feat: 初始化并发问题处理

2025-11-13 05:15:18 -08:00
parent 748ec6bee9
commit a47174df56
5 changed files with 400 additions and 118 deletions
@@ -28,13 +28,10 @@ class KROutboundItem {

  /// URL
  String url = "";
-  @override
-  String toString() {
-    return 'KROutboundItem(tag: $tag, country: $country, delay: ${urlTestDelay.value}ms)';
-  }
+
  /// 服务器类型

-  /// 构造函数，接受 KrNodeListItem 对象并初始化 KROutboundItem
+  /// 构造函数，接受 KrItem 对象并初始化 KROutboundItem
  KROutboundItem(KrNodeListItem nodeListItem) {
    id = nodeListItem.id.toString();
    protocol = nodeListItem.protocol;
@@ -152,7 +149,7 @@ class KROutboundItem {
        break;
      case "hysteria":
      case "hysteria2":
-        // 后端的 "hysteria" 实际上是 Hysteria2 协议
+      // 后端的 "hysteria" 实际上是 Hysteria2 协议
        final securityConfig =
            json["security_config"] as Map<String, dynamic>? ?? {};
        config = {
@@ -274,6 +271,7 @@ class KROutboundItem {
    // 🔧 尝试从 config 字段解析 transport 配置
    Map<String, dynamic>? transportConfig;
    Map<String, dynamic>? securityConfig;
+    int actualPort = nodeListItem.port;  // 🔧 使用局部变量存储实际端口

    // 🔧 关键修复：优先从 protocols 字段解析配置
    if (nodeListItem.protocols.isNotEmpty) {
@@ -307,6 +305,28 @@ class KROutboundItem {
        }

        if (matchedProtocol != null) {
+          // 🔧 关键修复：只在顶层端口为0时，才使用 protocols 中的端口
+          // 这样可以保留顶层的正确端口（如 53441），不被 protocols 数组中的端口（如 287）覆盖
+          if (actualPort == 0 && matchedProtocol['port'] != null) {
+            // 安全解析端口号
+            int protocolPort = 0;
+            final portValue = matchedProtocol['port'];
+            if (portValue is int) {
+              protocolPort = portValue;
+            } else if (portValue is String) {
+              protocolPort = int.tryParse(portValue) ?? 0;
+            }
+
+            if (protocolPort > 0) {
+              actualPort = protocolPort;
+              if (kDebugMode) {
+                print('  ✅ 从 protocols 使用端口: $protocolPort (顶层端口为0)');
+              }
+            }
+          } else if (kDebugMode && matchedProtocol['port'] != null) {
+            print('  ✅ 保留顶层端口: $actualPort (protocols中的端口: ${matchedProtocol['port']})');
+          }
+
          // 提取 transport 配置
          if (matchedProtocol['network'] != null || matchedProtocol['transport'] != null) {
            final network = matchedProtocol['network'] ?? matchedProtocol['transport'];
@@ -402,7 +422,7 @@ class KROutboundItem {

    switch (nodeListItem.protocol) {
      case "shadowsocks":
-        // 优先使用 protocols 解析出来的 cipher，其次是 method 字段，最后才是默认值
+      // 优先使用 protocols 解析出来的 cipher，其次是 method 字段，最后才是默认值
        String finalMethod = nodeListItem.method.isNotEmpty
            ? nodeListItem.method
            : "2022-blake3-aes-256-gcm";
@@ -411,22 +431,21 @@ class KROutboundItem {
          "type": "shadowsocks",
          "tag": nodeListItem.name,
          "server": nodeListItem.serverAddr,
-          "server_port": nodeListItem.port,
+          "server_port": actualPort,
          "method": finalMethod,
          "password": nodeListItem.uuid
        };
        if (kDebugMode) {
+          print('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
          print('✅ Shadowsocks 节点配置构建成功: ${nodeListItem.name}');
-        }
-        if (kDebugMode) {
          print('📄 使用加密方法: $finalMethod');
-        }
-        if (kDebugMode) {
-          print('📄 完整配置: $config');
+          print('📄 完整配置 JSON:');
+          print(jsonEncode(config));
+          print('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
        }
        break;
      case "vless":
-        // 判断是否为域名（非IP地址）
+      // 判断是否为域名（非IP地址）
        final bool isDomain = !RegExp(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$')
            .hasMatch(nodeListItem.serverAddr);

@@ -436,17 +455,25 @@ class KROutboundItem {
          serverName = securityConfig['sni'].toString();
        }

