First Commmit

2026-04-14 22:41:14 +08:00
commit 9f867b19da
1086 changed files with 147554 additions and 0 deletions
--- a/experimental/clashapi/api_meta.go
+++ b/experimental/clashapi/api_meta.go
@@ -0,0 +1,96 @@
+package clashapi
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"net/http"
+	"runtime/debug"
+	"time"
+
+	"github.com/sagernet/sing-box/experimental/clashapi/trafficontrol"
+	"github.com/sagernet/sing/common/json"
+	"github.com/sagernet/ws"
+	"github.com/sagernet/ws/wsutil"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
+	"github.com/go-chi/render"
+)
+
+// API created by Clash.Meta
+
+func (s *Server) setupMetaAPI(r chi.Router) {
+	if s.logDebug {
+		r := chi.NewRouter()
+		r.Put("/gc", func(w http.ResponseWriter, r *http.Request) {
+			debug.FreeOSMemory()
+		})
+		r.Mount("/", middleware.Profiler())
+	}
+	r.Get("/memory", memory(s.ctx, s.trafficManager))
+	r.Mount("/group", groupRouter(s))
+	r.Mount("/upgrade", upgradeRouter(s))
+}
+
+type Memory struct {
+	Inuse   uint64 `json:"inuse"`
+	OSLimit uint64 `json:"oslimit"` // maybe we need it in the future
+}
+
+func memory(ctx context.Context, trafficManager *trafficontrol.Manager) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var conn net.Conn
+		if r.Header.Get("Upgrade") == "websocket" {
+			var err error
+			conn, _, _, err = ws.UpgradeHTTP(r, w)
+			if err != nil {
+				return
+			}
+			defer conn.Close()
+		}
+
+		if conn == nil {
+			w.Header().Set("Content-Type", "application/json")
+			render.Status(r, http.StatusOK)
+		}
+
+		tick := time.NewTicker(time.Second)
+		defer tick.Stop()
+		buf := &bytes.Buffer{}
+		var err error
+		first := true
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-tick.C:
+			}
+			buf.Reset()
+
+			inuse := trafficManager.Snapshot().Memory
+
+			// make chat.js begin with zero
+			// this is shit var,but we need output 0 for first time
+			if first {
+				first = false
+				inuse = 0
+			}
+			if err := json.NewEncoder(buf).Encode(Memory{
+				Inuse:   inuse,
+				OSLimit: 0,
+			}); err != nil {
+				break
+			}
+			if conn == nil {
+				_, err = w.Write(buf.Bytes())
+				w.(http.Flusher).Flush()
+			} else {
+				err = wsutil.WriteServerText(conn, buf.Bytes())
+			}
+			if err != nil {
+				break
+			}
+		}
+	}
+}
--- a/experimental/clashapi/api_meta_group.go
+++ b/experimental/clashapi/api_meta_group.go
@@ -0,0 +1,136 @@
+package clashapi
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/common/urltest"
+	"github.com/sagernet/sing-box/protocol/group"
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/batch"
+	"github.com/sagernet/sing/common/json/badjson"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func groupRouter(server *Server) http.Handler {
+	r := chi.NewRouter()
+	r.Get("/", getGroups(server))
+	r.Route("/{name}", func(r chi.Router) {
+		r.Use(parseProxyName, findProxyByName(server))
+		r.Get("/", getGroup(server))
+		r.Get("/delay", getGroupDelay(server))
+	})
+	return r
+}
+
+func getGroups(server *Server) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		groups := common.Map(common.Filter(server.outbound.Outbounds(), func(it adapter.Outbound) bool {
+			_, isGroup := it.(adapter.OutboundGroup)
+			return isGroup
+		}), func(it adapter.Outbound) *badjson.JSONObject {
+			return proxyInfo(server, it)
+		})
+		render.JSON(w, r, render.M{
+			"proxies": groups,
+		})
+	}
+}
+
+func getGroup(server *Server) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		proxy := r.Context().Value(CtxKeyProxy).(adapter.Outbound)
+		if _, ok := proxy.(adapter.OutboundGroup); ok {
+			render.JSON(w, r, proxyInfo(server, proxy))
+			return
+		}
+		render.Status(r, http.StatusNotFound)
+		render.JSON(w, r, ErrNotFound)
+	}
+}
+
+func getGroupDelay(server *Server) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		proxy := r.Context().Value(CtxKeyProxy).(adapter.Outbound)
+		outboundGroup, ok := proxy.(adapter.OutboundGroup)
+		if !ok {
+			render.Status(r, http.StatusNotFound)
+			render.JSON(w, r, ErrNotFound)
+			return
+		}
+
+		query := r.URL.Query()
+		url := query.Get("url")
+		if strings.HasPrefix(url, "http://") {
+			url = ""
+		}
+		timeout, err := strconv.ParseInt(query.Get("timeout"), 10, 32)
+		if err != nil {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, ErrBadRequest)
+			return
+		}
+
+		ctx, cancel := context.WithTimeout(r.Context(), time.Millisecond*time.Duration(timeout))
+		defer cancel()
+
+		var result map[string]uint16
+		if urlTestGroup, isURLTestGroup := outboundGroup.(adapter.URLTestGroup); isURLTestGroup {
+			result, err = urlTestGroup.URLTest(ctx)
+		} else {
+			outbounds := common.FilterNotNil(common.Map(outboundGroup.All(), func(it string) adapter.Outbound {
+				itOutbound, _ := server.outbound.Outbound(it)
+				return itOutbound
+			}))
+			b, _ := batch.New(ctx, batch.WithConcurrencyNum[any](10))
+			checked := make(map[string]bool)
+			result = make(map[string]uint16)
+			var resultAccess sync.Mutex
+			for _, detour := range outbounds {
+				tag := detour.Tag()
+				realTag := group.RealTag(detour)
+				if checked[realTag] {
+					continue
+				}
+				checked[realTag] = true
+				p, loaded := server.outbound.Outbound(realTag)
+				if !loaded {
+					continue
+				}
+				b.Go(realTag, func() (any, error) {
+					t, err := urltest.URLTest(ctx, url, p)
+					if err != nil {
+						server.logger.Debug("outbound ", tag, " unavailable: ", err)
+						server.urlTestHistory.DeleteURLTestHistory(realTag)
+					} else {
+						server.logger.Debug("outbound ", tag, " available: ", t, "ms")
+						server.urlTestHistory.StoreURLTestHistory(realTag, &adapter.URLTestHistory{
+							Time:  time.Now(),
+							Delay: t,
+						})
+						resultAccess.Lock()
+						result[tag] = t
+						resultAccess.Unlock()
+					}
+					return nil, nil
+				})
+			}
+			b.Wait()
+		}
+
+		if err != nil {
+			render.Status(r, http.StatusGatewayTimeout)
+			render.JSON(w, r, newError(err.Error()))
+			return
+		}
+
+		render.JSON(w, r, result)
+	}
+}
--- a/experimental/clashapi/api_meta_upgrade.go
+++ b/experimental/clashapi/api_meta_upgrade.go
@@ -0,0 +1,36 @@
+package clashapi
+
+import (
+	"net/http"
+
+	E "github.com/sagernet/sing/common/exceptions"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func upgradeRouter(server *Server) http.Handler {
+	r := chi.NewRouter()
+	r.Post("/ui", updateExternalUI(server))
+	return r
+}
+
+func updateExternalUI(server *Server) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if server.externalUI == "" {
+			render.Status(r, http.StatusNotFound)
+			render.JSON(w, r, newError("external UI not enabled"))
+			return
+		}
