- Perf(watchdog): Adaptive external health checks for proxy (30s) and DNS (60s)
* Honor UCI ai_proxy_health_interval and ai_dns_interval while healthy
* Adapt to fast retry (10-15s) upon consecutive failures, instant post-heal reset
* Single shared observation context (tick_context) per tick eliminating redundant pgrep/proc scans
* Throttle watchdog keepalive file writes from 5s to 30s
- Perf(ui): Read-only fast path for get_ui_state
* Decouple refresh_action_dirs() filesystem GC from 500ms polling requests
* Throttle action directory cleanup to once per 30s via /var/run stamp
* Trigger immediate GC sweep on action job completion
- Perf(telegram): Long-poll 50s and eliminate redundant sleep after success
* Increase getUpdates long-poll timeout to 50s (curl timeout 65s)
* Remove redundant sleep after successful poll for instant command responsiveness
- Perf(torrserver): Cache detected PID and replace shell sleep with native ucode sleep(60000)
- Fix(singbox): Remove harmful hijack-dns rules from mixed proxy inbounds
* Eliminate hijack-dns (port 53 / protocol dns) from section, direct bypass and service mixed proxies
* Resolve 4-5s curl timeouts on component updates (api.github.com) and slow LAN DNS resolution
* Maintain ip_is_private: true direct LAN routing bypass
- Test: Add tests/watchdog_adaptive_intervals.sh and update tests/sing_box_runtime.sh
- Version: Bump fe-app-tachyon to 1.3.27
- Optimize get_ui_state backend by reading /proc natively instead of spawning pidof
- Avoid spawning readlink and redundant ubus queries in state.uc
- Cache positive tachyon_runtime_network_configured checks for 5s
- Back off idle UI state polling interval from 3s to 10s (60s when tab is hidden)
- Back off TachyonLogWatcher interval to 30s
- Pause Dashboard and Monitoring polling when browser tab is inactive (Page Visibility API)
- Fix cleanTabId to ensure inactive tab pollers and timers unmount properly
- Fix#52: Watchdog proxy restart on single URL failure:
* Validate failure against secondary independent probe URL before declaring proxy down
* Skip restart when direct WAN is also degraded or down (!direct_ok)
* Implement 120s cooldown between automated proxy restarts
* Fix Telegram notification to accurately state 'Перезапуск sing-box' instead of 'Перезапуск роутера'
- Fix#51: Telegram bot spamming WAN up/down notifications:
* Filter hotplug events strictly by badwan_monitored_interfaces (defaults to wan)
* Add atomic directory lock with debounce delay and real ubus state query
* Prevent repeated notifications when interface state has not transitioned
- Feat: 2-VPN deadlock elimination & self-download subscription proxy:
* Isolate unbootstrapped dependent subscription sections on initial boot (deferred_sections)
* Allow self-download proxy target for subscriptions with explicit UI hint '(текущее правило при активности)'
* Enable automatic local proxy fallback for subscription refresh when direct WAN download fails while sing-box is active
* Add regression test in tests/subscription_bootstrap_deadlock.sh
- Fix: Parental control quota enforcement:
* Correct route rule filtering when daily quota minutes are exhausted without a fixed time interval
- i18n & Version bump:
* Bump fe-app-tachyon to 1.3.26 and update Russian PO/POT translations
- Wrap test-all button in a clean sections header with Lucide route icon and localized title
- Remove loose inline styles and align button with card grid boundaries
- Add responsive wrapping for mobile displays
- Add Russian localization for Routing sections
- Rebuild LuCI frontend bundle
- Fix -1ms badge and green coloring in dashboard sections when node latency check fails or returns -1
- Handle Clash API group delay responses properly in dashboard single and batch latency tests
- Target active outbound node in diagnostics outbounds check instead of group tag to prevent router timeout
- Add nslookup fallback in country.uc resolve_service_host and retain system DNS resolution
- Ensure flag emoji country deduction acts as fallback in URLTest groups when exclude_countries is specified
- Ignore processes in container network namespaces when diagnosing system port 53 / DNS conflicts for AdGuardHome
- Bump fe-app-tachyon version to 1.3.25 and rebuild LuCI bundle
- Fix#50: Discord community subnets hijacking Cloudflare Anycast traffic:
* Filter broad Cloudflare shared subnets (104.16.0.0/12, 172.64.0.0/13, etc.) for Discord preset in generator_routes.uc, nft/apply.uc, and updates.uc.
* Add tachyon resolve_domain CLI and runtime.uc helper for DNS queries with rpcd ACL support.
* Update LuCI Routing Rule Tracer to resolve queried domains against section subnets/CIDRs (including community subnets) and show shared CDN/Anycast warnings.
* Add unit tests in tests/community_subnets_sanitization.sh.
- Fix#51: Telegram bot spamming WAN up/down notifications on hotplug:
* Check enable_badwan_interface_monitoring, telegram.enabled, and badwan_monitored_interfaces list in 99-tachyon-wan-monitor.
* Add background debounce with atomic directory locking and ubus interface status verification.
* Implement state transition tracking to only notify on actual UP->DOWN and DOWN->UP changes without duplicates.
* Preserve retry_start_on_wan_up behavior on ifup.
* Add comprehensive integration test suite in tests/wan_monitor_hotplug.sh.
