- initd.uc: retry_start_on_wan_up now calls BIN_PATH directly instead of
SERVICE_INIT to avoid the rc.common flock-1000 self-deadlock that was
hanging Backend CI for the full 1-hour runner timeout
- initd.uc: schedule_start_retry uses background_command() so inherited
fd 1000 (procd lock) is closed before the sleep starts
- updates.uc, parental_quota.uc: read /etc/crontabs/root via fs.readfile
instead of crontab -l — BusyBox exits 1 on an empty file causing
command_output_from_args to return '' and wipe all user cron entries
- shell/index.ts: COMPONENT_ACTION_RPC_TIMEOUT_MS 10s -> 45s to prevent
false RPC timeout errors during opkg installs on slow routers
- Feat(ui): implement adaptive polling in runtimeUiState service (1s -> 2s during active tasks, 10s idle)
- Perf(controller): cache settings snapshot in current_tick_ctx across all probe setting() calls to eliminate repeated uci_core.get_all()
- Perf(controller): reuse ctx.proxy_port in probe_proxy to eliminate duplicate proxy_port() evaluation
- Perf(watchdog): guard adaptive_normal_interval behind 120s check and clear tick context at tick boundary
- Test: add static and behavioral assertions in tests/watchdog_adaptive_intervals.sh
- Perf(watchdog): Adaptive external health checks for proxy (30s) and DNS (60s)
* Honor UCI ai_proxy_health_interval and ai_dns_interval while healthy
* Adapt to fast retry (10-15s) upon consecutive failures, instant post-heal reset
* Single shared observation context (tick_context) per tick eliminating redundant pgrep/proc scans
* Throttle watchdog keepalive file writes from 5s to 30s
- Perf(ui): Read-only fast path for get_ui_state
* Decouple refresh_action_dirs() filesystem GC from 500ms polling requests
* Throttle action directory cleanup to once per 30s via /var/run stamp
* Trigger immediate GC sweep on action job completion
- Perf(telegram): Long-poll 50s and eliminate redundant sleep after success
* Increase getUpdates long-poll timeout to 50s (curl timeout 65s)
* Remove redundant sleep after successful poll for instant command responsiveness
- Perf(torrserver): Cache detected PID and replace shell sleep with native ucode sleep(60000)
- Fix(singbox): Remove harmful hijack-dns rules from mixed proxy inbounds
* Eliminate hijack-dns (port 53 / protocol dns) from section, direct bypass and service mixed proxies
* Resolve 4-5s curl timeouts on component updates (api.github.com) and slow LAN DNS resolution
* Maintain ip_is_private: true direct LAN routing bypass
- Test: Add tests/watchdog_adaptive_intervals.sh and update tests/sing_box_runtime.sh
- Version: Bump fe-app-tachyon to 1.3.27
Replace brittle grep | head pipelines with assert_contains and direct grep flags to prevent pipefail SIGPIPE exit code 141 in OpenWrt container test runs.
- Preserve raw Cloudflare subnets in community-subnets-discord.lst in updates.uc instead of destructive deletion.
- In singbox/generator_routes.uc:
* Exclude Cloudflare Anycast CIDRs from general IP route rules (preventing web hijacking).
* Generate a dedicated Discord Voice route rule for Cloudflare subnets scoped to network: 'udp' and voice port ranges (50000-65535, 3478, 19302, 5000-5020).
* Provide DEFAULT_DISCORD_VOICE_SUBNETS fallback in core/ip.uc.
- In nft/apply.uc:
* Route Cloudflare subnets to ip_ports set with Discord voice ports (5000-5020, 3478, 19302, 50000-65535).
* Automatically enable ip_port rules when section has community_subnets for Discord.
- In section.js (Routing Rule Tracer):
* Filter out Cloudflare subnets when resolving domain web traffic to Discord community subnets.
* Accurately display voice UDP routing notice for Anycast ranges.
- Update tests/community_subnets_sanitization.sh with voice UDP and sing-box validation.
Fixes regression from 1.3.25 where section mixed proxy inbounds lost internet access due to missing DNS hijacking and missing private IP bypass, and suppresses noisy log warnings during service restart/update.
