws-opts']?.headers?.Host;
-                } else if (proxy.network === 'http') {
-                    let httpHost = proxy['http-opts']?.headers?.Host;
-                    proxy.sni = Array.isArray(httpHost)
-                        ? httpHost[0]
-                        : httpHost;
-                }
-            }
         }
-
         if (proxy['server-cert-fingerprint']) {
             proxy['tls-fingerprint'] = proxy['server-cert-fingerprint'];
         }

backend/src/core/proxy-utils/parsers/peggy/surge.js

@@ -41,7 +41,7 @@ start = (shadowsocks/vmess/trojan/https/http/snell/socks5/socks5_tls/tuic/tuic_v
     return proxy;
 }
 
-shadowsocks = tag equals "ss" address (method/passwordk/obfs/obfs_host/obfs_uri/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/udp_relay/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
+shadowsocks = tag equals "ss" address (method/passwordk/obfs/obfs_host/obfs_uri/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/udp_relay/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/udp_port/others)* {
     proxy.type = "ss";
     // handle obfs
     if (obfs.type == "http" || obfs.type === "tls") {
@@ -200,7 +200,7 @@ vmess_aead = comma "vmess-aead" equals flag:bool { proxy.aead = flag; }
 method = comma "encrypt-method" equals cipher:cipher {
     proxy.cipher = cipher;
 }
-cipher = ("aes-128-cfb"/"aes-128-ctr"/"aes-128-gcm"/"aes-192-cfb"/"aes-192-ctr"/"aes-192-gcm"/"aes-256-cfb"/"aes-256-ctr"/"aes-256-gcm"/"bf-cfb"/"camellia-128-cfb"/"camellia-192-cfb"/"camellia-256-cfb"/"cast5-cfb"/"chacha20-ietf-poly1305"/"chacha20-ietf"/"chacha20-poly1305"/"chacha20"/"des-cfb"/"idea-cfb"/"none"/"rc2-cfb"/"rc4-md5"/"rc4"/"salsa20"/"seed-cfb"/"xchacha20-ietf-poly1305");
+cipher = ("aes-128-cfb"/"aes-128-ctr"/"aes-128-gcm"/"aes-192-cfb"/"aes-192-ctr"/"aes-192-gcm"/"aes-256-cfb"/"aes-256-ctr"/"aes-256-gcm"/"bf-cfb"/"camellia-128-cfb"/"camellia-192-cfb"/"camellia-256-cfb"/"cast5-cfb"/"chacha20-ietf-poly1305"/"chacha20-ietf"/"chacha20-poly1305"/"chacha20"/"des-cfb"/"idea-cfb"/"none"/"rc2-cfb"/"rc4-md5"/"rc4"/"salsa20"/"seed-cfb"/"xchacha20-ietf-poly1305"/"2022-blake3-aes-128-gcm"/"2022-blake3-aes-256-gcm");
 
 ws = comma "ws" equals flag:bool { obfs.type = "ws"; }
 ws_headers = comma "ws-headers" equals headers:$[^,]+ {
@@ -219,7 +219,7 @@ obfs_host = comma "obfs-host" equals host:domain { obfs.host = host; };
 obfs_uri = comma "obfs-uri" equals path:uri { obfs.path = path }
 uri = $[^,]+
 
-udp_relay = comma "udp" equals flag:bool { proxy.udp = flag; }
+udp_relay = comma "udp-relay" equals flag:bool { proxy.udp = flag; }
 fast_open = comma "fast-open" equals flag:bool { proxy.tfo = flag; }
 reuse = comma "reuse" equals flag:bool { proxy.reuse = flag; }
 ecn = comma "ecn" equals flag:bool { proxy.ecn = flag; }
@@ -240,6 +240,7 @@ idle_timeout = comma "idle-timeout" equals match:$[0-9]+ { proxy["idle-timeout"]
 private_key = comma "private-key" equals match:[^,]+ { proxy["keystore-private-key"] = match.join("").replace(/^"(.*)"$/, '$1'); }
 server_fingerprint = comma "server-fingerprint" equals match:[^,]+ { proxy["server-fingerprint"] = match.join("").replace(/^"(.*)"$/, '$1'); }
 block_quic = comma "block-quic" equals match:[^,]+ { proxy["block-quic"] = match.join(""); }
+udp_port = comma "udp-port" equals match:$[0-9]+ { proxy["udp-port"] = parseInt(match.trim()); }
 shadow_tls_version = comma "shadow-tls-version" equals match:$[0-9]+ { proxy["shadow-tls-version"] = parseInt(match.trim()); }
 shadow_tls_sni = comma "shadow-tls-sni" equals match:[^,]+ { proxy["shadow-tls-sni"] = match.join(""); }
 shadow_tls_password = comma "shadow-tls-password" equals match:[^,]+ { proxy["shadow-tls-password"] = match.join(""); }

backend/src/core/proxy-utils/parsers/peggy/surge.peg

@@ -39,7 +39,7 @@ start = (shadowsocks/vmess/trojan/https/http/snell/socks5/socks5_tls/tuic/tuic_v
     return proxy;
 }
 
-shadowsocks = tag equals "ss" address (method/passwordk/obfs/obfs_host/obfs_uri/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/udp_relay/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
+shadowsocks = tag equals "ss" address (method/passwordk/obfs/obfs_host/obfs_uri/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/udp_relay/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/udp_port/others)* {
     proxy.type = "ss";
     // handle obfs
     if (obfs.type == "http" || obfs.type === "tls") {
@@ -198,7 +198,7 @@ vmess_aead = comma "vmess-aead" equals flag:bool { proxy.aead = flag; }
 method = comma "encrypt-method" equals cipher:cipher {
     proxy.cipher = cipher;
 }
-cipher = ("aes-128-cfb"/"aes-128-ctr"/"aes-128-gcm"/"aes-192-cfb"/"aes-192-ctr"/"aes-192-gcm"/"aes-256-cfb"/"aes-256-ctr"/"aes-256-gcm"/"bf-cfb"/"camellia-128-cfb"/"camellia-192-cfb"/"camellia-256-cfb"/"cast5-cfb"/"chacha20-ietf-poly1305"/"chacha20-ietf"/"chacha20-poly1305"/"chacha20"/"des-cfb"/"idea-cfb"/"none"/"rc2-cfb"/"rc4-md5"/"rc4"/"salsa20"/"seed-cfb"/"xchacha20-ietf-poly1305");
+cipher = ("aes-128-cfb"/"aes-128-ctr"/"aes-128-gcm"/"aes-192-cfb"/"aes-192-ctr"/"aes-192-gcm"/"aes-256-cfb"/"aes-256-ctr"/"aes-256-gcm"/"bf-cfb"/"camellia-128-cfb"/"camellia-192-cfb"/"camellia-256-cfb"/"cast5-cfb"/"chacha20-ietf-poly1305"/"chacha20-ietf"/"chacha20-poly1305"/"chacha20"/"des-cfb"/"idea-cfb"/"none"/"rc2-cfb"/"rc4-md5"/"rc4"/"salsa20"/"seed-cfb"/"xchacha20-ietf-poly1305"/"2022-blake3-aes-128-gcm"/"2022-blake3-aes-256-gcm");
 
 ws = comma "ws" equals flag:bool { obfs.type = "ws"; }
 ws_headers = comma "ws-headers" equals headers:$[^,]+ {
@@ -217,7 +217,7 @@ obfs_host = comma "obfs-host" equals host:domain { obfs.host = host; };
 obfs_uri = comma "obfs-uri" equals path:uri { obfs.path = path }
 uri = $[^,]+
 
