* feat(web): add headless ServiceLib API and replaceable UI host
* build(web): package API without bundled WebUI
* ci(web): build and test headless API packages
* docs(web): document the headless API and optional WebUI
* test(web): verify restore and build before API tests
* docs(web): align API release examples with current upstream
* test(web): cover creating and editing an empty-URL subscription group
Verify the API accepts and persists a subscription whose Url and MoreUrl stay empty, that an edit keeps the empty URL and zero interval, and that ServiceLib is untouched.
* fix(web): support per-target prerelease update preferences
* fix(web): require management key for non-loopback listeners
* ci: reduce development Web API build matrix
* fix(web): make native self-update rollback atomic and preserve progress
* docs(web): remove self-update E2E report
* ci(web): decouple Web releases from Linux Desktop
* feat(web): support standalone WebUI clients and rename the API to v2rayN.WebAPI
- Resolve every REST, login, setup, download, SSE-ticket and EventSource
request through one configurable Backend base per WebUI origin, with a
strict exact-match origin allowlist and no wildcard or credential CORS.
- Run the origin guard before authentication, and keep first-run setup,
instance diagnostics and the hosted-UI CSP same-origin as before.
- Rename the project directory, csproj, namespace, executable, lock,
build identity and self-update target to v2rayN.WebAPI while retaining
V2RAYN_WEB_* settings, WebVersion metadata, webVersion fields and the
existing release asset contracts.
- Migrate API-owned update preference identifiers and reject legacy
v2rayN.Web update packages with a manual reinstall instruction.
- Require staged native executables to be Linux ELF images for their RID.
- Add CORS, update-identity and setup-security tests, and record the
standalone-WebUI audit under v2rayN.WebAPI/STANDALONE-WEBUI-AUDIT.md.
* Remove WebUI hosting and configuration coupling from WebAPI
* Finish WebAPI cleanup and isolate native self-update worker
* Keep WebAPI client documentation implementation-neutral
* ci(webapi): verify Windows win-x64 build and startup
* fix(webapi): validate keys and unify loopback limits
* test(webapi): isolate update smoke from systemd runner
* feat(webapi): add Windows x64 release and self-update
* fix(webapi): verify release manifest version
* ci(webapi): publish web packages through the official release flow
* ci(webapi): run the web release inside the release-all workflow
* webapi: finish the rename and fix shutdown, terminal launch and help
- finish the Web -> WebAPI product rename: workflow files build-WebAPI.yml /
release-WebAPI.yml (path filters, reusable call sites, container tag),
solution entry, health headers X-v2rayn-WebAPI-*, WebAPI.self-update
capability, WebAPI-update-progress.json / WebAPI-update-runtime-state.json,
WebAPIData/WebAPI-auth.json with a migration from the legacy locations,
and the README compatibility notes
- end /api/events when the host starts stopping so Kestrel's graceful stop
cannot pin the whole shutdown budget with a client attached; a runtime
cleanup that starts after the host budget was exhausted now runs a reduced
fresh pass instead of skipping Core stop and shared-state saves entirely
- record the interactive launch context for detached children and helpers so
systemd markers leaked into a terminal (INVOCATION_ID / JOURNAL_STREAM) no
longer force foreground mode or misfire the supervised-deployment key check,
self-update gating and lifecycle decisions
- add --help / -h with the options and common environment variables in all
three launcher locales, and keep help flags out of the host arguments
* fix(webapi): retry transient file replacements during native updates
Windows antivirus and the search indexer can hold a freshly written
executable open for a moment, so replacing the installed executable or its
build identity could fail with a bare access-denied error and abort the
update or its rollback. Retry these replacements for a bounded window and
report the operation, target path and cause when they still fail.
* ci(webapi): display the release-all Web job as release-WebAPI
The reusable-workflow job key still used the pre-rename name, which is the
label the Actions UI shows for the nested Web release jobs.
* feat(webapi): add win-arm64, linux-riscv64 and linux-loongarch64 coverage
- build, package, sign and self-update support for the three architectures:
win-arm64 (windows-11-arm native startup smoke), linux-riscv64 (RISE RISC-V
runners with the community xujiegb/dotnet-riscv SDK; single-file publishing
verified on real hardware) and linux-loongarch64 (the upstream QEMU loong64
VM with the official Loongson SDK, smoke-tested inside the VM)
- per-RID native executable validation: ELF machines x86-64/AArch64/RISC-V
(0xF3)/LoongArch (0x102) and Windows PE AMD64/ARM64 (0xAA64), behind a
single IsSupportedRid gate
- release asset map and packager/manifest tables extended; the riscv64 and
loongarch64 Core bundles ship without the cronet payload
- release manifests now ignore unknown RID entries so a newer manifest cannot
be rejected wholesale by an older build
* fix(webapi): keep the loongarch64 QEMU smoke out of the packaged publish tree
The in-VM smoke ran the app inside the virtiofs-shared publish directory and
left runtime files owned by the VM root (v2rayN.WebAPI.instance.lock) that the
host runner could not read, so packaging failed with EACCES. The smoke now runs
in a VM-local copy, and a host-side guard verifies the shared tree is complete
and readable before packaging.