+		server.logger.Info("upgrading external UI")
+		err := server.downloadExternalUI()
+		if err != nil {
+			server.logger.Error(E.Cause(err, "upgrade external ui"))
+			render.Status(r, http.StatusInternalServerError)
+			render.JSON(w, r, newError(err.Error()))
+			return
+		}
+		server.logger.Info("updated external UI")
+		render.JSON(w, r, render.M{"status": "ok"})
+	}
+}
--- a/experimental/clashapi/cache.go
+++ b/experimental/clashapi/cache.go
@@ -0,0 +1,44 @@
+package clashapi
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing/service"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func cacheRouter(ctx context.Context) http.Handler {
+	r := chi.NewRouter()
+	r.Post("/fakeip/flush", flushFakeip(ctx))
+	r.Post("/dns/flush", flushDNS(ctx))
+	return r
+}
+
+func flushFakeip(ctx context.Context) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		cacheFile := service.FromContext[adapter.CacheFile](ctx)
+		if cacheFile != nil {
+			err := cacheFile.FakeIPReset()
+			if err != nil {
+				render.Status(r, http.StatusInternalServerError)
+				render.JSON(w, r, newError(err.Error()))
+				return
+			}
+		}
+		render.NoContent(w, r)
+	}
+}
+
+func flushDNS(ctx context.Context) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		dnsRouter := service.FromContext[adapter.DNSRouter](ctx)
+		if dnsRouter != nil {
+			dnsRouter.ClearCache()
+		}
+		render.NoContent(w, r)
+	}
+}
--- a/experimental/clashapi/common.go
+++ b/experimental/clashapi/common.go
@@ -0,0 +1,17 @@
+package clashapi
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// When name is composed of a partial escape string, Golang does not unescape it
+func getEscapeParam(r *http.Request, paramName string) string {
+	param := chi.URLParam(r, paramName)
+	if newParam, err := url.PathUnescape(param); err == nil {
+		param = newParam
+	}
+	return param
+}
--- a/experimental/clashapi/configs.go
+++ b/experimental/clashapi/configs.go
@@ -0,0 +1,71 @@
+package clashapi
+
+import (
+	"net/http"
+
+	"github.com/sagernet/sing-box/log"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func configRouter(server *Server, logFactory log.Factory) http.Handler {
+	r := chi.NewRouter()
+	r.Get("/", getConfigs(server, logFactory))
+	r.Put("/", updateConfigs)
+	r.Patch("/", patchConfigs(server))
+	return r
+}
+
+type configSchema struct {
+	Port        int    `json:"port"`
+	SocksPort   int    `json:"socks-port"`
+	RedirPort   int    `json:"redir-port"`
+	TProxyPort  int    `json:"tproxy-port"`
+	MixedPort   int    `json:"mixed-port"`
+	AllowLan    bool   `json:"allow-lan"`
+	BindAddress string `json:"bind-address"`
+	Mode        string `json:"mode"`
+	// sing-box added
+	ModeList []string       `json:"mode-list"`
+	LogLevel string         `json:"log-level"`
+	IPv6     bool           `json:"ipv6"`
+	Tun      map[string]any `json:"tun"`
+}
+
+func getConfigs(server *Server, logFactory log.Factory) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		logLevel := logFactory.Level()
+		if logLevel == log.LevelTrace {
+			logLevel = log.LevelDebug
+		} else if logLevel < log.LevelError {
+			logLevel = log.LevelError
+		}
+		render.JSON(w, r, &configSchema{
+			Mode:        server.mode,
+			ModeList:    server.modeList,
+			BindAddress: "*",
+			LogLevel:    log.FormatLevel(logLevel),
+		})
+	}
+}
+
+func patchConfigs(server *Server) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var newConfig configSchema
+		err := render.DecodeJSON(r.Body, &newConfig)
+		if err != nil {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, ErrBadRequest)
+			return
+		}
+		if newConfig.Mode != "" {
+			server.SetMode(newConfig.Mode)
+		}
+		render.NoContent(w, r)
+	}
+}
+
+func updateConfigs(w http.ResponseWriter, r *http.Request) {
+	render.NoContent(w, r)
+}
--- a/experimental/clashapi/connections.go
+++ b/experimental/clashapi/connections.go
@@ -0,0 +1,108 @@
+package clashapi
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/experimental/clashapi/trafficontrol"
+	"github.com/sagernet/sing/common/json"
+	"github.com/sagernet/ws"
+	"github.com/sagernet/ws/wsutil"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+	"github.com/gofrs/uuid/v5"
+)
+
+func connectionRouter(ctx context.Context, router adapter.Router, trafficManager *trafficontrol.Manager) http.Handler {
+	r := chi.NewRouter()
+	r.Get("/", getConnections(ctx, trafficManager))
+	r.Delete("/", closeAllConnections(router, trafficManager))
+	r.Delete("/{id}", closeConnection(trafficManager))
+	return r
+}
+
+func getConnections(ctx context.Context, trafficManager *trafficontrol.Manager) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Upgrade") != "websocket" {
+			snapshot := trafficManager.Snapshot()
+			render.JSON(w, r, snapshot)
+			return
+		}
+
+		conn, _, _, err := ws.UpgradeHTTP(r, w)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+
+		intervalStr := r.URL.Query().Get("interval")
+		interval := 1000
+		if intervalStr != "" {
+			t, err := strconv.Atoi(intervalStr)
+			if err != nil {
+				render.Status(r, http.StatusBadRequest)
+				render.JSON(w, r, ErrBadRequest)
+				return
+			}
+
+			interval = t
+		}
+
+		buf := &bytes.Buffer{}
+		sendSnapshot := func() error {
+			buf.Reset()
+			snapshot := trafficManager.Snapshot()
+			if err := json.NewEncoder(buf).Encode(snapshot); err != nil {
+				return err
+			}
+			return wsutil.WriteServerText(conn, buf.Bytes())
+		}
+
+		if err = sendSnapshot(); err != nil {
+			return
+		}
+
+		tick := time.NewTicker(time.Millisecond * time.Duration(interval))
+		defer tick.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-tick.C:
+			}
+			if err = sendSnapshot(); err != nil {
+				break
+			}
+		}
+	}
+}
+
+func closeConnection(trafficManager *trafficontrol.Manager) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id := uuid.FromStringOrNil(chi.URLParam(r, "id"))
+		snapshot := trafficManager.Snapshot()
+		for _, c := range snapshot.Connections {
+			if id == c.Metadata().ID {
+				c.Close()
+				break
+			}
+		}
+		render.NoContent(w, r)
+	}
+}
+
+func closeAllConnections(router adapter.Router, trafficManager *trafficontrol.Manager) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		snapshot := trafficManager.Snapshot()
+		for _, c := range snapshot.Connections {
+			c.Close()
+		}
+		router.ResetNetwork()
+		render.NoContent(w, r)
+	}
+}
--- a/experimental/clashapi/ctxkeys.go
+++ b/experimental/clashapi/ctxkeys.go
@@ -0,0 +1,14 @@
+package clashapi
+
+var (
+	CtxKeyProxyName    = contextKey("proxy name")
+	CtxKeyProviderName = contextKey("provider name")
+	CtxKeyProxy        = contextKey("proxy")
+	CtxKeyProvider     = contextKey("provider")
+)