-udp_relay = comma "udp" equals flag:bool { proxy.udp = flag; }
+udp_relay = comma "udp-relay" equals flag:bool { proxy.udp = flag; }
 fast_open = comma "fast-open" equals flag:bool { proxy.tfo = flag; }
 reuse = comma "reuse" equals flag:bool { proxy.reuse = flag; }
 ecn = comma "ecn" equals flag:bool { proxy.ecn = flag; }
@@ -238,6 +238,7 @@ idle_timeout = comma "idle-timeout" equals match:$[0-9]+ { proxy["idle-timeout"]
 private_key = comma "private-key" equals match:[^,]+ { proxy["keystore-private-key"] = match.join("").replace(/^"(.*)"$/, '$1'); }
 server_fingerprint = comma "server-fingerprint" equals match:[^,]+ { proxy["server-fingerprint"] = match.join("").replace(/^"(.*)"$/, '$1'); }
 block_quic = comma "block-quic" equals match:[^,]+ { proxy["block-quic"] = match.join(""); }
+udp_port = comma "udp-port" equals match:$[0-9]+ { proxy["udp-port"] = parseInt(match.trim()); }
 shadow_tls_version = comma "shadow-tls-version" equals match:$[0-9]+ { proxy["shadow-tls-version"] = parseInt(match.trim()); }
 shadow_tls_sni = comma "shadow-tls-sni" equals match:[^,]+ { proxy["shadow-tls-sni"] = match.join(""); }
 shadow_tls_password = comma "shadow-tls-password" equals match:[^,]+ { proxy["shadow-tls-password"] = match.join(""); }

backend/src/core/proxy-utils/preprocessors/index.js

@@ -50,10 +50,32 @@ function Clash() {
     };
     const parse = function (raw) {
         // Clash YAML format
+
+        // 防止 VLESS节点 reality-opts 选项中的 short-id 被解析成 Infinity
+        // 匹配 short-id 冒号后面的值(包含空格和引号)
+        const afterReplace = raw.replace(
+            /short-id:([ ]*[^,\n}]*)/g,
+            (matched, value) => {
+            const afterTrim = value.trim();
+        
+            // 为空
+            if (!afterTrim || afterTrim === '') {
+                return 'short-id: ""'
+            }
+        
+            // 是否被引号包裹
+            if (/^(['"]).*\1$/.test(afterTrim)) {
+                return `short-id: ${afterTrim}`;
+            } else {
+                return `short-id: "${afterTrim}"`
+            }
+            }
+        );
+
         const {
             proxies,
             'global-client-fingerprint': globalClientFingerprint,
-        } = safeLoad(raw);
+        } = safeLoad(afterReplace);
         return proxies
             .map((p) => {
                 // https://github.com/MetaCubeX/mihomo/blob/Alpha/docs/config.yaml#L73C1-L73C26

backend/src/core/proxy-utils/producers/surge.js

@@ -20,7 +20,7 @@ export default function Surge_Producer() {
         }
         switch (proxy.type) {
             case 'ss':
-                return shadowsocks(proxy);
+                return shadowsocks(proxy, opts['include-unsupported-proxy']);
             case 'trojan':
                 return trojan(proxy);
             case 'vmess':
@@ -51,7 +51,7 @@ export default function Surge_Producer() {
     return { produce };
 }
 
-function shadowsocks(proxy) {
+function shadowsocks(proxy, includeUnsupportedProxy) {
     const result = new Result(proxy);
     result.append(`${proxy.name}=${proxy.type},${proxy.server},${proxy.port}`);
     if (!proxy.cipher) {
@@ -85,6 +85,9 @@ function shadowsocks(proxy) {
             'chacha20',
             'chacha20-ietf',
             'none',
+            ...(includeUnsupportedProxy
+                ? ['2022-blake3-aes-128-gcm', '2022-blake3-aes-256-gcm']
+                : []),
         ].includes(proxy.cipher)
     ) {
         throw new Error(`cipher ${proxy.cipher} is not supported`);
@@ -122,6 +125,8 @@ function shadowsocks(proxy) {
 
     // udp
     result.appendIfPresent(`,udp-relay=${proxy.udp}`, 'udp');
+    // udp-port
+    result.appendIfPresent(`,udp-port=${proxy['udp-port']}`, 'udp-port');
 
     // test-url
     result.appendIfPresent(`,test-url=${proxy['test-url']}`, 'test-url');

backend/src/core/proxy-utils/producers/surgemac.js

@@ -20,10 +20,16 @@ export default function SurgeMac_Producer() {
                 try {
                     return surge_Producer.produce(proxy, type, opts);
                 } catch (e) {
-                    $.log(
+                    if (opts.useMihomoExternal) {
-                        `${proxy.name} is not supported on ${targetPlatform}, try to use Mihomo(SurgeMac - External Proxy Program) instead`,
+                        $.log(
-                    );
+                            `${proxy.name} is not supported on ${targetPlatform}, try to use Mihomo(SurgeMac - External Proxy Program) instead`,
-                    return mihomo(proxy, type, opts);
+                        );
+                        return mihomo(proxy, type, opts);
+                    } else {
+                        throw new Error(
+                            `Surge for macOS 可手动指定链接参数 target=SurgeMac 或在 同步配置 中指定 SurgeMac 来启用 mihomo 支援 Surge 本身不支持的协议`,
+                        );
+                    }
                 }
             }
         }

backend/src/core/proxy-utils/producers/uri.js

@@ -224,6 +224,18 @@ export default function URI_Producer() {
                         vlessTransportServiceName,
                     )}`;
                 }
+                if (proxy.network === 'kcp') {
+                    if (proxy.seed) {
+                        vlessTransport += `&seed=${encodeURIComponent(
+                            proxy.seed,
+                        )}`;
+                    }
+                    if (proxy.headerType) {
+                        vlessTransport += `&headerType=${encodeURIComponent(
+                            proxy.headerType,
+                        )}`;
+                    }
+                }
 
                 result = `vless://${proxy.uuid}@${proxy.server}:${
                     proxy.port

backend/src/products/cron-sync-artifacts.js

@@ -130,6 +130,15 @@ async function doSync() {
                 try {
                     if (artifact.sync && artifact.source) {
                         $.info(`正在同步云配置：${artifact.name}...`);
+
+                        const useMihomoExternal =
+                            artifact.platform === 'SurgeMac';
+
+                        if (useMihomoExternal) {
+                            $.info(
+                                `手动指定了 target 为 SurgeMac, 将使用 Mihomo External`,
+                            );
+                        }
                         const output = await produceArtifact({
                             type: artifact.type,
                             name: artifact.source,
@@ -137,6 +146,7 @@ async function doSync() {
                             produceOpts: {
                                 'include-unsupported-proxy':
                                     artifact.includeUnsupportedProxy,
+                                useMihomoExternal,
                             },
                         });
 

backend/src/restful/download.js

@@ -13,6 +13,9 @@ import { getISO } from '@/utils/geo';
 import env from '@/utils/env';
 
 export default function register($app) {
+    $app.get('/share/col/:name', downloadCollection);
+    $app.get('/share/sub/:name', downloadSubscription);
+
     $app.get('/download/collection/:name', downloadCollection);
     $app.get('/download/:name', downloadSubscription);
     $app.get(
@@ -52,6 +55,8 @@ async function downloadSubscription(req, res) {
     name = decodeURIComponent(name);
     nezhaIndex = decodeURIComponent(nezhaIndex);
 
