feat: Surge 支持 client-cert

xream · xream · commit 27e7fa392828 · 2026-05-18T02:38:09.000+08:00
diff --git a/backend/package.json b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "sub-store",
-  "version": "2.23.11",
+  "version": "2.23.13",
   "description": "Advanced Subscription Manager for QX, Loon, Surge, Stash and Shadowrocket.",
   "main": "src/main.js",
   "packageManager": "pnpm@11.0.9",
diff --git a/backend/src/core/proxy-utils/parsers/peggy/surge.js b/backend/src/core/proxy-utils/parsers/peggy/surge.js
@@ -326,7 +326,7 @@ shadowsocks = tag equals "ss" address (method/passwordk/obfs/obfs_host/obfs_uri/
     }
     handleShadowTLS();
 }
-vmess = tag equals "vmess" address (vmess_uuid/vmess_aead/ws/ws_path/ws_headers/method/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls/sni/tls_fingerprint/tls_verification/fast_open/tfo/udp_relay/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
+vmess = tag equals "vmess" address (vmess_uuid/vmess_aead/ws/ws_path/ws_headers/method/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls/sni/tls_fingerprint/tls_verification/client_cert/fast_open/tfo/udp_relay/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
     proxy.type = "vmess";
     proxy.cipher = proxy.cipher || "none";
     // Surfboard 与 Surge 默认不一致, 不管 Surfboard https://getsurfboard.com/docs/profile-format/proxy/external-proxy/vmess
@@ -338,17 +338,17 @@ vmess = tag equals "vmess" address (vmess_uuid/vmess_aead/ws/ws_path/ws_headers/
     handleWebsocket();
     handleShadowTLS();
 }
-trojan = tag equals "trojan" address (passwordk/ws/ws_path/ws_headers/tls/sni/tls_fingerprint/tls_verification/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/tfo/udp_relay/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
+trojan = tag equals "trojan" address (passwordk/ws/ws_path/ws_headers/tls/sni/tls_fingerprint/tls_verification/client_cert/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/tfo/udp_relay/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
     proxy.type = "trojan";
     handleWebsocket();
     handleShadowTLS();
 }
-https = tag equals "https" address (username password)? (usernamek passwordk)? (headers/sni/tls_fingerprint/tls_verification/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/tfo/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
+https = tag equals "https" address (username password)? (usernamek passwordk)? (headers/sni/tls_fingerprint/tls_verification/client_cert/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/tfo/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
     proxy.type = "http";
     proxy.tls = true;
     handleShadowTLS();
 }
-h2_connect = tag equals "h2-connect" address (username password)? (usernamek passwordk)? (headers/sni/tls_fingerprint/tls_verification/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/tfo/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
+h2_connect = tag equals "h2-connect" address (username password)? (usernamek passwordk)? (headers/sni/tls_fingerprint/tls_verification/client_cert/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/tfo/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
     proxy.type = "h2-connect";
     proxy.tls = true;
     handleShadowTLS();
@@ -371,11 +371,11 @@ snell = tag equals "snell" address (snell_version/snell_psk/obfs/obfs_host/obfs_
     }
     handleShadowTLS();
 }
-tuic = tag equals "tuic" address (alpn/token/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls_fingerprint/tls_verification/sni/fast_open/tfo/ecn/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/port_hopping_interval/others)* {
+tuic = tag equals "tuic" address (alpn/token/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls_fingerprint/tls_verification/client_cert/sni/fast_open/tfo/ecn/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/port_hopping_interval/others)* {
     proxy.type = "tuic";
     handleShadowTLS();
 }
-tuic_v5 = tag equals "tuic-v5" address (alpn/passwordk/uuidk/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls_fingerprint/tls_verification/sni/fast_open/tfo/ecn/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/port_hopping_interval/others)* {
+tuic_v5 = tag equals "tuic-v5" address (alpn/passwordk/uuidk/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls_fingerprint/tls_verification/client_cert/sni/fast_open/tfo/ecn/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/port_hopping_interval/others)* {
     proxy.type = "tuic";
     proxy.version = 5;
     handleShadowTLS();
@@ -384,24 +384,24 @@ wireguard = tag equals "wireguard" (section_name/no_error_alert/ip_version/under
     proxy.type = "wireguard-surge";
     handleShadowTLS();
 }
-hysteria2 = tag equals "hysteria2" address (no_error_alert/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/sni/tls_verification/passwordk/tls_fingerprint/download_bandwidth/ecn/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/port_hopping_interval/salamander_password/others)* {
+hysteria2 = tag equals "hysteria2" address (no_error_alert/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/sni/tls_verification/client_cert/passwordk/tls_fingerprint/download_bandwidth/ecn/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/port_hopping_interval/salamander_password/others)* {
     proxy.type = "hysteria2";
     handleShadowTLS();
 }
 socks5 = tag equals "socks5" address (username password)? (usernamek passwordk)? (udp_relay/no_error_alert/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/fast_open/tfo/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
     proxy.type = "socks5";
     handleShadowTLS();
 }
-socks5_tls = tag equals "socks5-tls" address (username password)? (usernamek passwordk)? (udp_relay/no_error_alert/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/sni/tls_fingerprint/tls_verification/fast_open/tfo/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
+socks5_tls = tag equals "socks5-tls" address (username password)? (usernamek passwordk)? (udp_relay/no_error_alert/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/sni/tls_fingerprint/tls_verification/client_cert/fast_open/tfo/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
     proxy.type = "socks5";
     proxy.tls = true;
     handleShadowTLS();
 }
-anytls = tag equals "anytls" address (passwordk/reuse/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls_fingerprint/tls_verification/sni/fast_open/tfo/block_quic/others)* {
+anytls = tag equals "anytls" address (passwordk/reuse/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls_fingerprint/tls_verification/client_cert/sni/fast_open/tfo/block_quic/others)* {
     proxy.type = "anytls";
     proxy.tls = true;
 }
-trust_tunnel = tag equals "trust-tunnel" address (usernamek/passwordk/headers/reuse/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls_fingerprint/tls_verification/sni/fast_open/tfo/block_quic/others)* {
+trust_tunnel = tag equals "trust-tunnel" address (usernamek/passwordk/headers/reuse/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls_fingerprint/tls_verification/client_cert/sni/fast_open/tfo/block_quic/others)* {
     proxy.type = "trusttunnel";
     proxy.tls = true;
 }
@@ -480,6 +480,7 @@ sni = comma "sni" equals match:[^,]+ {
 }
 tls_verification = comma "skip-cert-verify" equals flag:bool { proxy["skip-cert-verify"] = flag; }
 tls_fingerprint = comma "server-cert-fingerprint-sha256" equals tls_fingerprint:$[^,]+ { proxy["tls-fingerprint"] = tls_fingerprint.trim(); }
+client_cert = comma "client-cert" equals match:[^,]+ { proxy["keystore-client-cert"] = stripQuotes(match.join("")); }
 