- Unblock devices when admin increases daily_quota_minutes in parental_quota.uc
- Unblock devices removed from active quota schedules and flush sets on disable
- Ignore target != 'all' schedules in parental_quota.uc screen-time dropper
- Do not suppress domain DNS reject or nft redirect rules when quota is set
- Run parental_quota.uc tick on service start and reload for instant sync
- Add target:all dependency to daily_quota_minutes in LuCI parental view
- Add tests in content_blocking.sh and parental_control.sh
- Optimize get_ui_state backend by reading /proc natively instead of spawning pidof
- Avoid spawning readlink and redundant ubus queries in state.uc
- Cache positive tachyon_runtime_network_configured checks for 5s
- Back off idle UI state polling interval from 3s to 10s (60s when tab is hidden)
- Back off TachyonLogWatcher interval to 30s
- Pause Dashboard and Monitoring polling when browser tab is inactive (Page Visibility API)
- Fix cleanTabId to ensure inactive tab pollers and timers unmount properly
- Fix#52: Watchdog proxy restart on single URL failure:
* Validate failure against secondary independent probe URL before declaring proxy down
* Skip restart when direct WAN is also degraded or down (!direct_ok)
* Implement 120s cooldown between automated proxy restarts
* Fix Telegram notification to accurately state 'Перезапуск sing-box' instead of 'Перезапуск роутера'
- Fix#51: Telegram bot spamming WAN up/down notifications:
* Filter hotplug events strictly by badwan_monitored_interfaces (defaults to wan)
* Add atomic directory lock with debounce delay and real ubus state query
* Prevent repeated notifications when interface state has not transitioned
- Feat: 2-VPN deadlock elimination & self-download subscription proxy:
* Isolate unbootstrapped dependent subscription sections on initial boot (deferred_sections)
* Allow self-download proxy target for subscriptions with explicit UI hint '(текущее правило при активности)'
* Enable automatic local proxy fallback for subscription refresh when direct WAN download fails while sing-box is active
* Add regression test in tests/subscription_bootstrap_deadlock.sh
- Fix: Parental control quota enforcement:
* Correct route rule filtering when daily quota minutes are exhausted without a fixed time interval
- i18n & Version bump:
* Bump fe-app-tachyon to 1.3.26 and update Russian PO/POT translations
- Wrap test-all button in a clean sections header with Lucide route icon and localized title
- Remove loose inline styles and align button with card grid boundaries
- Add responsive wrapping for mobile displays
- Add Russian localization for Routing sections
- Rebuild LuCI frontend bundle
- Fix -1ms badge and green coloring in dashboard sections when node latency check fails or returns -1
- Handle Clash API group delay responses properly in dashboard single and batch latency tests
- Target active outbound node in diagnostics outbounds check instead of group tag to prevent router timeout
- Add nslookup fallback in country.uc resolve_service_host and retain system DNS resolution
- Ensure flag emoji country deduction acts as fallback in URLTest groups when exclude_countries is specified
- Ignore processes in container network namespaces when diagnosing system port 53 / DNS conflicts for AdGuardHome
- Bump fe-app-tachyon version to 1.3.25 and rebuild LuCI bundle
- Replace invalid POSIX non-capturing group in diagnostics/runtime.uc with standard POSIX ERE pattern.
- Harden 99-tachyon-wan-monitor with stale PID directory lock cleanup and dynamic badwan_reload_delay support.
- Make is_cloudflare_shared_cidr in core/ip.uc case-insensitive.
- Add default wan to badwan_monitored_interfaces in settings.js.
- Fix#50: Discord community subnets hijacking Cloudflare Anycast traffic:
* Filter broad Cloudflare shared subnets (104.16.0.0/12, 172.64.0.0/13, etc.) for Discord preset in generator_routes.uc, nft/apply.uc, and updates.uc.
* Add tachyon resolve_domain CLI and runtime.uc helper for DNS queries with rpcd ACL support.
* Update LuCI Routing Rule Tracer to resolve queried domains against section subnets/CIDRs (including community subnets) and show shared CDN/Anycast warnings.
* Add unit tests in tests/community_subnets_sanitization.sh.
- Fix#51: Telegram bot spamming WAN up/down notifications on hotplug:
* Check enable_badwan_interface_monitoring, telegram.enabled, and badwan_monitored_interfaces list in 99-tachyon-wan-monitor.
* Add background debounce with atomic directory locking and ubus interface status verification.
* Implement state transition tracking to only notify on actual UP->DOWN and DOWN->UP changes without duplicates.