- runZapret2Check: add routes_configured check item (8th)
- runProviderChecks.test: update tests for route rules verification
- apply.uc: remove sec_mark override for zapret/zapret2 in priority_rules
Previously zapret/zapret2 sections with ports/subnets had sec_mark
overridden to 0x02000000+idx in prerouting, causing packets to bypass
TPROXY sing-box and go to NFQUEUE in mangle_forward (pre-NAT). Fakes
had grey LAN IPs and were dropped by ISP. Now all sections use
fakeip_mark (0x04000000) → TPROXY → sing-box outbound with routing_mark
→ mangle_output (post-NAT) → NFQUEUE with public WAN IP.
- fix(singbox): fix http_clients[0].detour field name (was incorrectly dial_detour, causing fatal decode config unknown field error on sing-box 1.14+)
- fix(ui): rename community list 'Block' to 'Block (RKN)' / 'Реестр РКН' in DOMAIN_LIST_OPTIONS and PO catalogs to prevent confusion with parental control action 'Блокировать'
- fix(ui): fix domain hint for adult content to pornhub.com in section.js
- test(ruleset): update http_clients detour check in ruleset_download_detour.sh
- fix(updater): support single release JSON object for specific tag queries and unblock prereleases on explicit selection
- fix(action): replace wget --header with -U for uclient-fetch compatibility on OpenWrt 23.05
- fix(action): make package list updates best-effort to prevent failures on snapshot kmod feeds
- fix(action): add offline/corrupt extract fallbacks (apk extract and opkg data.tar.gz) for kernel dependency mismatch
- fix(action): ensure /var/lock and /tmp/run directories exist before opkg/procd operations
- fix(action): fix fallback asset URL pattern for remittor zapret releases
- fix(packages): add binary presence and --version detection fallbacks for zapret, zapret2, byedpi, sing-box
- fix(byedpi): support direct apk list parsing for installed package version
- fix(state): include schedule, profile, and guest_mode in reload state signatures
- fix(imports): fix missing command_status_from_args, write_json, and remove_file imports
- fix(updates): extract meaningful ucode errors and strip trailing caret lines
- feat(diagnostics): router-level IP & DNS leak detection
* одновременный опрос прямого WAN сокета (SO_MARK 0x08000000) и локального прокси (127.0.0.1:4534)
* выявление утечки реального публичного IP адреса
* тестирование восходящих DNS-резолверов по протоколу bash.ws и обнаружение DNS провайдера
* CLI команды: tachyon leak_check [--pretty], check_ip_leak, check_dns_leak
* LuCI модальное окно с детализированными таблицами изоляции IP и анализа резолверов
- fix(hosts): устранение ложного предупреждения [warn] No hosts list URLs configured
* запуск HOSTS_UC в lifecycle.uc только при наличии активных списков хостов
* hosts.uc возвращает success:true и код 0 без лишних записей в syslog при отсутствии URL
* добавлена проверка has-hosts-list-update-sources в state.uc
- i18n: полная синхронизация русской локализации в каталогах gettext PO/POT
- bump: версия пакета 1.3.24
- Fix package postrm scripts to strictly require \ to be 'remove' or 'purge' before running cleanup, preventing destructive cleanup when opkg runs postrm with empty arguments during reinstalls/upgrades.
- In action.uc install_files, ensure tachyon backend package is installed before luci-app-tachyon to prevent opkg dependency removal races.
- In action.uc install_zapret2, ensure ::1 localhost exists in /etc/hosts before package installation to prevent nftables IPv6 resolution errors, and cleanly stop/disable standalone zapret2 daemon.
- In zapret2 provider common.uc and nfqueue runtime.uc, automatically resolve required blob binary payloads and default filter parameters for strategies.
- In fe-app-tachyon, add 'access denied' / 'Доступ запрещён' to transient RPC error patterns and track install_version as self-update so rpcd reload during self-update does not abort the progress modal with an error.
- In tests/package_lifecycle.sh, avoid grep -q in pipefail pipelines to prevent upstream SIGPIPE failures.
- Ensure selector and urltest groups require all member outbounds to support UDP
- Add explicit reject rule for UDP on non-UDP outbounds to avoid sing-box router log spam
- Add http/s:// to connection URL description in LuCI settings and update localization
- Display transport protocol badges on dashboard outbound cards and modal rows
- Deduplicate and collapse UDP routing error lines in telegram logs and bug report
- subscription: детерминированная сортировка аутбаундов при расчете сигнатуры кэша (защита от перезапусков при shuffle)
- dns: порог последовательных ошибок dns_failover_failure_threshold (защита от флаппинга)
- singbox: выделенный direct_bypass inbound (mixed port 2080) для прямого выхода устройств в обход TPROXY
- torrserver: автоматический bypass cgroups v2 services/torrserver прямо в WAN
- zapret: нормализация устаревших параметров conntrack --ctrack-timeouts
- ui: интеграция управления службами TorrServer Direct и Direct Proxy в LuCI
- tests: новые тесты subscription_order_independence и direct_bypass_torrserver
- backend: добавлены команды list_update_async и list_update_status с отслеживанием шагов в /var/run/tachyon/list-update.status
- ui: кнопка ручного обновления списков теперь запускает операцию в фоне, показывает модалку с индикатором и опрашивает статус (устранен таймаут LuCI XHR в 30 сек)
- json: sing-box config.json теперь форматируется с отступами в 2 пробела (sprintf '%.2J') для удобства чтения
- tests: обновлены тесты и добавлены проверки для list-update-status (122/122 passed)
Dushnilin