+    const useMihomoExternal = req.query.target === 'SurgeMac';
+
     const platform =
         req.query.target || getPlatformFromHeaders(req.headers) || 'JSON';
 
@@ -69,6 +74,7 @@ async function downloadSubscription(req, res) {
         produceType,
         includeUnsupportedProxy,
         resultFormat,
+        proxy,
     } = req.query;
     let $options = {};
     if (req.query.$options) {
@@ -92,6 +98,10 @@ async function downloadSubscription(req, res) {
         url = decodeURIComponent(url);
         $.info(`指定远程订阅 URL: ${url}`);
     }
+    if (proxy) {
+        proxy = decodeURIComponent(proxy);
+        $.info(`指定远程订阅使用代理/策略 proxy: ${proxy}`);
+    }
     if (ua) {
         ua = decodeURIComponent(ua);
         $.info(`指定远程订阅 User-Agent: ${ua}`);
@@ -117,6 +127,10 @@ async function downloadSubscription(req, res) {
         $.info(`包含不支持的节点: ${includeUnsupportedProxy}`);
     }
 
+    if (useMihomoExternal) {
+        $.info(`手动指定了 target 为 SurgeMac, 将使用 Mihomo External`);
+    }
+
     const allSubs = $.read(SUBS_KEY);
     const sub = findByName(allSubs, name);
     if (sub) {
@@ -133,8 +147,10 @@ async function downloadSubscription(req, res) {
                 produceType,
                 produceOpts: {
                     'include-unsupported-proxy': includeUnsupportedProxy,
+                    useMihomoExternal,
                 },
                 $options,
+                proxy,
             });
 
             if (
@@ -172,10 +188,10 @@ async function downloadSubscription(req, res) {
                     if (!$arguments.noFlow) {
                         // forward flow headers
                         const flowInfo = await getFlowHeaders(
-                            url,
+                            $arguments?.insecure ? `${url}#insecure` : url,
                             $arguments.flowUserAgent,
                             undefined,
-                            sub.proxy,
+                            proxy || sub.proxy,
                             $arguments.flowUrl,
                         );
                         if (flowInfo) {
@@ -247,6 +263,8 @@ async function downloadCollection(req, res) {
     name = decodeURIComponent(name);
     nezhaIndex = decodeURIComponent(nezhaIndex);
 
+    const useMihomoExternal = req.query.target === 'SurgeMac';
+
     const platform =
         req.query.target || getPlatformFromHeaders(req.headers) || 'JSON';
 
@@ -264,6 +282,7 @@ async function downloadCollection(req, res) {
         produceType,
         includeUnsupportedProxy,
         resultFormat,
+        proxy,
     } = req.query;
 
     let $options = {};
@@ -285,6 +304,11 @@ async function downloadCollection(req, res) {
         $.info(`传入 $options: ${JSON.stringify($options)}`);
     }
 
+    if (proxy) {
+        proxy = decodeURIComponent(proxy);
+        $.info(`指定远程订阅使用代理/策略 proxy: ${proxy}`);
+    }
+
     if (ignoreFailedRemoteSub != null && ignoreFailedRemoteSub !== '') {
         ignoreFailedRemoteSub = decodeURIComponent(ignoreFailedRemoteSub);
         $.info(`指定忽略失败的远程订阅: ${ignoreFailedRemoteSub}`);
@@ -298,6 +322,9 @@ async function downloadCollection(req, res) {
         includeUnsupportedProxy = decodeURIComponent(includeUnsupportedProxy);
         $.info(`包含不支持的节点: ${includeUnsupportedProxy}`);
     }
+    if (useMihomoExternal) {
+        $.info(`手动指定了 target 为 SurgeMac, 将使用 Mihomo External`);
+    }
 
     if (collection) {
         try {
@@ -309,8 +336,10 @@ async function downloadCollection(req, res) {
                 produceType,
                 produceOpts: {
                     'include-unsupported-proxy': includeUnsupportedProxy,
+                    useMihomoExternal,
                 },
                 $options,
+                proxy,
             });
 
             // forward flow header from the first subscription in this collection
@@ -352,10 +381,10 @@ async function downloadCollection(req, res) {
                         }
                         if (!$arguments.noFlow) {
                             const flowInfo = await getFlowHeaders(
-                                url,
+                                $arguments?.insecure ? `${url}#insecure` : url,
                                 $arguments.flowUserAgent,
                                 undefined,
-                                sub.proxy,
+                                proxy || sub.proxy || collection.proxy,
                                 $arguments.flowUrl,
                             );
                             if (flowInfo) {

backend/src/restful/file.js

@@ -13,6 +13,8 @@ import { produceArtifact } from '@/restful/sync';
 export default function register($app) {
     if (!$.read(FILES_KEY)) $.write([], FILES_KEY);
 
+    $app.get('/share/file/:name', getFile);
+
     $app.route('/api/file/:name')
         .get(getFile)
         .patch(updateFile)
@@ -59,6 +61,7 @@ async function getFile(req, res) {
         content,
         mergeSources,
         ignoreFailedRemoteFile,
+        proxy,
     } = req.query;
     let $options = {};
     if (req.query.$options) {
@@ -82,6 +85,10 @@ async function getFile(req, res) {
         url = decodeURIComponent(url);
         $.info(`指定远程文件 URL: ${url}`);
     }
+    if (proxy) {
+        proxy = decodeURIComponent(proxy);
+        $.info(`指定远程订阅使用代理/策略 proxy: ${proxy}`);
+    }
     if (ua) {
         ua = decodeURIComponent(ua);
         $.info(`指定远程文件 User-Agent: ${ua}`);
@@ -120,6 +127,7 @@ async function getFile(req, res) {
                 mergeSources,
                 ignoreFailedRemoteFile,
                 $options,
+                proxy,
             });
 
             try {
@@ -129,6 +137,8 @@ async function getFile(req, res) {
                     const flowInfo = await getFlowHeaders(
                         subInfoUrl,
                         subInfoUserAgent || file.subInfoUserAgent,
+                        undefined,
+                        proxy || file.proxy,
                     );
                     if (flowInfo) {
                         res.set('subscription-userinfo', flowInfo);
@@ -141,7 +151,14 @@ async function getFile(req, res) {
                     )}`,
                 );
             }
-
+            if (file.download) {
+                res.set(
+                    'Content-Disposition',
+                    `attachment; filename*=UTF-8''${encodeURIComponent(
+                        file.displayName || file.name,
+                    )}`,
+                );
+            }
             res.set('Content-Type', 'text/plain; charset=utf-8').send(
                 output ?? '',
             );