* docs(webapi): document the six-platform release matrix
Releases now cover linux-x64/arm64/riscv64/loongarch64 and win-x64/arm64;
note the per-RID machine validation and the forward-compatible manifest
behavior in the API release documentation.
* ci(webapi): keep the release-all desktop dispatch exactly upstream
build-all.yml dispatches the desktop workflows with "ref": "master" exactly
as upstream does. The fork-only github.ref_name change is reverted so the PR
leaves the existing release behavior untouched; the WebAPI release stays an
additive reusable job in the same workflow.
* fix(webapi): probe the effective listener and refuse unverifiable updates
GetCurrentHealthUri and GetLauncherUris forced every probe to 127.0.0.1 and
fell back to port 5080, so IPv6-only, wildcard and port-only listeners could
be checked at the wrong endpoint. The detached update helper then either
rolled back a healthy replacement or restarted without being able to verify
the old instance, and --stop could probe the wrong process.
Both callers now resolve the probe through one WebProbeUriResolver that uses
the same effective Kestrel configuration as the host (command line, urls,
http/https ports, Kestrel endpoints, preferHostingUrls) and maps each
listener to its matching loopback address: "*", "+" and host names probe
localhost, 0.0.0.0 probes 127.0.0.1, [::] probes [::1], and loopback
literals keep their family. When no loopback HTTP probe exists (HTTPS-only
or an explicit non-loopback address), GetWebUpdateTarget reports
canInstall=false with maintenance.webUpdateProbeUnavailable and the update
is refused before anything is stopped; the helper still accepts only
loopback HTTP plan URIs, now including [::1]. --stop reports the new
stopUnprobeable result instead of signalling an unverified owner, and the
background launcher fails closed with startUnprobeable.
Regression: new resolver/listener tests (default, custom port, IPv6-only,
HTTP_PORTS, Kestrel override, HTTPS-only) and the real update fixture now
covers an IPv6-only replacement, asserts that a failed update leaves the old
build running (replacement PID), and proves that an unprobeable instance
refuses both the API and --stop while staying up.
* ci(webapi): capture the real smoke PID and bound the SIGTERM waits
The riscv64 smoke backgrounded "cd && app" and recorded the subshell PID,
so the later kill could target the wrapper while the app kept running. Both
the riscv64 and loong64 smokes now start the app directly, record the
application PID, fail fast when the process exits before health, wait a
bounded time for SIGTERM before printing the log and force-killing, and
assert a zero exit status. The loong64 VM smoke replaces its fixed
two-second sleep with the same exit assertion.
* chore(webapi): drop unreferenced legacy scripts
bootstrap-xray.sh installed the removed bundled core-bin layout, and
test-backup-fixtures.py compared desktop/Web backup ZIPs from before the
WebUI decoupling; nothing references either script.
* fix(webapi): unify the loopback probe, diagnostics and helper rules
The resolver rewrote a configured localhost to 127.0.0.1 while the health
diagnostics and the update helper each carried their own copy of the
accepted-host rule. Keep localhost as localhost (resolving it covers both
families instead of forcing one IPv4 literal) and make
WebProbeUriResolver.IsProbeableLoopbackUri the single rule: plain HTTP to a
host the diagnostics accept as local (localhost, 127.0.0.1 or ::1). The
helper validates plans with that rule, the health endpoint uses the shared
WebSetupAccessPolicy.IsLocalDiagnosticSource predicate, and every probe URI
the resolver produces satisfies the rule. Unprobeable listeners
(HTTPS-only or an explicit non-loopback address) still refuse the
self-update up front: canInstall=false with
maintenance.webUpdateProbeUnavailable while the current instance keeps
running.
Regression: localhost stays localhost across the resolver and launcher
tests, the probe-rule invariant, the shared diagnostics/probe address
rule, a direct unit test of the refusal reason, and a real
localhost-listener replacement scenario in the update fixture.
* fix(webapi): gate generated probes through the shared loopback rule
MapToLoopbackHost accepted every address the OS reports as loopback, which in
.NET is the whole 127.0.0.0/8 range, and TryCreateHealthUri returned true
without checking the generated URI against the same rule the diagnostics and
the update helper use. A listener on 127.0.0.2 therefore passed the up-front
canInstall check, but the helper rejected its plan (and refused to restart
the previous build for the same reason), so an update could stop the service
without bringing anything back.
TryCreateHealthUri now gates the constructed probe through
IsProbeableLoopbackUri, so loopback aliases are refused before the instance
is stopped and a mixed listener list falls through to the next verifiable
endpoint.
Regression: 127.0.0.2/127.255.255.254 mapping rows, a dedicated
loopback-alias rejection test, the alias canInstall=false reason case, the
mixed-list fall-through, and a real 127.0.0.2-listener fixture scenario that
proves the update is refused while the current instance keeps running.