-        // 🔧 关键修复：根据 security_config 判断是否启用 TLS
-        final bool vlessTlsEnabled = securityConfig?['tls_enabled'] ?? false;
+        // 🔧 关键修复：智能判断是否启用 TLS
+        // 1. 优先使用 securityConfig['tls_enabled']
+        // 2. 如果没有明确配置，根据端口和域名智能判断
+        bool vlessTlsEnabled = securityConfig?['tls_enabled'] ?? true;  // 默认启用 TLS
+
+        // 如果端口是标准非TLS端口（80, 8080等），则禁用 TLS
+        if (nodeListItem.port == 80 || nodeListItem.port == 8080) {
+          vlessTlsEnabled = false;
+        }
+
        if (kDebugMode) {
-          print('🔐 VLESS TLS 状态: enabled=$vlessTlsEnabled');
+          print('🔐 VLESS TLS 状态: enabled=$vlessTlsEnabled (port=${nodeListItem.port}, isDomain=$isDomain)');
        }

        config = {
          "type": "vless",
          "tag": nodeListItem.name,
          "server": nodeListItem.serverAddr,
-          "server_port": nodeListItem.port,
+          "server_port": actualPort,
          "uuid": nodeListItem.uuid,
          if (transportConfig != null) "transport": transportConfig,
          if (vlessTlsEnabled) "tls": {
@@ -460,14 +487,27 @@ class KROutboundItem {
          }
        };
        if (kDebugMode) {
+          print('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
          print('✅ VLESS 节点配置构建成功: ${nodeListItem.name}');
-        }
-        if (kDebugMode) {
-          print('📄 完整配置: $config');
+          print('📋 原始节点信息:');
+          print('  - serverAddr: ${nodeListItem.serverAddr}');
+          print('  - port: ${nodeListItem.port}');
+          print('  - uuid: ${nodeListItem.uuid}');
+          print('  - protocols: ${nodeListItem.protocols}');
+          print('🔐 安全配置:');
+          print('  - TLS 启用: $vlessTlsEnabled');
+          print('  - 是域名: $isDomain');
+          print('  - server_name: $serverName');
+          print('  - securityConfig: $securityConfig');
+          print('📡 传输配置:');
+          print('  - transportConfig: $transportConfig');
+          print('📄 最终生成的完整配置 JSON:');
+          print(jsonEncode(config));
+          print('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
        }
        break;
      case "vmess":
-        // 判断是否为域名（非IP地址）
+      // 判断是否为域名（非IP地址）
        final bool isDomain = !RegExp(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$')
            .hasMatch(nodeListItem.serverAddr);

@@ -477,17 +517,25 @@ class KROutboundItem {
          serverName = securityConfig['sni'].toString();
        }

-        // 🔧 关键修复：根据 security_config 判断是否启用 TLS
-        final bool tlsEnabled = securityConfig?['tls_enabled'] ?? false;
+        // 🔧 关键修复：智能判断是否启用 TLS
+        // 1. 优先使用 securityConfig['tls_enabled']
+        // 2. 如果没有明确配置，根据端口和域名智能判断
+        bool tlsEnabled = securityConfig?['tls_enabled'] ?? true;  // 默认启用 TLS
+
+        // 如果端口是标准非TLS端口（80, 8080等），则禁用 TLS
+        if (nodeListItem.port == 80 || nodeListItem.port == 8080) {
+          tlsEnabled = false;
+        }
+
        if (kDebugMode) {
-          print('🔐 TLS 状态: enabled=$tlsEnabled');
+          print('🔐 VMess TLS 状态: enabled=$tlsEnabled (port=${nodeListItem.port}, isDomain=$isDomain)');
        }

        config = {
          "type": "vmess",
          "tag": nodeListItem.name,
          "server": nodeListItem.serverAddr,
-          "server_port": nodeListItem.port,
+          "server_port": actualPort,
          "uuid": nodeListItem.uuid,
          "alter_id": 0,
          "security": "auto",
@@ -503,14 +551,27 @@ class KROutboundItem {
          }
        };
        if (kDebugMode) {
+          print('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
          print('✅ VMess 节点配置构建成功: ${nodeListItem.name}');
-        }
-        if (kDebugMode) {
-          print('📄 完整配置: $config');
+          print('📋 原始节点信息:');
+          print('  - serverAddr: ${nodeListItem.serverAddr}');
+          print('  - port: ${nodeListItem.port}');
+          print('  - uuid: ${nodeListItem.uuid}');
+          print('  - protocols: ${nodeListItem.protocols}');
+          print('🔐 安全配置:');
+          print('  - TLS 启用: $tlsEnabled');
+          print('  - 是域名: $isDomain');
+          print('  - server_name: $serverName');
+          print('  - securityConfig: $securityConfig');
+          print('📡 传输配置:');
+          print('  - transportConfig: $transportConfig');
+          print('📄 最终生成的完整配置 JSON:');
+          print(jsonEncode(config));
+          print('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
        }
        break;
      case "trojan":
-        // 判断是否为域名（非IP地址）
+      // 判断是否为域名（非IP地址）
        final bool isDomain = !RegExp(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$')
            .hasMatch(nodeListItem.serverAddr);

