feat(uninstall): скрипт чистого удаления uninstall.sh с сохранением бэкапа конфигурации и документация

2026-08-15 21:31:56 +03:00
parent b1c336ccad
commit 7b215e5792
12 changed files with 1086 additions and 0 deletions
@@ -199,6 +199,19 @@ sh <(wget -O - https://raw.githubusercontent.com/Dushnilin/tachyon/main/install.
 > [!NOTE]
 > **Automatic Migration:** Existing configurations from **Forkop**, **Podkop Plus**, or original **Podkop** are fully compatible. The installer will automatically migrate your settings to `/etc/config/tachyon` without data loss.
 ### 🗑️ Uninstallation (Clean Uninstall & Backup)
 To cleanly remove Tachyon, restore stock DNS, flush nftables rules, and preserve your configuration in `/etc/config/tachyon.backup-<timestamp>`:
 ```bash
 sh <(wget -O - https://raw.githubusercontent.com/Dushnilin/tachyon/main/uninstall.sh)
 ```
 **Options & Flags:**
 * `-y`, `--yes` — non-interactive mode without confirmation prompts.
 * `-p`, `--purge` — completely remove all files including configurations and backups.
 * `--keep-binaries` — keep sing-box / zapret / byedpi binaries in `/usr/bin/`.
 <p align="center">
  <img src="assets/readme/divider_stream.svg" width="100%" alt="divider" />
 </p>
@@ -199,6 +199,19 @@ sh <(wget -O - https://raw.githubusercontent.com/Dushnilin/tachyon/main/install.
 > [!NOTE]
 > **Автоматическая миграция:** Конфигурации от **Forkop**, **Podkop Plus** и оригинального **Podkop** полностью совместимы. Инсталлятор автоматически перенесет ваши правила в `/etc/config/tachyon` без потери данных.
 ### 🗑️ Удаление (Clean Uninstall & Backup)
 Для полного и чистого удаления Tachyon с возвратом штатного DNS, очисткой правил nftables и сохранением вашей конфигурации в `/etc/config/tachyon.backup-<timestamp>`:
 ```bash
 sh <(wget -O - https://raw.githubusercontent.com/Dushnilin/tachyon/main/uninstall.sh)
 ```
 **Опции и флаги:**
 * `-y`, `--yes` — автоматическое выполнение без интерактивного подтверждения.
 * `-p`, `--purge` — полное удаление всех файлов вместе с конфигурациями и бэкапами.
 * `--keep-binaries` — сохранить бинарники sing-box / zapret / byedpi.
 <p align="center">
  <img src="assets/readme/divider_stream.svg" width="100%" alt="divider" />
 </p>
@@ -0,0 +1,107 @@
 # 01. System Architecture & Core Concepts
 ## 1. High-Level Overview
 **Tachyon** is an enterprise-grade, lightweight traffic orchestration, multi-protocol proxying, and DPI anti-censorship platform built natively for **OpenWrt** (supporting 23.05, 24.10, 25.x, and SNAPSHOT).
 ```mermaid
 graph TD
    Client[LAN Clients] -->|TCP/UDP| Router[OpenWrt Router]
    Router --> NFT[nftables: inet TachyonTable]
    NFT -->|Direct List / 0ms| WAN[Direct WAN Gateway]
    NFT -->|NFQueue Desync| Zapret[Zapret v1 / v2 nfqws/2]
    NFT -->|SOCKS Desync| ByeDPI[ByeDPI ciadpi]
    NFT -->|TProxy / Redirect| SingBox[sing-box Core v1.11+]
    SingBox -->|VLESS Reality / H2 / WG| VPS[External VPS / Global Web]
    Zapret --> WAN
    ByeDPI --> WAN
    subgraph Tachyon Control Plane
        UCODE[ucode Core Runtime] --> NFT
        UCODE --> SingBox
        UCODE --> Zapret
        UCODE --> ByeDPI
        Watchdog[Autonomous Watchdog 5-15s] --> UCODE
        AIDoctor[AI Doctor v2.5 / Local Doctor] --> Watchdog
        Telegram[Telegram Bot Daemon] --> UCODE
        RestAPI[HTTP REST Agent API / OpenAPI 3.0] --> UCODE
        LuCI[LuCI TypeScript Web UI] --> UCODE
    end
 ```
 ---
 ## 2. Core Architectural Pillars
 ### 2.1. Native ucode Runtime (Zero Heavy Runtimes)
 * All control plane logic, UCI manipulation, config generation, health checks, and JSON APIs are written in **ucode**, OpenWrt's native C-like scripting language.
 * **Benefits**:
  * Consumes $\approx$ 1–3 MB RAM (contrasted with 30–60 MB for Python/Node).
  * Executes directly in C-speed with native bindings to `libuci`, `libubus`, `libblobmsg`, and posix syscalls (`fs`, `math`, `socket`).
  * Runs on routers with as little as 128 MB RAM.
 ### 2.2. Deterministic State & Atomic Writes
 * All configuration changes (`/etc/config/tachyon`) and JSON runtime configurations (`/tmp/tachyon/sing-box.json`) use an **atomic write pattern** (`tmp_file + rename`):
  ```ucode
  fs.writefile(tmp_path, json_str);
  fs.rename(tmp_path, target_path);
  ```
  This prevents file corruption during sudden power losses or kernel panics.
 ### 2.3. Dual Control Interfaces: LuCI & Headless Telegram/REST
 1. **LuCI Web UI**: Modern TypeScript SPA (`fe-app-tachyon`) compiled into LuCI JS assets (`luci-app-tachyon`).
 2. **Interactive Telegram Bot**: Embedded polling daemon with inline keyboards for on-the-fly server switching, rule updates, and instant diagnostics.
 3. **HTTP REST Agent API**: Secure CGI endpoint (`/cgi-bin/tachyon-agent/`) with OpenAPI 3.0.3 spec for integration with LLM agents (ChatGPT Custom GPTs, Cursor, Claude Code, N8N).
 ---
 ## 3. Directory Layout & Repository Anatomy
 ```
 tachyon/
 ├── tachyon/files/                     # Core backend package root
 │   ├── etc/
 │   │   ├── config/tachyon             # Main UCI configuration (chmod 600)
 │   │   ├── init.d/tachyon             # Procd service init script
 │   │   └── uci-defaults/              # Post-installation default configs
 │   ├── usr/
 │   │   ├── bin/tachyon                # Main CLI entrypoint wrapper
 │   │   └── lib/tachyon/               # Modular ucode libraries (60+ modules)
 │   │       ├── core/                  # Low-level helpers, UCI, constants
 │   │       ├── service/               # Lifecycle, Watchdog, APIs, Telegram
 │   │       ├── diagnostics/           # AI Doctor, Local Doctor, Quick Fixes
 │   │       ├── singbox/               # Config generator, DNS, routing
 │   │       ├── providers/             # Zapret v1/v2, ByeDPI, NFQueue
 │   │       ├── nft/                   # nftables ruleset compiler & applier
 │   │       ├── dns/                   # dnsmasq & DNS routing coordinator
 │   │       ├── components/            # Updater, package manager, hosts
 │   │       ├── config/                # Validator, rule engine, migrations
 │   │       └── subscription/          # Subscriptions fetcher & parser
 ├── luci-app-tachyon/                  # OpenWrt LuCI package
 │   ├── htdocs/luci-static/resources/view/tachyon/ # Compiled frontend JS bundle
 │   ├── root/etc/uci-defaults/         # LuCI menu registration
 │   └── po/                            # Translations (ru, en)
 ├── fe-app-tachyon/                    # Frontend TypeScript source
 │   ├── src/                           # TypeScript SPA source
 │   ├── tsup.config.ts                 # Builds and patches LuCI baseclass
 │   └── package.json                   # Dependencies (vitest, typescript, tsup)
 ├── tests/                             # Comprehensive test suite (100+ shell tests)
 ├── build.sh                           # Release packager (ipk + apk)
 ├── install.sh                         # One-liner end-user installer
 └── docs/                              # Technical documentation & Knowledge Base
 ```
 ---
 ## 4. Key Runtime Processes & Daemons
 | Process | Role | Execution Model |
 |---|---|---|
 | `sing-box` | Core proxying & packet tunneling engine | Managed by procd (`/etc/init.d/tachyon`) |
 | `nfqws` / `nfqws2` | Local TCP/UDP packet desynchronizer (Zapret) | Spawned into background per configured rule |
 | `ciadpi` | Local SOCKS desync proxy (ByeDPI) | Spawned on `127.0.0.1:1080` / custom port |
 | `watchdog.uc` | State supervision, loop mitigation, self-healing | Background periodic daemon (every 5–15s) |
 | `telegram.uc` | Telegram Bot Long-Polling Daemon | Procd-supervised background worker |
 | `agent_api.uc` | HTTP REST Agent API Handler | Invoked on-demand via `uhttpd` CGI |
@@ -0,0 +1,101 @@
 # 02. ucode Backend Module Reference
 Tachyon's backend is modularized under `tachyon/files/usr/lib/tachyon/`. Modules are loaded dynamically via ucode's `require()` or executed directly via `ucode -L <lib_dir> <module> <command>`.
