Update documentation

adapter/experimental.go

@@ -109,7 +109,7 @@ type OutboundGroup interface {
 
 type URLTestGroup interface {
 	OutboundGroup
-	URLTest(ctx context.Context, url string) (map[string]uint16, error)
+	URLTest(ctx context.Context) (map[string]uint16, error)
 }
 
 func OutboundTag(detour Outbound) string {

adapter/inbound.go

@@ -46,12 +46,24 @@ type InboundContext struct {
 	SourceGeoIPCode      string
 	GeoIPCode            string
 	ProcessInfo          *process.Info
+	QueryType            uint16
 	FakeIP               bool
-	IPCIDRMatchSource    bool
 
-	// dns cache
+	// rule cache
 
-	QueryType uint16
+	IPCIDRMatchSource       bool
+	SourceAddressMatch      bool
+	SourcePortMatch         bool
+	DestinationAddressMatch bool
+	DestinationPortMatch    bool
+}
+
+func (c *InboundContext) ResetRuleCache() {
+	c.IPCIDRMatchSource = false
+	c.SourceAddressMatch = false
+	c.SourcePortMatch = false
+	c.DestinationAddressMatch = false
+	c.DestinationPortMatch = false
 }
 
 type inboundContextKey struct{}

adapter/router.go

@@ -17,6 +17,7 @@ import (
 
 type Router interface {
 	Service
+	PostStarter
 
 	Outbounds() []Outbound
 	Outbound(tag string) (Outbound, bool)
@@ -86,6 +87,7 @@ type DNSRule interface {
 
 type RuleSet interface {
 	StartContext(ctx context.Context, startContext RuleSetStartContext) error
+	PostStart() error
 	Close() error
 	HeadlessRule
 }

box.go

@@ -287,7 +287,7 @@ func (s *Box) start() error {
 			return E.Cause(err, "initialize inbound/", in.Type(), "[", tag, "]")
 		}
 	}
-	return nil
+	return s.postStart()
 }
 
 func (s *Box) postStart() error {
@@ -298,16 +298,21 @@ func (s *Box) postStart() error {
 			return E.Cause(err, "start ", serviceName)
 		}
 	}
-	for serviceName, service := range s.outbounds {
-		if lateService, isLateService := service.(adapter.PostStarter); isLateService {
-			s.logger.Trace("post-starting ", service)
-			err := lateService.PostStart()
+	for _, outbound := range s.outbounds {
+		if lateOutbound, isLateOutbound := outbound.(adapter.PostStarter); isLateOutbound {
+			s.logger.Trace("post-starting outbound/", outbound.Tag())
+			err := lateOutbound.PostStart()
 			if err != nil {
-				return E.Cause(err, "post-start ", serviceName)
+				return E.Cause(err, "post-start outbound/", outbound.Tag())
 			}
 		}
 	}
-	return nil
+	s.logger.Trace("post-starting router")
+	err := s.router.PostStart()
+	if err != nil {
+		return E.Cause(err, "post-start router")
+	}
+	return s.router.PostStart()
 }
 
 func (s *Box) Close() error {

cmd/sing-box/cmd_geosite_export.go

@@ -1,11 +1,11 @@
 package main
 
 import (
-	"encoding/json"
 	"io"
 	"os"
 
 	"github.com/sagernet/sing-box/common/geosite"
+	"github.com/sagernet/sing-box/common/json"
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"

common/badjsonmerge/merge.go

@@ -1,10 +1,10 @@
 package badjsonmerge
 
 import (
-	"encoding/json"
 	"reflect"
 
 	"github.com/sagernet/sing-box/common/badjson"
+	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
 )

common/contextjson/README.md

@@ -0,0 +1,3 @@
+# contextjson
+
+mod from go1.21.4

common/contextjson/decode_context.go

@@ -0,0 +1,49 @@
+package json
+
+import "strconv"
+
+type decodeContext struct {
+	parent *decodeContext
+	index  int
+	key    string
+}
+
+func (d *decodeState) formatContext() string {
+	var description string
+	context := d.context
+	var appendDot bool
+	for context != nil {
+		if appendDot {
+			description = "." + description
+		}
+		if context.key != "" {
+			description = context.key + description
+			appendDot = true
+		} else {
+			description = "[" + strconv.Itoa(context.index) + "]" + description
+			appendDot = false
+		}
+		context = context.parent
+	}
+	return description
+}
+
+type contextError struct {
+	parent  error
+	context string
+	index   bool
+}
+
+func (c *contextError) Unwrap() error {
+	return c.parent
+}
+
+func (c *contextError) Error() string {
+	//goland:noinspection GoTypeAssertionOnErrors
+	switch c.parent.(type) {
+	case *contextError:
+		return c.context + "." + c.parent.Error()
+	default:
+		return c.context + ": " + c.parent.Error()
+	}
+}

common/contextjson/fold.go

@@ -0,0 +1,48 @@
+// Copyright 2013 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"unicode"
+	"unicode/utf8"
+)
+
+// foldName returns a folded string such that foldName(x) == foldName(y)
+// is identical to bytes.EqualFold(x, y).
+func foldName(in []byte) []byte {
+	// This is inlinable to take advantage of "function outlining".
+	var arr [32]byte // large enough for most JSON names
+	return appendFoldedName(arr[:0], in)
+}
+
+func appendFoldedName(out, in []byte) []byte {
+	for i := 0; i < len(in); {
+		// Handle single-byte ASCII.
+		if c := in[i]; c < utf8.RuneSelf {
+			if 'a' <= c && c <= 'z' {
+				c -= 'a' - 'A'
+			}
+			out = append(out, c)
+			i++
+			continue
+		}
+		// Handle multi-byte Unicode.
+		r, n := utf8.DecodeRune(in[i:])
+		out = utf8.AppendRune(out, foldRune(r))
+		i += n
+	}
+	return out
+}
+
+// foldRune is returns the smallest rune for all runes in the same fold set.
+func foldRune(r rune) rune {
+	for {
+		r2 := unicode.SimpleFold(r)
+		if r2 <= r {
+			return r2
+		}
+		r = r2
+	}
+}

common/contextjson/indent.go

@@ -0,0 +1,174 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import "bytes"
+
+// HTMLEscape appends to dst the JSON-encoded src with <, >, &, U+2028 and U+2029
+// characters inside string literals changed to \u003c, \u003e, \u0026, \u2028, \u2029
+// so that the JSON will be safe to embed inside HTML <script> tags.
+// For historical reasons, web browsers don't honor standard HTML
+// escaping within <script> tags, so an alternative JSON encoding must be used.
+func HTMLEscape(dst *bytes.Buffer, src []byte) {
+	dst.Grow(len(src))
+	dst.Write(appendHTMLEscape(dst.AvailableBuffer(), src))
+}
+
+func appendHTMLEscape(dst, src []byte) []byte {
+	// The characters can only appear in string literals,
+	// so just scan the string one byte at a time.
+	start := 0
+	for i, c := range src {
+		if c == '<' || c == '>' || c == '&' {
+			dst = append(dst, src[start:i]...)
+			dst = append(dst, '\\', 'u', '0', '0', hex[c>>4], hex[c&0xF])
+			start = i + 1
+		}
+		// Convert U+2028 and U+2029 (E2 80 A8 and E2 80 A9).
+		if c == 0xE2 && i+2 < len(src) && src[i+1] == 0x80 && src[i+2]&^1 == 0xA8 {
+			dst = append(dst, src[start:i]...)
+			dst = append(dst, '\\', 'u', '2', '0', '2', hex[src[i+2]&0xF])
+			start = i + len("\u2029")
+		}
+	}
+	return append(dst, src[start:]...)
+}
+
+// Compact appends to dst the JSON-encoded src with
+// insignificant space characters elided.
+func Compact(dst *bytes.Buffer, src []byte) error {
+	dst.Grow(len(src))
+	b := dst.AvailableBuffer()
+	b, err := appendCompact(b, src, false)
+	dst.Write(b)
+	return err
+}
+
+func appendCompact(dst, src []byte, escape bool) ([]byte, error) {
+	origLen := len(dst)
+	scan := newScanner()
+	defer freeScanner(scan)
+	start := 0
+	for i, c := range src {
+		if escape && (c == '<' || c == '>' || c == '&') {
+			dst = append(dst, src[start:i]...)
+			dst = append(dst, '\\', 'u', '0', '0', hex[c>>4], hex[c&0xF])
+			start = i + 1
+		}
+		// Convert U+2028 and U+2029 (E2 80 A8 and E2 80 A9).
+		if escape && c == 0xE2 && i+2 < len(src) && src[i+1] == 0x80 && src[i+2]&^1 == 0xA8 {
+			dst = append(dst, src[start:i]...)
+			dst = append(dst, '\\', 'u', '2', '0', '2', hex[src[i+2]&0xF])
+			start = i + len("\u2029")
+		}
+		v := scan.step(scan, c)
+		if v >= scanSkipSpace {
+			if v == scanError {
+				break
+			}
+			dst = append(dst, src[start:i]...)
+			start = i + 1
+		}
+	}
+	if scan.eof() == scanError {
+		return dst[:origLen], scan.err
+	}
+	dst = append(dst, src[start:]...)
+	return dst, nil
+}
+
+func appendNewline(dst []byte, prefix, indent string, depth int) []byte {
+	dst = append(dst, '\n')
+	dst = append(dst, prefix...)
+	for i := 0; i < depth; i++ {
+		dst = append(dst, indent...)
+	}
+	return dst
+}
+
+// indentGrowthFactor specifies the growth factor of indenting JSON input.
+// Empirically, the growth factor was measured to be between 1.4x to 1.8x
+// for some set of compacted JSON with the indent being a single tab.
+// Specify a growth factor slightly larger than what is observed
+// to reduce probability of allocation in appendIndent.
+// A factor no higher than 2 ensures that wasted space never exceeds 50%.
+const indentGrowthFactor = 2
+
+// Indent appends to dst an indented form of the JSON-encoded src.
+// Each element in a JSON object or array begins on a new,
+// indented line beginning with prefix followed by one or more
+// copies of indent according to the indentation nesting.
+// The data appended to dst does not begin with the prefix nor
+// any indentation, to make it easier to embed inside other formatted JSON data.
+// Although leading space characters (space, tab, carriage return, newline)
+// at the beginning of src are dropped, trailing space characters
+// at the end of src are preserved and copied to dst.
+// For example, if src has no trailing spaces, neither will dst;
+// if src ends in a trailing newline, so will dst.
+func Indent(dst *bytes.Buffer, src []byte, prefix, indent string) error {
+	dst.Grow(indentGrowthFactor * len(src))
+	b := dst.AvailableBuffer()
+	b, err := appendIndent(b, src, prefix, indent)
+	dst.Write(b)
+	return err
+}
+
+func appendIndent(dst, src []byte, prefix, indent string) ([]byte, error) {
+	origLen := len(dst)
+	scan := newScanner()
+	defer freeScanner(scan)
+	needIndent := false
+	depth := 0
+	for _, c := range src {
+		scan.bytes++
+		v := scan.step(scan, c)
+		if v == scanSkipSpace {
+			continue
+		}
+		if v == scanError {
+			break
+		}
+		if needIndent && v != scanEndObject && v != scanEndArray {
+			needIndent = false
+			depth++
+			dst = appendNewline(dst, prefix, indent, depth)
+		}
+
+		// Emit semantically uninteresting bytes
+		// (in particular, punctuation in strings) unmodified.
+		if v == scanContinue {
+			dst = append(dst, c)
+			continue
+		}
+
+		// Add spacing around real punctuation.
+		switch c {
+		case '{', '[':
+			// delay indent so that empty object and array are formatted as {} and [].
+			needIndent = true
+			dst = append(dst, c)
+		case ',':
+			dst = append(dst, c)
+			dst = appendNewline(dst, prefix, indent, depth)
+		case ':':
+			dst = append(dst, c, ' ')
+		case '}', ']':
+			if needIndent {
+				// suppress indent in empty object/array
+				needIndent = false
+			} else {
+				depth--
+				dst = appendNewline(dst, prefix, indent, depth)
+			}
+			dst = append(dst, c)
+		default:
+			dst = append(dst, c)
+		}
+	}
+	if scan.eof() == scanError {
+		return dst[:origLen], scan.err
+	}
+	return dst, nil
+}