backend/src/restful/index.js

@@ -4,11 +4,13 @@ import migrate from '@/utils/migration';
 import download from '@/utils/download';
 import { syncArtifacts } from '@/restful/sync';
 import { gistBackupAction } from '@/restful/miscs';
+import { TOKENS_KEY } from '@/constants';
 
 import registerSubscriptionRoutes from './subscriptions';
 import registerCollectionRoutes from './collections';
 import registerArtifactRoutes from './artifacts';
 import registerFileRoutes from './file';
+import registerTokenRoutes from './token';
 import registerModuleRoutes from './module';
 import registerSyncRoutes from './sync';
 import registerDownloadRoutes from './download';
@@ -36,6 +38,7 @@ export default function serve() {
     registerSettingRoutes($app);
     registerArtifactRoutes($app);
     registerFileRoutes($app);
+    registerTokenRoutes($app);
     registerModuleRoutes($app);
     registerSyncRoutes($app);
     registerNodeInfoRoutes($app);
@@ -45,6 +48,7 @@ export default function serve() {
     $app.start();
 
     if ($.env.isNode) {
+        // Deprecated: SUB_STORE_BACKEND_CRON
         const backend_sync_cron =
             eval('process.env.SUB_STORE_BACKEND_SYNC_CRON') ||
             eval('process.env.SUB_STORE_BACKEND_CRON');
@@ -142,7 +146,7 @@ export default function serve() {
             try {
                 fs.accessSync(path.join(fe_abs_path, 'index.html'));
             } catch (e) {
-                throw new Error(
+                $.error(
                     `[FRONTEND] index.html file not found in ${fe_abs_path}`,
                 );
             }
@@ -157,6 +161,7 @@ export default function serve() {
 
             const staticFileMiddleware = express_.static(fe_path);
 
+            let be_share_rewrite = '/share/:type/:name';
             let be_api_rewrite = '';
             let be_download_rewrite = '';
             let be_api = '/api/';
@@ -173,15 +178,39 @@ export default function serve() {
                 be_download_rewrite = `${
                     fe_be_path === '/' ? '' : fe_be_path
                 }${be_download}`;
+
+                app.use(
+                    be_share_rewrite,
+                    createProxyMiddleware({
+                        target: `http://127.0.0.1:${port}`,
+                        changeOrigin: true,
+                        pathRewrite: (path, req) => {
+                            if (req.method.toLowerCase() !== 'get')
+                                throw new Error('Method not allowed');
+                            const tokens = $.read(TOKENS_KEY) || [];
+                            const token = tokens.find(
+                                (t) =>
+                                    t.token === req.query.token &&
+                                    t.type === req.params.type &&
+                                    t.name === req.params.name &&
+                                    (t.exp == null || t.exp > Date.now()),
+                            );
+                            if (!token) throw new Error('Forbbiden');
+                            return path;
+                        },
+                    }),
+                );
                 app.use(
                     be_api_rewrite,
                     createProxyMiddleware({
                         target: `http://127.0.0.1:${port}`,
-                        changeOrigin: true,
                         pathRewrite: (path) => {
-                            return path.startsWith(be_api_rewrite)
+                            const newPath = path.startsWith(be_api_rewrite)
                                 ? path.replace(be_api_rewrite, be_api)
                                 : path;
+                            return newPath.includes('?')
+                                ? `${newPath}&share=true`
+                                : `${newPath}?share=true`;
                         },
                     }),
                 );
@@ -219,6 +248,9 @@ export default function serve() {
                     $.info(
                         `[FRONTEND -> BACKEND] ${fe_address}:${fe_port}${be_download_rewrite} -> http://127.0.0.1:${port}${be_download}`,
                     );
+                    $.info(
+                        `[SHARE BACKEND] ${fe_address}:${fe_port}${be_share_rewrite}`,
+                    );
                 }
             });
         }

backend/src/restful/miscs.js

@@ -65,6 +65,9 @@ export default function register($app) {
 }
 
 function getEnv(req, res) {
+    if (req.query.share) {
+        env.feature.share = true;
+    }
     success(res, env);
 }
 

backend/src/restful/preview.js

@@ -146,7 +146,8 @@ async function compareSub(req, res) {
         // add id
         original.forEach((proxy, i) => {
             proxy.id = i;
-            proxy.subName = sub.name;
+            proxy._subName = sub.name;
+            proxy._subDisplayName = sub.displayName;
         });
 
         // apply processors
@@ -176,7 +177,20 @@ async function compareCollection(req, res) {
     try {
         const allSubs = $.read(SUBS_KEY);
         const collection = req.body;
-        const subnames = collection.subscriptions;
+        const subnames = [...collection.subscriptions];
+        let subscriptionTags = collection.subscriptionTags;
+        if (Array.isArray(subscriptionTags) && subscriptionTags.length > 0) {
+            allSubs.forEach((sub) => {
+                if (
+                    Array.isArray(sub.tag) &&
+                    sub.tag.length > 0 &&
+                    !subnames.includes(sub.name) &&
+                    sub.tag.some((tag) => subscriptionTags.includes(tag))
+                ) {
+                    subnames.push(sub.name);
+                }
+            });
+        }
         const results = {};
         const errors = {};
         await Promise.all(
@@ -237,8 +251,10 @@ async function compareCollection(req, res) {
                         .flat();
 
                     currentProxies.forEach((proxy) => {
-                        proxy.subName = sub.name;
+                        proxy._subName = sub.name;
-                        proxy.collectionName = collection.name;
+                        proxy._subDisplayName = sub.displayName;
+                        proxy._collectionName = collection.name;
+                        proxy._collectionDisplayName = collection.displayName;
                     });
 
                     // apply processors
@@ -276,7 +292,8 @@ async function compareCollection(req, res) {
 
         original.forEach((proxy, i) => {
             proxy.id = i;
-            proxy.collectionName = collection.name;
+            proxy._collectionName = collection.name;
+            proxy._collectionDisplayName = collection.displayName;
         });
 
         const processed = await ProxyUtils.process(

backend/src/restful/subscriptions.js

@@ -57,9 +57,25 @@ async function getFlowInfo(req, res) {
         !['localFirst', 'remoteFirst'].includes(sub.mergeSources)
     ) {
         if (sub.subUserinfo) {
-            success(res, {
+            try {
-                ...parseFlowHeaders(sub.subUserinfo),
+                success(res, {
-            });
+                    ...parseFlowHeaders(sub.subUserinfo),
+                });
+            } catch (e) {
+                $.error(
+                    `Failed to parse flow info for local subscription ${name}: ${
+                        e.message ?? e
+                    }`,
+                );
+                failed(
+                    res,
+                    new RequestInvalidError(
+                        'NO_FLOW_INFO',
+                        'N/A',
+                        `Failed to parse flow info`,
+                    ),
+                );
+            }
         } else {
             failed(
                 res,
@@ -110,17 +126,33 @@ async function getFlowInfo(req, res) {
             return;
         }
         if (sub.subUserinfo) {
-            success(res, {
+            try {
-                ...parseFlowHeaders(sub.subUserinfo),
+                success(res, {
-                remainingDays: getRmainingDays({
+                    ...parseFlowHeaders(sub.subUserinfo),
-                    resetDay: $arguments.resetDay,
+                    remainingDays: getRmainingDays({
-                    startDate: $arguments.startDate,
+                        resetDay: $arguments.resetDay,
-                    cycleDays: $arguments.cycleDays,
+                        startDate: $arguments.startDate,
-                }),
+                        cycleDays: $arguments.cycleDays,
-            });
+                    }),
+                });
+            } catch (e) {
+                $.error(
+                    `Failed to parse flow info for local subscription ${name}: ${
+                        e.message ?? e
+                    }`,
+                );
+                failed(
+                    res,
+                    new RequestInvalidError(
+                        'NO_FLOW_INFO',
+                        'N/A',
+                        `Failed to parse flow info`,
+                    ),
+                );
+            }
         } else {
             const flowHeaders = await getFlowHeaders(
-                url,
+                $arguments?.insecure ? `${url}#insecure` : url,
                 $arguments.flowUserAgent,
                 undefined,
                 sub.proxy,