+
+type contextKey string
+
+func (c contextKey) String() string {
+	return "clash context key " + string(c)
+}
--- a/experimental/clashapi/dns.go
+++ b/experimental/clashapi/dns.go
@@ -0,0 +1,82 @@
+package clashapi
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/sagernet/sing-box/adapter"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing/common"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+	"github.com/miekg/dns"
+)
+
+func dnsRouter(router adapter.DNSRouter) http.Handler {
+	r := chi.NewRouter()
+	r.Get("/query", queryDNS(router))
+	return r
+}
+
+func queryDNS(router adapter.DNSRouter) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		name := r.URL.Query().Get("name")
+		qTypeStr := r.URL.Query().Get("type")
+		if qTypeStr == "" {
+			qTypeStr = "A"
+		}
+
+		qType, exist := dns.StringToType[qTypeStr]
+		if !exist {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, newError("invalid query type"))
+			return
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), C.DNSTimeout)
+		defer cancel()
+
+		msg := dns.Msg{}
+		msg.SetQuestion(dns.Fqdn(name), qType)
+		resp, err := router.Exchange(ctx, &msg, adapter.DNSQueryOptions{})
+		if err != nil {
+			render.Status(r, http.StatusInternalServerError)
+			render.JSON(w, r, newError(err.Error()))
+			return
+		}
+
+		responseData := render.M{
+			"Status":   resp.Rcode,
+			"Question": resp.Question,
+			"Server":   "internal",
+			"TC":       resp.Truncated,
+			"RD":       resp.RecursionDesired,
+			"RA":       resp.RecursionAvailable,
+			"AD":       resp.AuthenticatedData,
+			"CD":       resp.CheckingDisabled,
+		}
+
+		rr2Json := func(rr dns.RR) render.M {
+			header := rr.Header()
+			return render.M{
+				"name": header.Name,
+				"type": header.Rrtype,
+				"TTL":  header.Ttl,
+				"data": rr.String()[len(header.String()):],
+			}
+		}
+
+		if len(resp.Answer) > 0 {
+			responseData["Answer"] = common.Map(resp.Answer, rr2Json)
+		}
+		if len(resp.Ns) > 0 {
+			responseData["Authority"] = common.Map(resp.Ns, rr2Json)
+		}
+		if len(resp.Extra) > 0 {
+			responseData["Additional"] = common.Map(resp.Extra, rr2Json)
+		}
+
+		render.JSON(w, r, responseData)
+	}
+}
--- a/experimental/clashapi/errors.go
+++ b/experimental/clashapi/errors.go
@@ -0,0 +1,22 @@
+package clashapi
+
+var (
+	ErrUnauthorized   = newError("Unauthorized")
+	ErrBadRequest     = newError("Body invalid")
+	ErrForbidden      = newError("Forbidden")
+	ErrNotFound       = newError("Resource not found")
+	ErrRequestTimeout = newError("Timeout")
+)
+
+// HTTPError is custom HTTP error for API
+type HTTPError struct {
+	Message string `json:"message"`
+}
+
+func (e *HTTPError) Error() string {
+	return e.Message
+}
+
+func newError(msg string) *HTTPError {
+	return &HTTPError{Message: msg}
+}
--- a/experimental/clashapi/profile.go
+++ b/experimental/clashapi/profile.go
@@ -0,0 +1,53 @@
+package clashapi
+
+import (
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func profileRouter() http.Handler {
+	r := chi.NewRouter()
+	r.Get("/tracing", subscribeTracing)
+	return r
+}
+
+func subscribeTracing(w http.ResponseWriter, r *http.Request) {
+	// if !profile.Tracing.Load() {
+	render.Status(r, http.StatusNotFound)
+	render.JSON(w, r, ErrNotFound)
+	//return
+	//}
+
+	/*wsConn, err := upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		return
+	}
+
+	ch := make(chan map[string]any, 1024)
+	sub := event.Subscribe()
+	defer event.UnSubscribe(sub)
+	buf := &bytes.Buffer{}
+
+	go func() {
+		for elm := range sub {
+			select {
+			case ch <- elm:
+			default:
+			}
+		}
+		close(ch)
+	}()
+
+	for elm := range ch {
+		buf.Reset()
+		if err := json.NewEncoder(buf).Encode(elm); err != nil {
+			break
+		}
+
+		if err := wsConn.WriteMessage(websocket.TextMessage, buf.Bytes()); err != nil {
+			break
+		}
+	}*/
+}
--- a/experimental/clashapi/provider.go
+++ b/experimental/clashapi/provider.go
@@ -0,0 +1,74 @@
+package clashapi
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func proxyProviderRouter() http.Handler {
+	r := chi.NewRouter()
+	r.Get("/", getProviders)
+
+	r.Route("/{name}", func(r chi.Router) {
+		r.Use(parseProviderName, findProviderByName)
+		r.Get("/", getProvider)
+		r.Put("/", updateProvider)
+		r.Get("/healthcheck", healthCheckProvider)
+	})
+	return r
+}
+
+func getProviders(w http.ResponseWriter, r *http.Request) {
+	render.JSON(w, r, render.M{
+		"providers": render.M{},
+	})
+}
+
+func getProvider(w http.ResponseWriter, r *http.Request) {
+	/*provider := r.Context().Value(CtxKeyProvider).(provider.ProxyProvider)
+	render.JSON(w, r, provider)*/
+	render.NoContent(w, r)
+}
+
+func updateProvider(w http.ResponseWriter, r *http.Request) {
+	/*provider := r.Context().Value(CtxKeyProvider).(provider.ProxyProvider)
+	if err := provider.Update(); err != nil {
+		render.Status(r, http.StatusServiceUnavailable)
+		render.JSON(w, r, newError(err.Error()))
+		return
+	}*/
+	render.NoContent(w, r)
+}
+
+func healthCheckProvider(w http.ResponseWriter, r *http.Request) {
+	/*provider := r.Context().Value(CtxKeyProvider).(provider.ProxyProvider)
+	provider.HealthCheck()*/
+	render.NoContent(w, r)
+}
+
+func parseProviderName(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		name := getEscapeParam(r, "name")
+		ctx := context.WithValue(r.Context(), CtxKeyProviderName, name)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func findProviderByName(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		/*name := r.Context().Value(CtxKeyProviderName).(string)
+		providers := tunnel.ProxyProviders()
+		provider, exist := providers[name]
+		if !exist {*/
+		render.Status(r, http.StatusNotFound)
+		render.JSON(w, r, ErrNotFound)
+		//return
+		//}
+
+		// ctx := context.WithValue(r.Context(), CtxKeyProvider, provider)
+		// next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
--- a/experimental/clashapi/proxies.go
+++ b/experimental/clashapi/proxies.go
@@ -0,0 +1,234 @@
+package clashapi
+
+import (
+	"context"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/common/urltest"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/protocol/group"
+	"github.com/sagernet/sing/common"
+	F "github.com/sagernet/sing/common/format"
+	"github.com/sagernet/sing/common/json/badjson"
+	N "github.com/sagernet/sing/common/network"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func proxyRouter(server *Server, router adapter.Router) http.Handler {
+	r := chi.NewRouter()
+	r.Get("/", getProxies(server))
+
+	r.Route("/{name}", func(r chi.Router) {
+		r.Use(parseProxyName, findProxyByName(server))
+		r.Get("/", getProxy(server))
+		r.Get("/delay", getProxyDelay(server))