@@ -524,7 +585,7 @@ class KROutboundItem {
          "type": "trojan",
          "tag": nodeListItem.name,
          "server": nodeListItem.serverAddr,
-          "server_port": nodeListItem.port,
+          "server_port": actualPort,
          "password": nodeListItem.uuid,
          if (transportConfig != null) "transport": transportConfig,
          "tls": {
@@ -546,7 +607,7 @@ class KROutboundItem {
        break;
      case "hysteria":
      case "hysteria2":
-        // 后端的 "hysteria" 实际上是 Hysteria2 协议
+      // 后端的 "hysteria" 实际上是 Hysteria2 协议
        if (kDebugMode) {
          print('🔍 构建 Hysteria2 节点: ${nodeListItem.name}');
        }
@@ -2,7 +2,7 @@ import 'dart:convert';
 import 'package:kaer_with_panels/app/utils/kr_log_util.dart';

 class KRNodeList {
-   final List<KrNodeListItem> list;
+  final List<KrNodeListItem> list;
  final String subscribeId;
  final String startTime;
  final String expireTime;
@@ -35,8 +35,8 @@ class KRNodeList {
        // 查找 id 匹配的订阅项
        try {
          subscribeData = listData.firstWhere(
-            (item) => (item as Map<String, dynamic>)['id']?.toString() == requestSubscribeId,
-            orElse: () => listData[0] as Map<String, dynamic>
+                  (item) => (item as Map<String, dynamic>)['id']?.toString() == requestSubscribeId,
+              orElse: () => listData[0] as Map<String, dynamic>
          ) as Map<String, dynamic>;
          KRLogUtil.kr_i('✅ 找到匹配的订阅项: id=$requestSubscribeId', tag: 'NodeList');
        } catch (e) {
@@ -70,7 +70,7 @@ class KRNodeList {

 class KrNodeListItem {
  final int id;
-   String name;
+  String name;
  final String uuid;
  final String protocol;
  final String relayMode;
@@ -136,25 +136,68 @@ class KrNodeListItem {
      String method = json['method']?.toString() ?? ''; // 加密方法（Shadowsocks等）
      final protocols = json['protocols']?.toString() ?? ''; // 协议配置JSON

-      // 🔧 如果有 protocols 字段，从中解析 port 和 cipher
+      // 🔧 打印原始节点 JSON（用于调试）
+      KRLogUtil.kr_i('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━', tag: 'NodeList');
+      KRLogUtil.kr_i('📥 收到节点 API 原始数据:', tag: 'NodeList');
+      KRLogUtil.kr_i('节点名称: ${json['name']}', tag: 'NodeList');
+      KRLogUtil.kr_i('协议类型: ${json['protocol']}', tag: 'NodeList');
+      KRLogUtil.kr_i('完整 JSON:', tag: 'NodeList');
+      KRLogUtil.kr_i(jsonEncode(json), tag: 'NodeList');
+
+      // 🔧 如果有 protocols 字段，从中解析 cipher（但不覆盖顶层的 port）
      if (protocols.isNotEmpty) {
        try {
          final protocolsList = jsonDecode(protocols) as List;
+          final currentProtocol = json['protocol']?.toString().toLowerCase() ?? '';
+
+          KRLogUtil.kr_i('📋 protocols 字段内容 (${protocolsList.length} 个协议):', tag: 'NodeList');
+          for (var i = 0; i < protocolsList.length; i++) {
+            KRLogUtil.kr_i('  协议 $i: ${jsonEncode(protocolsList[i])}', tag: 'NodeList');
+          }
+
          if (protocolsList.isNotEmpty) {
-            final firstProtocol = protocolsList[0] as Map<String, dynamic>;
-            // 优先使用 protocols 中的配置
-            if (firstProtocol['port'] != null) {
-              port = _parseIntSafely(firstProtocol['port']);
+            // 🔧 修复：查找与当前协议类型匹配的配置，而不是直接使用第一个
+            Map<String, dynamic>? matchedProtocolConfig;
+
+            // 尝试找到协议类型匹配的配置
+            for (var protocolConfig in protocolsList) {
+              final configMap = protocolConfig as Map<String, dynamic>;
+              // 🔧 修复：API 使用的字段名是 'type'，不是 'protocol'
+              final protocolType = (configMap['type'] ?? configMap['protocol'])?.toString().toLowerCase() ?? '';
+
+              // 检查是否匹配（支持 shadowsocks/ss, vmess, vless, trojan 等）
+              if (protocolType == currentProtocol ||
+                  (currentProtocol == 'shadowsocks' && protocolType == 'ss') ||
+                  (currentProtocol == 'ss' && protocolType == 'shadowsocks')) {
+                matchedProtocolConfig = configMap;
+                KRLogUtil.kr_i('🎯 找到匹配的协议配置: $protocolType', tag: 'NodeList');
+                break;
+              }
            }
-            if (firstProtocol['cipher'] != null && firstProtocol['cipher'].toString().isNotEmpty) {
-              method = firstProtocol['cipher'].toString();
+
+            // 如果没找到匹配的，使用第一个配置（兼容旧API）
+            final targetProtocol = matchedProtocolConfig ?? (protocolsList[0] as Map<String, dynamic>);
+
+            // 🔧 关键修复：只在顶层没有 port 字段时，才使用 protocols 中的端口
+            // 这样可以保留顶层的正确端口（如 53441），不被 protocols 数组中的端口（如 287）覆盖
+            if (port == 0 && targetProtocol['port'] != null) {
+              port = _parseIntSafely(targetProtocol['port']);
+              KRLogUtil.kr_i('✅ 从 protocols 解析端口: $port', tag: 'NodeList');
+            } else {
+              KRLogUtil.kr_i('✅ 保留顶层端口: $port (protocols中的端口: ${targetProtocol['port']})', tag: 'NodeList');
+            }
+
+            // 提取 cipher（加密方法）
+            if (targetProtocol['cipher'] != null && targetProtocol['cipher'].toString().isNotEmpty) {
+              method = targetProtocol['cipher'].toString();
+              KRLogUtil.kr_i('✅ 从 protocols 解析 cipher: $method', tag: 'NodeList');
            }
-            KRLogUtil.kr_i('从 protocols 解析: port=$port, cipher=$method', tag: 'NodeList');
          }
        } catch (e) {
-          KRLogUtil.kr_w('解析 protocols 字段失败: $e', tag: 'NodeList');
+          KRLogUtil.kr_w('⚠️ 解析 protocols 字段失败: $e', tag: 'NodeList');
        }
      }
+      KRLogUtil.kr_i('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━', tag: 'NodeList');