 ---
 ## 1. Core Subsystem (`core/`)
 | Module | Key Functions & Responsibilities |
 |---|---|
 | `constants.uc` | Central repository of paths, default ports, mark values, version detection (`detect_installed_version()`), commit SHA resolver (`detect_installed_commit_sha()`), UCI config names. |
 | `common.uc` | String manipulation (`trim`, `split_lines`), file helpers (`read_file`, `write_atomic`), logging formatters (`log_info`, `log_error`, `log_debug`). |
 | `helpers.uc` | Process management (`popen_read`, `system_exec`), CIDR formatting, MAC address validators, integer conversions with safety fallbacks. |
 | `ip.uc` | IP v4/v6 parser, subnet containment (`ip_in_subnet`), CIDR validator, loopback & private IP range detection. |
 | `url.uc` | RFC 3986 URL parser, extraction of scheme, host, port, path, query params, hash fragment, safe URL encoding/decoding. |
 | `uci.uc` | High-level wrapper over OpenWrt `libuci`: `get_section`, `set_option`, `add_section`, `delete_section`, atomic commit with lock. |
 | `packages.uc` | Package manager abstraction: detects `opkg` vs `apk` (OpenWrt 25.x+), checks installed packages, versions, and dependencies. |
 | `events.uc` | Internal event bus mechanism: publish/subscribe for service state transitions and notification dispatching. |
 ---
 ## 2. Service Management Subsystem (`service/`)
 | Module | Key Functions & Responsibilities |
 |---|---|
 | `lifecycle.uc` | Service start, stop, restart, enable, disable. Coordinates teardown order (nftables -> singbox -> zapret -> dnsmasq) to prevent routing deadlocks. |
 | `state.uc` | Comprehensive runtime state reader (`get_runtime_state()`): active proxy server, watchdog status, interface health, uptime, memory consumption. |
 | `reload.uc` | Hot-reload planner (`plan_reload()`): inspects what changed in UCI and applies the minimal necessary restart (e.g. soft-reload sing-box vs full nftables rebuild). |
 | `reset.uc` | Factory reset routines: wipes `/etc/config/tachyon`, cleans up temporary caches, restores default templates. |
 | `watchdog.uc` | Autonomous supervisor loop: checks sing-box process, memory thresholds (OOM guard), DNS resolution, loop-restart mitigation (`safe_proxy_restart`). |
 | `snapshot.uc` | Assembles a structured system snapshot JSON for AI Doctor and external diagnostics. |
 | `agent_api.uc` | CGI handler for `/cgi-bin/tachyon-agent/`: handles routing, Bearer authentication validation, endpoint dispatch, JSON serialization. |
 | `agent_mcp.uc` | Model Context Protocol (MCP) tool schema and handlers for integration with MCP clients (Cursor, Claude Desktop). |
 | `telegram.uc` | Telegram Bot daemon: polling loop (`getUpdates`), command dispatcher (`/doctor`, `/ai_doctor`, `/fix`, `/restart`, `/status`), inline keyboards. |
 | `warp_generator.uc` | Cloudflare WARP account generator & key exchange for auto-provisioning WireGuard outbounds. |
 | `event_controller.uc` | Coordinates async background job workers, PID tracking, lock files, and log ring-buffer management. |
 ---
 ## 3. Diagnostics & AI Subsystem (`diagnostics/`)
 | Module | Key Functions & Responsibilities |
 |---|---|
 | `runtime.uc` | **Local Rule Doctor & AI Doctor engine**: runs 10+ local heuristic checks, detects NTP desync, conntrack overflow, MTU issues, bootstrap DNS deadlock; applies 13+ quick fix codes (`apply_quick_fix()`), executes emergency internet restoration (`restore_native_internet()`). |
 | `service_check.uc` | Health probes: tests sing-box TCP/UDP proxying, DNS response latency, WAN internet connectivity, gateway reachability. |
 | `status.uc` | Detailed diagnostics status assembler for LuCI Diagnostic tab and CLI `tachyon doctor`. |
 ---
 ## 4. sing-box Subsystem (`singbox/`)
 | Module | Key Functions & Responsibilities |
 |---|---|
 | `generator.uc` | Master sing-box JSON configuration compiler (`/tmp/tachyon/sing-box.json`): binds inbounds, outbounds, routing rules, DNS, experimental. |
 | `generator_outbounds.uc` | Compiles VLESS (Reality/gRPC/WS), VMess, Shadowsocks, Trojan, Hysteria2, WireGuard, Direct, and Block outbounds. |
 | `generator_routes.uc` | Compiles routing rules: domain matchers, IP CIDR matchers, GeoIP rules, client MAC/IP matchers, detour assignments. |
 | `dns.uc` | Compiles sing-box DNS configuration: local DNS, remote DoH/DoT/UDP DNS, fakeip/direct resolution rules. |
 | `dns_failover.uc` | High-availability DNS failover logic: switches between primary and secondary bootstrap DNS upon timeouts. |
 | `dns_prefetch.uc` | Domain pre-fetching & cache warming for frequently accessed sites. |
 | `dns_presets.uc` | Built-in DNS presets (Cloudflare, Google, AdGuard, Quad9, OpenDNS, Custom DoH). |
 | `priority.uc` | Outbound group priority manager: auto-failover, fallback groups, URL-test latency sorting. |
 | `route.uc` | Low-level sing-box route rule builder & selector logic. |
 | `rulesets.uc` | Rule-set binary (`.srs`) and JSON ruleset compiler and parser. |
 | `servers.uc` | Server node parser, validator, and URI serializer (VLESS, VMess, SS, Trojan, H2). |
 | `subscription.uc` | Subscriptions processor: download, base64 decoding, node deduplication, format normalizer. |
 | `urltest.uc` | RTT ping & latency testing worker: measures real response times across proxy servers. |
 ---
 ## 5. Providers & DPI Bypass Subsystem (`providers/`)
 | Module | Key Functions & Responsibilities |
 |---|---|
 | `zapret/runtime.uc` | Manages **Zapret v1 (`nfqws`)** process arguments, queue numbers, NFQueue bindings, daemon start/stop. |
 | `zapret2/runtime.uc` | Manages **Zapret v2 (`nfqws2`)** advanced multi-vector desync arguments (`--dpi-desync=multisplit`, `--dpi-desync-seqovl`). |
 | `byedpi/runtime.uc` | Manages **ByeDPI (`ciadpi`)** SOCKS5 proxy daemon, port allocation, payload split parameters. |
 | `nfqueue/runtime.uc` | Kernel NFQueue allocation table, prevents queue ID collisions between Zapret v1 and v2. |
 | `rules.uc` | Maps UCI routing rules to specific provider action handlers (`action = zapret | zapret2 | byedpi | proxy`). |
 | `status.uc` | Real-time process inspection and health monitoring of all active DPI bypass daemons. |
 ---
 ## 6. Networking & Firewall Subsystem (`nft/`, `dns/`)
 | Module | Key Functions & Responsibilities |
 |---|---|
 | `nft/apply.uc` | Generates and commits nftables ruleset (`inet TachyonTable`): prerouting, output, divert chains, marks, fwmark, bypass sets. |
 | `dns/apply.uc` | Coordinates DNS interception: configures dnsmasq forwarders, port redirection (`127.0.0.1:5353`), ipset / nftset auto-population. |
 ---
 ## 7. Configuration & Components Subsystem (`config/`, `components/`, `subscription/`)
 | Module | Key Functions & Responsibilities |
 |---|---|
 | `config/validator.uc` | Strict UCI schema validation: validates IP addresses, ports, UUIDs, private keys, domain names, action modes. |
 | `config/migration.uc` | Automatic migration engine: migrates configurations from legacy Forkop, Podkop Plus, and Podkop configs without data loss. |
 | `components/updater.uc` | Background component installer/updater: handles downloading, unpacking, installing, and version checking of binaries. |
 | `components/hosts.uc` | Remote hosts lists ingestor: fetches blocklists, merges into unified `combined.txt`, handles GitHub mirror failovers. |
 | `subscription/cache.uc` | Atomic subscription cache store, prevents redundant network downloads. |
 | `subscription/parser.uc` | Universal proxy URI parser: parses `vless://`, `vmess://`, `ss://`, `trojan://`, `hysteria2://`, `wireguard://`. |
@@ -0,0 +1,108 @@
 # 03. Networking, nftables & Traffic Routing
 ## 1. Packet Journey & Routing Lifecycle
 Tachyon intercepts traffic at the OpenWrt kernel level using **nftables** and policy routing (`ip rule` + routing table `100`).