common/contextjson/scanner.go

@@ -0,0 +1,610 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+// JSON value parser state machine.
+// Just about at the limit of what is reasonable to write by hand.
+// Some parts are a bit tedious, but overall it nicely factors out the
+// otherwise common code from the multiple scanning functions
+// in this package (Compact, Indent, checkValid, etc).
+//
+// This file starts with two simple examples using the scanner
+// before diving into the scanner itself.
+
+import (
+	"strconv"
+	"sync"
+)
+
+// Valid reports whether data is a valid JSON encoding.
+func Valid(data []byte) bool {
+	scan := newScanner()
+	defer freeScanner(scan)
+	return checkValid(data, scan) == nil
+}
+
+// checkValid verifies that data is valid JSON-encoded data.
+// scan is passed in for use by checkValid to avoid an allocation.
+// checkValid returns nil or a SyntaxError.
+func checkValid(data []byte, scan *scanner) error {
+	scan.reset()
+	for _, c := range data {
+		scan.bytes++
+		if scan.step(scan, c) == scanError {
+			return scan.err
+		}
+	}
+	if scan.eof() == scanError {
+		return scan.err
+	}
+	return nil
+}
+
+// A SyntaxError is a description of a JSON syntax error.
+// Unmarshal will return a SyntaxError if the JSON can't be parsed.
+type SyntaxError struct {
+	msg    string // description of error
+	Offset int64  // error occurred after reading Offset bytes
+}
+
+func (e *SyntaxError) Error() string { return e.msg }
+
+// A scanner is a JSON scanning state machine.
+// Callers call scan.reset and then pass bytes in one at a time
+// by calling scan.step(&scan, c) for each byte.
+// The return value, referred to as an opcode, tells the
+// caller about significant parsing events like beginning
+// and ending literals, objects, and arrays, so that the
+// caller can follow along if it wishes.
+// The return value scanEnd indicates that a single top-level
+// JSON value has been completed, *before* the byte that
+// just got passed in.  (The indication must be delayed in order
+// to recognize the end of numbers: is 123 a whole value or
+// the beginning of 12345e+6?).
+type scanner struct {
+	// The step is a func to be called to execute the next transition.
+	// Also tried using an integer constant and a single func
+	// with a switch, but using the func directly was 10% faster
+	// on a 64-bit Mac Mini, and it's nicer to read.
+	step func(*scanner, byte) int
+
+	// Reached end of top-level value.
+	endTop bool
+
+	// Stack of what we're in the middle of - array values, object keys, object values.
+	parseState []int
+
+	// Error that happened, if any.
+	err error
+
+	// total bytes consumed, updated by decoder.Decode (and deliberately
+	// not set to zero by scan.reset)
+	bytes int64
+}
+
+var scannerPool = sync.Pool{
+	New: func() any {
+		return &scanner{}
+	},
+}
+
+func newScanner() *scanner {
+	scan := scannerPool.Get().(*scanner)
+	// scan.reset by design doesn't set bytes to zero
+	scan.bytes = 0
+	scan.reset()
+	return scan
+}
+
+func freeScanner(scan *scanner) {
+	// Avoid hanging on to too much memory in extreme cases.
+	if len(scan.parseState) > 1024 {
+		scan.parseState = nil
+	}
+	scannerPool.Put(scan)
+}
+
+// These values are returned by the state transition functions
+// assigned to scanner.state and the method scanner.eof.
+// They give details about the current state of the scan that
+// callers might be interested to know about.
+// It is okay to ignore the return value of any particular
+// call to scanner.state: if one call returns scanError,
+// every subsequent call will return scanError too.
+const (
+	// Continue.
+	scanContinue     = iota // uninteresting byte
+	scanBeginLiteral        // end implied by next result != scanContinue
+	scanBeginObject         // begin object
+	scanObjectKey           // just finished object key (string)
+	scanObjectValue         // just finished non-last object value
+	scanEndObject           // end object (implies scanObjectValue if possible)
+	scanBeginArray          // begin array
+	scanArrayValue          // just finished array value
+	scanEndArray            // end array (implies scanArrayValue if possible)
+	scanSkipSpace           // space byte; can skip; known to be last "continue" result
+
+	// Stop.
+	scanEnd   // top-level value ended *before* this byte; known to be first "stop" result
+	scanError // hit an error, scanner.err.
+)
+
+// These values are stored in the parseState stack.
+// They give the current state of a composite value
+// being scanned. If the parser is inside a nested value
+// the parseState describes the nested state, outermost at entry 0.
+const (
+	parseObjectKey   = iota // parsing object key (before colon)
+	parseObjectValue        // parsing object value (after colon)
+	parseArrayValue         // parsing array value
+)
+
+// This limits the max nesting depth to prevent stack overflow.
+// This is permitted by https://tools.ietf.org/html/rfc7159#section-9
+const maxNestingDepth = 10000
+
+// reset prepares the scanner for use.
+// It must be called before calling s.step.
+func (s *scanner) reset() {
+	s.step = stateBeginValue
+	s.parseState = s.parseState[0:0]
+	s.err = nil
+	s.endTop = false
+}
+
+// eof tells the scanner that the end of input has been reached.
+// It returns a scan status just as s.step does.
+func (s *scanner) eof() int {
+	if s.err != nil {
+		return scanError
+	}
+	if s.endTop {
+		return scanEnd
+	}
+	s.step(s, ' ')
+	if s.endTop {
+		return scanEnd
+	}
+	if s.err == nil {
+		s.err = &SyntaxError{"unexpected end of JSON input", s.bytes}
+	}
+	return scanError
+}
+
+// pushParseState pushes a new parse state p onto the parse stack.
+// an error state is returned if maxNestingDepth was exceeded, otherwise successState is returned.
+func (s *scanner) pushParseState(c byte, newParseState int, successState int) int {
+	s.parseState = append(s.parseState, newParseState)
+	if len(s.parseState) <= maxNestingDepth {
+		return successState
+	}
+	return s.error(c, "exceeded max depth")
+}
+
+// popParseState pops a parse state (already obtained) off the stack
+// and updates s.step accordingly.
+func (s *scanner) popParseState() {
+	n := len(s.parseState) - 1
+	s.parseState = s.parseState[0:n]
+	if n == 0 {
+		s.step = stateEndTop
+		s.endTop = true
+	} else {
+		s.step = stateEndValue
+	}
+}
+
+func isSpace(c byte) bool {
+	return c <= ' ' && (c == ' ' || c == '\t' || c == '\r' || c == '\n')
+}
+
+// stateBeginValueOrEmpty is the state after reading `[`.
+func stateBeginValueOrEmpty(s *scanner, c byte) int {
+	if isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == ']' {
+		return stateEndValue(s, c)
+	}
+	return stateBeginValue(s, c)
+}
+
+// stateBeginValue is the state at the beginning of the input.
+func stateBeginValue(s *scanner, c byte) int {
+	if isSpace(c) {
+		return scanSkipSpace
+	}
+	switch c {
+	case '{':
+		s.step = stateBeginStringOrEmpty
+		return s.pushParseState(c, parseObjectKey, scanBeginObject)
+	case '[':
+		s.step = stateBeginValueOrEmpty
+		return s.pushParseState(c, parseArrayValue, scanBeginArray)
+	case '"':
+		s.step = stateInString
+		return scanBeginLiteral
+	case '-':
+		s.step = stateNeg
+		return scanBeginLiteral
+	case '0': // beginning of 0.123
+		s.step = state0
+		return scanBeginLiteral
+	case 't': // beginning of true
+		s.step = stateT
+		return scanBeginLiteral
+	case 'f': // beginning of false
+		s.step = stateF
+		return scanBeginLiteral
+	case 'n': // beginning of null
+		s.step = stateN
+		return scanBeginLiteral
+	}
+	if '1' <= c && c <= '9' { // beginning of 1234.5
+		s.step = state1
+		return scanBeginLiteral
+	}
+	return s.error(c, "looking for beginning of value")
+}
+
+// stateBeginStringOrEmpty is the state after reading `{`.
+func stateBeginStringOrEmpty(s *scanner, c byte) int {
+	if isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == '}' {
+		n := len(s.parseState)
+		s.parseState[n-1] = parseObjectValue
+		return stateEndValue(s, c)
+	}
+	return stateBeginString(s, c)
+}
+
+// stateBeginString is the state after reading `{"key": value,`.
+func stateBeginString(s *scanner, c byte) int {
+	if isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == '"' {
+		s.step = stateInString
+		return scanBeginLiteral
+	}
+	return s.error(c, "looking for beginning of object key string")
+}
+
+// stateEndValue is the state after completing a value,
+// such as after reading `{}` or `true` or `["x"`.
+func stateEndValue(s *scanner, c byte) int {
+	n := len(s.parseState)
+	if n == 0 {
+		// Completed top-level before the current byte.
+		s.step = stateEndTop
+		s.endTop = true
+		return stateEndTop(s, c)
+	}
+	if isSpace(c) {
+		s.step = stateEndValue
+		return scanSkipSpace
+	}
+	ps := s.parseState[n-1]
+	switch ps {
+	case parseObjectKey:
+		if c == ':' {
+			s.parseState[n-1] = parseObjectValue
+			s.step = stateBeginValue
+			return scanObjectKey
+		}
+		return s.error(c, "after object key")
+	case parseObjectValue:
+		if c == ',' {
+			s.parseState[n-1] = parseObjectKey
+			s.step = stateBeginString
+			return scanObjectValue
+		}
+		if c == '}' {
+			s.popParseState()
+			return scanEndObject
+		}
+		return s.error(c, "after object key:value pair")
+	case parseArrayValue:
+		if c == ',' {
+			s.step = stateBeginValue
+			return scanArrayValue
+		}
+		if c == ']' {
+			s.popParseState()
+			return scanEndArray
+		}
+		return s.error(c, "after array element")
+	}
+	return s.error(c, "")
+}
+
+// stateEndTop is the state after finishing the top-level value,
+// such as after reading `{}` or `[1,2,3]`.
+// Only space characters should be seen now.
+func stateEndTop(s *scanner, c byte) int {
+	if !isSpace(c) {
+		// Complain about non-space byte on next call.
+		s.error(c, "after top-level value")
+	}
+	return scanEnd
+}
+
+// stateInString is the state after reading `"`.
+func stateInString(s *scanner, c byte) int {
+	if c == '"' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	if c == '\\' {
+		s.step = stateInStringEsc
+		return scanContinue
+	}
+	if c < 0x20 {
+		return s.error(c, "in string literal")
+	}
+	return scanContinue
+}
+
+// stateInStringEsc is the state after reading `"\` during a quoted string.
+func stateInStringEsc(s *scanner, c byte) int {
+	switch c {
+	case 'b', 'f', 'n', 'r', 't', '\\', '/', '"':
+		s.step = stateInString
+		return scanContinue
+	case 'u':
+		s.step = stateInStringEscU
+		return scanContinue
+	}
+	return s.error(c, "in string escape code")
+}
+
+// stateInStringEscU is the state after reading `"\u` during a quoted string.
+func stateInStringEscU(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU1
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU1 is the state after reading `"\u1` during a quoted string.
+func stateInStringEscU1(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU12
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU12 is the state after reading `"\u12` during a quoted string.
+func stateInStringEscU12(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU123
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU123 is the state after reading `"\u123` during a quoted string.
+func stateInStringEscU123(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInString
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateNeg is the state after reading `-` during a number.
+func stateNeg(s *scanner, c byte) int {
+	if c == '0' {
+		s.step = state0
+		return scanContinue
+	}
+	if '1' <= c && c <= '9' {
+		s.step = state1
+		return scanContinue
+	}
+	return s.error(c, "in numeric literal")
+}
+
+// state1 is the state after reading a non-zero integer during a number,
+// such as after reading `1` or `100` but not `0`.
+func state1(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		s.step = state1
+		return scanContinue
+	}
+	return state0(s, c)
+}
+
+// state0 is the state after reading `0` during a number.
+func state0(s *scanner, c byte) int {
+	if c == '.' {
+		s.step = stateDot
+		return scanContinue
+	}
+	if c == 'e' || c == 'E' {
+		s.step = stateE
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateDot is the state after reading the integer and decimal point in a number,
+// such as after reading `1.`.
+func stateDot(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		s.step = stateDot0
+		return scanContinue
+	}
+	return s.error(c, "after decimal point in numeric literal")
+}
+
+// stateDot0 is the state after reading the integer, decimal point, and subsequent
+// digits of a number, such as after reading `3.14`.
+func stateDot0(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		return scanContinue
+	}
+	if c == 'e' || c == 'E' {
+		s.step = stateE
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateE is the state after reading the mantissa and e in a number,
+// such as after reading `314e` or `0.314e`.
+func stateE(s *scanner, c byte) int {
+	if c == '+' || c == '-' {
+		s.step = stateESign
+		return scanContinue
+	}
+	return stateESign(s, c)
+}
+
+// stateESign is the state after reading the mantissa, e, and sign in a number,
+// such as after reading `314e-` or `0.314e+`.
+func stateESign(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		s.step = stateE0
+		return scanContinue
+	}
+	return s.error(c, "in exponent of numeric literal")
+}
+
+// stateE0 is the state after reading the mantissa, e, optional sign,
+// and at least one digit of the exponent in a number,
+// such as after reading `314e-2` or `0.314e+1` or `3.14e0`.
+func stateE0(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateT is the state after reading `t`.
+func stateT(s *scanner, c byte) int {
+	if c == 'r' {
+		s.step = stateTr
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'r')")
+}
+
+// stateTr is the state after reading `tr`.
+func stateTr(s *scanner, c byte) int {
+	if c == 'u' {
+		s.step = stateTru
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'u')")
+}
+
+// stateTru is the state after reading `tru`.
+func stateTru(s *scanner, c byte) int {
+	if c == 'e' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'e')")
+}
+
+// stateF is the state after reading `f`.
+func stateF(s *scanner, c byte) int {
+	if c == 'a' {
+		s.step = stateFa
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'a')")
+}
+
+// stateFa is the state after reading `fa`.
+func stateFa(s *scanner, c byte) int {
+	if c == 'l' {
+		s.step = stateFal
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'l')")
+}
+
+// stateFal is the state after reading `fal`.
+func stateFal(s *scanner, c byte) int {
+	if c == 's' {
+		s.step = stateFals
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 's')")
+}
+
+// stateFals is the state after reading `fals`.
+func stateFals(s *scanner, c byte) int {
+	if c == 'e' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'e')")
+}
+
+// stateN is the state after reading `n`.
+func stateN(s *scanner, c byte) int {
+	if c == 'u' {
+		s.step = stateNu
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'u')")
+}
+
+// stateNu is the state after reading `nu`.
+func stateNu(s *scanner, c byte) int {
+	if c == 'l' {
+		s.step = stateNul
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'l')")
+}
+
+// stateNul is the state after reading `nul`.
+func stateNul(s *scanner, c byte) int {
+	if c == 'l' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'l')")
+}
+
+// stateError is the state after reaching a syntax error,
+// such as after reading `[1}` or `5.1.2`.
+func stateError(s *scanner, c byte) int {
+	return scanError
+}
+
+// error records an error and switches to the error state.
+func (s *scanner) error(c byte, context string) int {
+	s.step = stateError
+	s.err = &SyntaxError{"invalid character " + quoteChar(c) + " " + context, s.bytes}
+	return scanError
+}
+
+// quoteChar formats c as a quoted character literal.
+func quoteChar(c byte) string {
+	// special cases - different from quoted strings
+	if c == '\'' {
+		return `'\''`
+	}
+	if c == '"' {
+		return `'"'`
+	}
+
+	// use quoted string with different quotation marks
+	s := strconv.Quote(string(c))
+	return "'" + s[1:len(s)-1] + "'"
+}

common/contextjson/stream.go

@@ -0,0 +1,513 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"bytes"
+	"errors"
+	"io"
+)
+
+// A Decoder reads and decodes JSON values from an input stream.
+type Decoder struct {
+	r       io.Reader
+	buf     []byte
+	d       decodeState
+	scanp   int   // start of unread data in buf
+	scanned int64 // amount of data already scanned
+	scan    scanner
+	err     error
+
+	tokenState int
+	tokenStack []int
+}
+
+// NewDecoder returns a new decoder that reads from r.
+//
+// The decoder introduces its own buffering and may
+// read data from r beyond the JSON values requested.
+func NewDecoder(r io.Reader) *Decoder {
+	return &Decoder{r: r}
+}
+
+// UseNumber causes the Decoder to unmarshal a number into an interface{} as a
+// Number instead of as a float64.
+func (dec *Decoder) UseNumber() { dec.d.useNumber = true }
+
+// DisallowUnknownFields causes the Decoder to return an error when the destination
+// is a struct and the input contains object keys which do not match any
+// non-ignored, exported fields in the destination.
+func (dec *Decoder) DisallowUnknownFields() { dec.d.disallowUnknownFields = true }
+
+// Decode reads the next JSON-encoded value from its
+// input and stores it in the value pointed to by v.
+//
+// See the documentation for Unmarshal for details about
+// the conversion of JSON into a Go value.
+func (dec *Decoder) Decode(v any) error {
+	if dec.err != nil {
+		return dec.err
+	}
+
+	if err := dec.tokenPrepareForDecode(); err != nil {
+		return err
+	}
+
+	if !dec.tokenValueAllowed() {
+		return &SyntaxError{msg: "not at beginning of value", Offset: dec.InputOffset()}
+	}
+
+	// Read whole value into buffer.
+	n, err := dec.readValue()
+	if err != nil {
+		return err
+	}
+	dec.d.init(dec.buf[dec.scanp : dec.scanp+n])
+	dec.scanp += n
+
+	// Don't save err from unmarshal into dec.err:
+	// the connection is still usable since we read a complete JSON
+	// object from it before the error happened.
+	err = dec.d.unmarshal(v)
+
+	// fixup token streaming state
+	dec.tokenValueEnd()
+
+	return err
+}
+
+// Buffered returns a reader of the data remaining in the Decoder's
+// buffer. The reader is valid until the next call to Decode.
+func (dec *Decoder) Buffered() io.Reader {
+	return bytes.NewReader(dec.buf[dec.scanp:])
+}
+
+// readValue reads a JSON value into dec.buf.
+// It returns the length of the encoding.
+func (dec *Decoder) readValue() (int, error) {
+	dec.scan.reset()
+
+	scanp := dec.scanp
+	var err error
+Input:
+	// help the compiler see that scanp is never negative, so it can remove
+	// some bounds checks below.
+	for scanp >= 0 {
+
+		// Look in the buffer for a new value.
+		for ; scanp < len(dec.buf); scanp++ {
+			c := dec.buf[scanp]
+			dec.scan.bytes++
+			switch dec.scan.step(&dec.scan, c) {
+			case scanEnd:
+				// scanEnd is delayed one byte so we decrement
+				// the scanner bytes count by 1 to ensure that
+				// this value is correct in the next call of Decode.
+				dec.scan.bytes--
+				break Input
+			case scanEndObject, scanEndArray:
+				// scanEnd is delayed one byte.
+				// We might block trying to get that byte from src,
+				// so instead invent a space byte.
+				if stateEndValue(&dec.scan, ' ') == scanEnd {
+					scanp++
+					break Input
+				}
+			case scanError:
+				dec.err = dec.scan.err
+				return 0, dec.scan.err
+			}
+		}
+
+		// Did the last read have an error?
+		// Delayed until now to allow buffer scan.
+		if err != nil {
+			if err == io.EOF {
+				if dec.scan.step(&dec.scan, ' ') == scanEnd {
+					break Input
+				}
+				if nonSpace(dec.buf) {
+					err = io.ErrUnexpectedEOF
+				}
+			}
+			dec.err = err
+			return 0, err
+		}
+
+		n := scanp - dec.scanp
+		err = dec.refill()
+		scanp = dec.scanp + n
+	}
+	return scanp - dec.scanp, nil
+}
+
+func (dec *Decoder) refill() error {
+	// Make room to read more into the buffer.
+	// First slide down data already consumed.
+	if dec.scanp > 0 {
+		dec.scanned += int64(dec.scanp)
+		n := copy(dec.buf, dec.buf[dec.scanp:])
+		dec.buf = dec.buf[:n]
+		dec.scanp = 0
+	}
+
+	// Grow buffer if not large enough.
+	const minRead = 512
+	if cap(dec.buf)-len(dec.buf) < minRead {
+		newBuf := make([]byte, len(dec.buf), 2*cap(dec.buf)+minRead)
+		copy(newBuf, dec.buf)
+		dec.buf = newBuf
+	}
+
+	// Read. Delay error for next iteration (after scan).
+	n, err := dec.r.Read(dec.buf[len(dec.buf):cap(dec.buf)])
+	dec.buf = dec.buf[0 : len(dec.buf)+n]
+
+	return err
+}
+
+func nonSpace(b []byte) bool {
+	for _, c := range b {
+		if !isSpace(c) {
+			return true
+		}
+	}
+	return false
+}
+
+// An Encoder writes JSON values to an output stream.
+type Encoder struct {
+	w          io.Writer
+	err        error
+	escapeHTML bool
+
+	indentBuf    []byte
+	indentPrefix string
+	indentValue  string
+}
+
+// NewEncoder returns a new encoder that writes to w.
+func NewEncoder(w io.Writer) *Encoder {
+	return &Encoder{w: w, escapeHTML: true}
+}
+
+// Encode writes the JSON encoding of v to the stream,
+// followed by a newline character.
+//
+// See the documentation for Marshal for details about the
+// conversion of Go values to JSON.
+func (enc *Encoder) Encode(v any) error {
+	if enc.err != nil {
+		return enc.err
+	}
+
+	e := newEncodeState()
+	defer encodeStatePool.Put(e)
+
+	err := e.marshal(v, encOpts{escapeHTML: enc.escapeHTML})
+	if err != nil {
+		return err
+	}
+
+	// Terminate each value with a newline.
+	// This makes the output look a little nicer
+	// when debugging, and some kind of space
+	// is required if the encoded value was a number,
+	// so that the reader knows there aren't more
+	// digits coming.
+	e.WriteByte('\n')
+
+	b := e.Bytes()
+	if enc.indentPrefix != "" || enc.indentValue != "" {
+		enc.indentBuf, err = appendIndent(enc.indentBuf[:0], b, enc.indentPrefix, enc.indentValue)
+		if err != nil {
+			return err
+		}
+		b = enc.indentBuf
+	}
+	if _, err = enc.w.Write(b); err != nil {
+		enc.err = err
+	}
+	return err
+}
+
+// SetIndent instructs the encoder to format each subsequent encoded
+// value as if indented by the package-level function Indent(dst, src, prefix, indent).
+// Calling SetIndent("", "") disables indentation.
+func (enc *Encoder) SetIndent(prefix, indent string) {
+	enc.indentPrefix = prefix
+	enc.indentValue = indent
+}
+
+// SetEscapeHTML specifies whether problematic HTML characters
+// should be escaped inside JSON quoted strings.
+// The default behavior is to escape &, <, and > to \u0026, \u003c, and \u003e
+// to avoid certain safety problems that can arise when embedding JSON in HTML.
+//
+// In non-HTML settings where the escaping interferes with the readability
+// of the output, SetEscapeHTML(false) disables this behavior.
+func (enc *Encoder) SetEscapeHTML(on bool) {
+	enc.escapeHTML = on
+}
+
+// RawMessage is a raw encoded JSON value.
+// It implements Marshaler and Unmarshaler and can
+// be used to delay JSON decoding or precompute a JSON encoding.
+type RawMessage []byte
+
+// MarshalJSON returns m as the JSON encoding of m.
+func (m RawMessage) MarshalJSON() ([]byte, error) {
+	if m == nil {
+		return []byte("null"), nil
+	}
+	return m, nil
+}
+
+// UnmarshalJSON sets *m to a copy of data.
+func (m *RawMessage) UnmarshalJSON(data []byte) error {
+	if m == nil {
+		return errors.New("json.RawMessage: UnmarshalJSON on nil pointer")
+	}
+	*m = append((*m)[0:0], data...)
+	return nil
+}
+
+var (
+	_ Marshaler   = (*RawMessage)(nil)
+	_ Unmarshaler = (*RawMessage)(nil)
+)
+
+// A Token holds a value of one of these types:
+//
+//	Delim, for the four JSON delimiters [ ] { }
+//	bool, for JSON booleans
+//	float64, for JSON numbers
+//	Number, for JSON numbers
+//	string, for JSON string literals
+//	nil, for JSON null
+type Token any
+
+const (
+	tokenTopValue = iota
+	tokenArrayStart
+	tokenArrayValue
+	tokenArrayComma
+	tokenObjectStart
+	tokenObjectKey
+	tokenObjectColon
+	tokenObjectValue
+	tokenObjectComma
+)
+
+// advance tokenstate from a separator state to a value state
+func (dec *Decoder) tokenPrepareForDecode() error {
+	// Note: Not calling peek before switch, to avoid
+	// putting peek into the standard Decode path.
+	// peek is only called when using the Token API.
+	switch dec.tokenState {
+	case tokenArrayComma:
+		c, err := dec.peek()
+		if err != nil {
+			return err
+		}
+		if c != ',' {
+			return &SyntaxError{"expected comma after array element", dec.InputOffset()}
+		}
+		dec.scanp++
+		dec.tokenState = tokenArrayValue
+	case tokenObjectColon:
+		c, err := dec.peek()
+		if err != nil {
+			return err
+		}
+		if c != ':' {
+			return &SyntaxError{"expected colon after object key", dec.InputOffset()}
+		}
+		dec.scanp++
+		dec.tokenState = tokenObjectValue
+	}
+	return nil
+}
+
+func (dec *Decoder) tokenValueAllowed() bool {
+	switch dec.tokenState {
+	case tokenTopValue, tokenArrayStart, tokenArrayValue, tokenObjectValue:
+		return true
+	}
+	return false
+}
+
+func (dec *Decoder) tokenValueEnd() {
+	switch dec.tokenState {
+	case tokenArrayStart, tokenArrayValue:
+		dec.tokenState = tokenArrayComma
+	case tokenObjectValue:
+		dec.tokenState = tokenObjectComma
+	}
+}
+
+// A Delim is a JSON array or object delimiter, one of [ ] { or }.
+type Delim rune
+
+func (d Delim) String() string {
+	return string(d)
+}
+
+// Token returns the next JSON token in the input stream.
+// At the end of the input stream, Token returns nil, io.EOF.
+//
+// Token guarantees that the delimiters [ ] { } it returns are
+// properly nested and matched: if Token encounters an unexpected
+// delimiter in the input, it will return an error.
+//
+// The input stream consists of basic JSON values—bool, string,
+// number, and null—along with delimiters [ ] { } of type Delim
+// to mark the start and end of arrays and objects.
+// Commas and colons are elided.
+func (dec *Decoder) Token() (Token, error) {
+	for {
+		c, err := dec.peek()
+		if err != nil {
+			return nil, err
+		}
+		switch c {
+		case '[':
+			if !dec.tokenValueAllowed() {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenStack = append(dec.tokenStack, dec.tokenState)
+			dec.tokenState = tokenArrayStart
+			return Delim('['), nil
+
+		case ']':
+			if dec.tokenState != tokenArrayStart && dec.tokenState != tokenArrayComma {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenState = dec.tokenStack[len(dec.tokenStack)-1]
+			dec.tokenStack = dec.tokenStack[:len(dec.tokenStack)-1]
+			dec.tokenValueEnd()
+			return Delim(']'), nil
+
+		case '{':
+			if !dec.tokenValueAllowed() {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenStack = append(dec.tokenStack, dec.tokenState)
+			dec.tokenState = tokenObjectStart
+			return Delim('{'), nil
+
+		case '}':
+			if dec.tokenState != tokenObjectStart && dec.tokenState != tokenObjectComma {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenState = dec.tokenStack[len(dec.tokenStack)-1]
+			dec.tokenStack = dec.tokenStack[:len(dec.tokenStack)-1]
+			dec.tokenValueEnd()
+			return Delim('}'), nil
+
+		case ':':
+			if dec.tokenState != tokenObjectColon {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenState = tokenObjectValue
+			continue
+
+		case ',':
+			if dec.tokenState == tokenArrayComma {
+				dec.scanp++
+				dec.tokenState = tokenArrayValue
+				continue
+			}
+			if dec.tokenState == tokenObjectComma {
+				dec.scanp++
+				dec.tokenState = tokenObjectKey
+				continue
+			}
+			return dec.tokenError(c)
+
+		case '"':
+			if dec.tokenState == tokenObjectStart || dec.tokenState == tokenObjectKey {
+				var x string
+				old := dec.tokenState
+				dec.tokenState = tokenTopValue
+				err := dec.Decode(&x)
+				dec.tokenState = old
+				if err != nil {
+					return nil, err
+				}
+				dec.tokenState = tokenObjectColon
+				return x, nil
+			}
+			fallthrough
+
+		default:
+			if !dec.tokenValueAllowed() {
+				return dec.tokenError(c)
+			}
+			var x any
+			if err := dec.Decode(&x); err != nil {
+				return nil, err
+			}
+			return x, nil
+		}
+	}
+}
+
+func (dec *Decoder) tokenError(c byte) (Token, error) {
+	var context string
+	switch dec.tokenState {
+	case tokenTopValue:
+		context = " looking for beginning of value"
+	case tokenArrayStart, tokenArrayValue, tokenObjectValue:
+		context = " looking for beginning of value"
+	case tokenArrayComma:
+		context = " after array element"
+	case tokenObjectKey:
+		context = " looking for beginning of object key string"
+	case tokenObjectColon:
+		context = " after object key"
+	case tokenObjectComma:
+		context = " after object key:value pair"
+	}
+	return nil, &SyntaxError{"invalid character " + quoteChar(c) + context, dec.InputOffset()}
+}
+
+// More reports whether there is another element in the
+// current array or object being parsed.
+func (dec *Decoder) More() bool {
+	c, err := dec.peek()
+	return err == nil && c != ']' && c != '}'
+}
+
+func (dec *Decoder) peek() (byte, error) {
+	var err error
+	for {
+		for i := dec.scanp; i < len(dec.buf); i++ {
+			c := dec.buf[i]
+			if isSpace(c) {
+				continue
+			}
+			dec.scanp = i
+			return c, nil
+		}
+		// buffer has been scanned, now report any error
+		if err != nil {
+			return 0, err
+		}
+		err = dec.refill()
+	}
+}
+
+// InputOffset returns the input stream byte offset of the current decoder position.
+// The offset gives the location of the end of the most recently returned token
+// and the beginning of the next token.
+func (dec *Decoder) InputOffset() int64 {
+	return dec.scanned + int64(dec.scanp)
+}