+		r.Put("/", updateProxy)
+	})
+	return r
+}
+
+func parseProxyName(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		name := getEscapeParam(r, "name")
+		ctx := context.WithValue(r.Context(), CtxKeyProxyName, name)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func findProxyByName(server *Server) func(next http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			name := r.Context().Value(CtxKeyProxyName).(string)
+			proxy, exist := server.outbound.Outbound(name)
+			if !exist {
+				render.Status(r, http.StatusNotFound)
+				render.JSON(w, r, ErrNotFound)
+				return
+			}
+			ctx := context.WithValue(r.Context(), CtxKeyProxy, proxy)
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
+
+func proxyInfo(server *Server, detour adapter.Outbound) *badjson.JSONObject {
+	var info badjson.JSONObject
+	var clashType string
+	switch detour.Type() {
+	case C.TypeBlock:
+		clashType = "Reject"
+	default:
+		clashType = C.ProxyDisplayName(detour.Type())
+	}
+	info.Put("type", clashType)
+	info.Put("name", detour.Tag())
+	info.Put("udp", common.Contains(detour.Network(), N.NetworkUDP))
+	delayHistory := server.urlTestHistory.LoadURLTestHistory(adapter.OutboundTag(detour))
+	if delayHistory != nil {
+		info.Put("history", []*adapter.URLTestHistory{delayHistory})
+	} else {
+		info.Put("history", []*adapter.URLTestHistory{})
+	}
+	if group, isGroup := detour.(adapter.OutboundGroup); isGroup {
+		info.Put("now", group.Now())
+		info.Put("all", group.All())
+	}
+	return &info
+}
+
+func getProxies(server *Server) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var proxyMap badjson.JSONObject
+		outbounds := common.Filter(server.outbound.Outbounds(), func(detour adapter.Outbound) bool {
+			return detour.Tag() != ""
+		})
+		outbounds = append(outbounds, common.Map(common.Filter(server.endpoint.Endpoints(), func(detour adapter.Endpoint) bool {
+			return detour.Tag() != ""
+		}), func(it adapter.Endpoint) adapter.Outbound {
+			return it
+		})...)
+
+		allProxies := make([]string, 0, len(outbounds))
+
+		for _, detour := range outbounds {
+			switch detour.Type() {
+			case C.TypeDirect, C.TypeBlock, C.TypeDNS:
+				continue
+			}
+			allProxies = append(allProxies, detour.Tag())
+		}
+
+		defaultTag := server.outbound.Default().Tag()
+
+		sort.SliceStable(allProxies, func(i, j int) bool {
+			return allProxies[i] == defaultTag
+		})
+
+		// fix clash dashboard
+		proxyMap.Put("GLOBAL", map[string]any{
+			"type":    "Fallback",
+			"name":    "GLOBAL",
+			"udp":     true,
+			"history": []*adapter.URLTestHistory{},
+			"all":     allProxies,
+			"now":     defaultTag,
+		})
+
+		for i, detour := range outbounds {
+			var tag string
+			if detour.Tag() == "" {
+				tag = F.ToString(i)
+			} else {
+				tag = detour.Tag()
+			}
+			proxyMap.Put(tag, proxyInfo(server, detour))
+		}
+		var responseMap badjson.JSONObject
+		responseMap.Put("proxies", &proxyMap)
+		response, err := responseMap.MarshalJSON()
+		if err != nil {
+			render.Status(r, http.StatusInternalServerError)
+			render.JSON(w, r, newError(err.Error()))
+			return
+		}
+		w.Write(response)
+	}
+}
+
+func getProxy(server *Server) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		proxy := r.Context().Value(CtxKeyProxy).(adapter.Outbound)
+		response, err := proxyInfo(server, proxy).MarshalJSON()
+		if err != nil {
+			render.Status(r, http.StatusInternalServerError)
+			render.JSON(w, r, newError(err.Error()))
+			return
+		}
+		w.Write(response)
+	}
+}
+
+type UpdateProxyRequest struct {
+	Name string `json:"name"`
+}
+
+func updateProxy(w http.ResponseWriter, r *http.Request) {
+	req := UpdateProxyRequest{}
+	if err := render.DecodeJSON(r.Body, &req); err != nil {
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, ErrBadRequest)
+		return
+	}
+
+	proxy := r.Context().Value(CtxKeyProxy).(adapter.Outbound)
+	selector, ok := proxy.(*group.Selector)
+	if !ok {
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, newError("Must be a Selector"))
+		return
+	}
+
+	if !selector.SelectOutbound(req.Name) {
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, newError("Selector update error: not found"))
+		return
+	}
+
+	render.NoContent(w, r)
+}
+
+func getProxyDelay(server *Server) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		query := r.URL.Query()
+		url := query.Get("url")
+		if strings.HasPrefix(url, "http://") {
+			url = ""
+		}
+		timeout, err := strconv.ParseInt(query.Get("timeout"), 10, 16)
+		if err != nil {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, ErrBadRequest)
+			return
+		}
+
+		proxy := r.Context().Value(CtxKeyProxy).(adapter.Outbound)
+		ctx, cancel := context.WithTimeout(context.Background(), time.Millisecond*time.Duration(timeout))
+		defer cancel()
+
+		delay, err := urltest.URLTest(ctx, url, proxy)
+		defer func() {
+			realTag := group.RealTag(proxy)
+			if err != nil {
+				server.urlTestHistory.DeleteURLTestHistory(realTag)
+			} else {
+				server.urlTestHistory.StoreURLTestHistory(realTag, &adapter.URLTestHistory{
+					Time:  time.Now(),
+					Delay: delay,
+				})
+			}
+		}()
+
+		if ctx.Err() != nil {
+			render.Status(r, http.StatusGatewayTimeout)
+			render.JSON(w, r, ErrRequestTimeout)
+			return
+		}
+
+		if err != nil || delay == 0 {
+			render.Status(r, http.StatusServiceUnavailable)
+			render.JSON(w, r, newError("An error occurred in the delay test"))
+			return
+		}
+
+		render.JSON(w, r, render.M{
+			"delay": delay,
+		})
+	}
+}
--- a/experimental/clashapi/ruleprovider.go
+++ b/experimental/clashapi/ruleprovider.go
@@ -0,0 +1,58 @@
+package clashapi
+
+import (
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func ruleProviderRouter() http.Handler {
+	r := chi.NewRouter()
+	r.Get("/", getRuleProviders)
+
+	r.Route("/{name}", func(r chi.Router) {
+		r.Use(parseProviderName, findRuleProviderByName)
+		r.Get("/", getRuleProvider)
+		r.Put("/", updateRuleProvider)
+	})
+	return r
+}
+
+func getRuleProviders(w http.ResponseWriter, r *http.Request) {
+	render.JSON(w, r, render.M{
+		"providers": []string{},
+	})
+}
+
+func getRuleProvider(w http.ResponseWriter, r *http.Request) {
+	// provider := r.Context().Value(CtxKeyProvider).(provider.RuleProvider)
+	// render.JSON(w, r, provider)
+	render.NoContent(w, r)
+}
+
+func updateRuleProvider(w http.ResponseWriter, r *http.Request) {
+	/*provider := r.Context().Value(CtxKeyProvider).(provider.RuleProvider)
+	if err := provider.Update(); err != nil {
+		render.Status(r, http.StatusServiceUnavailable)
+		render.JSON(w, r, newError(err.Error()))
+		return
+	}*/
+	render.NoContent(w, r)
+}
+