      return KrNodeListItem(
        id: _parseIntSafely(json['id']),
@@ -80,8 +80,8 @@ class HINodeListView extends GetView<HINodeListController> {
    //    并设置透明背景，让父组件的背景可以透出来
    return Material(
      color: Colors.transparent,
-        // child: _buildSubscribeList(context)
-       child: _kr_buildRegionList(context)
+         child: _buildSubscribeList(context)
+       // child: _kr_buildRegionList(context)
    );
  }

@@ -380,7 +380,7 @@ class HINodeListView extends GetView<HINodeListController> {
                  children: [
                    Flexible(
                      child: Text(
-                        controller.homeController.kr_getCountryFullName(item.country),
+                        '${controller.homeController.kr_getCountryFullName(item.country)}-${item.tag}',
                        style: KrAppTextStyle(fontSize: 14, color: Colors.white),
                        overflow: TextOverflow.ellipsis,
                        maxLines: 1,
@@ -849,6 +849,7 @@ class KRHomeController extends GetxController with WidgetsBindingObserver {
        if (kDebugMode) {
                  }
        await KRSingBoxImp.instance.kr_start();
+
        KRLogUtil.kr_i('✅ 连接命令已发送', tag: 'HomeController');
        if (kDebugMode) {
                  }
@@ -2185,6 +2186,7 @@ class KRHomeController extends GetxController with WidgetsBindingObserver {
          kr_isConnected.value = true;
          kr_startConnectionTimer();
          kr_updateConnectionInfo();
+          KRSingBoxImp.instance.kr_debugTunConnectivity();

          // 🔧 修复：同步已启动状态时，尝试更新延迟值
          if (!_kr_tryUpdateDelayFromActiveGroups()) {
@@ -107,6 +107,9 @@ class KRSingBoxImp {
  /// 初始化标志，防止重复初始化
  bool _kr_isInitialized = false;

+  /// 初始化进行中共享 Future（single-flight 防并发）
+  Future<void>? _kr_initFuture;
+
  /// 当前混合代理端口是否就绪
  bool get kr_isProxyReady => kr_status.value is SingboxStarted;

@@ -139,12 +142,23 @@ class KRSingBoxImp {

  /// 初始化
  Future<void> init() async {
-    // 防止重复初始化
+    // 防止重复初始化（已完成）
    if (_kr_isInitialized) {
      KRLogUtil.kr_i('SingBox 已经初始化，跳过重复初始化', tag: 'SingBox');
      return;
    }