* Preserve retry_start_on_wan_up behavior on ifup.
* Add comprehensive integration test suite in tests/wan_monitor_hotplug.sh.
- runZapret2Check: add routes_configured check item (8th)
- runProviderChecks.test: update tests for route rules verification
- apply.uc: remove sec_mark override for zapret/zapret2 in priority_rules
Previously zapret/zapret2 sections with ports/subnets had sec_mark
overridden to 0x02000000+idx in prerouting, causing packets to bypass
TPROXY sing-box and go to NFQUEUE in mangle_forward (pre-NAT). Fakes
had grey LAN IPs and were dropped by ISP. Now all sections use
fakeip_mark (0x04000000) → TPROXY → sing-box outbound with routing_mark
→ mangle_output (post-NAT) → NFQUEUE with public WAN IP.
- fix(singbox): fix http_clients[0].detour field name (was incorrectly dial_detour, causing fatal decode config unknown field error on sing-box 1.14+)
- fix(ui): rename community list 'Block' to 'Block (RKN)' / 'Реестр РКН' in DOMAIN_LIST_OPTIONS and PO catalogs to prevent confusion with parental control action 'Блокировать'
- fix(ui): fix domain hint for adult content to pornhub.com in section.js
- test(ruleset): update http_clients detour check in ruleset_download_detour.sh
- fix(zapret2): add safe_str fallback and avoid default --filter-tcp=443 injection on UDP rules in prepare_strategy_args()
- fix(providers): make individual rule failures non-fatal in start_runtime() so one bad rule does not rollback all running rules
- fix(binaries): dynamic candidate resolution for nfqws and nfqws2 across standard OpenWrt and custom paths (/opt/zapret2/nfq2, /opt/zapret2/nfq, /opt/zapret2, /usr/bin)
- fix(nft): add raw_output notrack chain and mangle_output/forward counter return rules for desync marks (0x40000000, 0x20000000) and musl/nobody skuid (2147483647, 65534) to prevent EPERM rawsend failure on reload
- fix(reload): ensure nft_rebuild is triggered on zapret and zapret2 runtime updates
- fix(singbox): reject mieru outbounds from rule_set download_detour and http_clients dial_detour to prevent fatal startup crash loop
- fix(singbox): detect sing-box 1.14+ and omit deprecated download_detour on remote rule-sets when http_clients is active
- fix(action): pre-seed /etc/config/zapret2 with enabled=0 via core.uci before package install to prevent conflicting upstream daemon startup
- test(ruleset): add verification tests for mieru download_detour and dial_detour rejection
- fix(updater): support single release JSON object for specific tag queries and unblock prereleases on explicit selection
- fix(action): replace wget --header with -U for uclient-fetch compatibility on OpenWrt 23.05
- fix(action): make package list updates best-effort to prevent failures on snapshot kmod feeds
- fix(action): add offline/corrupt extract fallbacks (apk extract and opkg data.tar.gz) for kernel dependency mismatch
- fix(action): ensure /var/lock and /tmp/run directories exist before opkg/procd operations
- fix(action): fix fallback asset URL pattern for remittor zapret releases
- fix(packages): add binary presence and --version detection fallbacks for zapret, zapret2, byedpi, sing-box
- fix(byedpi): support direct apk list parsing for installed package version
- fix(state): include schedule, profile, and guest_mode in reload state signatures
- fix(imports): fix missing command_status_from_args, write_json, and remove_file imports
- fix(updates): extract meaningful ucode errors and strip trailing caret lines
- fix(validator): add missing profiles parameter to validate_schedule() that caused ReferenceError crash preventing Tachyon startup when profiles/schedules enabled
- fix(nft): return empty intervals for 24/7 schedules instead of meta hour 00:00-23:59, eliminating always-true match and fixing DNS block rules that generated zero rules for always-on schedules
- fix(nft): add nft_add_rule return value checks and logging for DOH block and schedule rules
- fix(parental_quota): replace fragile shell heredoc nft -f with individual nft add set commands, add error logging for set creation and rule insertion
- fix(watchdog): anchor pkill logread pattern with $ to avoid killing system logremote/logfile processes that have extra flags (-r/-F)
- fix(action): replace killall logread with anchored pkill -f 'logread -f$' to preserve system syslog daemons
Dushnilin