fix(routing): resolve real IP for zapret routes, add IPv6 sniffing, and fix monitoring route display

tests/installer_rollback_detection.sh

@@ -122,8 +122,8 @@ grep -Fq '/stat' "$WORK_DIR/lock.uc" ||
 
 # ucode resolves names lexically and does not hoist, so a call placed above the
 # declaration silently becomes null and the lock is never released.
-lock_decl="$(grep -n '^function installer_release_init_lock() {' "$INSTALLER" | head -1 | cut -d: -f1)"
-lock_call="$(grep -n 'installer_release_init_lock();' "$INSTALLER" | head -1 | cut -d: -f1)"
+lock_decl="$(grep -m 1 -n '^function installer_release_init_lock() {' "$INSTALLER" | cut -d: -f1)"
+lock_call="$(grep -m 1 -n 'installer_release_init_lock();' "$INSTALLER" | cut -d: -f1)"
 [ -n "$lock_decl" ] && [ -n "$lock_call" ] ||
   fail "installer_release_init_lock must be both declared and called"
 [ "$lock_decl" -lt "$lock_call" ] ||

tests/route_rules_coexistence.sh

@@ -130,4 +130,55 @@ for (let rs in rulesets) {
 }
 ' || fail "DPI-out must never be set as download_detour"
 
+# 3. Verify zapret section generates resolve action for rulesets and domains
+cat >"$WORK_DIR/fixture_zapret_resolve.json" <<'JSON'
+{
+  "settings": {
+    ".name": "settings",
+    ".type": "settings",
+    "enabled": "1",
+    "dns_type": "udp",
+    "dns_server": "1.1.1.1",
+    "service_listen_address": "127.0.0.1"
+  },
+  "section": [
+    {
+      ".name": "zapret",
+      ".type": "section",
+      "enabled": "1",
+      "action": "zapret",
+      "community_lists": [ "youtube" ]
+    }
+  ]
+}
+JSON
+
+output_zapret_resolve="$WORK_DIR/out_zapret_resolve.json"
+mkdir -p "$output_zapret_resolve.section-cache" "$output_zapret_resolve.rulesets"
+ucode -L "$TACHYON_LIB" "$GENERATOR_UC" generate-config-fixture \
+  "$WORK_DIR/fixture_zapret_resolve.json" "$output_zapret_resolve" "127.0.0.1" "0" "1"
+
+ucode -e '
+let fs = require("fs");
+let raw = fs.readfile("'"$output_zapret_resolve"'");
+let cfg = json(raw);
+let rules = cfg.route.rules || [];
+let found_resolve = false;
+let found_route = false;
+for (let r in rules) {
+    if (r.action == "resolve" && r.rule_set)
+        found_resolve = true;
+    if (r.action == "route" && r.outbound == "zapret-out")
+        found_route = true;
+}
+if (!found_resolve) {
+    print("ERROR: zapret section did not generate action: resolve rule!\n");
+    exit(1);
+}
+if (!found_route) {
+    print("ERROR: zapret section did not generate action: route rule to zapret-out!\n");
+    exit(2);
+}
+' || fail "zapret section must generate resolve rule before route rule"
+
 printf "Route rules coexistence and detour checks passed\n"

tests/ruleset_download_detour.sh

@@ -115,4 +115,36 @@ grep -q '"http_clients"' "$output_v14" || \
 grep -q '"default_http_client": "ruleset-http"' "$output_v14" || \
   fail "sing-box 1.14+ must configure default_http_client"
 
+# 4. Verify zapret section with community_lists does NOT use zapret-out as download_detour
+cat >"$WORK_DIR/fixture_zapret.json" <<'JSON'
+{
+  "settings": {
+    ".name": "settings",
+    ".type": "settings",
+    "enabled": "1",
+    "dns_type": "udp",
+    "dns_server": "1.1.1.1",
+    "service_listen_address": "127.0.0.1"
+  },
+  "section": [
+    {
+      ".name": "zapret_sec",
+      ".type": "section",
+      "enabled": "1",
+      "action": "zapret",
+      "community_lists": [ "youtube" ]
+    }
+  ]
+}
+JSON
+
+output_zapret="$WORK_DIR/out_zapret.json"
+mkdir -p "$output_zapret.section-cache" "$output_zapret.rulesets"
+ucode -L "$TACHYON_LIB" "$GENERATOR_UC" generate-config-fixture \
+  "$WORK_DIR/fixture_zapret.json" "$output_zapret" "127.0.0.1" "0" "1"
+
+if grep -q '"download_detour": "zapret_sec-out"' "$output_zapret"; then
+  fail "zapret-out must never be selected as download_detour due to routing_mark"
+fi
+
 printf "ruleset download detour checks passed\n"