+    // 防止并发重复初始化（进行中复用同一个 Future）
+    if (_kr_initFuture != null) {
+      KRLogUtil.kr_i('SingBox 初始化进行中，等待完成（single-flight）', tag: 'SingBox');
+      await _kr_initFuture;
+      return;
+    }
+
+    // 建立 single-flight 共享 Future
+    final completer = Completer<void>();
+    _kr_initFuture = completer.future;
+
    try {
      KRLogUtil.kr_i('开始初始化 SingBox');
      // 在应用启动时初始化
@@ -167,14 +181,14 @@ class KRSingBoxImp {
        KRLogUtil.kr_i('iOS 路径获取完成: $paths');

        kr_configDics = (
-          baseDir: Directory(paths?["base"]! as String),
-          workingDir: Directory(paths?["working"]! as String),
-          tempDir: Directory(paths?["temp"]! as String),
+        baseDir: Directory(paths?["base"]! as String),
+        workingDir: Directory(paths?["working"]! as String),
+        tempDir: Directory(paths?["temp"]! as String),
        );
      } else {
        final baseDir = await getApplicationSupportDirectory();
        final workingDir =
-            Platform.isAndroid ? await getExternalStorageDirectory() : baseDir;
+        Platform.isAndroid ? await getExternalStorageDirectory() : baseDir;
        final tempDir = await getTemporaryDirectory();

        // Windows 路径规范化：确保使用正确的路径分隔符
@@ -190,9 +204,9 @@ class KRSingBoxImp {
        }

        kr_configDics = (
-          baseDir: normalizePath(baseDir),
-          workingDir: normalizePath(workingDir!),
-          tempDir: normalizePath(tempDir),
+        baseDir: normalizePath(baseDir),
+        workingDir: normalizePath(workingDir!),
+        tempDir: normalizePath(tempDir),
        );
        KRLogUtil.kr_i('其他平台路径初始化完成');
      }
@@ -400,11 +414,11 @@ class KRSingBoxImp {
      KRLogUtil.kr_i('📡 开始调用 setup() 注册 FFI 端口', tag: 'SingBox');
      final setupResult = await kr_singBox.setup(kr_configDics, false).run();
      setupResult.match(
-        (error) {
+            (error) {
          KRLogUtil.kr_e('❌ setup() 失败: $error', tag: 'SingBox');
          throw Exception('FFI setup 失败: $error');
        },
-        (_) {
+            (_) {
          KRLogUtil.kr_i('✅ setup() 成功，FFI 端口已注册', tag: 'SingBox');
        },
      );
@@ -416,6 +430,10 @@ class KRSingBoxImp {
      // 这样可以确保 UI 始终与 libcore 的实际状态同步
      _kr_subscribeToStatus();
      KRLogUtil.kr_i('✅ 状态订阅已设置', tag: 'SingBox');
+
+      // 完成 single-flight
+      completer.complete();
+      _kr_initFuture = null;
    } catch (e, stackTrace) {
      KRLogUtil.kr_e('❌ SingBox 初始化失败: $e');
      KRLogUtil.kr_e('📚 错误堆栈: $stackTrace');
@@ -451,6 +469,11 @@ class KRSingBoxImp {

      // 如果初始化失败，允许下次重试
      _kr_isInitialized = false;
+      // 失败时通知等待者并清理 single-flight
+      if (!completer.isCompleted) {
+        completer.completeError(e, stackTrace);
+      }
+      _kr_initFuture = null;
      rethrow;
    }
  }
@@ -464,13 +487,13 @@ class KRSingBoxImp {
      "region": "other",  // 参考 hiddify-app: 默认使用 "other" 跳过规则集下载
      "block-ads": false,  // 参考 hiddify-app: 默认关闭广告拦截
      "use-xray-core-when-possible": false,
-      "execute-config-as-is": false,
+      "execute-config-as-is": true,  // 🔧 修复：使用我们生成的完整配置，不让 libcore 重写
      "log-level": "info",  // 调试阶段使用 info，生产环境改为 warn
      "resolve-destination": false,
      "ipv6-mode": "ipv4_only",  // 参考 hiddify-app: 仅使用 IPv4 (有效值: ipv4_only, prefer_ipv4, prefer_ipv6, ipv6_only)
-      "remote-dns-address": "udp://1.1.1.1",  // 参考 hiddify-app: 使用 Cloudflare DNS
+      "remote-dns-address": "https://dns.google/dns-query", // 使用 Google DoH，避免中转节点 DNS 死锁
      "remote-dns-domain-strategy": "prefer_ipv4",
-      "direct-dns-address": "udp://1.1.1.1",  // 参考 hiddify-app: 统一使用 1.1.1.1
+      "direct-dns-address": "local" ,
      "direct-dns-domain-strategy": "prefer_ipv4",
      "mixed-port": kr_port,
      "tproxy-port": kr_port,
@@ -561,7 +584,7 @@ class KRSingBoxImp {