+func findRuleProviderByName(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		/*name := r.Context().Value(CtxKeyProviderName).(string)
+		providers := tunnel.RuleProviders()
+		provider, exist := providers[name]
+		if !exist {*/
+		render.Status(r, http.StatusNotFound)
+		render.JSON(w, r, ErrNotFound)
+		//return
+		//}
+
+		// ctx := context.WithValue(r.Context(), CtxKeyProvider, provider)
+		// next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
--- a/experimental/clashapi/rules.go
+++ b/experimental/clashapi/rules.go
@@ -0,0 +1,40 @@
+package clashapi
+
+import (
+	"net/http"
+
+	"github.com/sagernet/sing-box/adapter"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func ruleRouter(router adapter.Router) http.Handler {
+	r := chi.NewRouter()
+	r.Get("/", getRules(router))
+	return r
+}
+
+type Rule struct {
+	Type    string `json:"type"`
+	Payload string `json:"payload"`
+	Proxy   string `json:"proxy"`
+}
+
+func getRules(router adapter.Router) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		rawRules := router.Rules()
+
+		var rules []Rule
+		for _, rule := range rawRules {
+			rules = append(rules, Rule{
+				Type:    rule.Type(),
+				Payload: rule.String(),
+				Proxy:   rule.Action().String(),
+			})
+		}
+		render.JSON(w, r, render.M{
+			"rules": rules,
+		})
+	}
+}
--- a/experimental/clashapi/script.go
+++ b/experimental/clashapi/script.go
@@ -0,0 +1,98 @@
+package clashapi
+
+import (
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func scriptRouter() http.Handler {
+	r := chi.NewRouter()
+	r.Post("/", testScript)
+	r.Patch("/", patchScript)
+	return r
+}
+
+/*type TestScriptRequest struct {
+	Script   *string    `json:"script"`
+	Metadata C.Metadata `json:"metadata"`
+}*/
+
+func testScript(w http.ResponseWriter, r *http.Request) {
+	/*	req := TestScriptRequest{}
+		if err := render.DecodeJSON(r.Body, &req); err != nil {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, ErrBadRequest)
+			return
+		}
+
+		fn := tunnel.ScriptFn()
+		if req.Script == nil && fn == nil {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, newError("should send `script`"))
+			return
+		}
+
+		if !req.Metadata.Valid() {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, newError("metadata not valid"))
+			return
+		}
+
+		if req.Script != nil {
+			var err error
+			fn, err = script.ParseScript(*req.Script)
+			if err != nil {
+				render.Status(r, http.StatusBadRequest)
+				render.JSON(w, r, newError(err.Error()))
+				return
+			}
+		}
+
+		ctx, _ := script.MakeContext(tunnel.ProxyProviders(), tunnel.RuleProviders())
+
+		thread := &starlark.Thread{}
+		ret, err := starlark.Call(thread, fn, starlark.Tuple{ctx, script.MakeMetadata(&req.Metadata)}, nil)
+		if err != nil {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, newError(err.Error()))
+			return
+		}
+
+		elm, ok := ret.(starlark.String)
+		if !ok {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, "script fn must return a string")
+			return
+		}
+
+		render.JSON(w, r, render.M{
+			"result": string(elm),
+		})*/
+	render.Status(r, http.StatusBadRequest)
+	render.JSON(w, r, newError("not implemented"))
+}
+
+type PatchScriptRequest struct {
+	Script string `json:"script"`
+}
+
+func patchScript(w http.ResponseWriter, r *http.Request) {
+	/*req := PatchScriptRequest{}
+	if err := render.DecodeJSON(r.Body, &req); err != nil {
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, ErrBadRequest)
+		return
+	}
+
+	fn, err := script.ParseScript(req.Script)
+	if err != nil {
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, newError(err.Error()))
+		return
+	}
+
+	tunnel.UpdateScript(fn)*/
+	render.NoContent(w, r)
+}
--- a/experimental/clashapi/server.go
+++ b/experimental/clashapi/server.go
@@ -0,0 +1,435 @@
+package clashapi
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"os"
+	"runtime"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/sagernet/cors"
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/common/urltest"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/experimental"
+	"github.com/sagernet/sing-box/experimental/clashapi/trafficontrol"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing/common"
+	E "github.com/sagernet/sing/common/exceptions"
+	"github.com/sagernet/sing/common/json"
+	N "github.com/sagernet/sing/common/network"
+	"github.com/sagernet/sing/common/observable"
+	"github.com/sagernet/sing/service"
+	"github.com/sagernet/sing/service/filemanager"
+	"github.com/sagernet/ws"
+	"github.com/sagernet/ws/wsutil"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+func init() {
+	experimental.RegisterClashServerConstructor(NewServer)
+}
+
+var _ adapter.ClashServer = (*Server)(nil)
+
+type Server struct {
+	ctx            context.Context
+	router         adapter.Router
+	dnsRouter      adapter.DNSRouter
+	outbound       adapter.OutboundManager
+	endpoint       adapter.EndpointManager
+	logger         log.Logger
+	httpServer     *http.Server
+	trafficManager *trafficontrol.Manager
+	urlTestHistory adapter.URLTestHistoryStorage
+	logDebug       bool
+
+	mode           string
+	modeList       []string
+	modeUpdateHook *observable.Subscriber[struct{}]
+
+	externalController       bool
+	externalUI               string
+	externalUIDownloadURL    string
+	externalUIDownloadDetour string
+}
+
+func NewServer(ctx context.Context, logFactory log.ObservableFactory, options option.ClashAPIOptions) (adapter.ClashServer, error) {
+	trafficManager := trafficontrol.NewManager()
+	chiRouter := chi.NewRouter()
+	s := &Server{
+		ctx:       ctx,
+		router:    service.FromContext[adapter.Router](ctx),
+		dnsRouter: service.FromContext[adapter.DNSRouter](ctx),
+		outbound:  service.FromContext[adapter.OutboundManager](ctx),
+		endpoint:  service.FromContext[adapter.EndpointManager](ctx),
+		logger:    logFactory.NewLogger("clash-api"),
+		httpServer: &http.Server{
+			Addr:    options.ExternalController,
+			Handler: chiRouter,
+		},
+		trafficManager:           trafficManager,
+		logDebug:                 logFactory.Level() >= log.LevelDebug,
+		modeList:                 options.ModeList,
+		externalController:       options.ExternalController != "",
+		externalUIDownloadURL:    options.ExternalUIDownloadURL,
+		externalUIDownloadDetour: options.ExternalUIDownloadDetour,
+	}
+	s.urlTestHistory = service.FromContext[adapter.URLTestHistoryStorage](ctx)
+	if s.urlTestHistory == nil {
+		s.urlTestHistory = urltest.NewHistoryStorage()
+	}
+	defaultMode := "Rule"
+	if options.DefaultMode != "" {
+		defaultMode = options.DefaultMode
+	}
+	if !common.Contains(s.modeList, defaultMode) {
+		s.modeList = append([]string{defaultMode}, s.modeList...)