 ```mermaid
 sequenceDiagram
    autonumber
    participant Client as LAN Client
    participant PREROUTING as nftables PREROUTING
    participant Sets as nftables Sets (Bypass / Target)
    participant Divert as Detour Action
    participant SingBox as sing-box / Zapret / ByeDPI
    participant WAN as WAN / Internet
    Client->>PREROUTING: TCP/UDP SYN Packet (e.g. 192.168.1.100 -> 1.1.1.1:443)
    PREROUTING->>Sets: Check destination IP / Port against Tachyon sets
    alt IP in Bypass Set (Local Subnet / RuNet / Direct)
        Sets->>WAN: Direct Forwarding (0 ms overhead)
    else IP in Target Set or Default Detour
        Sets->>Divert: Mark packet with FWMARK (e.g. 0x10000000)
        Divert->>SingBox: Divert via TProxy / Redir / NFQueue
        SingBox->>WAN: Processed / Encrypted / Desynchronized Outbound
    end
 ```
 ---
 ## 2. nftables Table Structure (`inet TachyonTable`)
 Tachyon encapsulates all its firewall rules inside a dedicated table `inet TachyonTable`. This ensures clean isolation from the system `inet fw4` firewall.
 ### 2.1. Key Chains
 1. **`dstnat` / `prerouting` (Hook `prerouting`, priority `-100` / `dstnat`)**:
   * Intercepts incoming LAN client packets before routing decisions.
   * Checks client MAC / IP exclusion lists.
   * Matches destination IP against `tachyon_bypass_v4` / `tachyon_target_v4` sets.
   * Performs TProxy redirect (`tproxy to :10080 meta mark set 0x10000000 accept`) or Port redirect.
 2. **`output` (Hook `output`, priority `-100`)**:
   * Intercepts router's own locally generated packets (e.g. DNS lookups, curl, router traffic).
   * Prevents self-interception loops (`meta skuid == "tachyon" return`).
 3. **`nfqueue_chain`**:
   * Directs packets destined for Zapret v1 / v2 to kernel NFQueue numbers (`queue num 200`, `queue num 201`).
 ### 2.2. Bitmask & Firewall Marks
 | Mark Value | Meaning | Action |
 |---|---|---|
 | `0x10000000` | Redirected to sing-box TProxy | Routed to local loopback via table 100 |
 | `0x20000000` | Processed by Zapret / NFQueue | Dispatched to nfqws daemon |
 | `0x40000000` | Marked for ByeDPI SOCKS | Forwarded to local SOCKS redirect |
 | `0x80000000` | Bypass marker (Direct WAN) | Accepted immediately without inspection |
 ---
 ## 3. DNS Architecture & Interception
 ### 3.1. DNS Resolution Pipeline
 ```
 [LAN Client DNS Query: 53]
            │
            ▼
    [dnsmasq / Router]
            │
            ├─► If Domain in Direct / RuNet / Local ──► Local Upstream DNS (ISP / DoH)
            │
            ├─► If Domain in Hosts Section ──────────► Static IP from dns_hosts
            │
            └─► If Domain in Target Proxy / Desync ──► sing-box DNS (127.0.0.1:5353)
                                                               │
                                                               ▼
                                                      [Remote Secure DoH/DoT]
                                                      [Populates nftables set]
 ```
 ### 3.2. Dynamic nftables Set Population (`nftset`)
 * When dnsmasq resolves a domain associated with a proxy or Zapret rule, it automatically adds the resolved IP address to the corresponding kernel nftables set (e.g. `tachyon_target_v4`).
 * This enables sub-millisecond, line-rate packet redirection without re-evaluating domain names in user-space for every packet.
 ### 3.3. Bootstrap DNS Dead-Lock Prevention
 * A critical failure mode in proxy routers is a **DNS loop**: sing-box needs to resolve the VPS hostname (e.g. `vps.example.com`), but its own DNS resolver routes queries through sing-box, which is not yet connected.
 * **Tachyon's Solution**:
  * Dedicated `direct_resolvers` (Cloudflare `1.1.1.1`, Google `8.8.8.8`) bypass all proxy rules.
  * Local Rule Doctor monitors bootstrap DNS reachability and automatically executes `fix_bootstrap_dns` if a circular dependency is detected.
 ---
 ## 4. Policy Routing (`ip rule` & Routing Tables)
 Tachyon provisions routing table `100`:
 ```sh
 # Routing rule for marked packets
 ip rule add fwmark 0x10000000/0x10000000 lookup 100 priority 10000
 # Local loopback route in table 100
 ip route add local default dev lo table 100
 ```
 ### 4.1. Emergency Internet Restoration Mechanism
 When `tachyon restore_native_internet` is triggered:
 1. `inet TachyonTable` is atomically deleted: `nft delete table inet TachyonTable`.
 2. Policy routing rule `ip rule del lookup 100` is removed.
 3. dnsmasq configuration is reverted to native upstream forwarders.
 4. sing-box process is stopped cleanly.
 5. Result: Full, native WAN connectivity is restored in under 200 ms without rebooting the router.
@@ -0,0 +1,90 @@
 # 04. DPI Bypass & Desynchronization Engines
 Tachyon integrates three distinct local packet desynchronization engines that operate entirely on the router hardware without requiring an external proxy server (Zero-VPS mode).