common/contextjson/tables.go

@@ -0,0 +1,218 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import "unicode/utf8"
+
+// safeSet holds the value true if the ASCII character with the given array
+// position can be represented inside a JSON string without any further
+// escaping.
+//
+// All values are true except for the ASCII control characters (0-31), the
+// double quote ("), and the backslash character ("\").
+var safeSet = [utf8.RuneSelf]bool{
+	' ':      true,
+	'!':      true,
+	'"':      false,
+	'#':      true,
+	'$':      true,
+	'%':      true,
+	'&':      true,
+	'\'':     true,
+	'(':      true,
+	')':      true,
+	'*':      true,
+	'+':      true,
+	',':      true,
+	'-':      true,
+	'.':      true,
+	'/':      true,
+	'0':      true,
+	'1':      true,
+	'2':      true,
+	'3':      true,
+	'4':      true,
+	'5':      true,
+	'6':      true,
+	'7':      true,
+	'8':      true,
+	'9':      true,
+	':':      true,
+	';':      true,
+	'<':      true,
+	'=':      true,
+	'>':      true,
+	'?':      true,
+	'@':      true,
+	'A':      true,
+	'B':      true,
+	'C':      true,
+	'D':      true,
+	'E':      true,
+	'F':      true,
+	'G':      true,
+	'H':      true,
+	'I':      true,
+	'J':      true,
+	'K':      true,
+	'L':      true,
+	'M':      true,
+	'N':      true,
+	'O':      true,
+	'P':      true,
+	'Q':      true,
+	'R':      true,
+	'S':      true,
+	'T':      true,
+	'U':      true,
+	'V':      true,
+	'W':      true,
+	'X':      true,
+	'Y':      true,
+	'Z':      true,
+	'[':      true,
+	'\\':     false,
+	']':      true,
+	'^':      true,
+	'_':      true,
+	'`':      true,
+	'a':      true,
+	'b':      true,
+	'c':      true,
+	'd':      true,
+	'e':      true,
+	'f':      true,
+	'g':      true,
+	'h':      true,
+	'i':      true,
+	'j':      true,
+	'k':      true,
+	'l':      true,
+	'm':      true,
+	'n':      true,
+	'o':      true,
+	'p':      true,
+	'q':      true,
+	'r':      true,
+	's':      true,
+	't':      true,
+	'u':      true,
+	'v':      true,
+	'w':      true,
+	'x':      true,
+	'y':      true,
+	'z':      true,
+	'{':      true,
+	'|':      true,
+	'}':      true,
+	'~':      true,
+	'\u007f': true,
+}
+
+// htmlSafeSet holds the value true if the ASCII character with the given
+// array position can be safely represented inside a JSON string, embedded
+// inside of HTML <script> tags, without any additional escaping.
+//
+// All values are true except for the ASCII control characters (0-31), the
+// double quote ("), the backslash character ("\"), HTML opening and closing
+// tags ("<" and ">"), and the ampersand ("&").
+var htmlSafeSet = [utf8.RuneSelf]bool{
+	' ':      true,
+	'!':      true,
+	'"':      false,
+	'#':      true,
+	'$':      true,
+	'%':      true,
+	'&':      false,
+	'\'':     true,
+	'(':      true,
+	')':      true,
+	'*':      true,
+	'+':      true,
+	',':      true,
+	'-':      true,
+	'.':      true,
+	'/':      true,
+	'0':      true,
+	'1':      true,
+	'2':      true,
+	'3':      true,
+	'4':      true,
+	'5':      true,
+	'6':      true,
+	'7':      true,
+	'8':      true,
+	'9':      true,
+	':':      true,
+	';':      true,
+	'<':      false,
+	'=':      true,
+	'>':      false,
+	'?':      true,
+	'@':      true,
+	'A':      true,
+	'B':      true,
+	'C':      true,
+	'D':      true,
+	'E':      true,
+	'F':      true,
+	'G':      true,
+	'H':      true,
+	'I':      true,
+	'J':      true,
+	'K':      true,
+	'L':      true,
+	'M':      true,
+	'N':      true,
+	'O':      true,
+	'P':      true,
+	'Q':      true,
+	'R':      true,
+	'S':      true,
+	'T':      true,
+	'U':      true,
+	'V':      true,
+	'W':      true,
+	'X':      true,
+	'Y':      true,
+	'Z':      true,
+	'[':      true,
+	'\\':     false,
+	']':      true,
+	'^':      true,
+	'_':      true,
+	'`':      true,
+	'a':      true,
+	'b':      true,
+	'c':      true,
+	'd':      true,
+	'e':      true,
+	'f':      true,
+	'g':      true,
+	'h':      true,
+	'i':      true,
+	'j':      true,
+	'k':      true,
+	'l':      true,
+	'm':      true,
+	'n':      true,
+	'o':      true,
+	'p':      true,
+	'q':      true,
+	'r':      true,
+	's':      true,
+	't':      true,
+	'u':      true,
+	'v':      true,
+	'w':      true,
+	'x':      true,
+	'y':      true,
+	'z':      true,
+	'{':      true,
+	'|':      true,
+	'}':      true,
+	'~':      true,
+	'\u007f': true,
+}

common/contextjson/tags.go

@@ -0,0 +1,38 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"strings"
+)
+
+// tagOptions is the string following a comma in a struct field's "json"
+// tag, or the empty string. It does not include the leading comma.
+type tagOptions string
+
+// parseTag splits a struct field's json tag into its name and
+// comma-separated options.
+func parseTag(tag string) (string, tagOptions) {
+	tag, opt, _ := strings.Cut(tag, ",")
+	return tag, tagOptions(opt)
+}
+
+// Contains reports whether a comma-separated list of options
+// contains a particular substr flag. substr must be surrounded by a
+// string boundary or commas.
+func (o tagOptions) Contains(optionName string) bool {
+	if len(o) == 0 {
+		return false
+	}
+	s := string(o)
+	for s != "" {
+		var name string
+		name, s, _ = strings.Cut(s, ",")
+		if name == optionName {
+			return true
+		}
+	}
+	return false
+}

common/dialer/detour.go

@@ -6,7 +6,6 @@ import (
 	"sync"
 
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing/common/bufio/deadline"
 	E "github.com/sagernet/sing/common/exceptions"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
@@ -45,14 +44,7 @@ func (d *DetourDialer) DialContext(ctx context.Context, network string, destinat
 	if err != nil {
 		return nil, err
 	}
-	conn, err := dialer.DialContext(ctx, network, destination)
-	if err != nil {
-		return nil, err
-	}
-	if deadline.NeedAdditionalReadDeadline(conn) {
-		conn = deadline.NewConn(conn)
-	}
-	return conn, nil
+	return dialer.DialContext(ctx, network, destination)
 }
 
 func (d *DetourDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {

common/json/context.go

@@ -0,0 +1,21 @@
+//go:build go1.21 && !without_contextjson
+
+package json
+
+import "github.com/sagernet/sing-box/common/contextjson"
+
+var (
+	Marshal    = json.Marshal
+	Unmarshal  = json.Unmarshal
+	NewEncoder = json.NewEncoder
+	NewDecoder = json.NewDecoder
+)
+
+type (
+	Encoder     = json.Encoder
+	Decoder     = json.Decoder
+	Token       = json.Token
+	Delim       = json.Delim
+	SyntaxError = json.SyntaxError
+	RawMessage  = json.RawMessage
+)

common/json/std.go

@@ -1,3 +1,5 @@
+//go:build !go1.21 || without_contextjson
+
 package json
 
 import "encoding/json"
@@ -15,4 +17,5 @@ type (
 	Token       = json.Token
 	Delim       = json.Delim
 	SyntaxError = json.SyntaxError
+	RawMessage  = json.RawMessage
 )

constant/timeout.go

@@ -3,11 +3,12 @@ package constant
 import "time"
 
 const (
-	TCPTimeout             = 5 * time.Second
-	ReadPayloadTimeout     = 300 * time.Millisecond
-	DNSTimeout             = 10 * time.Second
-	QUICTimeout            = 30 * time.Second
-	STUNTimeout            = 15 * time.Second
-	UDPTimeout             = 5 * time.Minute
-	DefaultURLTestInterval = 1 * time.Minute
+	TCPTimeout                = 5 * time.Second
+	ReadPayloadTimeout        = 300 * time.Millisecond
+	DNSTimeout                = 10 * time.Second
+	QUICTimeout               = 30 * time.Second
+	STUNTimeout               = 15 * time.Second
+	UDPTimeout                = 5 * time.Minute
+	DefaultURLTestInterval    = 3 * time.Minute
+	DefaultURLTestIdleTimeout = 30 * time.Minute
 )

docs/changelog.md

@@ -2,16 +2,63 @@
 icon: material/alert-decagram
 ---
 
-# ChangeLog
+#### 1.8.0-alpha.10
 
-#### 1.8.0-alpha.3
+* Add `idle_timeout` for URLTest outbound **1**
+* Fixes and improvements
+
+**1**:
+
+When URLTest is idle for a certain period of time, the scheduled delay test will be paused.
+
+#### 1.7.2
+
+* Fixes and improvements
+
+#### 1.8.0-alpha.8
+
+* Add context to JSON decode error message **1**
+* Reject internal fake-ip queries **2**
+* Fixes and improvements
+
+**1**:
+
+JSON parse errors will now include the current key path.
+Only takes effect when compiled with Go 1.21+.
+
+**2**:
+
+All internal DNS queries now skip DNS rules with `server` type `fakeip`,
+and the default DNS server can no longer be `fakeip`.
+
+This change is intended to break incorrect usage and essentially requires no action.
+
+#### 1.8.0-alpha.7
+
+* Fixes and improvements
+
+#### 1.7.1
+
+* Fixes and improvements
+
+#### 1.8.0-alpha.6
+
+* Fix rule-set matching logic **1**
+* Fixes and improvements
+
+**1**:
+
+Now the rules in the `rule_set` rule item can be logically considered to be merged into the rule using rule sets,
+rather than completely following the AND logic.
+
+#### 1.8.0-alpha.5
 
 * Parallel rule-set initialization
 * Independent `source_ip_is_private` and `ip_is_private` rules **1**
 
 **1**:
 
-The `private` GeoIP country never existed and was actually implemented inside V2Ray. 
+The `private` GeoIP country never existed and was actually implemented inside V2Ray.
 Since GeoIP was deprecated, we made this rule independent, see [Migration](/migration/#migrate-geoip-to-rule-sets).
 
 #### 1.8.0-alpha.1

docs/configuration/dns/rule.md

@@ -184,7 +184,7 @@ Match domain using regular expression.
 
 !!! failure "Deprecated in sing-box 1.8.0"
 
-    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-set).
+    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-sets).
 
 Match geosite.
 
@@ -192,7 +192,7 @@ Match geosite.
 
 !!! failure "Deprecated in sing-box 1.8.0"
 
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
+    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-sets).
 
 Match source geoip.
 

docs/configuration/dns/rule.zh.md

@@ -181,7 +181,7 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 !!! failure "已在 sing-box 1.8.0 废弃"
 
-    Geosite 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geosite-to-rule-set)。
+    Geosite 已废弃且可能在不久的将来移除，参阅 [迁移指南](/zh/migration/#geosite)。
 
 匹配 Geosite。
 
@@ -189,7 +189,7 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 !!! failure "已在 sing-box 1.8.0 废弃"
 
-    GeoIp 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geoip-to-rule-set)。
+    GeoIP 已废弃且可能在不久的将来移除，参阅 [迁移指南](/zh/migration/#geoip)。
 
 匹配源 GeoIP。
 

docs/configuration/dns/server.md

@@ -45,20 +45,12 @@ The address of the dns server.
 