+	}
+	s.mode = defaultMode
+	//goland:noinspection GoDeprecation
+	//nolint:staticcheck
+	if options.StoreMode || options.StoreSelected || options.StoreFakeIP || options.CacheFile != "" || options.CacheID != "" {
+		return nil, E.New("cache_file and related fields in Clash API is deprecated in sing-box 1.8.0, use experimental.cache_file instead.")
+	}
+	allowedOrigins := options.AccessControlAllowOrigin
+	if len(allowedOrigins) == 0 {
+		allowedOrigins = []string{"*"}
+	}
+	cors := cors.New(cors.Options{
+		AllowedOrigins:      allowedOrigins,
+		AllowedMethods:      []string{"GET", "POST", "PUT", "PATCH", "DELETE"},
+		AllowedHeaders:      []string{"Content-Type", "Authorization"},
+		AllowPrivateNetwork: options.AccessControlAllowPrivateNetwork,
+		MaxAge:              300,
+	})
+	chiRouter.Use(cors.Handler)
+	chiRouter.Group(func(r chi.Router) {
+		r.Use(authentication(options.Secret))
+		r.Get("/", hello(options.ExternalUI != ""))
+		r.Get("/logs", getLogs(s.ctx, logFactory))
+		r.Get("/traffic", traffic(s.ctx, trafficManager))
+		r.Get("/version", version)
+		r.Mount("/configs", configRouter(s, logFactory))
+		r.Mount("/proxies", proxyRouter(s, s.router))
+		r.Mount("/rules", ruleRouter(s.router))
+		r.Mount("/connections", connectionRouter(s.ctx, s.router, trafficManager))
+		r.Mount("/providers/proxies", proxyProviderRouter())
+		r.Mount("/providers/rules", ruleProviderRouter())
+		r.Mount("/script", scriptRouter())
+		r.Mount("/profile", profileRouter())
+		r.Mount("/cache", cacheRouter(ctx))
+		r.Mount("/dns", dnsRouter(s.dnsRouter))
+
+		s.setupMetaAPI(r)
+	})
+	if options.ExternalUI != "" {
+		s.externalUI = filemanager.BasePath(ctx, os.ExpandEnv(options.ExternalUI))
+		chiRouter.Group(func(r chi.Router) {
+			r.Get("/ui", http.RedirectHandler("/ui/", http.StatusMovedPermanently).ServeHTTP)
+			r.Handle("/ui/*", http.StripPrefix("/ui/", http.FileServer(Dir(s.externalUI))))
+		})
+	}
+	return s, nil
+}
+
+func (s *Server) Name() string {
+	return "clash server"
+}
+
+func (s *Server) Start(stage adapter.StartStage) error {
+	switch stage {
+	case adapter.StartStateStart:
+		cacheFile := service.FromContext[adapter.CacheFile](s.ctx)
+		if cacheFile != nil {
+			mode := cacheFile.LoadMode()
+			if common.Any(s.modeList, func(it string) bool {
+				return strings.EqualFold(it, mode)
+			}) {
+				s.mode = mode
+			}
+		}
+	case adapter.StartStateStarted:
+		if s.externalController {
+			s.checkAndDownloadExternalUI()
+			var (
+				listener net.Listener
+				err      error
+			)
+			for i := 0; i < 3; i++ {
+				listener, err = net.Listen("tcp", s.httpServer.Addr)
+				if runtime.GOOS == "android" && errors.Is(err, syscall.EADDRINUSE) {
+					time.Sleep(100 * time.Millisecond)
+					continue
+				}
+				break
+			}
+			if err != nil {
+				return E.Cause(err, "external controller listen error")
+			}
+			s.logger.Info("restful api listening at ", listener.Addr())
+			go func() {
+				err = s.httpServer.Serve(listener)
+				if err != nil && !errors.Is(err, http.ErrServerClosed) {
+					s.logger.Error("external controller serve error: ", err)
+				}
+			}()
+		}
+	}
+
+	return nil
+}
+
+func (s *Server) Close() error {
+	return common.Close(
+		common.PtrOrNil(s.httpServer),
+		s.trafficManager,
+		s.urlTestHistory,
+	)
+}
+
+func (s *Server) Mode() string {
+	return s.mode
+}
+
+func (s *Server) ModeList() []string {
+	return s.modeList
+}
+
+func (s *Server) SetModeUpdateHook(hook *observable.Subscriber[struct{}]) {
+	s.modeUpdateHook = hook
+}
+
+func (s *Server) SetMode(newMode string) {
+	if !common.Contains(s.modeList, newMode) {
+		newMode = common.Find(s.modeList, func(it string) bool {
+			return strings.EqualFold(it, newMode)
+		})
+	}
+	if !common.Contains(s.modeList, newMode) {
+		return
+	}
+	if newMode == s.mode {
+		return
+	}
+	s.mode = newMode
+	if s.modeUpdateHook != nil {
+		s.modeUpdateHook.Emit(struct{}{})
+	}
+	s.dnsRouter.ClearCache()
+	cacheFile := service.FromContext[adapter.CacheFile](s.ctx)
+	if cacheFile != nil {
+		err := cacheFile.StoreMode(newMode)
+		if err != nil {
+			s.logger.Error(E.Cause(err, "save mode"))
+		}
+	}
+	s.logger.Info("updated mode: ", newMode)
+}
+
+func (s *Server) HistoryStorage() adapter.URLTestHistoryStorage {
+	return s.urlTestHistory
+}
+
+func (s *Server) TrafficManager() *trafficontrol.Manager {
+	return s.trafficManager
+}
+
+func (s *Server) RoutedConnection(ctx context.Context, conn net.Conn, metadata adapter.InboundContext, matchedRule adapter.Rule, matchOutbound adapter.Outbound) net.Conn {
+	return trafficontrol.NewTCPTracker(conn, s.trafficManager, metadata, s.outbound, matchedRule, matchOutbound)
+}
+
+func (s *Server) RoutedPacketConnection(ctx context.Context, conn N.PacketConn, metadata adapter.InboundContext, matchedRule adapter.Rule, matchOutbound adapter.Outbound) N.PacketConn {
+	return trafficontrol.NewUDPTracker(conn, s.trafficManager, metadata, s.outbound, matchedRule, matchOutbound)
+}
+
+func authentication(serverSecret string) func(next http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+			if serverSecret == "" {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			// Browser websocket not support custom header
+			if r.Header.Get("Upgrade") == "websocket" && r.URL.Query().Get("token") != "" {