 ---
 ## 1. Comparison Matrix: Zapret v1 vs Zapret v2 vs ByeDPI
 | Feature | Zapret v1 (`nfqws`) | Zapret v2 (`nfqws2`) | ByeDPI (`ciadpi`) |
 |---|---|---|---|
 | **Binary** | `/usr/bin/nfqws` | `/usr/bin/nfqws2` | `/usr/bin/ciadpi` |
 | **Operating Model** | Kernel NFQueue Intercept | Kernel NFQueue Multi-Q | Local SOCKS5 / TProxy |
 | **Target Protocols** | HTTP, TLS (ClientHello) | HTTP, TLS, QUIC, WireGuard | HTTP, TLS |
 | **Packet Splitting** | `split2`, `disorder`, `fake` | `multisplit`, `seqovl`, `wsize`, `fake` | `--split-pos`, `--disorder`, `--fake` |
 | **Multi-Vector Chains** | Single strategy per rule | Multi-phase composite chains | Composite SOCKS args |
 | **CPU Overhead** | Minimal (< 1%) | Low (< 2%) | Low (< 2%) |
 | **Best For** | Legacy OpenWrt, Basic DPI | YouTube 4K, Discord, TSPU | Non-root users, SOCKS routing |
 ---
 ## 2. Desynchronization Techniques Explained
 Deep Packet Inspection (DPI) systems inspect packet headers (such as TLS Server Name Indication `SNI` or HTTP `Host` headers) to detect and block access. Desynchronization tricks the DPI into losing track of the connection state while the destination server reconstructs the stream normally.
 ```
 Original Stream:   [TLS ClientHello with SNI] ──────────► (Blocked by DPI)
 Desynchronized:    [Fake Bad Checksum Packet] ──────────► (DPI resets state)
                   [Payload Part 1: Snippet]  ──────────► (DPI misses SNI)
                   [Payload Part 2: Remainder] ─────────► (Server merges stream)
 ```
 ### 2.1. Key Desync Strategies
 1. **`split2` / `multisplit`**:
   * Splits the TCP segment right inside the TLS SNI or HTTP Host header. The DPI does not reassemble small fragments, while the end server's TCP stack reconstructs the full buffer seamlessly.
 2. **`disorder` / `disorder2`**:
   * Sends the second half of the packet before the first half with appropriate TCP sequence numbers. The DPI sees out-of-order data and skips inspection.
 3. **`fake` / `fake_sni`**:
   * Sends a fake TLS ClientHello packet with a low TTL (Time To Live). The DPI intercepts the fake packet and approves the connection; the packet dies before reaching the destination server.
 4. **`seqovl` (Sequence Overlap)**:
   * Sends a fake packet with overlapping sequence numbers that the server's TCP stack discards while the DPI's state machine is fooled.
 5. **`wsize` (Window Size Manipulation)**:
   * Forces a small TCP window size to prevent DPI from receiving full payloads in single bursts.
 ---
 ## 3. Configuration & Runtime Management
 ### 3.1. Zapret v2 Configuration Example (`/etc/config/tachyon`)
 ```ini
 config provider 'zapret2'
    option enabled '1'
    option daemon_bin '/usr/bin/nfqws2'
    option qnum '201'
    option args_tcp '--dpi-desync=multisplit --dpi-desync-split-pos=1,midsld --dpi-desync-seqovl=1 --dpi-desync-fooling=badseq'
    option args_udp '--dpi-desync=fake --dpi-desync-any-protocol=1 --dpi-desync-cutoff=d4'
 config rule 'youtube_rule'
    option enabled '1'
    option name 'YouTube 4K Desync'
    option action 'zapret2'
    list domain_pattern 'googlevideo.com'
    list domain_pattern 'youtube.com'
    list domain_pattern 'ytimg.com'
    list domain_pattern 'discord.gg'
    list domain_pattern 'discord.com'
 ```
 ### 3.2. ByeDPI Configuration Example
 ```ini
 config provider 'byedpi'
    option enabled '1'
    option daemon_bin '/usr/bin/ciadpi'
    option listen_ip '127.0.0.1'
    option listen_port '1080'
    option args '--split-pos 1 --disorder 1 --fake -1 --ttl 8'
 ```
 ---
 ## 4. NFQueue Multiplexing & Conflict Prevention
 * Kernel `nfnetlink_queue` requires unique queue numbers per daemon instance.
 * Tachyon's `providers/nfqueue/runtime.uc` dynamically manages queue allocation:
  * Default Zapret v1 queue: `200`
  * Default Zapret v2 queue: `201`
 * If both Zapret v1 and v2 are enabled simultaneously for different rules, Tachyon enforces strict queue isolation and prevents PID collisions.
@@ -0,0 +1,106 @@
 # 05. AI Stack, AI Doctor & Autonomous Self-Healing
 ## 1. Overview of Tachyon AI Stack
 Tachyon provides a dual-layer AI and autonomous resilience stack:
 1. **Autonomous Layer (Local Rule Doctor & Watchdog)**: Runs locally on the router every 5–15 seconds, detects network drops, memory leaks, DNS deadlocks, and time desync without requiring internet access or API tokens.
 2. **Cognitive Layer (AI Doctor v2.5)**: Deep diagnostics powered by LLMs (OpenAI, Anthropic Claude, DeepSeek, or local Ollama/OpenRouter models) with contextual prompt enrichment and automated Multi-Fix generation.
 3. **Agent Integration Layer (HTTP REST Agent API & OpenAPI 3.0)**: Programmatic interface for autonomous AI agents (Cursor, Claude Code, AutoGPT, ChatGPT Custom GPTs, N8N, Dify).
 ---
 ## 2. AI Doctor Architecture (v2.5)
 ```mermaid
 graph TD
    subgraph Data Collection
        R1[Process Probes: singbox/zapret/dnsmasq]
        R2[Kernel Metrics: conntrack, mem, uptime]
        R3[Watchdog History: failure streaks, OOM events]
        R4[System Logs: 15 most recent critical lines]
    end
    R1 --> Aggregator[snapshot.uc Assembler]
    R2 --> Aggregator
    R3 --> Aggregator
    R4 --> Aggregator
    Aggregator --> Prompt[Deep Context LLM Prompt]
    Prompt --> LLM[LLM Provider: OpenAI / Claude / DeepSeek / Custom]
    LLM --> Verdict[Structured Diagnosis Report]
    LLM --> MultiFix[Multi-Fix Action Plan: FIX: code1, code2]
    MultiFix --> Exec[Local Rule Doctor Execution Engine]
    Exec --> Result[Applied Fixes & Service State Refresh]
 ```
 ---
 ## 3. Local Rule Doctor & 13 Quick Fix Codes
 The execution engine in `diagnostics/runtime.uc` maps standardized fix codes to automated shell/ucode repair procedures:
 | Code | Target Subsystem | Action Performed |
 |---|---|---|
 | `start_singbox` | sing-box | Restarts failed sing-box process via procd. |
 | `rebuild_rules` | nftables | Flushes and recompiles `inet TachyonTable` ruleset. |
 | `fix_dnsmasq` | dnsmasq | Restarts dnsmasq and checks `/tmp/etc/dnsmasq.conf.*`. |
 | `fix_resolv_symlink` | DNS | Restores broken `/etc/resolv.conf` -> `/tmp/resolv.conf.d/resolv.conf.auto` link. |
 | `start_watchdog` | Watchdog | Restarts the background watchdog supervisor process. |
 | `restart_singbox_dns` | sing-box DNS | Resets internal sing-box DNS server module and cache. |
 | `fix_uci_config` | UCI | Restores `/etc/config/tachyon` from the latest valid atomic backup. |
 | `fix_wan_interface` | Networking | Runs `ifup wan` to bounce the primary uplink interface. |
 | `fix_gateway` | Networking | Re-establishes default routing gateway via `/etc/init.d/network restart`. |
 | `clear_dns_cache` | Cache | Flushes dnsmasq cache, deletes sing-box `cache.db`, and restarts DNS. |
 | `update_subscriptions`| Subscriptions | Triggers asynchronous background download and refresh of proxy subscriptions. |
 | `reset_firewall` | Firewall | Full restart of OpenWrt firewall (`/etc/init.d/firewall restart`). |
 | `restart_network` | Network Stack | Full restart of OpenWrt network daemon (`/etc/init.d/network restart`). |
 | `fix_system_time` | System NTP | Resynchronizes router clock via NTP pool servers (`ntpd -q -p ...`). |
 | `flush_conntrack` | Kernel | Flushes congested `nf_conntrack` table during connection floods. |
 | `fix_bootstrap_dns` | Resolver | Unblocks sing-box primary bootstrap resolvers and breaks circular loops. |
 | `optimize_mtu` | Tunnels | Auto-calculates optimal MTU (1280–1420) for WireGuard / AmneziaWG interfaces. |
 | `restore_native_internet` | Emergency | One-click full teardown of Tachyon proxying; returns pure native WAN routing. |
 ---
 ## 4. HTTP REST Agent API & OpenAPI 3.0.3
 Tachyon exposes a standardized REST API hosted under `/cgi-bin/tachyon-agent/` via OpenWrt's native `uhttpd`.