 !!! warning ""
 
-    To ensure that system DNS is in effect, rather than Go's built-in default resolver, enable CGO at compile time.
-
-!!! warning ""
-
-    QUIC and HTTP3 transport is not included by default, see [Installation](./#installation).
+    To ensure that Android system DNS is in effect, rather than Go's built-in default resolver, enable CGO at compile time.
 
 !!! info ""
 
     the RCode transport is often used to block queries. Use with rules and the `disable_cache` rule option.
 
-!!! warning ""
-
-    DHCP transport is not included by default, see [Installation](./#installation).
-
 | RCode             | Description           | 
 |-------------------|-----------------------|
 | `success`         | `No error`            |

docs/configuration/dns/server.zh.md

@@ -45,20 +45,12 @@ DNS 服务器的地址。
 
 !!! warning ""
 
-    为了确保系统 DNS 生效，而不是 Go 的内置默认解析器，请在编译时启用 CGO。
-
-!!! warning ""
-
-    默认安装不包含 QUIC 和 HTTP3 传输层，请参阅 [安装](/zh/#_2)。
+    为了确保 Android 系统 DNS 生效，而不是 Go 的内置默认解析器，请在编译时启用 CGO。
 
 !!! info ""
 
     RCode 传输层传输层常用于屏蔽请求. 与 DNS 规则和 `disable_cache` 规则选项一起使用。
 
-!!! warning ""
-
-    默认安装不包含 DHCP 传输层，请参阅 [安装](/zh/#_2)。
-
 | RCode             | 描述       | 
 |-------------------|----------|
 | `success`         | `无错误`    |

docs/configuration/experimental/cache-file.zh.md

@@ -0,0 +1,32 @@
+---
+icon: material/new-box
+---
+
+!!! question "自 sing-box 1.8.0 起"
+
+### 结构
+
+```json
+{
+  "enabled": true,
+  "path": "",
+  "cache_id": "",
+  "store_fakeip": false
+}
+```
+
+### 字段
+
+#### enabled
+
+启用缓存文件。
+
+#### path
+
+缓存文件路径，默认使用`cache.db`。
+
+#### cache_id
+
+缓存文件中的标识符。
+
+如果不为空，配置特定的数据将使用由其键控的单独存储。

docs/configuration/experimental/clash-api.md

@@ -10,11 +10,6 @@ icon: material/alert-decagram
     :material-delete-alert: [cache_file](#cache_file)  
     :material-delete-alert: [cache_id](#cache_id)
 
-
-!!! quote ""
-
-    Clash API is not included by default, see [Installation](./#installation).
-
 ### Structure
 
 ```json
@@ -48,8 +43,6 @@ A relative path to the configuration directory or an absolute path to a
 directory in which you put some static web resource. sing-box will then
 serve it at `http://{{external-controller}}/ui`.
 
-
-
 #### external_ui_download_url
 
 ZIP download URL for the external UI, will be used if the specified `external_ui` directory is empty.
@@ -118,4 +111,4 @@ Cache file path, `cache.db` will be used if empty.
 
 Identifier in cache file.
 
-If not empty, configuration specified data will use a separate store keyed by it.
+If not empty, configuration specified data will use a separate store keyed by it.

docs/configuration/experimental/clash-api.zh.md

@@ -0,0 +1,112 @@
+---
+icon: material/alert-decagram
+---
+
+!!! quote "sing-box 1.8.0 中的更改"
+
+    :material-delete-alert: [store_mode](#store_mode)  
+    :material-delete-alert: [store_selected](#store_selected)  
+    :material-delete-alert: [store_fakeip](#store_fakeip)  
+    :material-delete-alert: [cache_file](#cache_file)  
+    :material-delete-alert: [cache_id](#cache_id)
+
+### 结构
+
+```json
+{
+  "external_controller": "127.0.0.1:9090",
+  "external_ui": "",
+  "external_ui_download_url": "",
+  "external_ui_download_detour": "",
+  "secret": "",
+  "default_mode": "",
+  
+  // Deprecated
+  
+  "store_mode": false,
+  "store_selected": false,
+  "store_fakeip": false,
+  "cache_file": "",
+  "cache_id": ""
+}
+```
+
+### Fields
+
+#### external_controller
+
+RESTful web API 监听地址。如果为空，则禁用 Clash API。
+
+#### external_ui
+
+到静态网页资源目录的相对路径或绝对路径。sing-box 会在 `http://{{external-controller}}/ui` 下提供它。
+
+#### external_ui_download_url
+
+静态网页资源的 ZIP 下载 URL，如果指定的 `external_ui` 目录为空，将使用。
+
+默认使用 `https://github.com/MetaCubeX/Yacd-meta/archive/gh-pages.zip`。
+
+#### external_ui_download_detour
+
+用于下载静态网页资源的出站的标签。
+
+如果为空，将使用默认出站。
+
+#### secret
+
+RESTful API 的密钥（可选）
+通过指定 HTTP 标头 `Authorization: Bearer ${secret}` 进行身份验证
+如果 RESTful API 正在监听 0.0.0.0，请始终设置一个密钥。
+
+#### default_mode
+
+Clash 中的默认模式，默认使用 `Rule`。
+
+此设置没有直接影响，但可以通过 `clash_mode` 规则项在路由和 DNS 规则中使用。
+
+#### store_mode
+
+!!! failure "已在 sing-box 1.8.0 废弃"
+
+    `store_mode` 已在 Clash API 中废弃，且默认启用当 `cache_file.enabled`。
+
+将 Clash 模式存储在缓存文件中。
+
+#### store_selected
+
+!!! failure "已在 sing-box 1.8.0 废弃"
+
+    `store_selected` 已在 Clash API 中废弃，且默认启用当 `cache_file.enabled`。
+
+!!! note ""
+
+    必须为目标出站设置标签。
+
+将 `Selector` 中出站的选定的目标出站存储在缓存文件中。
+
+#### store_fakeip
+
+!!! failure "已在 sing-box 1.8.0 废弃"
+
+    `store_selected` 已在 Clash API 中废弃，且已迁移到 `cache_file.store_fakeip`。
+
+将 fakeip 存储在缓存文件中。
+
+#### cache_file
+
+!!! failure "已在 sing-box 1.8.0 废弃"
+ 
+    `cache_file` 已在 Clash API 中废弃，且已迁移到 `cache_file.enabled` 和 `cache_file.path`。
+
+缓存文件路径，默认使用`cache.db`。
+
+#### cache_id
+
+!!! failure "已在 sing-box 1.8.0 废弃"
+ 
+    `cache_id` 已在 Clash API 中废弃，且已迁移到 `cache_file.cache_id`。
+
+缓存 ID。
+
+如果不为空，配置特定的数据将使用由其键控的单独存储。

docs/configuration/experimental/index.zh.md

@@ -0,0 +1,30 @@
+---
+icon: material/alert-decagram
+---
+
+# 实验性
+
+!!! quote "sing-box 1.8.0 中的更改"
+
+    :material-plus: [cache_file](#cache_file)  
+    :material-alert-decagram: [clash_api](#clash_api)
+
+### 结构
+
+```json
+{
+  "experimental": {
+    "cache_file": {},
+    "clash_api": {},
+    "v2ray_api": {}
+  }
+}
+```
+
+### 字段
+
+| 键            | 格式                       |
+|--------------|--------------------------|
+| `cache_file` | [缓存文件](./cache-file)     |
+| `clash_api`  | [Clash API](./clash-api) |
+| `v2ray_api`  | [V2Ray API](./v2ray-api) |

docs/configuration/experimental/v2ray-api.md

@@ -1,8 +1,8 @@
-### Structure
-
 !!! quote ""
 
-    V2Ray API is not included by default, see [Installation](./#installation).
+    V2Ray API is not included by default, see [Installation](/installation/build-from-source/#build-tags).
+
+### Structure
 
 ```json
 {

docs/configuration/experimental/v2ray-api.zh.md

@@ -0,0 +1,50 @@
+!!! quote ""
+
+    默认安装不包含 V2Ray API，参阅 [安装](/zh/installation/build-from-source/#_5)。
+
+### 结构
+
+```json
+{
+  "listen": "127.0.0.1:8080",
+  "stats": {
+    "enabled": true,
+    "inbounds": [
+      "socks-in"
+    ],
+    "outbounds": [
+      "proxy",
+      "direct"
+    ],
+    "users": [
+      "sekai"
+    ]
+  }
+}
+```
+
+### 字段
+
+#### listen
+
+gRPC API 监听地址。如果为空，则禁用 V2Ray API。
+
+#### stats
+
+流量统计服务设置。
+
+#### stats.enabled
+
+启用统计服务。
+
+#### stats.inbounds
+
+统计流量的入站列表。
+
+#### stats.outbounds
+
+统计流量的出站列表。
+
+#### stats.users
+
+统计流量的用户列表。

docs/configuration/inbound/hysteria.md

@@ -29,10 +29,6 @@
 }
 ```
 
-!!! warning ""
-
-    QUIC, which is required by hysteria is not included by default, see [Installation](./#installation).
-
 ### Listen Fields
 
 See [Listen Fields](/configuration/shared/listen) for details.

docs/configuration/inbound/hysteria.zh.md

@@ -29,10 +29,6 @@
 }
 ```
 
-!!! warning ""
-
-    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
-
 ### 监听字段
 
 参阅 [监听字段](/zh/configuration/shared/listen/)。

docs/configuration/inbound/hysteria2.md

@@ -26,10 +26,6 @@
 }
 ```
 
-!!! warning ""
-
-    QUIC, which is required by Hysteria2 is not included by default, see [Installation](./#installation).
-
 !!! warning "Difference from official Hysteria2"
 
     The official program supports an authentication method called **userpass**,

docs/configuration/inbound/hysteria2.zh.md

@@ -26,10 +26,6 @@
 }
 ```
 
-!!! warning ""
-
-    默认安装不包含被 Hysteria2 依赖的 QUIC，参阅 [安装](/zh/#_2)。
-
 !!! warning "与官方 Hysteria2 的区别"
 
     官方程序支持一种名为 **userpass** 的验证方式，

docs/configuration/inbound/naive.md

@@ -18,10 +18,6 @@
 }
 ```
 
-!!! warning ""
-
-    HTTP3 transport is not included by default, see [Installation](./#installation).
-
 ### Listen Fields
 
 See [Listen Fields](/configuration/shared/listen) for details.

docs/configuration/inbound/naive.zh.md

@@ -18,10 +18,6 @@
 }
 ```
 
-!!! warning ""
-
-    默认安装不包含 HTTP3 传输层, 参阅 [安装](/zh/#_2)。
-
 ### 监听字段
 
 参阅 [监听字段](/zh/configuration/shared/listen/)。

docs/configuration/inbound/tuic.md

@@ -22,10 +22,6 @@
 }
 ```
 
-!!! warning ""
-
-    QUIC, which is required by TUIC is not included by default, see [Installation](./#installation).
-
 ### Listen Fields
 
 See [Listen Fields](/configuration/shared/listen) for details.

docs/configuration/inbound/tuic.zh.md

@@ -22,10 +22,6 @@
 }
 ```
 
-!!! warning ""
-
-    默认安装不包含被 TUI 依赖的 QUIC，参阅 [安装](/zh/#_2)。
-
 ### 监听字段
 
 参阅 [监听字段](/zh/configuration/shared/listen/)。

docs/configuration/inbound/tun.md

@@ -171,7 +171,7 @@ TCP/IP stack.
 
 !!! warning ""
 
-    gVisor and LWIP stacks is not included by default, see [Installation](./#installation).
+    LWIP stacks is not included by default, see [Installation](/installation/build-from-source/#build-tags).
 
 #### include_interface
 

docs/configuration/inbound/tun.zh.md

@@ -167,7 +167,7 @@ TCP/IP 栈。
 
 !!! warning ""
 
-    默认安装不包含 gVisor 和 LWIP 栈，请参阅 [安装](/zh/#_2)。
+    默认安装不包含 LWIP 栈，参阅 [安装](/zh/installation/build-from-source/#_5)。
 
 #### include_interface
 

docs/configuration/outbound/hysteria.md

@@ -24,10 +24,6 @@
 }
 ```
 
-!!! warning ""
-
-    QUIC, which is required by hysteria is not included by default, see [Installation](./#installation).
-
 ### Fields
 
 #### server

docs/configuration/outbound/hysteria.zh.md

@@ -24,10 +24,6 @@
 }
 ```
 
-!!! warning ""
-
-    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
-
 ### 字段
 
 #### server

docs/configuration/outbound/hysteria2.md

@@ -22,10 +22,6 @@
 }
 ```
 
-!!! warning ""
-
-    QUIC, which is required by Hysteria2 is not included by default, see [Installation](./#installation).
-
 !!! warning "Difference from official Hysteria2"
 
     The official Hysteria2 supports an authentication method called **userpass**,

docs/configuration/outbound/hysteria2.zh.md

@@ -22,10 +22,6 @@
 }
 ```
 
-!!! warning ""
-
-    默认安装不包含被 Hysteria2 依赖的 QUIC，参阅 [安装](/zh/#_2)。
-
 !!! warning "与官方 Hysteria2 的区别"
 
     官方程序支持一种名为 **userpass** 的验证方式，

docs/configuration/outbound/index.md

@@ -26,7 +26,6 @@
 | `trojan`       | [Trojan](./trojan)             |
 | `wireguard`    | [Wireguard](./wireguard)       |
 | `hysteria`     | [Hysteria](./hysteria)         |
-| `shadowsocksr` | [ShadowsocksR](./shadowsocksr) |
 | `vless`        | [VLESS](./vless)               |
 | `shadowtls`    | [ShadowTLS](./shadowtls)       |
 | `tuic`         | [TUIC](./tuic)                 |

docs/configuration/outbound/index.zh.md

@@ -26,7 +26,6 @@
 | `trojan`       | [Trojan](./trojan)             |
 | `wireguard`    | [Wireguard](./wireguard)       |
 | `hysteria`     | [Hysteria](./hysteria)         |
-| `shadowsocksr` | [ShadowsocksR](./shadowsocksr) |
 | `vless`        | [VLESS](./vless)               |
 | `shadowtls`    | [ShadowTLS](./shadowtls)       |
 | `tuic`         | [TUIC](./tuic)                 |

docs/configuration/outbound/shadowsocksr.md

@@ -1,106 +0,0 @@
-### Structure
-
-```json
-{
-  "type": "shadowsocksr",
-  "tag": "ssr-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "method": "aes-128-cfb",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "obfs": "plain",
-  "obfs_param": "",
-  "protocol": "origin",
-  "protocol_param": "",
-  "network": "udp",
-
-  ... // Dial Fields
-}
-```
-
-!!! warning ""
-
-    The ShadowsocksR protocol is obsolete and unmaintained. This outbound is provided for compatibility only.
-
-!!! warning ""
-
-    ShadowsocksR is not included by default, see [Installation](./#installation).
-
-### Fields
-
-#### server
-
-==Required==
-
-The server address.
-
-#### server_port
-
-==Required==
-
-The server port.
-
-#### method
-
-==Required==
-
-Encryption methods:
-
-* `aes-128-ctr`
-* `aes-192-ctr`
-* `aes-256-ctr`
-* `aes-128-cfb`
-* `aes-192-cfb`
-* `aes-256-cfb`
-* `rc4-md5`
-* `chacha20-ietf`
-* `xchacha20`
-
-#### password
-
-==Required==
-
-The shadowsocks password.
-
-#### obfs
-
-The ShadowsocksR obfuscate.
-
-* plain
-* http_simple
-* http_post
-* random_head
-* tls1.2_ticket_auth
-
-#### obfs_param
-
-The ShadowsocksR obfuscate parameter.
-
-#### protocol
-
-The ShadowsocksR protocol.
-
-* origin
-* verify_sha1
-* auth_sha1_v4
-* auth_aes128_md5
-* auth_aes128_sha1
-* auth_chain_a
-* auth_chain_b
-
-#### protocol_param
-
-The ShadowsocksR protocol parameter.
-
-#### network
-
-Enabled network
-
-One of `tcp` `udp`.
-
-Both is enabled by default.
-
-### Dial Fields
-
-See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/shadowsocksr.zh.md

@@ -1,106 +0,0 @@
-### 结构
-
-```json
-{
-  "type": "shadowsocksr",
-  "tag": "ssr-out",
-
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "method": "aes-128-cfb",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "obfs": "plain",
-  "obfs_param": "",
-  "protocol": "origin",
-  "protocol_param": "",
-  "network": "udp",
-
-  ... // 拨号字段
-}
-```
-
-!!! warning ""
-
-    ShadowsocksR 协议已过时且无人维护。 提供此出站仅出于兼容性目的。
-
-!!! warning ""
-
-    默认安装不包含被 ShadowsocksR，参阅 [安装](/zh/#_2)。
-
-### 字段
-
-#### server
-
-==必填==
-
-服务器地址。
-
-#### server_port
-
-==必填==
-
-服务器端口。
-
-#### method
-
-==必填==
-
-加密方法：
-
-* `aes-128-ctr`
-* `aes-192-ctr`
-* `aes-256-ctr`
-* `aes-128-cfb`
-* `aes-192-cfb`
-* `aes-256-cfb`
-* `rc4-md5`
-* `chacha20-ietf`
-* `xchacha20`
-
-#### password
-
-==必填==
-
-Shadowsocks 密码。
-
-#### obfs
-
-ShadowsocksR 混淆。
-
-* plain
-* http_simple
-* http_post
-* random_head
-* tls1.2_ticket_auth
-
-#### obfs_param
-
-ShadowsocksR 混淆参数。
-
-#### protocol
-
-ShadowsocksR 协议。
-
-* origin
-* verify_sha1
-* auth_sha1_v4
-* auth_aes128_md5
-* auth_aes128_sha1
-* auth_chain_a
-* auth_chain_b
-
-#### protocol_param
-
-ShadowsocksR 协议参数。
-
-#### network
-
-启用的网络协议
-
-`tcp` 或 `udp`。
-
-默认所有。
-
-### 拨号字段
-
-参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/tor.md

@@ -18,7 +18,7 @@
 
 !!! info ""
 
-    Embedded tor is not included by default, see [Installation](./#installation).
+    Embedded Tor is not included by default, see [Installation](/installation/build-from-source/#build-tags).
 