backend/src/restful/sync.js

@@ -38,6 +38,7 @@ async function produceArtifact({
     subscription,
     awaitCustomCache,
     $options,
+    proxy,
 }) {
     platform = platform || 'JSON';
 
@@ -68,7 +69,7 @@ async function produceArtifact({
                                 url,
                                 ua || sub.ua,
                                 undefined,
-                                sub.proxy,
+                                proxy || sub.proxy,
                                 undefined,
                                 awaitCustomCache,
                             );
@@ -115,7 +116,7 @@ async function produceArtifact({
                                 url,
                                 ua || sub.ua,
                                 undefined,
-                                sub.proxy,
+                                proxy || sub.proxy,
                                 undefined,
                                 awaitCustomCache,
                             );
@@ -151,7 +152,8 @@ async function produceArtifact({
             .flat();
 
         proxies.forEach((proxy) => {
-            proxy.subName = sub.name;
+            proxy._subName = sub.name;
+            proxy._subDisplayName = sub.displayName;
         });
         // apply processors
         proxies = await ProxyUtils.process(
@@ -188,7 +190,20 @@ async function produceArtifact({
         const allCols = $.read(COLLECTIONS_KEY);
         const collection = findByName(allCols, name);
         if (!collection) throw new Error(`找不到组合订阅 ${name}`);
-        const subnames = collection.subscriptions;
+        const subnames = [...collection.subscriptions];
+        let subscriptionTags = collection.subscriptionTags;
+        if (Array.isArray(subscriptionTags) && subscriptionTags.length > 0) {
+            allSubs.forEach((sub) => {
+                if (
+                    Array.isArray(sub.tag) &&
+                    sub.tag.length > 0 &&
+                    !subnames.includes(sub.name) &&
+                    sub.tag.some((tag) => subscriptionTags.includes(tag))
+                ) {
+                    subnames.push(sub.name);
+                }
+            });
+        }
         const results = {};
         const errors = {};
         let processed = 0;
@@ -219,7 +234,9 @@ async function produceArtifact({
                                             url,
                                             sub.ua,
                                             undefined,
-                                            sub.proxy,
+                                            proxy ||
+                                                sub.proxy ||
+                                                collection.proxy,
                                         );
                                     } catch (err) {
                                         errors[url] = err;
@@ -252,8 +269,10 @@ async function produceArtifact({
                         .flat();
 
                     currentProxies.forEach((proxy) => {
-                        proxy.subName = sub.name;
+                        proxy._subName = sub.name;
-                        proxy.collectionName = collection.name;
+                        proxy._subDisplayName = sub.displayName;
+                        proxy._collectionName = collection.name;
+                        proxy._collectionDisplayName = collection.displayName;
                     });
 
                     // apply processors
@@ -309,7 +328,8 @@ async function produceArtifact({
         );
 
         proxies.forEach((proxy) => {
-            proxy.collectionName = collection.name;
+            proxy._collectionName = collection.name;
+            proxy._collectionDisplayName = collection.displayName;
         });
 
         // apply own processors
@@ -385,7 +405,12 @@ async function produceArtifact({
                     .filter((i) => i.length)
                     .map(async (url) => {
                         try {
-                            return await download(url, ua || file.ua);
+                            return await download(
+                                url,
+                                ua || file.ua,
+                                undefined,
+                                file.proxy || proxy,
+                            );
                         } catch (err) {
                             errors[url] = err;
                             $.error(
@@ -428,7 +453,12 @@ async function produceArtifact({
                     .filter((i) => i.length)
                     .map(async (url) => {
                         try {
-                            return await download(url, ua || file.ua);
+                            return await download(
+                                url,
+                                ua || file.ua,
+                                undefined,
+                                file.proxy || proxy,
+                            );
                         } catch (err) {
                             errors[url] = err;
                             $.error(
@@ -529,6 +559,16 @@ async function syncArtifacts() {
                 try {
                     if (artifact.sync && artifact.source) {
                         $.info(`正在同步云配置：${artifact.name}...`);
+
+                        const useMihomoExternal =
+                            artifact.platform === 'SurgeMac';
+
+                        if (useMihomoExternal) {
+                            $.info(
+                                `手动指定了 target 为 SurgeMac, 将使用 Mihomo External`,
+                            );
+                        }
+
                         const output = await produceArtifact({
                             type: artifact.type,
                             name: artifact.source,
@@ -536,6 +576,7 @@ async function syncArtifacts() {
                             produceOpts: {
                                 'include-unsupported-proxy':
                                     artifact.includeUnsupportedProxy,
+                                useMihomoExternal,
                             },
                         });
 
@@ -651,12 +692,18 @@ async function syncArtifact(req, res) {
     }
 
     try {
+        const useMihomoExternal = artifact.platform === 'SurgeMac';
+
+        if (useMihomoExternal) {
+            $.info(`手动指定了 target 为 SurgeMac, 将使用 Mihomo External`);
+        }
         const output = await produceArtifact({
             type: artifact.type,
             name: artifact.source,
             platform: artifact.platform,
             produceOpts: {
                 'include-unsupported-proxy': artifact.includeUnsupportedProxy,
+                useMihomoExternal,
             },
         });
 