    _kr_subscriptions.add(
      kr_singBox.watchStatus().listen(
-        (status) {
+            (status) {
          if (kDebugMode) {
            print('🔵 收到 Native 状态更新: ${status.runtimeType}');
          }
@@ -599,7 +622,7 @@ class KRSingBoxImp {
    // 所以外层必须有 try-catch
    final stream = kr_singBox.watchStats();
    final subscription = stream.listen(
-      (stats) {
+          (stats) {
        kr_stats.value = stats;
      },
      onError: (error) {
@@ -624,7 +647,7 @@ class KRSingBoxImp {

    _kr_subscriptions.add(
      kr_singBox.watchActiveGroups().listen(
-        (groups) {
+            (groups) {
          print('[watchActiveGroups] 📡 收到活动组更新，数量: ${groups.length}');
          KRLogUtil.kr_i('📡 收到活动组更新，数量: ${groups.length}', tag: 'SingBox');
          kr_activeGroups.value = groups;
@@ -651,7 +674,7 @@ class KRSingBoxImp {

    _kr_subscriptions.add(
      kr_singBox.watchGroups().listen(
-        (groups) {
+            (groups) {
          print('[watchGroups] 📡 收到所有组更新，数量: ${groups.length}');
          kr_allGroups.value = groups;
          // 打印每个组的基本信息
@@ -679,7 +702,7 @@ class KRSingBoxImp {

      // 查找 "select" 组
      final selectGroup = kr_activeGroups.firstWhere(
-        (group) => group.tag == 'select',
+            (group) => group.tag == 'select',
        orElse: () => throw Exception('未找到 "select" 选择器组'),
      );

@@ -719,11 +742,11 @@ class KRSingBoxImp {
  ///
  /// 确保 command.sock 准备好后再执行节点选择
  Future<void> _kr_selectOutboundWithRetry(
-    String groupTag,
-    String outboundTag, {
-    int maxAttempts = 3,
-    int initialDelay = 100,
-  }) async {
+      String groupTag,
+      String outboundTag, {
+        int maxAttempts = 3,
+        int initialDelay = 100,
+      }) async {
    int attempt = 0;
    int delay = initialDelay;

@@ -1031,17 +1054,86 @@ class KRSingBoxImp {

    KRLogUtil.kr_i('✅ 过滤后节点数量: ${kr_outbounds.length}/${outbounds.length}', tag: 'SingBox');

-    // 只保存 outbounds，Mobile.buildConfig() 会添加其他配置
-    final map = {
-      "outbounds": kr_outbounds
+    // 🔧 修复：生成完整的 SingBox 配置
+    // 之前只保存 {"outbounds": [...]}, 导致 libcore 无法正确处理
+    // 现在保存完整配置，包含所有必需字段
+    final Map<String, dynamic> fullConfig = {
+      "log": {
+        "level": "debug",
+        "timestamp": true
+      },
+      "dns": {
+        "servers": [
+          {
+            "tag": "dns-remote",
+            "address": "https://dns.google/dns-query",
+            "detour": "direct",
+            "address_resolver": "dns-direct"
+          },
+          {
+            "tag": "dns-direct",
+            "address": "local",
+            "detour": "direct"
+          }
+        ],
+        "rules": [],
+        "final": "dns-remote",
+        "strategy": "prefer_ipv4"
+      },
+      "inbounds": [
+        {
+          "type": "tun",
+          "tag": "tun-in",
+          "interface_name": "utun",
+          "inet4_address": "172.19.0.1/30",
+          "auto_route": true,
+          "strict_route": true,
+          "sniff": true,
+          "sniff_override_destination": false
+        }
+      ],
+      "outbounds": [
+        // 🔧 修复：添加 selector 组，让用户可以手动选择节点
+        {
+          "type": "selector",
+          "tag": "proxy",
+          "outbounds": kr_outbounds.map((o) => o['tag'] as String).toList(),
+          "default": kr_outbounds.isNotEmpty ? kr_outbounds[0]['tag'] : "direct",
+        },
+        ...kr_outbounds,
+        {
+          "type": "direct",
+          "tag": "direct"
+        },
+        {
+          "type": "block",
+          "tag": "block"
+        },
+        {
+          "type": "dns",
+          "tag": "dns-out"
+        }
+      ],
+      "route": {
+         "rules": [
+        { "type": "dns", "outbound": "dns-out" },              // sing-box 内部解析交给 dns-out
+        { "type": "field", "port": 53,  "network": "udp", "outbound": "direct" }, // 系统 UDP 53 直连
+        { "type": "field", "port": 53,  "network": "tcp", "outbound": "direct" }, // 系统 TCP 53 直连
+        { "type": "field", "port": 853, "network": "tcp", "outbound": "direct" }, // 系统 TCP 853（Private DNS）直连
+        { "type": "field", "domain": ["dns.google", "cloudflare-dns.com", "one.one.one.one"], "outbound": "direct" } // 常见 DoH 域名直连，避免误走代理
+      ],
+        "final": "proxy",  // 🔧 修复：使用 selector 组作为默认出站
+        "auto_detect_interface": true
+      }
    };

    final file = _file(kr_configName);
    final temp = _tempFile(kr_configName);
-    final mapStr = jsonEncode(map);
+    final mapStr = jsonEncode(fullConfig);