 snell_psk = comma "psk" equals match:[^,]+ { proxy.psk = match.join(""); }
 snell_version = comma "version" equals match:$[0-9]+ { proxy.version = parseInt(match.trim()); }
@@ -537,7 +538,7 @@ interface = comma "interface" equals match:[^,]+ { proxy.interface = match.join(
 allow_other_interface = comma "allow-other-interface" equals flag:bool { proxy["allow-other-interface"] = flag; }
 hybrid = comma "hybrid" equals flag:bool { proxy.hybrid = flag; }
 idle_timeout = comma "idle-timeout" equals match:$[0-9]+ { proxy["idle-timeout"] = parseInt(match.trim()); }
-private_key = comma "private-key" equals match:[^,]+ { proxy["keystore-private-key"] = match.join("").replace(/^"(.*)"$/, '$1'); }
+private_key = comma "private-key" equals match:[^,]+ { proxy["keystore-private-key"] = stripQuotes(match.join("")); }
 server_fingerprint = comma "server-fingerprint" equals match:[^,]+ { proxy["server-fingerprint"] = match.join("").replace(/^"(.*)"$/, '$1'); }
 block_quic = comma "block-quic" equals match:[^,]+ { proxy["block-quic"] = match.join(""); }
 udp_port = comma "udp-port" equals match:$[0-9]+ { proxy["udp-port"] = parseInt(match.trim()); }
diff --git a/backend/src/core/proxy-utils/producers/surge.js b/backend/src/core/proxy-utils/producers/surge.js
@@ -23,6 +23,51 @@ const ipVersions = {
     'ipv6-prefer': 'prefer-v6',
 };
 