backend/src/restful/token.js

@@ -0,0 +1,181 @@
+import { deleteByName } from '@/utils/database';
+import { ENV } from '@/vendor/open-api';
+import { TOKENS_KEY, SUBS_KEY, FILES_KEY, COLLECTIONS_KEY } from '@/constants';
+import { failed, success } from '@/restful/response';
+import $ from '@/core/app';
+import { RequestInvalidError, InternalServerError } from '@/restful/errors';
+
+export default function register($app) {
+    if (!$.read(TOKENS_KEY)) $.write([], TOKENS_KEY);
+
+    $app.post('/api/token', signToken);
+
+    $app.route('/api/token/:token').delete(deleteToken);
+
+    $app.route('/api/tokens').get(getAllTokens);
+}
+
+function deleteToken(req, res) {
+    let { token } = req.params;
+    token = decodeURIComponent(token);
+    $.info(`正在删除：${token}`);
+    let allTokens = $.read(TOKENS_KEY);
+    deleteByName(allTokens, token, 'token');
+    $.write(allTokens, TOKENS_KEY);
+    success(res);
+}
+
+function getAllTokens(req, res) {
+    const { type, name } = req.query;
+    const allTokens = $.read(TOKENS_KEY) || [];
+    success(
+        res,
+        type || name
+            ? allTokens.filter(
+                  (item) =>
+                      (type ? item.type === type : true) &&
+                      (name ? item.name === name : true),
+              )
+            : allTokens,
+    );
+}
+
+async function signToken(req, res) {
+    if (!ENV().isNode) {
+        return failed(
+            res,
+            new RequestInvalidError(
+                'INVALID_ENV',
+                `This endpoint is only available in Node.js environment`,
+            ),
+        );
+    }
+    try {
+        const { payload, options } = req.body;
+        const ms = eval(`require("ms")`);
+        let token = payload?.token;
+        if (token != null) {
+            if (typeof token !== 'string' || token.length < 1) {
+                return failed(
+                    res,
+                    new RequestInvalidError(
+                        'INVALID_CUSTOM_TOKEN',
+                        `Invalid custom token: ${token}`,
+                    ),
+                );
+            }
+            const tokens = $.read(TOKENS_KEY) || [];
+            if (tokens.find((t) => t.token === token)) {
+                return failed(
+                    res,
+                    new RequestInvalidError(
+                        'DUPLICATE_TOKEN',
+                        `Token ${token} already exists`,
+                    ),
+                );
+            }
+        }
+        const type = payload?.type;
+        const name = payload?.name;
+        if (!type || !name)
+            return failed(
+                res,
+                new RequestInvalidError(
+                    'INVALID_PAYLOAD',
+                    `payload type and name are required`,
+                ),
+            );
+        if (type === 'col') {
+            const collections = $.read(COLLECTIONS_KEY) || [];
+            const collection = collections.find((c) => c.name === name);
+            if (!collection)
+                return failed(
+                    res,
+                    new RequestInvalidError(
+                        'INVALID_COLLECTION',
+                        `collection ${name} not found`,
+                    ),
+                );
+        } else if (type === 'file') {
+            const files = $.read(FILES_KEY) || [];
+            const file = files.find((f) => f.name === name);
+            if (!file)
+                return failed(
+                    res,
+                    new RequestInvalidError(
+                        'INVALID_FILE',
+                        `file ${name} not found`,
+                    ),
+                );
+        } else if (type === 'sub') {
+            const subs = $.read(SUBS_KEY) || [];
+            const sub = subs.find((s) => s.name === name);
+            if (!sub)
+                return failed(
+                    res,
+                    new RequestInvalidError(
+                        'INVALID_SUB',
+                        `sub ${name} not found`,
+                    ),
+                );
+        } else {
+            return failed(
+                res,
+                new RequestInvalidError(
+                    'INVALID_TYPE',
+                    `type ${name} not supported`,
+                ),
+            );
+        }
+        let expiresIn = options?.expiresIn;
+        if (options?.expiresIn != null) {
+            expiresIn = ms(options.expiresIn);
+            if (expiresIn == null || isNaN(expiresIn) || expiresIn <= 0) {
+                return failed(
+                    res,
+                    new RequestInvalidError(
+                        'INVALID_EXPIRES_IN',
+                        `Invalid expiresIn option: ${options.expiresIn}`,
+                    ),
+                );
+            }
+        }
+        const secret = eval('process.env.SUB_STORE_FRONTEND_BACKEND_PATH');
+        const nanoid = eval(`require("nanoid")`);
+        const tokens = $.read(TOKENS_KEY) || [];
+        // const now = Date.now();
+        // for (const key in tokens) {
+        //     const token = tokens[key];
+        //     if (token.exp != null || token.exp < now) {
+        //         delete tokens[key];
+        //     }
+        // }
+        if (!token) {
+            do {
+                token = nanoid.customAlphabet(nanoid.urlAlphabet)();
+            } while (tokens.find((t) => t.token === token));
+        }
+        tokens.push({
+            ...payload,
+            token,
+            createdAt: Date.now(),
+            expiresIn: expiresIn > 0 ? options?.expiresIn : undefined,
+            exp: expiresIn > 0 ? Date.now() + expiresIn : undefined,
+        });
+
+        $.write(tokens, TOKENS_KEY);
+        return success(res, {
+            token,
+            secret,
+        });
+    } catch (e) {
+        return failed(
+            res,
+            new InternalServerError(
+                'TOKEN_SIGN_FAILED',
+                `Failed to sign token`,
+                `Reason: ${e.message ?? e}`,
+            ),
+        );
+    }
+}

backend/src/utils/database.js

@@ -1,17 +1,17 @@
-export function findByName(list, name) {
+export function findByName(list, name, field = 'name') {
-    return list.find((item) => item.name === name);
+    return list.find((item) => item[field] === name);
 }
 
-export function findIndexByName(list, name) {
+export function findIndexByName(list, name, field = 'name') {
-    return list.findIndex((item) => item.name === name);
+    return list.findIndex((item) => item[field] === name);
 }
 
-export function deleteByName(list, name) {
+export function deleteByName(list, name, field = 'name') {
-    const idx = findIndexByName(list, name);
+    const idx = findIndexByName(list, name, field);
     list.splice(idx, 1);
 }
 
-export function updateByName(list, name, newItem) {
+export function updateByName(list, name, newItem, field = 'name') {
-    const idx = findIndexByName(list, name);
+    const idx = findIndexByName(list, name, field);
     list[idx] = newItem;
 }

backend/src/utils/download.js

@@ -18,7 +18,7 @@ export default async function download(
     rawUrl = '',
     ua,
     timeout,
-    proxy,
+    customProxy,
     skipCustomCache,
     awaitCustomCache,
 ) {
@@ -43,12 +43,21 @@ export default async function download(
         }
     }
     const { isNode, isStash, isLoon, isShadowRocket, isQX } = ENV();
-    const { defaultUserAgent, defaultTimeout, cacheThreshold } =
+    const { defaultProxy, defaultUserAgent, defaultTimeout, cacheThreshold } =
         $.read(SETTINGS_KEY);
+    let proxy = customProxy || defaultProxy;
+    if ($.env.isNode) {
+        proxy = proxy || eval('process.env.SUB_STORE_BACKEND_DEFAULT_PROXY');
+    }
     const userAgent = ua || defaultUserAgent || 'clash.meta';
     const requestTimeout = timeout || defaultTimeout;
     const id = hex_md5(userAgent + url);
 