* refactor(webapi): centralize integration tests and simplify release scripts
Move the Linux integration tests (startup security, release packaging
dry-run, full-ZIP runtime, native update regression and its fixture) from
Scripts/ into Tests/Integration/; Scripts/verify.sh stays the unified entry
and all path resolution, workflow calls, README text and cross-script
invocations were updated. No test coverage changes.
Merge Test-Windows.ps1 and Test-WindowsUpdate.ps1 into one
Tests/Integration/Test-Windows.ps1 with -Mode startup|update: both modes
share the native process control (CREATE_NEW_PROCESS_GROUP + CTRL_BREAK),
environment isolation, free-port selection, no-proxy health waiting, JSON
fixtures and retained-on-failure cleanup. CI keeps the Windows x64/ARM64
startup smokes and the x64 replacement/rollback smoke.
Delete the package-native.sh thin wrapper; the workflow and the packaging
dry-run now call web-release-assets.py package directly with the same
--rid/--publish/--dist arguments, so asset names and ZIP boundaries stay
unchanged.
* test(webapi): keep the Windows health-body assertion in the merged smoke
The merged Wait-TestHealth only accepted HTTP 200 in startup mode, while
the original startup smoke parsed the health JSON and required
status == "ok". Restore the body assertion in the shared helper so both
modes verify the health payload instead of trusting the status code alone.
* fix(webapi): preflight and verify native backup restores
* test(webapi): isolate restore preflight smoke from systemd
* test(webapi): set Windows smoke autostart default
* test(webapi): retry transient Windows smoke cleanup
* test(webapi): retry Windows smoke temp cleanup longer
* ci(webapi): check whitespace on workflow dispatch
The Code Test workflow only has a pull_request trigger, so the suite
never runs against master itself: a direct push is untested, and a
merge can break tests even when the pull request's own check was
green, because checks run on the PR head rather than on the merged
result. Add a push trigger for master with the same paths filter.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Follow-ups to #10007, none of which change what the test command does.
The `paths:` filter listed individual source folders rather than the
projects the suite builds, so a change anywhere else in that build
produced no check at all. Of the last 40 merged pull requests, 31 touch
the test build and 15 of those ran no tests. #9976 and #9932 edit
`ServiceLib/Common/`, which every test depends on, and neither shows a
single check. `Directory.Build.props` is the sharpest case: it sets
`TargetFramework` and the Release options for every project, so an edit
there can break the test build without producing a workflow run at all.
The filter now follows the project graph instead. `ServiceLib.Tests`
references `ServiceLib`, which references `ServiceLib.UdpTest`, and
`Directory.Build.*`, `Directory.Packages.props` and `global.json`
configure that build. It is shorter than the list it replaces, needs no
edit when a test is added or a class moves, and still skips UI and
documentation work: of those same 40 pull requests, 9 stay filtered out.
`global.json` belongs there for a different reason: it does not affect a
single line of the code under test, but it decides whether the tests run
at all, so a bad edit there silently reproduces the failure #10007 fixed.
The Checkout step needs neither `submodules: 'recursive'` nor
`fetch-depth: '0'`. `GlobalHotKeys` is pulled in by `v2rayN.Desktop`
only, and nothing in this job reads git history.
`global.json` also gained the final newline `.editorconfig` asks for with
`insert_final_newline = true` under `[*]`.
* chore(deps): update xunit.v3 to 4.0.0 and drop the VSTest packages
xunit.v3 4.0.0 moves from Microsoft.Testing.Platform v1 to v2, and MTP v2 drops the VSTest bridge on the .NET 10 SDK, so anything routed through VSTest now fails before a single test runs.
Rather than bridging back to VSTest, the two VSTest-era packages are removed. The test project is already an executable carrying xunit's own in-process runner, so Microsoft.NET.Test.Sdk and xunit.runner.visualstudio have nothing left to contribute, and without them no opt-in file is needed anywhere.
No source or test changes are required: every 4.0.0 breaking change is in the extensibility and runner APIs, and the suite uses only [Fact], [Theory] and [InlineData].
* ci: run the tests directly and let versions float on their major
test.yml requested the 8.0.x SDK while every project targets net10.0, which an 8.0 SDK cannot build (NETSDK1045), and it invoked dotnet test, which needs the VSTest bridge that MTP v2 has dropped. It now runs the test executable, which needs no adapter and no test SDK.
All three setup-dotnet steps ask for 10.x with quality ga, so a new .NET 10 patch or feature band is picked up automatically while previews and release candidates stay out of builds. setup-dotnet and upload-artifact were the only actions pinned to an exact patch; they now track their major tag like the other seven.
* chore(deps): update NLog to 6.2.0
A minor release with no API change on the surface this project uses. Verified beyond compilation: Logging.Setup builds its FileTarget, and both SaveLog overloads write through it at runtime with the expected layout.
GitHub has updated its behavior: new forks no longer inherit the original repository's GitHub token permissions.
To ensure consistent access, this change explicitly defines the required permissions in the configuration file.
Nozilla-X