+				token := r.URL.Query().Get("token")
+				if token != serverSecret {
+					render.Status(r, http.StatusUnauthorized)
+					render.JSON(w, r, ErrUnauthorized)
+					return
+				}
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			header := r.Header.Get("Authorization")
+			bearer, token, found := strings.Cut(header, " ")
+
+			hasInvalidHeader := bearer != "Bearer"
+			hasInvalidSecret := !found || token != serverSecret
+			if hasInvalidHeader || hasInvalidSecret {
+				render.Status(r, http.StatusUnauthorized)
+				render.JSON(w, r, ErrUnauthorized)
+				return
+			}
+			next.ServeHTTP(w, r)
+		}
+		return http.HandlerFunc(fn)
+	}
+}
+
+func hello(redirect bool) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		contentType := r.Header.Get("Content-Type")
+		if !redirect || contentType == "application/json" {
+			render.JSON(w, r, render.M{"hello": "clash"})
+		} else {
+			http.Redirect(w, r, "/ui/", http.StatusTemporaryRedirect)
+		}
+	}
+}
+
+type Traffic struct {
+	Up   int64 `json:"up"`
+	Down int64 `json:"down"`
+}
+
+func traffic(ctx context.Context, trafficManager *trafficontrol.Manager) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var conn net.Conn
+		if r.Header.Get("Upgrade") == "websocket" {
+			var err error
+			conn, _, _, err = ws.UpgradeHTTP(r, w)
+			if err != nil {
+				return
+			}
+			defer conn.Close()
+		}
+
+		if conn == nil {
+			w.Header().Set("Content-Type", "application/json")
+			render.Status(r, http.StatusOK)
+		}
+
+		tick := time.NewTicker(time.Second)
+		defer tick.Stop()
+		buf := &bytes.Buffer{}
+		uploadTotal, downloadTotal := trafficManager.Total()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-tick.C:
+			}
+			buf.Reset()
+			uploadTotalNew, downloadTotalNew := trafficManager.Total()
+			err := json.NewEncoder(buf).Encode(Traffic{
+				Up:   uploadTotalNew - uploadTotal,
+				Down: downloadTotalNew - downloadTotal,
+			})
+			if err != nil {
+				break
+			}
+			if conn == nil {
+				_, err = w.Write(buf.Bytes())
+				w.(http.Flusher).Flush()
+			} else {
+				err = wsutil.WriteServerText(conn, buf.Bytes())
+			}
+			if err != nil {
+				break
+			}
+
+			uploadTotal = uploadTotalNew
+			downloadTotal = downloadTotalNew
+		}
+	}
+}
+
+type Log struct {
+	Type    string `json:"type"`
+	Payload string `json:"payload"`
+}
+
+func getLogs(ctx context.Context, logFactory log.ObservableFactory) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		levelText := r.URL.Query().Get("level")
+		if levelText == "" {
+			levelText = "info"
+		}
+
+		level, ok := log.ParseLevel(levelText)
+		if ok != nil {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, ErrBadRequest)
+			return
+		}
+
+		subscription, done, err := logFactory.Subscribe()
+		if err != nil {
+			render.Status(r, http.StatusNoContent)
+			return
+		}
+		defer logFactory.UnSubscribe(subscription)
+
+		var conn net.Conn
+		if r.Header.Get("Upgrade") == "websocket" {
+			conn, _, _, err = ws.UpgradeHTTP(r, w)
+			if err != nil {
+				return
+			}
+			defer conn.Close()
+		}
+
+		if conn == nil {
+			w.Header().Set("Content-Type", "application/json")
+			render.Status(r, http.StatusOK)
+		}
+
+		buf := &bytes.Buffer{}
+		var logEntry log.Entry
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-done:
+				return
+			case logEntry = <-subscription:
+			}
+			if logEntry.Level > level {
+				continue
+			}
+			buf.Reset()
+			err = json.NewEncoder(buf).Encode(Log{
+				Type:    log.FormatLevel(logEntry.Level),
+				Payload: logEntry.Message,
+			})
+			if err != nil {
+				break
+			}
+			if conn == nil {
+				_, err = w.Write(buf.Bytes())
+				w.(http.Flusher).Flush()
+			} else {
+				err = wsutil.WriteServerText(conn, buf.Bytes())
+			}
+
+			if err != nil {
+				break
+			}
+		}
+	}
+}
+
+func version(w http.ResponseWriter, r *http.Request) {
+	render.JSON(w, r, render.M{"version": "sing-box " + C.Version, "premium": true, "meta": true})
+}
--- a/experimental/clashapi/server_fs.go
+++ b/experimental/clashapi/server_fs.go
@@ -0,0 +1,18 @@
+package clashapi
+
+import "net/http"
+
+type Dir http.Dir
+
+func (d Dir) Open(name string) (http.File, error) {
+	file, err := http.Dir(d).Open(name)
+	if err != nil {
+		return nil, err
+	}
+	return &fileWrapper{file}, nil
+}
+
+// workaround for #2345 #2596
+type fileWrapper struct {
+	http.File
+}
--- a/experimental/clashapi/server_resources.go
+++ b/experimental/clashapi/server_resources.go
@@ -0,0 +1,170 @@
+package clashapi
+
+import (
+	"archive/zip"
+	"context"
+	"crypto/tls"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/sagernet/sing-box/adapter"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing/common"
+	E "github.com/sagernet/sing/common/exceptions"
+	M "github.com/sagernet/sing/common/metadata"
+	"github.com/sagernet/sing/common/ntp"
+	"github.com/sagernet/sing/service/filemanager"
+)
+
+func (s *Server) checkAndDownloadExternalUI() {
+	if s.externalUI == "" {
+		return
+	}
+	entries, err := os.ReadDir(s.externalUI)
+	if err != nil {
+		os.MkdirAll(s.externalUI, 0o755)
+	}
+	if len(entries) == 0 {
+		err = s.downloadExternalUI()
+		if err != nil {
+			s.logger.Error("download external ui error: ", err)
+		}
+	}
+}
+
+func (s *Server) downloadExternalUI() error {
+	var downloadURL string