+    if ($arguments?.cacheKey === true) {
+        $.error(`使用自定义缓存时 cacheKey 的值不能为空`);
+        $arguments.cacheKey = undefined;
+    }
+
     const customCacheKey = $arguments?.cacheKey
         ? `#sub-store-cached-custom-${$arguments?.cacheKey}`
         : undefined;
@@ -148,8 +157,13 @@ export default async function download(
             $.write(cached, customCacheKey);
         }
     } else {
+        const insecure = $arguments?.insecure
+            ? isNode
+                ? { strictSSL: false }
+                : { insecure: true }
+            : undefined;
         $.info(
-            `Downloading...\nUser-Agent: ${userAgent}\nTimeout: ${requestTimeout}\nProxy: ${proxy}\nURL: ${url}`,
+            `Downloading...\nUser-Agent: ${userAgent}\nTimeout: ${requestTimeout}\nProxy: ${proxy}\nInsecure: ${!!insecure}\nURL: ${url}`,
         );
         try {
             const { body, headers } = await http.get({
@@ -158,6 +172,7 @@ export default async function download(
                 ...(isLoon && proxy ? { node: proxy } : {}),
                 ...(isQX && proxy ? { opts: { policy: proxy } } : {}),
                 ...(proxy ? getPolicyDescriptor(proxy) : {}),
+                ...(insecure ? insecure : {}),
             });
 
             if (headers) {

backend/src/utils/env.js

@@ -24,6 +24,7 @@ if (isLanceX) backend = 'LanceX';
 if (isGUIforCores) backend = 'GUI.for.Cores';
 
 let meta = {};
+let feature = {};
 
 try {
     if (typeof $environment !== 'undefined') {
@@ -63,5 +64,6 @@ try {
 export default {
     backend,
     version: substoreVersion,
+    feature,
     meta,
 };

backend/src/utils/flow.js

@@ -10,7 +10,13 @@ export function getFlowField(headers) {
     )[0];
     return headers[subkey];
 }
-export async function getFlowHeaders(rawUrl, ua, timeout, proxy, flowUrl) {
+export async function getFlowHeaders(
+    rawUrl,
+    ua,
+    timeout,
+    customProxy,
+    flowUrl,
+) {
     let url = flowUrl || rawUrl || '';
     let $arguments = {};
     const rawArgs = url.split('#');
@@ -41,7 +47,18 @@ export async function getFlowHeaders(rawUrl, ua, timeout, proxy, flowUrl) {
         // $.info(`使用缓存的流量信息: ${url}`);
         flowInfo = cached;
     } else {
-        const { defaultFlowUserAgent, defaultTimeout } = $.read(SETTINGS_KEY);
+        const insecure = $arguments?.insecure
+            ? $.env.isNode
+                ? { strictSSL: false }
+                : { insecure: true }
+            : undefined;
+        const { defaultProxy, defaultFlowUserAgent, defaultTimeout } =
+            $.read(SETTINGS_KEY);
+        let proxy = customProxy || defaultProxy;
+        if ($.env.isNode) {
+            proxy =
+                proxy || eval('process.env.SUB_STORE_BACKEND_DEFAULT_PROXY');
+        }
         const userAgent =
             ua ||
             defaultFlowUserAgent ||
@@ -52,7 +69,7 @@ export async function getFlowHeaders(rawUrl, ua, timeout, proxy, flowUrl) {
             $.info(
                 `使用 GET 方法从响应体获取流量信息: ${flowUrl}, User-Agent: ${
                     userAgent || ''
-                }`,
+                }, Insecure: ${!!insecure}, Proxy: ${proxy}`,
             );
             const { body } = await http.get({
                 url: flowUrl,
@@ -60,6 +77,11 @@ export async function getFlowHeaders(rawUrl, ua, timeout, proxy, flowUrl) {
                     'User-Agent': userAgent,
                 },
                 timeout: requestTimeout,
+                ...(proxy ? { proxy } : {}),
+                ...(isLoon && proxy ? { node: proxy } : {}),
+                ...(isQX && proxy ? { opts: { policy: proxy } } : {}),
+                ...(proxy ? getPolicyDescriptor(proxy) : {}),
+                ...(insecure ? insecure : {}),
             });
             flowInfo = body;
         } else {
@@ -67,7 +89,7 @@ export async function getFlowHeaders(rawUrl, ua, timeout, proxy, flowUrl) {
                 $.info(
                     `使用 HEAD 方法从响应头获取流量信息: ${url}, User-Agent: ${
                         userAgent || ''
-                    }`,
+                    }, Insecure: ${!!insecure}, Proxy: ${proxy}`,
                 );
                 const { headers } = await http.head({
                     url: url
@@ -91,20 +113,23 @@ export async function getFlowHeaders(rawUrl, ua, timeout, proxy, flowUrl) {
                     ...(isLoon && proxy ? { node: proxy } : {}),
                     ...(isQX && proxy ? { opts: { policy: proxy } } : {}),
                     ...(proxy ? getPolicyDescriptor(proxy) : {}),
+                    ...(insecure ? insecure : {}),
                 });
                 flowInfo = getFlowField(headers);
             } catch (e) {
                 $.error(
                     `使用 HEAD 方法从响应头获取流量信息失败: ${url}, User-Agent: ${
                         userAgent || ''
-                    }: ${e.message ?? e}`,
+                    }, Insecure: ${!!insecure}, Proxy: ${proxy}: ${
+                        e.message ?? e
+                    }`,
                 );
             }
             if (!flowInfo) {
                 $.info(
                     `使用 GET 方法获取流量信息: ${url}, User-Agent: ${
                         userAgent || ''
-                    }`,
+                    }, Insecure: ${!!insecure}, Proxy: ${proxy}`,
                 );
                 const { headers } = await http.get({
                     url: url
@@ -113,8 +138,22 @@ export async function getFlowHeaders(rawUrl, ua, timeout, proxy, flowUrl) {
                         .filter((i) => i.length)[0],
                     headers: {
                         'User-Agent': userAgent,
+                        ...(isStash && proxy
+                            ? {
+                                  'X-Stash-Selected-Proxy':
+                                      encodeURIComponent(proxy),
+                              }
+                            : {}),
+                        ...(isShadowRocket && proxy
+                            ? { 'X-Surge-Policy': proxy }
+                            : {}),
                     },
                     timeout: requestTimeout,
+                    ...(proxy ? { proxy } : {}),
+                    ...(isLoon && proxy ? { node: proxy } : {}),
+                    ...(isQX && proxy ? { opts: { policy: proxy } } : {}),
+                    ...(proxy ? getPolicyDescriptor(proxy) : {}),
+                    ...(insecure ? insecure : {}),
                 });
                 flowInfo = getFlowField(headers);
             }

backend/src/utils/geo.js

@@ -474,4 +474,7 @@ export class MMDB {
     ipaso(ip) {
         return this.asnReader?.asn(ip)?.autonomousSystemOrganization;
     }
+    ipasn(ip) {
+        return this.asnReader?.asn(ip)?.autonomousSystemNumber;
+    }
 }

backend/src/utils/gist.js

@@ -1,10 +1,21 @@
-import { HTTP } from '@/vendor/open-api';
+import { HTTP, ENV } from '@/vendor/open-api';
+import { getPolicyDescriptor } from '@/utils';
+import $ from '@/core/app';
+import { SETTINGS_KEY } from '@/constants';
 