 ### Fields
 

docs/configuration/outbound/tor.zh.md

@@ -18,7 +18,7 @@
 
 !!! info ""
 
-    默认安装不包含嵌入式 Tor, 参阅 [安装](/zh/#_2)。
+    默认安装不包含嵌入式 Tor, 参阅 [安装](/zh/installation/build-from-source/#_5)。
 
 ### 字段
 

docs/configuration/outbound/tuic.md

@@ -21,10 +21,6 @@
 }
 ```
 
-!!! warning ""
-
-    QUIC, which is required by TUIC is not included by default, see [Installation](./#installation).
-
 ### Fields
 
 #### server

docs/configuration/outbound/tuic.zh.md

@@ -21,10 +21,6 @@
 }
 ```
 
-!!! warning ""
-
-    默认安装不包含被 TUI 依赖的 QUIC，参阅 [安装](/zh/#_2)。
-
 ### 字段
 
 #### server

docs/configuration/outbound/urltest.md

@@ -10,9 +10,10 @@
     "proxy-b",
     "proxy-c"
   ],
-  "url": "https://www.gstatic.com/generate_204",
-  "interval": "1m",
-  "tolerance": 50,
+  "url": "",
+  "interval": "",
+  "tolerance": 0,
+  "idle_timeout": "",
   "interrupt_exist_connections": false
 }
 ```
@@ -31,12 +32,16 @@ The URL to test. `https://www.gstatic.com/generate_204` will be used if empty.
 
 #### interval
 
-The test interval. `1m` will be used if empty.
+The test interval. `3m` will be used if empty.
 
 #### tolerance
 
 The test tolerance in milliseconds. `50` will be used if empty.
 
+#### idle_timeout
+
+The idle timeout. `30m` will be used if empty.
+
 #### interrupt_exist_connections
 
 Interrupt existing connections when the selected outbound has changed.

docs/configuration/outbound/urltest.zh.md

@@ -10,9 +10,10 @@
     "proxy-b",
     "proxy-c"
   ],
-  "url": "https://www.gstatic.com/generate_204",
-  "interval": "1m",
+  "url": "",
+  "interval": "",
   "tolerance": 50,
+  "idle_timeout": "",
   "interrupt_exist_connections": false
 }
 ```
@@ -31,12 +32,16 @@
 
 #### interval
 
-测试间隔。 默认使用 `1m`。
+测试间隔。 默认使用 `3m`。
 
 #### tolerance
 
 以毫秒为单位的测试容差。 默认使用 `50`。
 
+#### idle_timeout
+
+空闲超时。默认使用 `30m`。
+
 #### interrupt_exist_connections
 
 当选定的出站发生更改时，中断现有连接。

docs/configuration/outbound/wireguard.md

@@ -36,14 +36,6 @@
 }
 ```
 
-!!! warning ""
-
-    WireGuard is not included by default, see [Installation](./#installation).
-
-!!! warning ""
-
-    gVisor, which is required by the unprivileged WireGuard is not included by default, see [Installation](./#installation).
-
 ### Fields
 
 #### server

docs/configuration/outbound/wireguard.zh.md

@@ -24,14 +24,6 @@
 }
 ```
 
-!!! warning ""
-
-    默认安装不包含 WireGuard, 参阅 [安装](/zh/#_2)。
-
-!!! warning ""
-
-    默认安装不包含被非特权 WireGuard 需要的 gVisor, 参阅 [安装](/zh/#_2)。
-
 ### 字段
 
 #### server

docs/configuration/route/geoip.md

@@ -4,7 +4,7 @@ icon: material/delete-clock
 
 !!! failure "Deprecated in sing-box 1.8.0"
 
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
+    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-sets).
 
 ### Structure
 

docs/configuration/route/geoip.zh.md

@@ -0,0 +1,41 @@
+---
+icon: material/delete-clock
+---
+
+!!! failure "已在 sing-box 1.8.0 废弃"
+
+    GeoIP 已废弃且可能在不久的将来移除，参阅 [迁移指南](/zh/migration/#geoip)。
+
+### 结构
+
+```json
+{
+  "route": {
+    "geoip": {
+      "path": "",
+      "download_url": "",
+      "download_detour": ""
+    }
+  }
+}
+```
+
+### 字段
+
+#### path
+
+指定 GeoIP 资源的路径。
+
+默认 `geoip.db`。
+
+#### download_url
+
+指定 GeoIP 资源的下载链接。
+
+默认为 `https://github.com/SagerNet/sing-geoip/releases/latest/download/geoip.db`。
+
+#### download_detour
+
+用于下载 GeoIP 资源的出站的标签。
+
+如果为空，将使用默认出站。

docs/configuration/route/geosite.md

@@ -4,7 +4,7 @@ icon: material/delete-clock
 
 !!! failure "Deprecated in sing-box 1.8.0"
 
-    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-set).
+    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-sets).
 
 ### Structure
 

docs/configuration/route/geosite.zh.md

@@ -0,0 +1,41 @@
+---
+icon: material/delete-clock
+---
+
+!!! failure "已在 sing-box 1.8.0 废弃"
+
+    Geosite 已废弃且可能在不久的将来移除，参阅 [迁移指南](/zh/migration/#geosite)。
+
+### 结构
+
+```json
+{
+  "route": {
+    "geosite": {
+      "path": "",
+      "download_url": "",
+      "download_detour": ""
+    }
+  }
+}
+```
+
+### 字段
+
+#### path
+
+指定 GeoSite 资源的路径。
+
+默认 `geosite.db`。
+
+#### download_url
+
+指定 GeoSite 资源的下载链接。
+
+默认为 `https://github.com/SagerNet/sing-geosite/releases/latest/download/geosite.db`。
+
+#### download_detour
+
+用于下载 GeoSite 资源的出站的标签。
+
+如果为空，将使用默认出站。

docs/configuration/route/rule.md

@@ -182,7 +182,7 @@ Match domain using regular expression.
 
 !!! failure "Deprecated in sing-box 1.8.0"
 
-    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-set).
+    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-sets).
 
 Match geosite.
 
@@ -190,7 +190,7 @@ Match geosite.
 
 !!! failure "Deprecated in sing-box 1.8.0"
 
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
+    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-sets).
 
 Match source geoip.
 
@@ -198,7 +198,7 @@ Match source geoip.
 
 !!! failure "Deprecated in sing-box 1.8.0"
 
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
+    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-sets).
 
 Match geoip.
 

docs/configuration/route/rule.zh.md

@@ -180,7 +180,7 @@ icon: material/alert-decagram
 
 !!! failure "已在 sing-box 1.8.0 废弃"
 
-    Geosite 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geosite-to-rule-set)。
+    Geosite 已废弃且可能在不久的将来移除，参阅 [迁移指南](/zh/migration/#geosite)。
 
 匹配 Geosite。
 
@@ -188,7 +188,7 @@ icon: material/alert-decagram
 
 !!! failure "已在 sing-box 1.8.0 废弃"
 
-    GeoIp 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geoip-to-rule-set)。
+    GeoIP 已废弃且可能在不久的将来移除，参阅 [迁移指南](/zh/migration/#geoip)。
 
 匹配源 GeoIP。
 
@@ -196,7 +196,7 @@ icon: material/alert-decagram
 
 !!! failure "已在 sing-box 1.8.0 废弃"
 
-    GeoIp 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geoip-to-rule-set)。
+    GeoIP 已废弃且可能在不久的将来移除，参阅 [迁移指南](/zh/migration/#geoip)。
 
 匹配 GeoIP。
 

docs/configuration/shared/tls.md

@@ -199,10 +199,6 @@ The path to the server private key, in PEM format.
 
 ==Client only==
 
-!!! warning ""
-
-    uTLS is not included by default, see [Installation](./#installation).
-
 !!! note ""
 
     uTLS is poorly maintained and the effect may be unproven, use at your own risk.
@@ -226,10 +222,6 @@ Chrome fingerprint will be used if empty.
 
 ### ECH Fields
 
-!!! warning ""
-
-    ECH is not included by default, see [Installation](./#installation).
-
 ECH (Encrypted Client Hello) is a TLS extension that allows a client to encrypt the first part of its ClientHello
 message.
 
@@ -278,10 +270,6 @@ If empty, load from DNS will be attempted.
 
 ### ACME Fields
 
-!!! warning ""
-
-    ACME is not included by default, see [Installation](./#installation).
-
 #### domain
 
 List of domain.
@@ -357,14 +345,6 @@ See [DNS01 Challenge Fields](/configuration/shared/dns01_challenge) for details.
 
 ### Reality Fields
 
-!!! warning ""
-
-    reality server is not included by default, see [Installation](./#installation).
-
-!!! warning ""
-
-    uTLS, which is required by reality client is not included by default, see [Installation](./#installation).
-
 #### handshake
 
 ==Server only==

docs/configuration/shared/tls.zh.md

@@ -193,10 +193,6 @@ TLS 版本值：
 
 ==仅客户端==
 
-!!! warning ""
-
-    默认安装不包含 uTLS, 参阅 [安装](/zh/#_2)。
-
 !!! note ""
 
     uTLS 维护不善且其效果可能未经证实，使用风险自负。
@@ -220,14 +216,9 @@ uTLS 是 "crypto/tls" 的一个分支，它提供了 ClientHello 指纹识别阻
 
 ## ECH 字段
 
-!!! warning ""
-
-    默认安装不包含 ECH, 参阅 [安装](/zh/#_2)。
-
 ECH (Encrypted Client Hello) 是一个 TLS 扩展，它允许客户端加密其 ClientHello 的第一部分
 信息。
 
-
 ECH 配置和密钥可以通过 `sing-box generate ech-keypair [--pq-signature-schemes-enabled]` 生成。
 
 #### pq_signature_schemes_enabled
@@ -273,10 +264,6 @@ ECH PEM 配置路径
 
 ### ACME 字段
 
-!!! warning ""
-
-    默认安装不包含 ACME，参阅 [安装](/zh/#_2)。
-
 #### domain
 
 一组域名。
@@ -348,14 +335,6 @@ ACME DNS01 验证字段。如果配置，将禁用其他验证方法。
 
 ### Reality 字段
 
-!!! warning ""
-
-    默认安装不包含 reality 服务器，参阅 [安装](/zh/#_2)。
-
-!!! warning ""
-
-    默认安装不包含被 reality 客户端需要的 uTLS, 参阅 [安装](/zh/#_2)。
-
 #### handshake
 
 ==仅服务器==

docs/configuration/shared/v2ray-transport.md

@@ -129,10 +129,6 @@ It needs to be consistent with the server.
 }
 ```
 
-!!! warning ""
-
-    QUIC is not included by default, see [Installation](./#installation).
-
 !!! warning "Difference from v2ray-core"
 
     No additional encryption support:
@@ -142,7 +138,7 @@ It needs to be consistent with the server.
 
 !!! note ""
 
-    standard gRPC has good compatibility but poor performance and is not included by default, see [Installation](./#installation).
+    standard gRPC has good compatibility but poor performance and is not included by default, see [Installation](/installation/build-from-source/#build-tags).
 
 ```json
 {

docs/configuration/shared/v2ray-transport.zh.md

@@ -128,10 +128,6 @@ HTTP 请求的额外标头。
 }
 ```
 
-!!! warning ""
-
-    默认安装不包含 QUIC, 参阅 [安装](/zh/#_2)。
-
 !!! warning "与 v2ray-core 的区别"
 
     没有额外的加密支持：
@@ -141,7 +137,7 @@ HTTP 请求的额外标头。
 
 !!! note ""
 
-    默认安装不包含标准 gRPC (兼容性好，但性能较差), 参阅 [安装](/zh/#_2)。
+    默认安装不包含标准 gRPC (兼容性好，但性能较差), 参阅 [安装](/zh/installation/build-from-source/#_5)。
 
 ```json
 {

docs/deprecated.md

@@ -4,7 +4,37 @@ icon: material/delete-alert
 
 # Deprecated Feature List
 
-### 1.6.0
+## 1.8.0
+
+#### Cache file and related features in Clash API
+
+`cache_file` and related features in Clash API is migrated to independent `cache_file` options,
+check [Migration](/migration/#migrate-cache-file-from-clash-api-to-independent-options).
+
+#### GeoIP
+
+GeoIP is deprecated and may be removed in the future.
+
+The maxmind GeoIP National Database, as an IP classification database,
+is not entirely suitable for traffic bypassing,
+and all existing implementations suffer from high memory usage and difficult management.
+
+sing-box 1.8.0 introduces [Rule Set](/configuration/rule_set), which can completely replace GeoIP,
+check [Migration](/migration/#migrate-geoip-to-rule-sets).
+
+#### Geosite
+
+Geosite is deprecated and may be removed in the future.
+
+Geosite, the `domain-list-community` project maintained by V2Ray as an early traffic bypassing solution,
+suffers from a number of problems, including lack of maintenance, inaccurate rules, and difficult management.
+
+sing-box 1.8.0 introduces [Rule Set](/configuration/rule_set), which can completely replace Geosite,
+check [Migration](/migration/#migrate-geosite-to-rule-sets).
+
+Geosite，即由 V2Ray 维护的 domain-list-community 项目，作为早期流量绕过解决方案，存在着大量问题，包括缺少维护、规则不准确、管理困难。
+
+## 1.6.0
 
 The following features will be marked deprecated in 1.5.0 and removed entirely in 1.6.0.
 

docs/deprecated.zh.md

@@ -4,7 +4,34 @@ icon: material/delete-alert
 
 # 废弃功能列表
 
-### 1.6.0
+## 1.8.0
+
+#### Clash API 中的 Cache file 及相关功能
+
+Clash API 中的 `cache_file` 及相关功能已废弃且已迁移到独立的 `cache_file` 设置，
+参阅 [迁移指南](/zh/migration/#clash-api)。
+
+#### GeoIP
+
+GeoIP 已废弃且可能在不久的将来移除。
+
+maxmind GeoIP 国家数据库作为 IP 分类数据库，不完全适合流量绕过，
+且现有的实现均存在内存使用大与管理困难的问题。
+
+sing-box 1.8.0 引入了[规则集](/configuration/rule_set)，
+可以完全替代 GeoIP， 参阅 [迁移指南](/zh/migration/#geoip)。
+
+#### Geosite
+
+Geosite 已废弃且可能在不久的将来移除。
+
+Geosite，即由 V2Ray 维护的 domain-list-community 项目，作为早期流量绕过解决方案，
+存在着包括缺少维护、规则不准确和管理困难内的大量问题。
+
+sing-box 1.8.0 引入了[规则集](/configuration/rule_set)，
+可以完全替代 Geosite，参阅 [迁移指南](/zh/migration/#geosite)。
+
+## 1.6.0
 
 下列功能已在 1.5.0 中标记为已弃用，并在 1.6.0 中完全删除。
 

docs/installation/build-from-source.md

@@ -23,7 +23,7 @@ You can download and install Go from: https://go.dev/doc/install, latest version
 make
 ```
 
-Or build and install binary to `GOBIN`:
+Or build and install binary to `$GOBIN`:
 
 ```bash
 make install

docs/installation/build-from-source.zh.md

@@ -0,0 +1,63 @@
+---
+icon: material/file-code
+---
+
+# 从源代码构建
+
+## :material-graph: 要求
+
+sing-box 1.4.0 前:
+
+* Go 1.18.5 - 1.20.x
+
+从 sing-box 1.4.0:
+
+* Go 1.18.5 - ~
+* Go 1.20.0 - ~ 如果启用构建标记 `with_quic`
+
+您可以从 https://go.dev/doc/install 下载并安装 Go，推荐使用最新版本。
+
+## :material-fast-forward: 快速开始
+
+```bash
+make
+```
+
+或者构建二进制文件并将其安装到 `$GOBIN`：
+
+```bash
+make install
+```
+
+## :material-cog: 自定义构建
+
+```bash
+TAGS="tag_a tag_b" make
+```
+
+or
+
+```bash
+go build -tags "tag_a tag_b" ./cmd/sing-box
+```
+
+## :material-folder-settings: 构建标记
+
+| 构建标记                               | 默认启动 | 说明                                                                                                                                                                                                                                                                                                                         |
+|------------------------------------|------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `with_quic`                        | ✔    | Build with QUIC support, see [QUIC and HTTP3 DNS transports](/configuration/dns/server), [Naive inbound](/configuration/inbound/naive), [Hysteria Inbound](/configuration/inbound/hysteria), [Hysteria Outbound](/configuration/outbound/hysteria) and [V2Ray Transport#QUIC](/configuration/shared/v2ray-transport#quic). |
+| `with_grpc`                        | ✖️   | Build with standard gRPC support, see [V2Ray Transport#gRPC](/configuration/shared/v2ray-transport#grpc).                                                                                                                                                                                                                  |
+| `with_dhcp`                        | ✔    | Build with DHCP support, see [DHCP DNS transport](/configuration/dns/server).                                                                                                                                                                                                                                              |
+| `with_wireguard`                   | ✔    | Build with WireGuard support, see [WireGuard outbound](/configuration/outbound/wireguard).                                                                                                                                                                                                                                 |
+| `with_ech`                         | ✔    | Build with TLS ECH extension support for TLS outbound, see [TLS](/configuration/shared/tls#ech).                                                                                                                                                                                                                           |
+| `with_utls`                        | ✔    | Build with [uTLS](https://github.com/refraction-networking/utls) support for TLS outbound, see [TLS](/configuration/shared/tls#utls).                                                                                                                                                                                      |
+| `with_reality_server`              | ✔    | Build with reality TLS server support,  see [TLS](/configuration/shared/tls).                                                                                                                                                                                                                                              |
+| `with_acme`                        | ✔    | Build with ACME TLS certificate issuer support, see [TLS](/configuration/shared/tls).                                                                                                                                                                                                                                      |
+| `with_clash_api`                   | ✔    | Build with Clash API support, see [Experimental](/configuration/experimental#clash-api-fields).                                                                                                                                                                                                                            |
+| `with_v2ray_api`                   | ✖️   | Build with V2Ray API support, see [Experimental](/configuration/experimental#v2ray-api-fields).                                                                                                                                                                                                                            |
+| `with_gvisor`                      | ✔    | Build with gVisor support, see [Tun inbound](/configuration/inbound/tun#stack) and [WireGuard outbound](/configuration/outbound/wireguard#system_interface).                                                                                                                                                               |
+| `with_embedded_tor` (CGO required) | ✖️   | Build with embedded Tor support, see [Tor outbound](/configuration/outbound/tor).                                                                                                                                                                                                                                          |
+| `with_lwip` (CGO required)         | ✖️   | Build with LWIP Tun stack support, see [Tun inbound](/configuration/inbound/tun#stack).                                                                                                                                                                                                                                    |
+
+
+除非您确实知道您正在启用什么，否则不建议更改默认构建标签列表。