+function stripSurgeQuotes(value) {
+    if (typeof value !== 'string') return value;
+
+    const trimmed = value.trim();
+    const quote = trimmed[0];
+    if (
+        (quote === '"' || quote === "'") &&
+        trimmed[trimmed.length - 1] === quote
+    ) {
+        return trimmed.slice(1, -1).replace(/\\(["'\\])/g, '$1');
+    }
+
+    return trimmed.replace(/\\(["'\\])/g, '$1');
+}
+
+function quoteSurgeValue(value) {
+    return `"${String(stripSurgeQuotes(value))
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, '\\"')}"`;
+}
+
+function appendClientCert(result, proxy) {
+    const clientCert = isPresent(proxy, 'keystore-client-cert')
+        ? proxy['keystore-client-cert']
+        : proxy['client-cert'];
+    if (
+        isPresent(proxy, 'keystore-client-cert') ||
+        isPresent(proxy, 'client-cert')
+    ) {
+        result.append(`,client-cert=${quoteSurgeValue(clientCert)}`);
+    }
+}
+
+function appendSshPrivateKey(result, proxy) {
+    const privateKey = isPresent(proxy, 'keystore-private-key')
+        ? proxy['keystore-private-key']
+        : proxy['private-key'];
+    if (
+        isPresent(proxy, 'keystore-private-key') ||
+        isPresent(proxy, 'private-key')
+    ) {
+        result.append(`,private-key=${quoteSurgeValue(privateKey)}`);
+    }
+}
+
 export default function Surge_Producer() {
     const produce = (proxy, type, opts = {}) => {
         if (
@@ -264,6 +309,7 @@ function trojan(proxy) {
         `,skip-cert-verify=${proxy['skip-cert-verify']}`,
         'skip-cert-verify',
     );
+    appendClientCert(result, proxy);
 
     // tfo
     result.appendIfPresent(`,tfo=${proxy.tfo}`, 'tfo');
@@ -341,6 +387,7 @@ function anytls(proxy) {
         `,skip-cert-verify=${proxy['skip-cert-verify']}`,
         'skip-cert-verify',
     );
+    appendClientCert(result, proxy);
 
     // tfo
     result.appendIfPresent(`,tfo=${proxy.tfo}`, 'tfo');
@@ -408,6 +455,7 @@ function trusttunnel(proxy) {
         `,skip-cert-verify=${proxy['skip-cert-verify']}`,
         'skip-cert-verify',
     );
+    appendClientCert(result, proxy);
 
     // tfo
     result.appendIfPresent(`,tfo=${proxy.tfo}`, 'tfo');
@@ -472,6 +520,7 @@ function h2Connect(proxy) {
         `,skip-cert-verify=${proxy['skip-cert-verify']}`,
         'skip-cert-verify',
     );
+    appendClientCert(result, proxy);
 
     if (proxy.tfo) {
         $.info(`Option tfo is not supported by Surge, thus omitted`);
@@ -556,6 +605,7 @@ function vmess(proxy, includeUnsupportedProxy) {
         `,skip-cert-verify=${proxy['skip-cert-verify']}`,
         'skip-cert-verify',
     );
+    appendClientCert(result, proxy);
 
     // tfo
     result.appendIfPresent(`,tfo=${proxy.tfo}`, 'tfo');
@@ -617,10 +667,7 @@ function ssh(proxy) {
 
     // https://manual.nssurge.com/policy/ssh.html
     // 需配合 Keystore
-    result.appendIfPresent(
-        `,private-key=${proxy['keystore-private-key']}`,
-        'keystore-private-key',
-    );
+    appendSshPrivateKey(result, proxy);
     result.appendIfPresent(
         `,idle-timeout=${proxy['idle-timeout']}`,
         'idle-timeout',
@@ -702,6 +749,7 @@ function http(proxy) {
         `,skip-cert-verify=${proxy['skip-cert-verify']}`,
         'skip-cert-verify',
     );
+    appendClientCert(result, proxy);
 