-    KRLogUtil.kr_i('📄 配置文件内容长度: ${mapStr.length}', tag: 'SingBox');
-    KRLogUtil.kr_i('📄 完整配置文件内容: $mapStr', tag: 'SingBox');
+    KRLogUtil.kr_i('📄 完整配置文件长度: ${mapStr.length}', tag: 'SingBox');
+    KRLogUtil.kr_i('📄 Outbounds 数量: ${kr_outbounds.length}', tag: 'SingBox');
+    KRLogUtil.kr_i('📄 配置前800字符:\n${mapStr.substring(0, mapStr.length > 800 ? 800 : mapStr.length)}', tag: 'SingBox');

    await file.writeAsString(mapStr);
    await temp.writeAsString(mapStr);
@@ -1089,11 +1181,11 @@ class KRSingBoxImp {
      final oOption = SingboxConfigOption.fromJson(_getConfigOption());
      final changeResult = await kr_singBox.changeOptions(oOption).run();
      changeResult.match(
-        (error) {
+            (error) {
          KRLogUtil.kr_e('❌ changeOptions() 失败: $error', tag: 'SingBox');
          throw Exception('初始化 HiddifyOptions 失败: $error');
        },
-        (_) {
+            (_) {
          KRLogUtil.kr_i('✅ HiddifyOptions 初始化成功', tag: 'SingBox');
        },
      );
@@ -1112,7 +1204,7 @@ class KRSingBoxImp {
      _kr_subscribeToStatus();

      await kr_singBox.start(_cutPath, kr_configName, false).map(
-        (r) {
+            (r) {
          KRLogUtil.kr_i('✅ SingBox 启动成功', tag: 'SingBox');
        },
      ).mapLeft((err) {
@@ -1316,9 +1408,9 @@ class KRSingBoxImp {
          mode = KRCountryUtil.kr_getCurrentCountryCode();
          KRLogUtil.kr_i('🎯 切换到规则代理模式: $mode', tag: 'SingBox');
          break;
-        // case KRConnectionType.direct:
-        //   mode = "direct";
-        // break;
+      // case KRConnectionType.direct:
+      //   mode = "direct";
+      // break;
      }
      oOption["region"] = mode;
      KRLogUtil.kr_i('📝 更新 region 配置: $mode', tag: 'SingBox');
@@ -1454,8 +1546,8 @@ class KRSingBoxImp {
        // 使用 then/catchError 避免异常导致 UI 阻塞
        kr_singBox.selectOutbound("select", tag).run().then((result) {
          result.match(
-            (error) => KRLogUtil.kr_w('🔁 定时器重选节点失败: $error', tag: 'SingBox'),
-            (_) => KRLogUtil.kr_d('🔁 定时器重选节点成功', tag: 'SingBox'),
+                (error) => KRLogUtil.kr_w('🔁 定时器重选节点失败: $error', tag: 'SingBox'),
+                (_) => KRLogUtil.kr_d('🔁 定时器重选节点成功', tag: 'SingBox'),
          );
        }).catchError((error) {
          KRLogUtil.kr_w('🔁 定时器重选节点异常: $error', tag: 'SingBox');
@@ -1473,13 +1565,45 @@ class KRSingBoxImp {

    if (country == 'auto') {
      KRLogUtil.kr_i('🌀 国家为 auto，执行自动节点选择逻辑', tag: 'SingBox');
-      await kr_selectOutbound('auto');
+      try {
+        // 保存国家为 auto，并重建/保存全部节点
+        await KRSecureStorage().kr_saveData(key: 'SELECTED_COUNTRY_TAG', value: 'auto');
+        await KRSecureStorage().kr_saveData(key: _keySelectedNode, value: 'auto');
+        await kr_selectOutbound('auto');
+        _nodeSelectionTimer?.cancel();
+        _nodeSelectionTimer = null;
+        KRLogUtil.kr_i('✅ 已切换为 auto 节点选择', tag: 'SingBox');
+      } catch (e) {
+        KRLogUtil.kr_e('❌ auto 国家选择失败: $e', tag: 'SingBox');
+        rethrow;
+      }
      return;
    }