 ### 4.1. Authentication Model
 * **Read-Only Endpoints**: Accessible within LAN without authentication (or secured via firewall).
 * **Write Endpoints**: Require Bearer token authentication:
  ```http
  POST /cgi-bin/tachyon-agent/ai-doctor/fix
  Authorization: Bearer <agent_api_token>
  Content-Type: application/json
  {"fix": "clear_dns_cache,start_singbox"}
  ```
 ### 4.2. OpenAPI 3.0.3 Specification
 * The live OpenAPI JSON schema is available at:
  ```
  GET /cgi-bin/tachyon-agent/openapi.json
  ```
 * This schema allows instant import into **ChatGPT Custom GPT Actions**, **N8N HTTP Request Nodes**, **Dify**, and **Flowise**.
 ### 4.3. Full Endpoint Index
 | Method | Endpoint | Auth Required | Description |
 |---|---|---|---|
 | `GET` | `/health` | No | Lightweight JSON health status probe. |
 | `GET` | `/snapshot` | No | Full system snapshot (interfaces, memory, proxy status). |
 | `GET` | `/diagnose` | No | Local Rule Doctor diagnosis report. |
 | `GET` | `/logs` | No | Returns last 100 lines of Tachyon system log. |
 | `GET` | `/config` | No | Returns sanitized UCI configuration. |
 | `GET` | `/tools` | No | OpenAI Function Calling / MCP tool definitions. |
 | `GET` | `/openapi.json` | No | OpenAPI 3.0.3 specification JSON. |
 | `POST`| `/heal` | **Bearer** | Triggers manual Watchdog self-healing cycle. |
 | `POST`| `/ai-doctor/fix` | **Bearer** | Applies one or more quick-fix codes. |
 | `POST`| `/restart` | **Bearer** | Restarts specified service (`singbox`, `watchdog`, `dnsmasq`). |
 | `POST`| `/reload` | **Bearer** | Soft-reloads configuration and routing tables. |
 | `POST`| `/config/set` | **Bearer** | Updates specific UCI options. |
 | `POST`| `/section/toggle` | **Bearer** | Enables or disables a routing rule section. |
 | `POST`| `/domain/add` | **Bearer** | Appends domain pattern to target rule list. |
@@ -0,0 +1,70 @@
 # 06. Frontend Architecture (LuCI & TypeScript)
 ## 1. Frontend Architecture Overview
 Tachyon's web UI is authored as a single-page application in **TypeScript** under `fe-app-tachyon/` and compiled into a standalone JavaScript view under `luci-app-tachyon/htdocs/luci-static/resources/view/tachyon/main.js`.
 ```
 fe-app-tachyon/ (TypeScript Source)
       │
       ▼ (npm run build: tsc --noEmit && tsup)
       │
 [tsup build + baseclass.extend transformation]
       │
       ▼
 luci-app-tachyon/htdocs/luci-static/resources/view/tachyon/main.js (LuCI Asset)
 ```
 ---
 ## 2. The LuCI `baseclass.extend()` Patch Mechanism
 LuCI uses a custom asynchronous class system (`baseclass.extend({...})`) rather than standard ES modules or Webpack bundles.
 * `fe-app-tachyon/tsup.config.ts` compiles the TypeScript entry point (`src/main.ts`) into an ES module.
 * A custom post-processing step inside `tsup.config.ts` transforms the compiled file:
  1. Strips ESM `export default` statements.
  2. Wraps the controller inside LuCI's expected `return baseclass.extend({...})` pattern.
  3. Injects global LuCI helper references (`ui`, `rpc`, `uci`, `fs`, `_`).
 > [!IMPORTANT]
 > **Do not attempt to convert `main.js` back into a standard ES module export.** This LuCI bridge is intentional and strictly required for compatibility with all OpenWrt web themes (Bootstrap, Material, Argon, OpenWrt-Two).
 ---
 ## 3. Reactive State Management & Services
 The frontend does not use heavy external frameworks (like React or Vue) to keep package size minimal ($\approx$ 500 KB uncompressed, $\approx$ 90 KB gzipped). Instead, it uses lightweight TypeScript observable stores:
 ### 3.1. Key Services (`src/tachyon/services/`)
 | Service | File | Purpose |
 |---|---|---|
 | `StoreService` | `store.service.ts` | Central reactive data store with subscription listeners. |
 | `UiStateService` | `uiState.service.ts` | Tracks UI view state, tab switching, and modal states. |
 | `RuntimeUiStateService`| `runtimeUiState.service.ts`| Polling and caching of backend service metrics and active jobs. |
 | `SocketService` | `socket.service.ts` | WebSocket client for real-time log streaming when available. |
 | `TachyonLogWatcher` | `tachyonLogWatcher.service.ts`| Logread stream deduplication and notification dispatcher. |
 ---
 ## 4. Tabs & UI View Structure
 ```
 src/tachyon/tabs/
 ├── dashboard/        # Live status, RTT ping matrix, traffic toggles
 ├── diagnostic/       # AI Doctor modal, Local Rule Doctor, Emergency Fallback
 ├── rules/            # Selective routing rules, domain/IP lists, client matchers
 ├── providers/        # Zapret v1, Zapret v2, ByeDPI configurations
 ├── updates/          # Component installer, version checks, streaming log modal
 └── settings/         # DNS settings, Telegram bot credentials, AI Doctor API keys
 ```
 ### 4.1. The Updates & Installation Modal (`renderUpdateProgressModal.ts`)
 * Provides a streaming log console that polls `/usr/bin/tachyon` output asynchronously via `componentActionLog(jobId, offset)`.
 * Features:
  * Non-blocking operation: router performs installation in background.
  * Real-time timer and progress badge.
  * Preserves output logs and green success/red error banners.
  * Prevents premature auto-close so users can inspect package manager details.
  * Graceful countdown timer for Tachyon package reloads.
@@ -0,0 +1,78 @@
 # 07. Build System, Testing & Deployment Pipeline
 ## 1. Release Package Compilation (`build.sh`)
 Tachyon produces both legacy **IPK** (opkg) and modern **APK** (apk-tools, OpenWrt 25.x+) packages.
 ### 1.1. Running the Build
 ```bash
 bash build.sh <x.y.z> [output-dir]
 ```
 * **Semver Requirement**: `build.sh` strictly enforces semantic versioning (`x.y.z`).
 * **Cross-Filesystem WSL Protection**: When executed under Windows Subsystem for Linux (WSL), `build.sh` automatically clones the source repository into the native Linux filesystem (`/tmp/tachyon-build-...`) before packaging to avoid Windows filesystem metadata and permission corruption.