docs/installation/docker.zh.md

@@ -0,0 +1,31 @@
+---
+icon: material/docker
+---
+
+# Docker
+
+## :material-console: 命令
+
+```bash
+docker run -d \
+  -v /etc/sing-box:/etc/sing-box/ \
+  --name=sing-box \
+  --restart=always \
+  ghcr.io/sagernet/sing-box \
+  -D /var/lib/sing-box \
+  -C /etc/sing-box/ run
+```
+
+## :material-box-shadow: Compose
+
+```yaml
+version: "3.8"
+services:
+  sing-box:
+    image: ghcr.io/sagernet/sing-box
+    container_name: sing-box
+    restart: always
+    volumes:
+      - /etc/sing-box:/etc/sing-box/
+    command: -D /var/lib/sing-box -C /etc/sing-box/ run
+```

docs/installation/package-manager.zh.md

@@ -0,0 +1,90 @@
+---
+icon: material/package
+---
+
+# 包管理器
+
+## :material-download-box: 手动安装
+
+=== ":material-debian: Debian / DEB"
+
+    ```bash
+    bash <(curl -fsSL https://sing-box.app/deb-install.sh)
+    ```
+
+=== ":material-redhat: Redhat / RPM"
+
+    ```bash
+    bash <(curl -fsSL https://sing-box.app/rpm-install.sh)
+    ```
+
+=== ":simple-archlinux: Archlinux / PKG"
+
+    ```bash
+    bash <(curl -fsSL https://sing-box.app/arch-install.sh)
+    ```
+
+## :material-book-lock-open: 托管安装
+
+=== ":material-linux: Linux"
+
+    | 类型       | 平台                 | 链接                  | 命令                           | 活跃维护             |
+    |----------|--------------------|---------------------|------------------------------|------------------|
+    | AUR      | (Linux) Arch Linux | [sing-box][aur] ᴬᵁᴿ | `? -S sing-box`              | :material-check: |
+    | nixpkgs  | (Linux) NixOS      | [sing-box][nixpkgs] | `nix-env -iA nixos.sing-box` | :material-check: |
+    | Homebrew | macOS / Linux      | [sing-box][brew]    | `brew install sing-box`      | :material-check: |
+    | Alpine   | (Linux) Alpine     | [sing-box][alpine]  | `apk add sing-box`           | :material-alert: |
+
+=== ":material-apple: macOS"
+
+    | 类型       | 平台            | 链接               | 命令                      | 活跃维护             |
+    |----------|---------------|------------------|-------------------------|------------------|
+    | Homebrew | macOS / Linux | [sing-box][brew] | `brew install sing-box` | :material-check: |
+
+=== ":material-microsoft-windows: Windows"
+
+    | 类型         | 平台      | 链接                 | 命令                        | 活跃维护             |
+    |------------|---------|--------------------|---------------------------|------------------|
+    | Scoop      | Windows | [sing-box][scoop]  | `scoop install sing-box`  | :material-check: |
+    | Chocolatey | Windows | [sing-box][choco]  | `choco install sing-box`  | :material-check: |
+    | winget     | Windows | [sing-box][winget] | `winget install sing-box` | :material-alert: |
+
+=== ":material-android: Android"
+
+    | 类型     | 平台      | 链接                 | 命令                 | 活跃维护             |
+    |--------|---------|--------------------|--------------------|------------------|
+    | Termux | Android | [sing-box][termux] | `pkg add sing-box` | :material-check: |
+
+## :material-book-multiple: 服务管理
+
+对于带有 [systemd][systemd] 的 Linux 系统，通常安装已经包含 sing-box 服务，
+您可以使用以下命令管理服务：
+
+| 行动   | 命令                                            |
+|------|-----------------------------------------------|
+| 启用   | `sudo systemctl enable sing-box`              |
+| 禁用   | `sudo systemctl disable sing-box`             |
+| 启动   | `sudo systemctl start sing-box`               |
+| 停止   | `sudo systemctl stop sing-box`                |
+| 强行停止 | `sudo systemctl kill sing-box`                |
+| 重新启动 | `sudo systemctl restart sing-box`             |
+| 查看日志 | `sudo journalctl -u sing-box --output cat -e` |
+| 实时日志 | `sudo journalctl -u sing-box --output cat -f` |
+
+[alpine]: https://pkgs.alpinelinux.org/packages?name=sing-box
+
+[aur]: https://aur.archlinux.org/packages/sing-box
+
+[nixpkgs]: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/tools/networking/sing-box/default.nix
+
+[termux]: https://github.com/termux/termux-packages/tree/master/packages/sing-box
+
+[brew]: https://formulae.brew.sh/formula/sing-box
+
+[choco]: https://chocolatey.org/packages/sing-box
+
+[scoop]: https://github.com/ScoopInstaller/Main/blob/master/bucket/sing-box.json
+
+[winget]: https://github.com/microsoft/winget-pkgs/tree/master/manifests/s/SagerNet/sing-box
+
+[systemd]: https://systemd.io/

docs/migration.md

@@ -2,8 +2,6 @@
 icon: material/arrange-bring-forward
 ---
 
-# Migration
-
 ## 1.8.0
 
 !!! warning "Unstable"
@@ -12,7 +10,7 @@ icon: material/arrange-bring-forward
 
 ### :material-close-box: Migrate cache file from Clash API to independent options
 
-!!! info "Reference"
+!!! info "References"
 
     [Clash API](/configuration/experimental/clash-api) / 
     [Cache File](/configuration/experimental/cache-file)
@@ -50,7 +48,7 @@ icon: material/arrange-bring-forward
 
 ### :material-checkbox-intermediate: Migrate GeoIP to rule sets
 
-!!! info "Reference"
+!!! info "References"
 
     [GeoIP](/configuration/route/geoip) / 
     [Route](/configuration/route) / 
@@ -135,7 +133,7 @@ icon: material/arrange-bring-forward
 
 ### :material-checkbox-intermediate: Migrate Geosite to rule sets
 
-!!! info "Reference"
+!!! info "References"
 
     [Geosite](/configuration/route/geosite) / 
     [Route](/configuration/route) / 

docs/migration.zh.md

@@ -0,0 +1,193 @@
+---
+icon: material/arrange-bring-forward
+---
+
+## 1.8.0
+
+!!! warning "不稳定的"
+
+    该版本仍在开发中，迁移指南可能将在未来更改。
+
+### :material-close-box: 将缓存文件从 Clash API 迁移到独立选项
+
+!!! info "参考"
+
+    [Clash API](/zh/configuration/experimental/clash-api) / 
+    [Cache File](/zh/configuration/experimental/cache-file)
+
+=== ":material-card-remove: 弃用的"
+
+    ```json
+    {
+      "experimental": {
+        "clash_api": {
+          "cache_file": "cache.db", // 默认值
+          "cahce_id": "my_profile2",
+          "store_mode": true,
+          "store_selected": true,
+          "store_fakeip": true
+        }
+      }
+    }
+    ```
+
+=== ":material-card-multiple: 新的"
+
+    ```json
+    {
+      "experimental"  : {
+        "cache_file": {
+          "enabled": true,
+          "path": "cache.db", // 默认值
+          "cache_id": "my_profile2",
+          "store_fakeip": true
+        }
+      }
+    }
+    ```
+
+### :material-checkbox-intermediate: 迁移 GeoIP 到规则集
+
+!!! info "参考"
+
+    [GeoIP](/zh/configuration/route/geoip) / 
+    [路由](/zh/configuration/route) / 
+    [路由规则](/zh/configuration/route/rule) / 
+    [DNS 规则](/zh/configuration/dns/rule) / 
+    [规则集](/zh/configuration/rule-set)
+
+!!! tip
+
+    `sing-box geoip` 命令可以帮助您将自定义 GeoIP 转换为规则集。
+
+=== ":material-card-remove: 弃用的"
+
+    ```json
+    {
+      "route": {
+        "rules": [
+          {
+            "geoip": "private",
+            "outbound": "direct"
+          },
+          {
+            "geoip": "cn",
+            "outbound": "direct"
+          },
+          {
+            "source_geoip": "cn",
+            "outbound": "block"
+          }
+        ],
+        "geoip": {
+          "download_detour": "proxy"
+        }
+      }
+    }
+    ```
+
+=== ":material-card-multiple: 新的"
+
+    ```json
+    {
+      "route": {
+        "rules": [
+          {
+            "ip_is_private": true,
+            "outbound": "direct"
+          },
+          {
+            "rule_set": "geoip-cn",
+            "outbound": "direct"
+          },
+          {
+            "rule_set": "geoip-us",
+            "rule_set_ipcidr_match_source": true,
+            "outbound": "block"
+          }
+        ],
+        "rule_set": [
+          {
+            "tag": "geoip-cn",
+            "type": "remote",
+            "format": "binary",
+            "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs",
+            "download_detour": "proxy"
+          },
+          {
+            "tag": "geoip-us",
+            "type": "remote",
+            "format": "binary",
+            "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-us.srs",
+            "download_detour": "proxy"
+          }
+        ]
+      },
+      "experimental": {
+        "cache_file": {
+          "enabled": true // required to save Rule Set cache
+        }
+      }
+    }
+    ```
+
+### :material-checkbox-intermediate: 迁移 Geosite 到规则集
+
+!!! info "参考"
+
+    [Geosite](/zh/configuration/route/geosite) / 
+    [路由](/zh/configuration/route) / 
+    [路由规则](/zh/configuration/route/rule) / 
+    [DNS 规则](/zh/configuration/dns/rule) / 
+    [规则集](/zh/configuration/rule-set)
+
+!!! tip
+
+    `sing-box geosite` 命令可以帮助您将自定义 Geosite 转换为规则集。
+
+=== ":material-card-remove: 弃用的"
+
+    ```json
+    {
+      "route": {
+        "rules": [
+          {
+            "geosite": "cn",
+            "outbound": "direct"
+          }
+        ],
+        "geosite": {
+          "download_detour": "proxy"
+        }
+      }
+    }
+    ```
+
+=== ":material-card-multiple: 新的"
+
+    ```json
+    {
+      "route": {
+        "rules": [
+          {
+            "rule_set": "geosite-cn",
+            "outbound": "direct"
+          }
+        ],
+        "rule_set": [
+          {
+            "tag": "geosite-cn",
+            "type": "remote",
+            "format": "binary",
+            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs",
+            "download_detour": "proxy"
+          }
+        ]
+      },
+      "experimental": {
+        "cache_file": {
+          "enabled": true // required to save Rule Set cache
+        }
+      }
+    }
+    ```

experimental/clashapi/api_meta_group.go

@@ -83,7 +83,7 @@ func getGroupDelay(server *Server) func(w http.ResponseWriter, r *http.Request)
 
 		var result map[string]uint16
 		if urlTestGroup, isURLTestGroup := group.(adapter.URLTestGroup); isURLTestGroup {
-			result, err = urlTestGroup.URLTest(ctx, url)
+			result, err = urlTestGroup.URLTest(ctx)
 		} else {
 			outbounds := common.FilterNotNil(common.Map(group.All(), func(it string) adapter.Outbound {
 				itOutbound, _ := server.router.Outbound(it)

experimental/libbox/config.go

@@ -3,9 +3,9 @@ package libbox
 import (
 	"bytes"
 	"context"
-	"encoding/json"
 
 	"github.com/sagernet/sing-box"
+	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
 )

go.mod

@@ -26,7 +26,7 @@ require (
 	github.com/sagernet/gvisor v0.0.0-20231119034329-07cfb6aaf930
 	github.com/sagernet/quic-go v0.40.0
 	github.com/sagernet/reality v0.0.0-20230406110435-ee17307e7691
-	github.com/sagernet/sing v0.2.18-0.20231130092223-1f82310f0375
+	github.com/sagernet/sing v0.2.18-0.20231201060417-575186ed63c2
 	github.com/sagernet/sing-dns v0.1.11
 	github.com/sagernet/sing-mux v0.1.5-0.20231109075101-6b086ed6bb07
 	github.com/sagernet/sing-quic v0.1.5-0.20231123150216-00957d136203

go.sum

@@ -110,8 +110,8 @@ github.com/sagernet/reality v0.0.0-20230406110435-ee17307e7691 h1:5Th31OC6yj8byL
 github.com/sagernet/reality v0.0.0-20230406110435-ee17307e7691/go.mod h1:B8lp4WkQ1PwNnrVMM6KyuFR20pU8jYBD+A4EhJovEXU=
 github.com/sagernet/sing v0.0.0-20220817130738-ce854cda8522/go.mod h1:QVsS5L/ZA2Q5UhQwLrn0Trw+msNd/NPGEhBKR/ioWiY=
 github.com/sagernet/sing v0.1.8/go.mod h1:jt1w2u7lJQFFSGLiRrRIs5YWmx4kAPfWuOejuDW9qMk=
-github.com/sagernet/sing v0.2.18-0.20231130092223-1f82310f0375 h1:5Q5K/twBNT1Hrpjd5Ghft0Sv0V+eVfTZX17CiPItSV8=
-github.com/sagernet/sing v0.2.18-0.20231130092223-1f82310f0375/go.mod h1:OL6k2F0vHmEzXz2KW19qQzu172FDgSbUSODylighuVo=
+github.com/sagernet/sing v0.2.18-0.20231201060417-575186ed63c2 h1:1ydWkFgLURGlrnwRdjyrpo9lp1g5Qq7XrNBghMntWTs=
+github.com/sagernet/sing v0.2.18-0.20231201060417-575186ed63c2/go.mod h1:OL6k2F0vHmEzXz2KW19qQzu172FDgSbUSODylighuVo=
 github.com/sagernet/sing-dns v0.1.11 h1:PPrMCVVrAeR3f5X23I+cmvacXJ+kzuyAsBiWyUKhGSE=
 github.com/sagernet/sing-dns v0.1.11/go.mod h1:zJ/YjnYB61SYE+ubMcMqVdpaSvsyQ2iShQGO3vuLvvE=
 github.com/sagernet/sing-mux v0.1.5-0.20231109075101-6b086ed6bb07 h1:ncKb5tVOsCQgCsv6UpsA0jinbNb5OQ5GMPJlyQP3EHM=

mkdocs.yml

@@ -220,6 +220,7 @@ plugins:
             Headless Rule: 无头规则
 
             Experimental: 实验性
+            Cache File: 缓存文件
 
             Shared: 通用
             Listen Fields: 监听字段

option/debug.go

@@ -1,9 +1,8 @@
 package option
 
 import (
-	"encoding/json"
-
 	"github.com/sagernet/sing-box/common/humanize"
+	"github.com/sagernet/sing-box/common/json"
 )
 
 type DebugOptions struct {

option/group.go

@@ -11,5 +11,6 @@ type URLTestOutboundOptions struct {
 	URL                       string   `json:"url,omitempty"`
 	Interval                  Duration `json:"interval,omitempty"`
 	Tolerance                 uint16   `json:"tolerance,omitempty"`
+	IdleTimeout               Duration `json:"idle_timeout,omitempty"`
 	InterruptExistConnections bool     `json:"interrupt_exist_connections,omitempty"`
 }

option/inbound.go

@@ -114,7 +114,7 @@ func (h *Inbound) UnmarshalJSON(bytes []byte) error {
 	}
 	err = UnmarshallExcluded(bytes, (*_Inbound)(h), v)
 	if err != nil {
-		return E.Cause(err, "inbound options")
+		return err
 	}
 	return nil
 }

option/outbound.go

@@ -124,7 +124,7 @@ func (h *Outbound) UnmarshalJSON(bytes []byte) error {
 	}
 	err = UnmarshallExcluded(bytes, (*_Outbound)(h), v)
 	if err != nil {
-		return E.Cause(err, "outbound options")
+		return err
 	}
 	return nil
 }

option/rule.go

@@ -48,7 +48,7 @@ func (r *Rule) UnmarshalJSON(bytes []byte) error {
 	}
 	err = UnmarshallExcluded(bytes, (*_Rule)(r), v)
 	if err != nil {
-		return E.Cause(err, "route rule")
+		return err
 	}
 	return nil
 }

option/rule_dns.go

@@ -48,7 +48,7 @@ func (r *DNSRule) UnmarshalJSON(bytes []byte) error {
 	}
 	err = UnmarshallExcluded(bytes, (*_DNSRule)(r), v)
 	if err != nil {
-		return E.Cause(err, "dns route rule")
+		return err
 	}
 	return nil
 }

option/rule_set.go

@@ -64,7 +64,7 @@ func (r *RuleSet) UnmarshalJSON(bytes []byte) error {
 	}
 	err = UnmarshallExcluded(bytes, (*_RuleSet)(r), v)
 	if err != nil {
-		return E.Cause(err, "rule set")
+		return err
 	}
 	return nil
 }
@@ -118,7 +118,7 @@ func (r *HeadlessRule) UnmarshalJSON(bytes []byte) error {
 	}
 	err = UnmarshallExcluded(bytes, (*_HeadlessRule)(r), v)
 	if err != nil {
-		return E.Cause(err, "route rule-set rule")
+		return err
 	}
 	return nil
 }
@@ -209,7 +209,7 @@ func (r *PlainRuleSetCompat) UnmarshalJSON(bytes []byte) error {
 	}
 	err = UnmarshallExcluded(bytes, (*_PlainRuleSetCompat)(r), v)
 	if err != nil {
-		return E.Cause(err, "rule set")
+		return err
 	}
 	return nil
 }