     // tfo
     result.appendIfPresent(`,tfo=${proxy.tfo}`, 'tfo');
@@ -830,6 +878,7 @@ function socks5(proxy) {
         `,skip-cert-verify=${proxy['skip-cert-verify']}`,
         'skip-cert-verify',
     );
+    appendClientCert(result, proxy);
 
     // tfo
     if (proxy.tfo) {
@@ -1029,6 +1078,7 @@ function tuic(proxy) {
         `,skip-cert-verify=${proxy['skip-cert-verify']}`,
         'skip-cert-verify',
     );
+    appendClientCert(result, proxy);
 
     // tls fingerprint
     result.appendIfPresent(
@@ -1304,6 +1354,7 @@ function hysteria2(proxy) {
         `,skip-cert-verify=${proxy['skip-cert-verify']}`,
         'skip-cert-verify',
     );
+    appendClientCert(result, proxy);
     result.appendIfPresent(
         `,server-cert-fingerprint-sha256=${proxy['tls-fingerprint']}`,
         'tls-fingerprint',
diff --git a/backend/src/products/cron-sync-artifacts-eligibility.js b/backend/src/products/cron-sync-artifacts-eligibility.js
diff --git a/backend/src/products/cron-sync-artifacts.js b/backend/src/products/cron-sync-artifacts.js
@@ -8,7 +8,7 @@ import {
 import $ from '@/core/app';
 import { produceArtifact, uploadArtifactBatches } from '@/restful/sync';
 import { findByName } from '@/utils/database';
-import { hasCronArtifactSyncCredentials } from '@/products/cron-sync-artifacts-eligibility';
+import { hasGistSyncCredentials } from '@/utils/gist';
 
 !(async function () {
     let arg;
@@ -36,7 +36,7 @@ import { hasCronArtifactSyncCredentials } from '@/products/cron-sync-artifacts-e
     } else {
         const settings = $.read(SETTINGS_KEY);
         // if GitHub token is not configured
-        if (!hasCronArtifactSyncCredentials(settings)) return;
+        if (!hasGistSyncCredentials(settings)) return;
 
         const artifacts = $.read(ARTIFACTS_KEY);
         if (!artifacts || artifacts.length === 0) return;
diff --git a/backend/src/test/products/cron-sync-artifacts.spec.js b/backend/src/test/products/cron-sync-artifacts.spec.js
diff --git a/backend/src/test/proxy-producers/text.spec.js b/backend/src/test/proxy-producers/text.spec.js
@@ -453,6 +453,36 @@ describe('Proxy text producers', function () {
         );
     });
 
+    it('quotes Surge SSH private-key and TLS client-cert keystore values', function () {
+        const output = ProxyUtils.produce(
+            [
+                {
+                    type: 'ssh',
+                    name: 'Surge SSH Key',
+                    server: 'ssh.example.com',
+                    port: 22,
+                    username: 'user',
+                    'keystore-private-key': "'ssh-key'",
+                },
+                {
+                    type: 'http',
+                    name: 'Surge HTTPS Client Cert',
+                    server: 'https.example.com',
+                    port: 443,
+                    tls: true,
+                    'keystore-client-cert': "'client-cert'",
+                },
+            ],
+            'Surge',
+            'external',
+        );
+
+        expect(output.split('\n')).to.deep.equal([
+            'Surge SSH Key=ssh,ssh.example.com,22,username="user",private-key="ssh-key"',
+            'Surge HTTPS Client Cert=https,https.example.com,443,client-cert="client-cert"',
+        ]);
+    });
+
     it('produces Surge root headers for HTTP, HTTPS, HTTP/2 CONNECT, and TrustTunnel', function () {
         const output = ProxyUtils.produce(
             [
diff --git a/backend/src/test/utils/gist.spec.js b/backend/src/test/utils/gist.spec.js
@@ -6,6 +6,7 @@ import { SETTINGS_KEY } from '@/constants';
 import Gist, {
     describeGistApiErrorResponse,
     getGithubGistBaseURL,
+    hasGistSyncCredentials,
 } from '@/utils/gist';
 import {
     normalizeArtifactSyncBatchSize,
@@ -57,6 +58,23 @@ describe('Gist GitHub API URL', function () {
         );
     });
 