+    try {
+      await KRSecureStorage().kr_saveData(key: 'SELECTED_COUNTRY_TAG', value: country);
+      final oOption = _getConfigOption();
+      oOption["region"] = country;
+      KRLogUtil.kr_i('📝 更新 region 配置为国家: $country', tag: 'SingBox');
+      final op = SingboxConfigOption.fromJson(oOption);
+      await kr_singBox.changeOptions(op)
+        ..map((r) {
+          KRLogUtil.kr_i('✅ 国家 region 更新成功: $country', tag: 'SingBox');
+        }).mapLeft((err) {
+          KRLogUtil.kr_e('❌ 更新国家 region 失败: $err', tag: 'SingBox');
+          throw err;
+        }).run();
+
+      // 设置为 auto 以便在该国集合内自动选最快
+      await KRSecureStorage().kr_saveData(key: _keySelectedNode, value: 'auto');
+      KRLogUtil.kr_i('ℹ️ 已应用国家到配置，等待控制器执行重启', tag: 'SingBox');
+    } catch (e) {
+      KRLogUtil.kr_e('❌ 国家选择流程失败: $e', tag: 'SingBox');
+      rethrow;
+    }
+
    if (kr_activeGroups.isEmpty) {
-      KRLogUtil.kr_w('⚠️ kr_activeGroups 当前为空，无法进行国家选择', tag: 'SingBox');
-      return;
+      KRLogUtil.kr_w('⚠️ kr_activeGroups 当前为空，国家选择后将由重启同步分组', tag: 'SingBox');
    }

  }
@@ -1534,4 +1658,56 @@ class KRSingBoxImp {
      KRLogUtil.kr_e('📚 错误详情: ${e.toString()}', tag: 'SingBox');
    }
  }
+
+  Future<void> kr_debugTunConnectivity() async {
+    KRLogUtil.kr_i('🧪 [TUN Debug] 开始调试', tag: 'SingBoxTun');
+    final statusType = kr_status.value.runtimeType.toString();
+    KRLogUtil.kr_i('🔎 当前状态: $statusType', tag: 'SingBoxTun');
+
+    final selectedCountry = await KRSecureStorage().kr_readData(key: 'SELECTED_COUNTRY_TAG');
+    final selectedNode = await KRSecureStorage().kr_readData(key: 'SELECTED_NODE_TAG');
+    KRLogUtil.kr_i('🎯 选择: country=$selectedCountry, node=$selectedNode', tag: 'SingBox');
+
+    final activeTags = kr_activeGroups.map((g) => g.tag).join(', ');
+    KRLogUtil.kr_i('🧩 分组: all=${kr_allGroups.length}, active=${kr_activeGroups.length} [$activeTags]', tag: 'SingBoxTun');
+
+    // 1) TCP 到 1.1.1.1:443（避免纯 IP HTTP 被对端重置）
+    try {
+      final sock = await Socket.connect('1.1.1.1', 443, timeout: const Duration(seconds: 3));
+      sock.destroy();
+      KRLogUtil.kr_i('🌐 TCP 443连接成功 (1.1.1.1:443)', tag: 'SingBoxTun');
+    } catch (e) {
+      KRLogUtil.kr_e('🌐 TCP 443连接失败: $e', tag: 'SingBoxTun');
+    }
+
+    // 2) HTTPS 测试（使用 Google 204 连接性检测，更通用更稳健）
+    try {
+      final client = HttpClient()..connectionTimeout = const Duration(seconds: 3);
+      final req = await client.getUrl(Uri.parse('https://connectivitycheck.gstatic.com/generate_204'));
+      req.headers.add('User-Agent', 'kr-debug');
+      final resp = await req.close();
+      KRLogUtil.kr_i('🔐 HTTPS 204 状态: ${resp.statusCode}', tag: 'SingBoxTun');
+    } catch (e) {
+      KRLogUtil.kr_e('🔐 HTTPS 204 错误: $e', tag: 'SingBoxTun');
+    }
+
+    // 3) 系统DNS解析（走系统解析器）
+    try {
+      final addrs = await InternetAddress.lookup('google.com');
+      KRLogUtil.kr_i('🧭 DNS解析成功: ${addrs.map((a) => a.address).join(", ")}', tag: 'SingBoxTun');
+    } catch (e) {
+      KRLogUtil.kr_e('🧭 DNS解析错误: $e', tag: 'SingBoxTun');
+    }
+
+    // 4) TCP 53检测（公共DNS TCP53可达性）
+    try {
+      final sock = await Socket.connect('8.8.8.8', 53, timeout: const Duration(seconds: 3));
+      sock.destroy();
+      KRLogUtil.kr_i('🛰️ TCP 53连接成功 (8.8.8.8:53)', tag: 'SingBoxTun');
+    } catch (e) {
+      KRLogUtil.kr_w('🛰️ TCP 53连接失败: $e', tag: 'SingBoxTun');
+    }
+
+    KRLogUtil.kr_i('✅ [TUN Debug] 结束调试', tag: 'SingBoxTun');
+  }
 }