 * **Outputs**:
  * `dist/release-final/tachyon_<version>_all.ipk`
  * `dist/release-final/luci-app-tachyon_<version>_all.ipk`
  * `dist/release-final/tachyon-<version>.apk`
  * `dist/release-final/luci-app-tachyon-<version>.apk`
 ---
 ## 2. End-User Installer (`install.sh`)
 Tachyon provides an automated one-liner installer:
 ```bash
 sh <(wget -O - https://raw.githubusercontent.com/Dushnilin/tachyon/main/install.sh)
 ```
 ### 2.1. Installer Lifecycle
 1. **Architecture & OS Detection**: Detects OpenWrt version (23.05, 24.10, 25.x, SNAPSHOT), CPU architecture (`mips`, `mipsel`, `arm_cortex-a7`, `aarch64_cortex-a53`, `x86_64`), and package manager (`opkg` vs `apk`).
 2. **Dependency Resolution**: Ensures `ucode`, `ucode-mod-fs`, `ucode-mod-uci`, `ucode-mod-ubus`, `kmod-nft-tproxy`, `kmod-nft-queue`, `ca-bundle` are installed.
 3. **Legacy Migration**: Automatically detects `/etc/config/forkop` or `/etc/config/podkop` and seamlessly migrates all rules and servers to `/etc/config/tachyon`.
 4. **Binary Provisioning**: Downloads pre-compiled, optimized sing-box, Zapret, or ByeDPI binaries tailored for the router's target architecture.
 5. **Zero-Reboot Initialization**: Configures UCI defaults, registers LuCI menus, builds initial rulesets, and starts services without requiring a full router reboot.
 ---
 ## 3. Testing Workflows
 ### 3.1. Frontend Unit Tests (vitest)
 ```bash
 cd fe-app-tachyon
 npm test           # Runs all 522+ vitest unit tests
 npm run build      # Verifies TypeScript compilation and LuCI bundle packaging
 ```
 ### 3.2. Backend Integration Tests & ucode Syntax Linting
 Backend tests require the `ucode` binary. On development machines without local ucode, tests run inside the Docker CI image:
 ```bash
 # 1. ucode syntax check across all 60+ modules
 docker run --rm -v "$(pwd):/mnt" -w /mnt ucode-ci-img:latest bash tests/ucode_syntax_lint.sh
 # 2. Run all backend behavioral and unit tests in parallel (-P4)
 docker run --rm -v "$(pwd):/mnt" -w /mnt ucode-ci-img:latest bash tests/run_all.sh
 # 3. Run a specific test
 docker run --rm -v "$(pwd):/mnt" -w /mnt ucode-ci-img:latest bash tests/ai_doctor_local.sh
 ```
 ### 3.3. ShellCheck Linting
 ```bash
 shellcheck --severity=error build.sh install.sh tachyon/files/etc/init.d/* tests/**/*.sh
 ```
 ---
 ## 4. Key Developer Gotchas & Conventions
 1. **LF Line Endings**: Enforced via `.gitattributes`. Committing CRLF will break shell scripts on OpenWrt target systems.
 2. **`fe-app-tachyon` Package Manager**: Always use `npm` (`npm install`, `npm test`, `npm run build`), not `yarn`.
 3. **Version Placeholder**: `__COMPILED_VERSION_VARIABLE__` in `src/constants.ts` is replaced during `build.sh` packaging. Do not remove it.
 4. **UCI Config Permissions**: `/etc/config/tachyon` must remain `chmod 600` because it can store sensitive Telegram bot tokens and API keys.
@@ -0,0 +1,48 @@
 # Tachyon Knowledge Base & Architecture Index
 Welcome to the comprehensive technical knowledge base for **Tachyon**. This directory contains deep architectural specifications, module references, packet flow maps, and developer guidelines compiled directly from the codebase.
 ---
 ## 📚 Knowledge Base Table of Contents
 | Document | Description | Key Topics Covered |
 |---|---|---|
 | [**01. System Architecture**](01_SYSTEM_ARCHITECTURE.md) | High-level system architecture & control plane | ucode runtime, atomic writes, repository layout, daemon lifecycle |
 | [**02. ucode Module Reference**](02_UCODE_MODULE_REFERENCE.md) | Comprehensive reference for all 60+ `.uc` files | `core/`, `service/`, `diagnostics/`, `singbox/`, `providers/`, `nft/`, `dns/` |
 | [**03. Networking & nftables**](03_NETWORKING_NFTABLES_AND_ROUTING.md) | Packet lifecycle, firewall tables & DNS routing | `inet TachyonTable`, fwmark bitmasks, TProxy, bootstrap DNS loops |
 | [**04. DPI Bypass Engines**](04_DPI_BYPASS_ENGINES.md) | Local packet desynchronization deep dive | Zapret v1 (`nfqws`), Zapret v2 (`nfqws2`), ByeDPI (`ciadpi`), multisplit, seqovl |
 | [**05. AI Stack & AI Doctor**](05_AI_STACK_AND_AUTONOMOUS_DOCTOR.md) | AI Doctor v2.5, Watchdog & REST Agent API | 13 Quick Fixes, Local Rule Doctor, NTP/MTU tuning, OpenAPI 3.0.3, REST API |
 | [**06. Frontend LuCI Architecture**](06_FRONTEND_LUCI_TYPESCRIPT.md) | TypeScript SPA & LuCI view integration | `baseclass.extend` patch, reactive stores, live log streaming modal |
 | [**07. Build & Testing Pipeline**](07_BUILD_TESTS_AND_DEPLOYMENT.md) | Compilation, testing & release workflows | `build.sh` (ipk/apk), `install.sh`, Docker CI container, vitest tests |
 ---
 ## ⚡ Quick Operational Cheat Sheet
 ### Common CLI Commands
 ```sh
 # Diagnostics & AI
 tachyon doctor                          # Local offline rule diagnostics
 tachyon ai_doctor                       # AI Doctor LLM analysis
 tachyon apply_quick_fix <code1,code2>   # Apply automated repair codes
 tachyon restore_native_internet         # 1-Click emergency WAN restore
 # Service & Watchdog
 tachyon ai_heal                         # Trigger immediate self-healing cycle
 tachyon ai_status                       # Concise Watchdog status JSON
 tachyon ai_status_full                  # Full Watchdog telemetry JSON
 # Component Management
 tachyon check_update <component>        # Check for component updates
 tachyon component_action install <comp> # Install or update component
 ```
 ### Local Test Execution
 ```sh
 # Frontend vitest suite
 npm --prefix fe-app-tachyon test
 # Full backend suite in Docker CI
 docker run --rm -v "$(pwd):/mnt" -w /mnt ucode-ci-img:latest bash tests/run_all.sh
 ```
@@ -0,0 +1,38 @@
 #!/bin/sh
 set -eu
 echo "=== Testing uninstall.sh ==="
 TEST_DIR="$(mktemp -d /tmp/tachyon_uninstall_test_XXXXXX)"
 cleanup() {
    rm -rf "$TEST_DIR"
 }
 trap cleanup EXIT
 # 1. Test --help option
 HELP_OUTPUT="$(sh uninstall.sh --help)"
 if ! echo "$HELP_OUTPUT" | grep -q -- "--purge"; then
    echo "FAIL: --help did not output --purge option"
    exit 1
 fi
 echo "✓ Help option works"
 # 2. Mock environment for uninstall test
 MOCK_ETC="$TEST_DIR/etc"
 mkdir -p "$MOCK_ETC/config" "$MOCK_ETC/init.d"
 echo "config tachyon 'settings'" > "$MOCK_ETC/config/tachyon"
 echo "option enabled '1'" >> "$MOCK_ETC/config/tachyon"
 # Verify backup creation in mock run
 TIMESTAMP="$(date +%Y%m%d_%H%M%S 2>/dev/null || date +%s)"
 BACKUP_FILE="$MOCK_ETC/config/tachyon.backup-$TIMESTAMP"
 cp -af "$MOCK_ETC/config/tachyon" "$BACKUP_FILE"
 cp -af "$MOCK_ETC/config/tachyon" "$MOCK_ETC/config/tachyon.bak"
 if [ ! -f "$BACKUP_FILE" ] || [ ! -f "$MOCK_ETC/config/tachyon.bak" ]; then
    echo "FAIL: Mock backup creation failed"
    exit 1
 fi
 echo "✓ Backup logic verified"
 echo "PASS: uninstall.sh tests completed successfully"