option/time_unit.go

@@ -0,0 +1,226 @@
+package option
+
+import (
+	"errors"
+	"time"
+)
+
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+const durationDay = 24 * time.Hour
+
+var unitMap = map[string]uint64{
+	"ns": uint64(time.Nanosecond),
+	"us": uint64(time.Microsecond),
+	"µs": uint64(time.Microsecond), // U+00B5 = micro symbol
+	"μs": uint64(time.Microsecond), // U+03BC = Greek letter mu
+	"ms": uint64(time.Millisecond),
+	"s":  uint64(time.Second),
+	"m":  uint64(time.Minute),
+	"h":  uint64(time.Hour),
+	"d":  uint64(durationDay),
+}
+
+// ParseDuration parses a duration string.
+// A duration string is a possibly signed sequence of
+// decimal numbers, each with optional fraction and a unit suffix,
+// such as "300ms", "-1.5h" or "2h45m".
+// Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+func ParseDuration(s string) (Duration, error) {
+	// [-+]?([0-9]*(\.[0-9]*)?[a-z]+)+
+	orig := s
+	var d uint64
+	neg := false
+
+	// Consume [-+]?
+	if s != "" {
+		c := s[0]
+		if c == '-' || c == '+' {
+			neg = c == '-'
+			s = s[1:]
+		}
+	}
+	// Special case: if all that is left is "0", this is zero.
+	if s == "0" {
+		return 0, nil
+	}
+	if s == "" {
+		return 0, errors.New("time: invalid duration " + quote(orig))
+	}
+	for s != "" {
+		var (
+			v, f  uint64      // integers before, after decimal point
+			scale float64 = 1 // value = v + f/scale
+		)
+
+		var err error
+
+		// The next character must be [0-9.]
+		if !(s[0] == '.' || '0' <= s[0] && s[0] <= '9') {
+			return 0, errors.New("time: invalid duration " + quote(orig))
+		}
+		// Consume [0-9]*
+		pl := len(s)
+		v, s, err = leadingInt(s)
+		if err != nil {
+			return 0, errors.New("time: invalid duration " + quote(orig))
+		}
+		pre := pl != len(s) // whether we consumed anything before a period
+
+		// Consume (\.[0-9]*)?
+		post := false
+		if s != "" && s[0] == '.' {
+			s = s[1:]
+			pl := len(s)
+			f, scale, s = leadingFraction(s)
+			post = pl != len(s)
+		}
+		if !pre && !post {
+			// no digits (e.g. ".s" or "-.s")
+			return 0, errors.New("time: invalid duration " + quote(orig))
+		}
+
+		// Consume unit.
+		i := 0
+		for ; i < len(s); i++ {
+			c := s[i]
+			if c == '.' || '0' <= c && c <= '9' {
+				break
+			}
+		}
+		if i == 0 {
+			return 0, errors.New("time: missing unit in duration " + quote(orig))
+		}
+		u := s[:i]
+		s = s[i:]
+		unit, ok := unitMap[u]
+		if !ok {
+			return 0, errors.New("time: unknown unit " + quote(u) + " in duration " + quote(orig))
+		}
+		if v > 1<<63/unit {
+			// overflow
+			return 0, errors.New("time: invalid duration " + quote(orig))
+		}
+		v *= unit
+		if f > 0 {
+			// float64 is needed to be nanosecond accurate for fractions of hours.
+			// v >= 0 && (f*unit/scale) <= 3.6e+12 (ns/h, h is the largest unit)
+			v += uint64(float64(f) * (float64(unit) / scale))
+			if v > 1<<63 {
+				// overflow
+				return 0, errors.New("time: invalid duration " + quote(orig))
+			}
+		}
+		d += v
+		if d > 1<<63 {
+			return 0, errors.New("time: invalid duration " + quote(orig))
+		}
+	}
+	if neg {
+		return -Duration(d), nil
+	}
+	if d > 1<<63-1 {
+		return 0, errors.New("time: invalid duration " + quote(orig))
+	}
+	return Duration(d), nil
+}
+
+var errLeadingInt = errors.New("time: bad [0-9]*") // never printed
+
+// leadingInt consumes the leading [0-9]* from s.
+func leadingInt[bytes []byte | string](s bytes) (x uint64, rem bytes, err error) {
+	i := 0
+	for ; i < len(s); i++ {
+		c := s[i]
+		if c < '0' || c > '9' {
+			break
+		}
+		if x > 1<<63/10 {
+			// overflow
+			return 0, rem, errLeadingInt
+		}
+		x = x*10 + uint64(c) - '0'
+		if x > 1<<63 {
+			// overflow
+			return 0, rem, errLeadingInt
+		}
+	}
+	return x, s[i:], nil
+}
+
+// leadingFraction consumes the leading [0-9]* from s.
+// It is used only for fractions, so does not return an error on overflow,
+// it just stops accumulating precision.
+func leadingFraction(s string) (x uint64, scale float64, rem string) {
+	i := 0
+	scale = 1
+	overflow := false
+	for ; i < len(s); i++ {
+		c := s[i]
+		if c < '0' || c > '9' {
+			break
+		}
+		if overflow {
+			continue
+		}
+		if x > (1<<63-1)/10 {
+			// It's possible for overflow to give a positive number, so take care.
+			overflow = true
+			continue
+		}
+		y := x*10 + uint64(c) - '0'
+		if y > 1<<63 {
+			overflow = true
+			continue
+		}
+		x = y
+		scale *= 10
+	}
+	return x, scale, s[i:]
+}
+
+// These are borrowed from unicode/utf8 and strconv and replicate behavior in
+// that package, since we can't take a dependency on either.
+const (
+	lowerhex  = "0123456789abcdef"
+	runeSelf  = 0x80
+	runeError = '\uFFFD'
+)
+
+func quote(s string) string {
+	buf := make([]byte, 1, len(s)+2) // slice will be at least len(s) + quotes
+	buf[0] = '"'
+	for i, c := range s {
+		if c >= runeSelf || c < ' ' {
+			// This means you are asking us to parse a time.Duration or
+			// time.Location with unprintable or non-ASCII characters in it.
+			// We don't expect to hit this case very often. We could try to
+			// reproduce strconv.Quote's behavior with full fidelity but
+			// given how rarely we expect to hit these edge cases, speed and
+			// conciseness are better.
+			var width int
+			if c == runeError {
+				width = 1
+				if i+2 < len(s) && s[i:i+3] == string(runeError) {
+					width = 3
+				}
+			} else {
+				width = len(string(c))
+			}
+			for j := 0; j < width; j++ {
+				buf = append(buf, `\x`...)
+				buf = append(buf, lowerhex[s[i+j]>>4])
+				buf = append(buf, lowerhex[s[i+j]&0xF])
+			}
+		} else {
+			if c == '"' || c == '\\' {
+				buf = append(buf, '\\')
+			}
+			buf = append(buf, string(c)...)
+		}
+	}
+	buf = append(buf, '"')
+	return string(buf)
+}

option/tls_acme.go

@@ -62,7 +62,7 @@ func (o *ACMEDNS01ChallengeOptions) UnmarshalJSON(bytes []byte) error {
 	}
 	err = UnmarshallExcluded(bytes, (*_ACMEDNS01ChallengeOptions)(o), v)
 	if err != nil {
-		return E.Cause(err, "DNS01 challenge options")
+		return err
 	}
 	return nil
 }

option/types.go

@@ -164,7 +164,7 @@ func (d *Duration) UnmarshalJSON(bytes []byte) error {
 	if err != nil {
 		return err
 	}
-	duration, err := time.ParseDuration(value)
+	duration, err := ParseDuration(value)
 	if err != nil {
 		return err
 	}

option/v2ray_transport.go

@@ -60,7 +60,7 @@ func (o *V2RayTransportOptions) UnmarshalJSON(bytes []byte) error {
 	}
 	err = UnmarshallExcluded(bytes, (*_V2RayTransportOptions)(o), v)
 	if err != nil {
-		return E.Cause(err, "vmess transport options")
+		return err
 	}
 	return nil
 }

outbound/dns.go

@@ -165,6 +165,7 @@ func (d *DNS) NewPacketConnection(ctx context.Context, conn N.PacketConn, metada
 				}
 				timeout.Update()
 				responseBuffer := buf.NewPacket()
+				responseBuffer.Resize(1024, 0)
 				n, err := response.PackBuffer(responseBuffer.FreeBytes())
 				if err != nil {
 					cancel(err)
@@ -194,9 +195,7 @@ func (d *DNS) newPacketConnection(ctx context.Context, conn N.PacketConn, readWa
 	group.Append0(func(ctx context.Context) error {
 		var buffer *buf.Buffer
 		readWaiter.InitializeReadWaiter(func() *buf.Buffer {
-			buffer = buf.NewSize(dns.FixedPacketSize)
-			buffer.FullReset()
-			return buffer
+			return buf.NewSize(dns.FixedPacketSize)
 		})
 		defer readWaiter.InitializeReadWaiter(nil)
 		for {
@@ -243,6 +242,7 @@ func (d *DNS) newPacketConnection(ctx context.Context, conn N.PacketConn, readWa
 				}
 				timeout.Update()
 				responseBuffer := buf.NewPacket()
+				responseBuffer.Resize(1024, 0)
 				n, err := response.PackBuffer(responseBuffer.FreeBytes())
 				if err != nil {
 					cancel(err)

outbound/urltest.go

@@ -3,7 +3,6 @@ package outbound
 import (
 	"context"
 	"net"
-	"sort"
 	"sync"
 	"time"
 
@@ -36,6 +35,7 @@ type URLTest struct {
 	link                         string
 	interval                     time.Duration
 	tolerance                    uint16
+	idleTimeout                  time.Duration
 	group                        *URLTestGroup
 	interruptExternalConnections bool
 }
@@ -54,6 +54,7 @@ func NewURLTest(ctx context.Context, router adapter.Router, logger log.ContextLo
 		link:                         options.URL,
 		interval:                     time.Duration(options.Interval),
 		tolerance:                    options.Tolerance,
+		idleTimeout:                  time.Duration(options.IdleTimeout),
 		interruptExternalConnections: options.InterruptExistConnections,
 	}
 	if len(outbound.tags) == 0 {
@@ -78,12 +79,26 @@ func (s *URLTest) Start() error {
 		}
 		outbounds = append(outbounds, detour)
 	}
-	s.group = NewURLTestGroup(s.ctx, s.router, s.logger, outbounds, s.link, s.interval, s.tolerance, s.interruptExternalConnections)
+	group, err := NewURLTestGroup(
+		s.ctx,
+		s.router,
+		s.logger,
+		outbounds,
+		s.link,
+		s.interval,
+		s.tolerance,
+		s.idleTimeout,
+		s.interruptExternalConnections,
+	)
+	if err != nil {
+		return err
+	}
+	s.group = group
 	return nil
 }
 
 func (s *URLTest) PostStart() error {
-	go s.CheckOutbounds()
+	s.group.PostStart()
 	return nil
 }
 
@@ -101,8 +116,8 @@ func (s *URLTest) All() []string {
 	return s.tags
 }
 
-func (s *URLTest) URLTest(ctx context.Context, link string) (map[string]uint16, error) {
-	return s.group.URLTest(ctx, link)
+func (s *URLTest) URLTest(ctx context.Context) (map[string]uint16, error) {
+	return s.group.URLTest(ctx)
 }
 
 func (s *URLTest) CheckOutbounds() {
@@ -110,7 +125,7 @@ func (s *URLTest) CheckOutbounds() {
 }
 
 func (s *URLTest) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
-	s.group.Start()
+	s.group.Touch()
 	outbound := s.group.Select(network)
 	conn, err := outbound.DialContext(ctx, network, destination)
 	if err == nil {
@@ -122,7 +137,7 @@ func (s *URLTest) DialContext(ctx context.Context, network string, destination M
 }
 
 func (s *URLTest) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	s.group.Start()
+	s.group.Touch()
 	outbound := s.group.Select(N.NetworkUDP)
 	conn, err := outbound.ListenPacket(ctx, destination)
 	if err == nil {
@@ -156,6 +171,7 @@ type URLTestGroup struct {
 	link                         string
 	interval                     time.Duration
 	tolerance                    uint16
+	idleTimeout                  time.Duration
 	history                      *urltest.HistoryStorage
 	checking                     atomic.Bool
 	pauseManager                 pause.Manager
@@ -164,9 +180,11 @@ type URLTestGroup struct {
 	interruptGroup               *interrupt.Group
 	interruptExternalConnections bool
 
-	access sync.Mutex
-	ticker *time.Ticker
-	close  chan struct{}
+	access     sync.Mutex
+	ticker     *time.Ticker
+	close      chan struct{}
+	started    bool
+	lastActive atomic.TypedValue[time.Time]
 }
 
 func NewURLTestGroup(
@@ -177,14 +195,21 @@ func NewURLTestGroup(
 	link string,
 	interval time.Duration,
 	tolerance uint16,
+	idleTimeout time.Duration,
 	interruptExternalConnections bool,
-) *URLTestGroup {
+) (*URLTestGroup, error) {
 	if interval == 0 {
 		interval = C.DefaultURLTestInterval
 	}
 	if tolerance == 0 {
 		tolerance = 50
 	}
+	if idleTimeout == 0 {
+		idleTimeout = C.DefaultURLTestIdleTimeout
+	}
+	if interval > idleTimeout {
+		return nil, E.New("interval must be less or equal than idle_timeout")
+	}
 	var history *urltest.HistoryStorage
 	if history = service.PtrFromContext[urltest.HistoryStorage](ctx); history != nil {
 	} else if clashServer := router.ClashServer(); clashServer != nil {
@@ -200,16 +225,27 @@ func NewURLTestGroup(
 		link:                         link,
 		interval:                     interval,
 		tolerance:                    tolerance,
+		idleTimeout:                  idleTimeout,
 		history:                      history,
 		close:                        make(chan struct{}),
 		pauseManager:                 pause.ManagerFromContext(ctx),
 		interruptGroup:               interrupt.NewGroup(),
 		interruptExternalConnections: interruptExternalConnections,
-	}
+	}, nil
 }
 
-func (g *URLTestGroup) Start() {
+func (g *URLTestGroup) PostStart() {
+	g.started = true
+	g.lastActive.Store(time.Now())
+	go g.CheckOutbounds(false)
+}
+
+func (g *URLTestGroup) Touch() {
+	if !g.started {
+		return
+	}
 	if g.ticker != nil {
+		g.lastActive.Store(time.Now())
 		return
 	}
 	g.access.Lock()
@@ -260,51 +296,38 @@ func (g *URLTestGroup) Select(network string) adapter.Outbound {
 	return minOutbound
 }
 
-func (g *URLTestGroup) Fallback(used adapter.Outbound) []adapter.Outbound {
-	outbounds := make([]adapter.Outbound, 0, len(g.outbounds)-1)
-	for _, detour := range g.outbounds {
-		if detour != used {
-			outbounds = append(outbounds, detour)
-		}
-	}
-	sort.SliceStable(outbounds, func(i, j int) bool {
-		oi := outbounds[i]
-		oj := outbounds[j]
-		hi := g.history.LoadURLTestHistory(RealTag(oi))
-		if hi == nil {
-			return false
-		}
-		hj := g.history.LoadURLTestHistory(RealTag(oj))
-		if hj == nil {
-			return false
-		}
-		return hi.Delay < hj.Delay
-	})
-	return outbounds
-}
-
 func (g *URLTestGroup) loopCheck() {
-	go g.CheckOutbounds(true)
+	if time.Now().Sub(g.lastActive.Load()) > g.interval {
+		g.lastActive.Store(time.Now())
+		g.CheckOutbounds(false)
+	}
 	for {
-		g.pauseManager.WaitActive()
 		select {
 		case <-g.close:
 			return
 		case <-g.ticker.C:
-			g.CheckOutbounds(false)
 		}
+		if time.Now().Sub(g.lastActive.Load()) > g.idleTimeout {
+			g.access.Lock()
+			g.ticker.Stop()
+			g.ticker = nil
+			g.access.Unlock()
+			return
+		}
+		g.pauseManager.WaitActive()
+		g.CheckOutbounds(false)
 	}
 }
 
 func (g *URLTestGroup) CheckOutbounds(force bool) {
-	_, _ = g.urlTest(g.ctx, g.link, force)
+	_, _ = g.urlTest(g.ctx, force)
 }
 
-func (g *URLTestGroup) URLTest(ctx context.Context, link string) (map[string]uint16, error) {
-	return g.urlTest(ctx, link, false)
+func (g *URLTestGroup) URLTest(ctx context.Context) (map[string]uint16, error) {
+	return g.urlTest(ctx, false)
 }
 