+    it('allows token-only Gist-compatible sync settings', function () {
+        expect(
+            hasGistSyncCredentials({
+                gistToken: 'token',
+                githubUser: '',
+            }),
+        ).to.equal(true);
+    });
+
+    it('skips sync when the token is missing', function () {
+        expect(
+            hasGistSyncCredentials({
+                githubUser: 'xream',
+            }),
+        ).to.equal(false);
+    });
+
     it('normalizes artifact sync batch size', function () {
         expect(normalizeArtifactSyncBatchSize()).to.equal(10);
         expect(normalizeArtifactSyncBatchSize('')).to.equal(10);
diff --git a/backend/src/utils/gist.js b/backend/src/utils/gist.js
@@ -44,6 +44,10 @@ export function getGithubGistBaseURL({ githubApiUrl, githubProxy } = {}) {
     }${DEFAULT_GITHUB_API_URL}`;
 }
 
+export function hasGistSyncCredentials(settings = {}) {
+    return Boolean(settings?.gistToken);
+}
+
 export { describeGistApiErrorResponse };
 
 /**
diff --git a/scripts/demo.js b/scripts/demo.js
@@ -23,6 +23,9 @@ function operator(proxies = [], targetPlatform, context) {
   // 10. `sni` 在某些协议里会自动与 `servername` 转换
   // 11. 读取节点的 ca-str 和 _ca (后端文件路径) 字段, 自动计算 fingerprint (参考 https://t.me/zhetengsha/1512)
   // 12. 以 Surge 为例, 最新的参数一般我都会跟进, 以 Surge 文档为例, 一些常用的: TUIC/Hysteria 2 的 `ecn`, Snell 的 `reuse` 连接复用, QUIC 策略 block-quic`, Hysteria 2 下载带宽 `down`
+  //     Surge 的 `private-key`/`client-cert` 对应内部字段 `keystore-private-key`/`keystore-client-cert`, 值都是 Surge `[Keystore]` 里的密钥库条目名, 不是证书/密钥内容或本地路径
+  //     例如: $server['keystore-private-key'] = 'ssh-key-name' 输出 Surge SSH 时会生成 private-key="ssh-key-name"
+  //     例如: $server['keystore-client-cert'] = 'client-cert-name' 输出 Surge TLS 代理时会生成 client-cert="client-cert-name"
   // 13. `test-url` 为测延迟链接, `test-timeout` 为测延迟超时
   // 14. `ports` 为端口跳跃, `hop-interval` 变换端口号的时间间隔
   // 15. `ip-version` 设置节点使用 IP 版本，兼容各家的值. 会进行内部转换. sing-box 以外: 若无法匹配则使用原始值. sing-box: 需有匹配且节点上设置 `_dns_server` 字段, 将自动设置 `domain_resolver.server`. 同时, `sing-box` 支持使用完整的 `_domain_resolver` 结构设置 `domain_resolver` 字段

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "sub-store",`
`3`		`- "version": "2.23.11",`
	`3`	`+ "version": "2.23.13",`
`4`	`4`	`"description": "Advanced Subscription Manager for QX, Loon, Surge, Stash and Shadowrocket.",`
`5`	`5`	`"main": "src/main.js",`
`6`	`6`	`"packageManager": "pnpm@11.0.9",`
Original file line number	Diff line number	Diff line change
`@@ -44,6 +44,10 @@ export function getGithubGistBaseURL({ githubApiUrl, githubProxy } = {}) {`
`44`	`44`	}${DEFAULT_GITHUB_API_URL}`;
`45`	`45`	`}`
`46`	`46`
	`47`	`+export function hasGistSyncCredentials(settings = {}) {`
	`48`	`+ return Boolean(settings?.gistToken);`
	`49`	`+}`
	`50`	`+`
`47`	`51`	`export { describeGistApiErrorResponse };`
`48`	`52`
`49`	`53`	`/**`