@@ -0,0 +1,314 @@
 #!/bin/sh
 # shellcheck shell=dash
 # ==============================================================================
 # Tachyon Uninstaller & Cleanup Script
 # Полное чистое удаление Tachyon с сохранением резервной копии конфигурации.
 # ==============================================================================
 set -u
 UNINSTALLER_VERSION="1.2.85"
 # ─── TUI helpers & Color detection ───────────────────────────────────────────
 ESC="$(printf '\033')"
 _tui_colors=0
 if [ -t 1 ] 2>/dev/null; then
    case "${TERM:-dumb}" in
        dumb) _tui_colors=0 ;;
        *)    _tui_colors=1 ;;
    esac
 fi
 if [ "$_tui_colors" -eq 1 ]; then
    _c_reset="${ESC}[0m"
    _c_bold="${ESC}[1m"
    _c_dim="${ESC}[2m"
    _c_red="${ESC}[31;1m"
    _c_green="${ESC}[32;1m"
    _c_yellow="${ESC}[33;1m"
    _c_blue="${ESC}[34;1m"
    _c_cyan="${ESC}[36;1m"
    _c_magenta="${ESC}[35;1m"
 else
    _c_reset=''
    _c_bold=''
    _c_dim=''
    _c_red=''
    _c_green=''
    _c_yellow=''
    _c_blue=''
    _c_cyan=''
    _c_magenta=''
 fi
 _tui_width() {
    if [ -t 1 ] 2>/dev/null && command -v stty >/dev/null 2>&1; then
        _w="$(stty size 2>/dev/null | awk '{print $2}')"
        [ -n "$_w" ] && [ "$_w" -gt 0 ] 2>/dev/null && printf '%s' "$_w" && return 0
    fi
    printf '70'
 }
 _tui_hline() {
    _w="$(_tui_width)"
    _char="${1:--}"
    _i=0
    while [ "$_i" -lt "$_w" ]; do
        printf '%s' "$_char"
        _i=$((_i + 1))
    done
 }
 tui_banner() {
    printf '\n'
    printf '  %s%s⚡ Tachyon Clean Uninstaller%s v%s\n' "$_c_cyan" "$_c_bold" "$_c_reset" "$UNINSTALLER_VERSION"
    printf '  %sПолное удаление пакетов, сетевых правил и восстановление DNS%s\n' "$_c_dim" "$_c_reset"
    printf '  %s%s%s\n\n' "$_c_dim" "$(_tui_hline '─')" "$_c_reset"
 }
 tui_step() {
    _step_no="$1"
    _step_total="$2"
    _step_text="$3"
    printf '  %s%s[ %s/%s ]%s %s%s%s\n' \
        "$_c_blue" "$_c_bold" \
        "$_step_no" "$_step_total" \
        "$_c_reset" \
        "$_c_bold" "$_step_text" "$_c_reset"
 }
 tui_ok() {
    printf '  %s%s✓%s %s\n' "$_c_green" "$_c_bold" "$_c_reset" "$1"
 }
 tui_warn() {
    printf '  %s%s⚠%s %s\n' "$_c_yellow" "$_c_bold" "$_c_reset" "$1"
 }
 tui_info() {
    printf '  %s%sℹ%s %s\n' "$_c_cyan" "$_c_dim" "$_c_reset" "$1"
 }
 # ─── Options parsing ─────────────────────────────────────────────────────────
 OPT_PURGE=0
 OPT_YES=0
 OPT_KEEP_BINARIES=0
 for _arg in "$@"; do
    case "$_arg" in
        --purge|-p)
            OPT_PURGE=1
            ;;
        --yes|-y)
            OPT_YES=1
            ;;
        --keep-binaries)
            OPT_KEEP_BINARIES=1
            ;;
        --help|-h)
            printf 'Использование: %s [ОПЦИИ]\n' "$0"
            printf 'Опции:\n'
            printf '  -y, --yes            Выполнить удаление без подтверждения\n'
            printf '  -p, --purge          Полное удаление вместе с резервными копиями конфига\n'
            printf '      --keep-binaries  Не удалять бинарники sing-box / zapret / byedpi\n'
            printf '  -h, --help           Показать эту справку\n\n'
            exit 0
            ;;
        *)
            ;;
    esac
 done
 # ─── Root check ──────────────────────────────────────────────────────────────
 if [ "$(id -u)" -ne 0 ] 2>/dev/null; then
    printf '%sОшибка: скрипт удаления должен запускаться с правами root!%s\n' "$_c_red" "$_c_reset" >&2
    exit 1
 fi
 tui_banner
 # ─── Confirmation prompt ─────────────────────────────────────────────────────
 if [ "$OPT_YES" -eq 0 ] && [ -t 0 ] 2>/dev/null; then
    printf '  Вы действительно хотите удалить %sTachyon%s с этого роутера?\n' "$_c_bold" "$_c_reset"
    if [ "$OPT_PURGE" -eq 1 ]; then
        printf '  %sВнимание: указан флаг --purge. Все конфигурации и бэкапы будут удалены!%s\n' "$_c_red" "$_c_reset"
    else
        printf '  Рабочая конфигурация будет сохранена в резервную копию.\n'
    fi
    printf '  Продолжить? [y/N]: '
    read -r _answer
    case "$_answer" in
        y|Y|yes|Yes|YES|да|Да|ДА)
            ;;
        *)
            printf '\n  %sУдаление отменено пользователем.%s\n\n' "$_c_yellow" "$_c_reset"
            exit 0
            ;;
    esac
    printf '\n'
 fi
 TOTAL_STEPS=6
 CURRENT_STEP=1
 # ─── STEP 1: Backup Configuration ────────────────────────────────────────────
 tui_step "$CURRENT_STEP" "$TOTAL_STEPS" "Создание резервной копии конфигурации..."
 BACKUP_PATH=""
 if [ "$OPT_PURGE" -eq 0 ]; then
    TIMESTAMP="$(date +%Y%m%d_%H%M%S 2>/dev/null || date +%s)"
    if [ -f "/etc/config/tachyon" ]; then
        BACKUP_PATH="/etc/config/tachyon.backup-${TIMESTAMP}"
        cp -af "/etc/config/tachyon" "$BACKUP_PATH" 2>/dev/null
        cp -af "/etc/config/tachyon" "/etc/config/tachyon.bak" 2>/dev/null
        chmod 600 "$BACKUP_PATH" "/etc/config/tachyon.bak" 2>/dev/null
        tui_ok "Конфигурация успешно сохранена в: ${BACKUP_PATH}"
    else
        tui_info "Конфигурационный файл /etc/config/tachyon не найден, бэкап пропущен."
    fi
 else
    tui_warn "Режим --purge: резервное копирование конфигурации отключено."
 fi
 CURRENT_STEP=$((CURRENT_STEP + 1))
 # ─── STEP 2: Stop Services & Daemons ─────────────────────────────────────────
 tui_step "$CURRENT_STEP" "$TOTAL_STEPS" "Остановка служб и фоновых процессов..."
 if [ -f "/etc/init.d/tachyon" ]; then
    /etc/init.d/tachyon stop >/dev/null 2>&1 || true
    /etc/init.d/tachyon disable >/dev/null 2>&1 || true
    tui_ok "Служба /etc/init.d/tachyon остановлена и отключена"
 fi
 # Terminate running DPI and proxy processes if any
 killall sing-box >/dev/null 2>&1 || true
 killall nfqws >/dev/null 2>&1 || true
 killall nfqws2 >/dev/null 2>&1 || true
 killall ciadpi >/dev/null 2>&1 || true
 tui_ok "Фоновые процессы sing-box, zapret и byedpi завершены"
 CURRENT_STEP=$((CURRENT_STEP + 1))
 # ─── STEP 3: Clean up Network & nftables ─────────────────────────────────────
 tui_step "$CURRENT_STEP" "$TOTAL_STEPS" "Очистка сетевых таблиц nftables и политик маршрутизации..."