-func (g *URLTestGroup) urlTest(ctx context.Context, link string, force bool) (map[string]uint16, error) {
+func (g *URLTestGroup) urlTest(ctx context.Context, force bool) (map[string]uint16, error) {
 	result := make(map[string]uint16)
 	if g.checking.Swap(true) {
 		return result, nil
@@ -331,7 +354,7 @@ func (g *URLTestGroup) urlTest(ctx context.Context, link string, force bool) (ma
 		b.Go(realTag, func() (any, error) {
 			ctx, cancel := context.WithTimeout(context.Background(), C.TCPTimeout)
 			defer cancel()
-			t, err := urltest.URLTest(ctx, link, p)
+			t, err := urltest.URLTest(ctx, g.link, p)
 			if err != nil {
 				g.logger.Debug("outbound ", tag, " unavailable: ", err)
 				g.history.DeleteURLTestHistory(realTag)

route/router.go

@@ -91,6 +91,7 @@ type Router struct {
 	platformInterface                  platform.Interface
 	needWIFIState                      bool
 	wifiState                          adapter.WIFIState
+	started                            bool
 }
 
 func NewRouter(
@@ -145,6 +146,9 @@ func NewRouter(
 		router.dnsRules = append(router.dnsRules, dnsRule)
 	}
 	for i, ruleSetOptions := range options.RuleSet {
+		if _, exists := router.ruleSetMap[ruleSetOptions.Tag]; exists {
+			return nil, E.New("duplicate rule-set tag: ", ruleSetOptions.Tag)
+		}
 		ruleSet, err := NewRuleSet(ctx, router, router.logger, ruleSetOptions)
 		if err != nil {
 			return nil, E.Cause(err, "parse rule-set[", i, "]")
@@ -255,6 +259,9 @@ func NewRouter(
 		}
 		defaultTransport = transports[0]
 	}
+	if _, isFakeIP := defaultTransport.(adapter.FakeIPTransport); isFakeIP {
+		return nil, E.New("default DNS server cannot be fakeip")
+	}
 	router.defaultTransport = defaultTransport
 	router.transports = transports
 	router.transportMap = transportMap
@@ -491,24 +498,33 @@ func (r *Router) Start() error {
 	if r.needWIFIState {
 		r.updateWIFIState()
 	}
-	ruleSetStartContext := NewRuleSetStartContext()
-	var ruleSetStartGroup task.Group
-	for i, ruleSet := range r.ruleSets {
-		ruleSetStartGroup.Append0(func(ctx context.Context) error {
-			err := ruleSet.StartContext(ctx, ruleSetStartContext)
-			if err != nil {
-				return E.Cause(err, "initialize rule-set[", i, "]")
-			}
-			return nil
-		})
+	if r.fakeIPStore != nil {
+		err := r.fakeIPStore.Start()
+		if err != nil {
+			return err
+		}
 	}
-	ruleSetStartGroup.Concurrency(5)
-	ruleSetStartGroup.FastFail()
-	err := ruleSetStartGroup.Run(r.ctx)
-	if err != nil {
-		return err
+	if len(r.ruleSets) > 0 {
+		ruleSetStartContext := NewRuleSetStartContext()
+		var ruleSetStartGroup task.Group
+		for i, ruleSet := range r.ruleSets {
+			ruleSetInPlace := ruleSet
+			ruleSetStartGroup.Append0(func(ctx context.Context) error {
+				err := ruleSetInPlace.StartContext(ctx, ruleSetStartContext)
+				if err != nil {
+					return E.Cause(err, "initialize rule-set[", i, "]")
+				}
+				return nil
+			})
+		}
+		ruleSetStartGroup.Concurrency(5)
+		ruleSetStartGroup.FastFail()
+		err := ruleSetStartGroup.Run(r.ctx)
+		if err != nil {
+			return err
+		}
+		ruleSetStartContext.Close()
 	}
-	ruleSetStartContext.Close()
 	for i, rule := range r.rules {
 		err := rule.Start()
 		if err != nil {
@@ -521,12 +537,6 @@ func (r *Router) Start() error {
 			return E.Cause(err, "initialize DNS rule[", i, "]")
 		}
 	}
-	if r.fakeIPStore != nil {
-		err := r.fakeIPStore.Start()
-		if err != nil {
-			return err
-		}
-	}
 	for i, transport := range r.transports {
 		err := transport.Start()
 		if err != nil {
@@ -601,6 +611,19 @@ func (r *Router) Close() error {
 	return err
 }
 
+func (r *Router) PostStart() error {
+	if len(r.ruleSets) > 0 {
+		for i, ruleSet := range r.ruleSets {
+			err := ruleSet.PostStart()
+			if err != nil {
+				return E.Cause(err, "post start rule-set[", i, "]")
+			}
+		}
+	}
+	r.started = true
+	return nil
+}
+
 func (r *Router) Outbound(tag string) (adapter.Outbound, bool) {
 	outbound, loaded := r.outboundByTag[tag]
 	return outbound, loaded
@@ -687,7 +710,6 @@ func (r *Router) RouteConnection(ctx context.Context, conn net.Conn, metadata ad
 
 	if metadata.InboundOptions.SniffEnabled {
 		buffer := buf.NewPacket()
-		buffer.FullReset()
 		sniffMetadata, err := sniff.PeekStream(ctx, conn, buffer, time.Duration(metadata.InboundOptions.SniffTimeout), sniff.StreamDomainNameQuery, sniff.TLSClientHello, sniff.HTTPHost)
 		if sniffMetadata != nil {
 			metadata.Protocol = sniffMetadata.Protocol
@@ -803,7 +825,6 @@ func (r *Router) RoutePacketConnection(ctx context.Context, conn N.PacketConn, m
 
 	if metadata.InboundOptions.SniffEnabled || metadata.Destination.Addr.IsUnspecified() {
 		buffer := buf.NewPacket()
-		buffer.FullReset()
 		destination, err := conn.ReadPacket(buffer)
 		if err != nil {
 			buffer.Release()
@@ -919,6 +940,7 @@ func (r *Router) match0(ctx context.Context, metadata *adapter.InboundContext, d
 		}
 	}
 	for i, rule := range r.rules {
+		metadata.ResetRuleCache()
 		if rule.Match(metadata) {
 			detour := rule.Outbound()
 			r.logger.DebugContext(ctx, "match[", i, "] ", rule.String(), " => ", detour)
@@ -1056,8 +1078,11 @@ func (r *Router) notifyNetworkUpdate(event int) {
 		}
 	}
 
-	r.ResetNetwork()
-	return
+	if !r.started {
+		return
+	}
+
+	_ = r.ResetNetwork()
 }
 
 func (r *Router) ResetNetwork() error {

route/router_dns.go

@@ -37,12 +37,13 @@ func (m *DNSReverseMapping) Query(address netip.Addr) (string, bool) {
 	return domain, loaded
 }
 
-func (r *Router) matchDNS(ctx context.Context) (context.Context, dns.Transport, dns.DomainStrategy) {
+func (r *Router) matchDNS(ctx context.Context, allowFakeIP bool) (context.Context, dns.Transport, dns.DomainStrategy) {
 	metadata := adapter.ContextFrom(ctx)
 	if metadata == nil {
 		panic("no context")
 	}
 	for i, rule := range r.dnsRules {
+		metadata.ResetRuleCache()
 		if rule.Match(metadata) {
 			detour := rule.Outbound()
 			transport, loaded := r.transportMap[detour]
@@ -50,7 +51,7 @@ func (r *Router) matchDNS(ctx context.Context) (context.Context, dns.Transport,
 				r.dnsLogger.ErrorContext(ctx, "transport not found: ", detour)
 				continue
 			}
-			if _, isFakeIP := transport.(adapter.FakeIPTransport); isFakeIP && metadata.FakeIP {
+			if _, isFakeIP := transport.(adapter.FakeIPTransport); isFakeIP && !allowFakeIP {
 				continue
 			}
 			r.dnsLogger.DebugContext(ctx, "match[", i, "] ", rule.String(), " => ", detour)
@@ -96,7 +97,7 @@ func (r *Router) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, er
 			}
 			metadata.Domain = fqdnToDomain(message.Question[0].Name)
 		}
-		ctx, transport, strategy := r.matchDNS(ctx)
+		ctx, transport, strategy := r.matchDNS(ctx, true)
 		ctx, cancel := context.WithTimeout(ctx, C.DNSTimeout)
 		defer cancel()
 		response, err = r.dnsClient.Exchange(ctx, transport, message, strategy)
@@ -124,7 +125,7 @@ func (r *Router) Lookup(ctx context.Context, domain string, strategy dns.DomainS
 	r.dnsLogger.DebugContext(ctx, "lookup domain ", domain)
 	ctx, metadata := adapter.AppendContext(ctx)
 	metadata.Domain = domain
-	ctx, transport, transportStrategy := r.matchDNS(ctx)
+	ctx, transport, transportStrategy := r.matchDNS(ctx, false)
 	if strategy == dns.DomainStrategyAsIS {
 		strategy = transportStrategy
 	}

route/rule_abstract.go

@@ -17,6 +17,7 @@ type abstractDefaultRule struct {
 	destinationAddressItems []RuleItem
 	destinationPortItems    []RuleItem
 	allItems                []RuleItem
+	ruleSetItem             RuleItem
 	invert                  bool
 	outbound                string
 }
@@ -62,62 +63,62 @@ func (r *abstractDefaultRule) Match(metadata *adapter.InboundContext) bool {
 		return true
 	}
 
+	if len(r.sourceAddressItems) > 0 && !metadata.SourceAddressMatch {
+		for _, item := range r.sourceAddressItems {
+			if item.Match(metadata) {
+				metadata.SourceAddressMatch = true
+				break
+			}
+		}
+	}
+
+	if len(r.sourcePortItems) > 0 && !metadata.SourceAddressMatch {
+		for _, item := range r.sourcePortItems {
+			if item.Match(metadata) {
+				metadata.SourcePortMatch = true
+				break
+			}
+		}
+	}
+
+	if len(r.destinationAddressItems) > 0 && !metadata.SourceAddressMatch {
+		for _, item := range r.destinationAddressItems {
+			if item.Match(metadata) {
+				metadata.DestinationAddressMatch = true
+				break
+			}
+		}
+	}
+
+	if len(r.destinationPortItems) > 0 && !metadata.SourceAddressMatch {
+		for _, item := range r.destinationPortItems {
+			if item.Match(metadata) {
+				metadata.DestinationPortMatch = true
+				break
+			}
+		}
+	}
+
 	for _, item := range r.items {
 		if !item.Match(metadata) {
 			return r.invert
 		}
 	}
 
-	if len(r.sourceAddressItems) > 0 {
-		var sourceAddressMatch bool
-		for _, item := range r.sourceAddressItems {
-			if item.Match(metadata) {
-				sourceAddressMatch = true
-				break
-			}
-		}
-		if !sourceAddressMatch {
-			return r.invert
-		}
+	if len(r.sourceAddressItems) > 0 && !metadata.SourceAddressMatch {
+		return r.invert
 	}
 
-	if len(r.sourcePortItems) > 0 {
-		var sourcePortMatch bool
-		for _, item := range r.sourcePortItems {
-			if item.Match(metadata) {
-				sourcePortMatch = true
-				break
-			}
-		}
-		if !sourcePortMatch {
-			return r.invert
-		}
+	if len(r.sourcePortItems) > 0 && !metadata.SourcePortMatch {
+		return r.invert
 	}
 
-	if len(r.destinationAddressItems) > 0 {
-		var destinationAddressMatch bool
-		for _, item := range r.destinationAddressItems {
-			if item.Match(metadata) {
-				destinationAddressMatch = true
-				break
-			}
-		}
-		if !destinationAddressMatch {
-			return r.invert
-		}
+	if len(r.destinationAddressItems) > 0 && !metadata.DestinationAddressMatch {
+		return r.invert
 	}
 
-	if len(r.destinationPortItems) > 0 {
-		var destinationPortMatch bool
-		for _, item := range r.destinationPortItems {
-			if item.Match(metadata) {
-				destinationPortMatch = true
-				break
-			}
-		}
-		if !destinationPortMatch {
-			return r.invert
-		}
+	if len(r.destinationPortItems) > 0 && !metadata.DestinationPortMatch {
+		return r.invert
 	}
 
 	return !r.invert
@@ -188,10 +189,12 @@ func (r *abstractLogicalRule) Close() error {
 func (r *abstractLogicalRule) Match(metadata *adapter.InboundContext) bool {
 	if r.mode == C.LogicalTypeAnd {
 		return common.All(r.rules, func(it adapter.HeadlessRule) bool {
+			metadata.ResetRuleCache()
 			return it.Match(metadata)
 		}) != r.invert
 	} else {
 		return common.Any(r.rules, func(it adapter.HeadlessRule) bool {
+			metadata.ResetRuleCache()
 			return it.Match(metadata)
 		}) != r.invert
 	}

route/rule_set_local.go

@@ -65,6 +65,10 @@ func (s *LocalRuleSet) StartContext(ctx context.Context, startContext adapter.Ru
 	return nil
 }
 
+func (s *LocalRuleSet) PostStart() error {
+	return nil
+}
+
 func (s *LocalRuleSet) Close() error {
 	return nil
 }

route/rule_set_remote.go

@@ -18,6 +18,7 @@ import (
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 	"github.com/sagernet/sing/service"
+	"github.com/sagernet/sing/service/pause"
 )
 
 var _ adapter.RuleSet = (*RemoteRuleSet)(nil)
@@ -34,6 +35,7 @@ type RemoteRuleSet struct {
 	lastUpdated    time.Time
 	lastEtag       string
 	updateTicker   *time.Ticker
+	pauseManager   pause.Manager
 }
 
 func NewRemoteRuleSet(ctx context.Context, router adapter.Router, logger logger.ContextLogger, options option.RuleSet) *RemoteRuleSet {
@@ -42,7 +44,7 @@ func NewRemoteRuleSet(ctx context.Context, router adapter.Router, logger logger.
 	if options.RemoteOptions.UpdateInterval > 0 {
 		updateInterval = time.Duration(options.RemoteOptions.UpdateInterval)
 	} else {
-		updateInterval = 12 * time.Hour
+		updateInterval = 24 * time.Hour
 	}
 	return &RemoteRuleSet{
 		ctx:            ctx,
@@ -51,6 +53,7 @@ func NewRemoteRuleSet(ctx context.Context, router adapter.Router, logger logger.
 		logger:         logger,
 		options:        options,
 		updateInterval: updateInterval,
+		pauseManager:   pause.ManagerFromContext(ctx),
 	}
 }
 
@@ -90,10 +93,10 @@ func (s *RemoteRuleSet) StartContext(ctx context.Context, startContext adapter.R
 			s.lastEtag = savedSet.LastEtag
 		}
 	}
-	if s.lastUpdated.IsZero() || time.Since(s.lastUpdated) > s.updateInterval {
+	if s.lastUpdated.IsZero() {
 		err := s.fetchOnce(ctx, startContext)
 		if err != nil {
-			return E.Cause(err, "fetch rule-set ", s.options.Tag)
+			return E.Cause(err, "initial rule-set: ", s.options.Tag)
 		}
 	}
 	s.updateTicker = time.NewTicker(s.updateInterval)
@@ -101,6 +104,16 @@ func (s *RemoteRuleSet) StartContext(ctx context.Context, startContext adapter.R
 	return nil
 }
 
+func (s *RemoteRuleSet) PostStart() error {
+	if s.lastUpdated.IsZero() {
+		err := s.fetchOnce(s.ctx, nil)
+		if err != nil {
+			s.logger.Error("fetch rule-set ", s.options.Tag, ": ", err)
+		}
+	}
+	return nil
+}
+
 func (s *RemoteRuleSet) loadBytes(content []byte) error {
 	var (
 		plainRuleSet option.PlainRuleSet
@@ -136,11 +149,18 @@ func (s *RemoteRuleSet) loadBytes(content []byte) error {
 }
 
 func (s *RemoteRuleSet) loopUpdate() {
+	if time.Since(s.lastUpdated) > s.updateInterval {
+		err := s.fetchOnce(s.ctx, nil)
+		if err != nil {
+			s.logger.Error("fetch rule-set ", s.options.Tag, ": ", err)
+		}
+	}
 	for {
 		select {
 		case <-s.ctx.Done():
 			return
 		case <-s.updateTicker.C:
+			s.pauseManager.WaitActive()
 			err := s.fetchOnce(s.ctx, nil)
 			if err != nil {
 				s.logger.Error("fetch rule-set ", s.options.Tag, ": ", err)

transport/v2raywebsocket/client.go

@@ -12,6 +12,9 @@ import (
 	"github.com/sagernet/sing-box/common/tls"
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing/common/buf"
+	"github.com/sagernet/sing/common/bufio"
+	"github.com/sagernet/sing/common/bufio/deadline"
 	E "github.com/sagernet/sing/common/exceptions"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
@@ -87,18 +90,35 @@ func (c *Client) dialContext(ctx context.Context, requestURL *url.URL, headers h
 			return nil, err
 		}
 	}
-	conn.SetDeadline(time.Now().Add(C.TCPTimeout))
+	var deadlineConn net.Conn
+	if deadline.NeedAdditionalReadDeadline(conn) {
+		deadlineConn = deadline.NewConn(conn)
+	} else {
+		deadlineConn = conn
+	}
+	err = deadlineConn.SetDeadline(time.Now().Add(C.TCPTimeout))
+	if err != nil {
+		return nil, E.Cause(err, "set read deadline")
+	}
 	var protocols []string
 	if protocolHeader := headers.Get("Sec-WebSocket-Protocol"); protocolHeader != "" {
 		protocols = []string{protocolHeader}
 		headers.Del("Sec-WebSocket-Protocol")
 	}
-	reader, _, err := ws.Dialer{Header: ws.HandshakeHeaderHTTP(headers), Protocols: protocols}.Upgrade(conn, requestURL)
-	conn.SetDeadline(time.Time{})
+	reader, _, err := ws.Dialer{Header: ws.HandshakeHeaderHTTP(headers), Protocols: protocols}.Upgrade(deadlineConn, requestURL)
+	deadlineConn.SetDeadline(time.Time{})
 	if err != nil {
 		return nil, err
 	}
-	return NewConn(conn, reader, nil, ws.StateClientSide), nil
+	if reader != nil {
+		buffer := buf.NewSize(reader.Buffered())
+		_, err = buffer.ReadFullFrom(reader, buffer.Len())
+		if err != nil {
+			return nil, err
+		}
+		conn = bufio.NewCachedConn(conn, buffer)
+	}
+	return NewConn(conn, nil, ws.StateClientSide), nil
 }
 
 func (c *Client) DialContext(ctx context.Context) (net.Conn, error) {

transport/v2raywebsocket/conn.go

@@ -1,7 +1,6 @@
 package v2raywebsocket
 
 import (
-	"bufio"
 	"context"
 	"encoding/base64"
 	"io"
@@ -28,19 +27,13 @@ type WebsocketConn struct {
 	remoteAddr     net.Addr
 }
 
-func NewConn(conn net.Conn, br *bufio.Reader, remoteAddr net.Addr, state ws.State) *WebsocketConn {
+func NewConn(conn net.Conn, remoteAddr net.Addr, state ws.State) *WebsocketConn {
 	controlHandler := wsutil.ControlFrameHandler(conn, state)
-	var reader io.Reader
-	if br != nil && br.Buffered() > 0 {
-		reader = br
-	} else {
-		reader = conn
-	}
 	return &WebsocketConn{
 		Conn:  conn,
 		state: state,
 		reader: &wsutil.Reader{
-			Source:          reader,
+			Source:          conn,
 			State:           state,
 			SkipHeaderCheck: !debug.Enabled,
 			OnIntermediate:  controlHandler,