 /**
  * Gist backup
  */
 export default class Gist {
     constructor({ token, key, syncPlatform }) {
+        const { isStash, isLoon, isShadowRocket, isQX } = ENV();
+        const { defaultProxy, defaultTimeout: timeout } = $.read(SETTINGS_KEY);
+        let proxy = defaultProxy;
+        if ($.env.isNode) {
+            proxy =
+                proxy || eval('process.env.SUB_STORE_BACKEND_DEFAULT_PROXY');
+        }
+
         if (syncPlatform === 'gitlab') {
             this.headers = {
                 'PRIVATE-TOKEN': `${token}`,
@@ -13,7 +24,25 @@ export default class Gist {
             };
             this.http = HTTP({
                 baseURL: 'https://gitlab.com/api/v4',
-                headers: { ...this.headers },
+                headers: {
+                    ...this.headers,
+                    ...(isStash && proxy
+                        ? {
+                              'X-Stash-Selected-Proxy':
+                                  encodeURIComponent(proxy),
+                          }
+                        : {}),
+                    ...(isShadowRocket && proxy
+                        ? { 'X-Surge-Policy': proxy }
+                        : {}),
+                },
+
+                ...(proxy ? { proxy } : {}),
+                ...(isLoon && proxy ? { node: proxy } : {}),
+                ...(isQX && proxy ? { opts: { policy: proxy } } : {}),
+                ...(proxy ? getPolicyDescriptor(proxy) : {}),
+                timeout,
+
                 events: {
                     onResponse: (resp) => {
                         if (/^[45]/.test(String(resp.statusCode))) {
@@ -35,7 +64,25 @@ export default class Gist {
             };
             this.http = HTTP({
                 baseURL: 'https://api.github.com',
-                headers: { ...this.headers },
+                headers: {
+                    ...this.headers,
+                    ...(isStash && proxy
+                        ? {
+                              'X-Stash-Selected-Proxy':
+                                  encodeURIComponent(proxy),
+                          }
+                        : {}),
+                    ...(isShadowRocket && proxy
+                        ? { 'X-Surge-Policy': proxy }
+                        : {}),
+                },
+
+                ...(proxy ? { proxy } : {}),
+                ...(isLoon && proxy ? { node: proxy } : {}),
+                ...(isQX && proxy ? { opts: { policy: proxy } } : {}),
+                ...(proxy ? getPolicyDescriptor(proxy) : {}),
+                timeout,
+
                 events: {
                     onResponse: (resp) => {
                         if (/^[45]/.test(String(resp.statusCode))) {

backend/src/utils/index.js

@@ -111,6 +111,12 @@ function getRandomPort(portString) {
     }
 }
 
+function numberToString(value) {
+    return Number.isSafeInteger(value)
+        ? String(value)
+        : BigInt(value).toString();
+}
+
 export {
     ipAddress,
     isIPv4,
@@ -123,4 +129,5 @@ export {
     // utf8ArrayToStr,
     getPolicyDescriptor,
     getRandomPort,
+    numberToString,
 };

backend/src/utils/yaml.js

@@ -17,16 +17,16 @@ function retry(fn, content, ...args) {
 }
 
 export function safeLoad(content, ...args) {
-    return retry(YAML.safeLoad, content, ...args);
+    return retry(YAML.safeLoad, JSON.parse(JSON.stringify(content)), ...args);
 }
 export function load(content, ...args) {
-    return retry(YAML.load, content, ...args);
+    return retry(YAML.load, JSON.parse(JSON.stringify(content)), ...args);
 }
-export function safeDump(...args) {
+export function safeDump(content, ...args) {
-    return YAML.safeDump(...args);
+    return YAML.safeDump(JSON.parse(JSON.stringify(content)), ...args);
 }
-export function dump(...args) {
+export function dump(content, ...args) {
-    return YAML.dump(...args);
+    return YAML.dump(JSON.parse(JSON.stringify(content)), ...args);
 }
 
 export default {

scripts/demo.js

@@ -10,14 +10,17 @@ function operator(proxies = [], targetPlatform, context) {
   // 2. 域名解析后 会多一个 `_resolved` 字段, 表示是否解析成功
   // 3. 域名解析后会有`_IPv4`, `_IPv6`, `_IP`(若有多个步骤, 只取第一次成功的 v4 或 v6 数据), `_IP4P`(若解析类型为 IPv6 且符合 IP4P 类型, 将自动转换), `_domain` 字段, `_resolved_ips` 为解析出的所有 IP
   // 4. 节点字段 `exec` 为 `ssr-local` 路径, 默认 `/usr/local/bin/ssr-local`; 端口从 10000 开始递增(暂不支持配置)
-  // 5. `_subName` 为单条订阅名
+  // 5. `_subName` 为单条订阅名, `_subDisplayName` 为单条订阅显示名
-  // 6. `_collectionName` 为组合订阅名
+  // 6. `_collectionName` 为组合订阅名, `_collectionDisplayName` 为组合订阅显示名
   // 7. `tls-fingerprint` 为 tls 指纹
   // 8. `underlying-proxy` 为前置代理
   // 9. `trojan`, `tuic`, `hysteria`, `hysteria2`, `juicity` 会在解析时设置 `tls`: true (会使用 tls 类协议的通用逻辑),  输出时删除
   // 10. `sni` 在某些协议里会自动与 `servername` 转换
   // 11. 读取节点的 ca-str 和 _ca (后端文件路径) 字段, 自动计算 fingerprint (参考 https://t.me/zhetengsha/1512)
   // 12. 以 Surge 为例, 最新的参数一般我都会跟进, 以 Surge 文档为例, 一些常用的: TUIC/Hysteria 2 的 `ecn`, Snell 的 `reuse` 连接复用, QUIC 策略 block-quic`, Hysteria 2 下载带宽 `down`
+  // 13. `test-url` 为测延迟链接, `test-timeout` 为测延迟超时
+  // 14. `ports` 为端口跳跃, `hop-interval` 变换端口号的时间间隔
+  // 15. `ip-version` 设置节点使用 IP 版本，可选：dual，ipv4，ipv6，ipv4-prefer，ipv6-prefer. 会进行内部转换, 若无法匹配则使用原始值
 
   // require 为 Node.js 的 require, 在 Node.js 运行环境下 可以用来引入模块
 
@@ -63,6 +66,8 @@ function operator(proxies = [], targetPlatform, context) {
   //     removeFlag, // 移除 emoji 旗帜
   //     getISO, // 获取 ISO 3166-1 alpha-2 代码
   //     Gist, // Gist 类
+  //     download, // 内部的下载方法, 见 backend/src/utils/download.js
+  //     MMDB, // Node.js 环境 可用于模拟 Surge/Loon 的 $utils.ipasn, $utils.ipaso, $utils.geoip. 具体见 https://t.me/zhetengsha/1269
   // }
 
   // 如果只是为了快速修改或者筛选 可以参考 脚本操作支持节点快捷脚本 https://t.me/zhetengsha/970 和 脚本筛选支持节点快捷脚本 https://t.me/zhetengsha/1009
@@ -152,7 +157,7 @@ function operator(proxies = [], targetPlatform, context) {
   // 1. https://t.me/zhetengsha/948
 
   // context 为传入的上下文
-  // 其中 source 为 订阅和组合订阅的数据, 有三种情况, 按需判断
+  // 其中 source 为 订阅和组合订阅的数据, 有三种情况, 按需判断 (若只需要取订阅/组合订阅名称 直接用 `_subName` `_subDisplayName` `_collectionName` `_collectionDisplayName` 即可)
 
   // 若存在 `source._collection` 且 `source._collection.subscriptions` 中的 key 在 `source` 上也存在, 说明输出结果为组合订阅, 但是脚本设置在单条订阅上