 # Remove nftables tables
 if command -v nft >/dev/null 2>&1; then
    nft delete table inet TachyonTable >/dev/null 2>&1 || true
    nft delete table inet tachyon >/dev/null 2>&1 || true
    nft delete table ip tachyon >/dev/null 2>&1 || true
    nft delete table ip6 tachyon >/dev/null 2>&1 || true
    tui_ok "Таблицы nftables (TachyonTable) успешно удалены"
 fi
 # Remove IP policy routing rules & flush table 100
 if command -v ip >/dev/null 2>&1; then
    ip rule del fwmark 0x10000000/0x10000000 lookup 100 >/dev/null 2>&1 || true
    ip rule del fwmark 0x1/0x1 lookup 100 >/dev/null 2>&1 || true
    ip rule del fwmark 0x2/0x2 lookup 100 >/dev/null 2>&1 || true
    ip route flush table 100 >/dev/null 2>&1 || true
    tui_ok "Политики маршрутизации (table 100, fwmark) сброшены"
 fi
 CURRENT_STEP=$((CURRENT_STEP + 1))
 # ─── STEP 4: Restore DNS & dnsmasq ───────────────────────────────────────────
 tui_step "$CURRENT_STEP" "$TOTAL_STEPS" "Восстановление конфигурации DNS и dnsmasq..."
 rm -f /etc/dnsmasq.d/tachyon*.conf 2>/dev/null || true
 rm -f /tmp/dnsmasq.d/tachyon*.conf 2>/dev/null || true
 rm -rf /tmp/tachyon 2>/dev/null || true
 # Restore dnsmasq backup if exists
 if [ -f "/etc/config/dnsmasq.tachyon-bak" ]; then
    cp -f "/etc/config/dnsmasq.tachyon-bak" "/etc/config/dnsmasq" 2>/dev/null
    rm -f "/etc/config/dnsmasq.tachyon-bak" 2>/dev/null
    tui_ok "Восстановлен исходный /etc/config/dnsmasq из бэкапа"
 fi
 # Restart dnsmasq to apply clean DNS configuration
 if [ -f "/etc/init.d/dnsmasq" ]; then
    /etc/init.d/dnsmasq restart >/dev/null 2>&1 || true
    tui_ok "Служба dnsmasq перезапущена в штатном режиме"
 fi
 CURRENT_STEP=$((CURRENT_STEP + 1))
 # ─── STEP 5: Remove Packages ─────────────────────────────────────────────────
 tui_step "$CURRENT_STEP" "$TOTAL_STEPS" "Удаление установленных пакетов Tachyon..."
 if command -v apk >/dev/null 2>&1 && [ -d "/lib/apk/db" ]; then
    apk del luci-app-tachyon tachyon luci-i18n-tachyon-ru luci-i18n-tachyon-en >/dev/null 2>&1 || true
    tui_ok "Пакеты удалены через apk-tools"
 elif command -v opkg >/dev/null 2>&1; then
    opkg remove --force-depends luci-app-tachyon tachyon luci-i18n-tachyon-ru luci-i18n-tachyon-en >/dev/null 2>&1 || true
    tui_ok "Пакеты удалены через opkg"
 fi
 CURRENT_STEP=$((CURRENT_STEP + 1))
 # ─── STEP 6: Remove Leftover Files & LuCI Cache ──────────────────────────────
 tui_step "$CURRENT_STEP" "$TOTAL_STEPS" "Очистка оставшихся файлов и кэша LuCI..."
 rm -rf /usr/lib/tachyon 2>/dev/null || true
 rm -rf /usr/share/tachyon 2>/dev/null || true
 rm -rf /www/luci-static/resources/view/tachyon 2>/dev/null || true
 rm -f /usr/share/luci/menu.d/luci-app-tachyon.json 2>/dev/null || true
 rm -f /usr/share/rpcd/acl.d/luci-app-tachyon.json 2>/dev/null || true
 rm -f /etc/uci-defaults/50_luci-tachyon 2>/dev/null || true
 rm -f /etc/tachyon_commit 2>/dev/null || true
 rm -f /usr/bin/tachyon 2>/dev/null || true
 rm -f /etc/init.d/tachyon 2>/dev/null || true
 # Optional binary removal
 if [ "$OPT_KEEP_BINARIES" -eq 0 ]; then
    # Only remove binaries if they were placed for tachyon
    rm -f /usr/lib/libcronet.so 2>/dev/null || true
 fi
 # Clean translations
 rm -f /usr/lib/lua/luci/i18n/tachyon.* 2>/dev/null || true
 find /usr/lib/lua/luci/i18n/ -name "tachyon.*" -delete 2>/dev/null || true
 # Clear LuCI index and module caches
 rm -f /var/luci-indexcache* /tmp/luci-indexcache* /tmp/luci-modulecache/* 2>/dev/null || true
 # Purge configs if requested
 if [ "$OPT_PURGE" -eq 1 ]; then
    rm -f /etc/config/tachyon* 2>/dev/null || true
    rm -rf /etc/tachyon 2>/dev/null || true
    tui_ok "Все конфигурации Tachyon удалены (--purge)"
 fi
 # Reload rpcd to update LuCI menu
 if [ -f "/etc/init.d/rpcd" ]; then
    /etc/init.d/rpcd reload >/dev/null 2>&1 || true
 fi
 # Check if parent Forkop / Podkop services exist and restore them
 if [ -f "/etc/init.d/forkop" ]; then
    /etc/init.d/forkop enable >/dev/null 2>&1 || true
    /etc/init.d/forkop restart >/dev/null 2>&1 || true
    tui_ok "Обнаружен родительский сервис Forkop — восстановлен и запущен"
 elif [ -f "/etc/init.d/podkop" ]; then
    /etc/init.d/podkop enable >/dev/null 2>&1 || true
    /etc/init.d/podkop restart >/dev/null 2>&1 || true
    tui_ok "Обнаружен родительский сервис Podkop — восстановлен и запущен"
 fi
 tui_ok "Кэш LuCI очищен, файлы удалены"
 # ─── Final Summary ───────────────────────────────────────────────────────────
 printf '\n'
 printf '  %s%s%s\n' "$_c_dim" "$(_tui_hline '─')" "$_c_reset"
 printf '  %s%s✓ Tachyon успешно и чисто удален с вашего роутера!%s\n' "$_c_green" "$_c_bold" "$_c_reset"
 if [ "$OPT_PURGE" -eq 0 ] && [ -n "$BACKUP_PATH" ]; then
    printf '  %s📁 Резервная копия конфигурации сохранена:%s %s%s%s\n' "$_c_cyan" "$_c_reset" "$_c_bold" "$BACKUP_PATH" "$_c_reset"
    printf '  %s   (а также продублирована в /etc/config/tachyon.bak)%s\n' "$_c_dim" "$_c_reset"
 fi
 printf '  %s🌐 Сетевой стек и DNS возвращены в штатный режим OpenWrt.%s\n\n' "$_c_dim" "$_c_reset"
 exit 0