+	if s.externalUIDownloadURL != "" {
+		downloadURL = s.externalUIDownloadURL
+	} else {
+		downloadURL = "https://github.com/MetaCubeX/Yacd-meta/archive/gh-pages.zip"
+	}
+	var detour adapter.Outbound
+	if s.externalUIDownloadDetour != "" {
+		outbound, loaded := s.outbound.Outbound(s.externalUIDownloadDetour)
+		if !loaded {
+			return E.New("detour outbound not found: ", s.externalUIDownloadDetour)
+		}
+		detour = outbound
+	} else {
+		outbound := s.outbound.Default()
+		detour = outbound
+	}
+	s.logger.Info("downloading external ui using outbound/", detour.Type(), "[", detour.Tag(), "]")
+	httpClient := &http.Client{
+		Transport: &http.Transport{
+			ForceAttemptHTTP2:   true,
+			TLSHandshakeTimeout: C.TCPTimeout,
+			DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+				return detour.DialContext(ctx, network, M.ParseSocksaddr(addr))
+			},
+			TLSClientConfig: &tls.Config{
+				Time:    ntp.TimeFuncFromContext(s.ctx),
+				RootCAs: adapter.RootPoolFromContext(s.ctx),
+			},
+		},
+	}
+	defer httpClient.CloseIdleConnections()
+	response, err := httpClient.Get(downloadURL)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return E.New("download external ui failed: ", response.Status)
+	}
+	err = s.downloadZIP(response.Body, s.externalUI)
+	if err != nil {
+		removeAllInDirectory(s.externalUI)
+	}
+	return err
+}
+
+func (s *Server) downloadZIP(body io.Reader, output string) error {
+	tempFile, err := filemanager.CreateTemp(s.ctx, "external-ui.zip")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tempFile.Name())
+	_, err = io.Copy(tempFile, body)
+	tempFile.Close()
+	if err != nil {
+		return err
+	}
+	reader, err := zip.OpenReader(tempFile.Name())
+	if err != nil {
+		return err
+	}
+	defer reader.Close()
+	trimDir := zipIsInSingleDirectory(reader.File)
+	for _, file := range reader.File {
+		if file.FileInfo().IsDir() {
+			continue
+		}
+		pathElements := strings.Split(file.Name, "/")
+		if trimDir {
+			pathElements = pathElements[1:]
+		}
+		saveDirectory := output
+		if len(pathElements) > 1 {
+			saveDirectory = filepath.Join(saveDirectory, filepath.Join(pathElements[:len(pathElements)-1]...))
+		}
+		err = os.MkdirAll(saveDirectory, 0o755)
+		if err != nil {
+			return err
+		}
+		savePath := filepath.Join(saveDirectory, pathElements[len(pathElements)-1])
+		err = downloadZIPEntry(s.ctx, file, savePath)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func downloadZIPEntry(ctx context.Context, zipFile *zip.File, savePath string) error {
+	saveFile, err := filemanager.Create(ctx, savePath)
+	if err != nil {
+		return err
+	}
+	defer saveFile.Close()
+	reader, err := zipFile.Open()
+	if err != nil {
+		return err
+	}
+	defer reader.Close()
+	return common.Error(io.Copy(saveFile, reader))
+}
+
+func removeAllInDirectory(directory string) {
+	dirEntries, err := os.ReadDir(directory)
+	if err != nil {
+		return
+	}
+	for _, dirEntry := range dirEntries {
+		os.RemoveAll(filepath.Join(directory, dirEntry.Name()))
+	}
+}
+
+func zipIsInSingleDirectory(files []*zip.File) bool {
+	var singleDirectory string
+	for _, file := range files {
+		if file.FileInfo().IsDir() {
+			continue
+		}
+		pathElements := strings.Split(file.Name, "/")
+		if len(pathElements) == 0 {
+			return false
+		}
+		if singleDirectory == "" {
+			singleDirectory = pathElements[0]
+		} else if singleDirectory != pathElements[0] {
+			return false
+		}
+	}
+	return true
+}
--- a/experimental/clashapi/trafficontrol/manager.go
+++ b/experimental/clashapi/trafficontrol/manager.go
@@ -0,0 +1,181 @@
+package trafficontrol
+
+import (
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/sagernet/sing-box/common/compatible"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/json"
+	"github.com/sagernet/sing/common/observable"
+	"github.com/sagernet/sing/common/x/list"
+
+	"github.com/gofrs/uuid/v5"
+)
+
+type ConnectionEventType int
+
+const (
+	ConnectionEventNew ConnectionEventType = iota
+	ConnectionEventUpdate
+	ConnectionEventClosed
+)
+
+type ConnectionEvent struct {
+	Type          ConnectionEventType
+	ID            uuid.UUID
+	Metadata      *TrackerMetadata
+	UplinkDelta   int64
+	DownlinkDelta int64
+	ClosedAt      time.Time
+}
+
+const closedConnectionsLimit = 1000
+
+type Manager struct {
+	uploadTotal   atomic.Int64
+	downloadTotal atomic.Int64
+
+	connections             compatible.Map[uuid.UUID, Tracker]
+	closedConnectionsAccess sync.Mutex
+	closedConnections       list.List[TrackerMetadata]
+	memory                  uint64
+
+	eventSubscriber *observable.Subscriber[ConnectionEvent]
+}
+
+func NewManager() *Manager {
+	return &Manager{}
+}
+
+func (m *Manager) SetEventHook(subscriber *observable.Subscriber[ConnectionEvent]) {
+	m.eventSubscriber = subscriber
+}
+
+func (m *Manager) Join(c Tracker) {
+	metadata := c.Metadata()
+	m.connections.Store(metadata.ID, c)
+	if m.eventSubscriber != nil {
+		m.eventSubscriber.Emit(ConnectionEvent{
+			Type:     ConnectionEventNew,
+			ID:       metadata.ID,
+			Metadata: metadata,
+		})
+	}
+}
+
+func (m *Manager) Leave(c Tracker) {
+	metadata := c.Metadata()
+	_, loaded := m.connections.LoadAndDelete(metadata.ID)
+	if loaded {
+		closedAt := time.Now()
+		metadata.ClosedAt = closedAt
+		metadataCopy := *metadata
+		m.closedConnectionsAccess.Lock()
+		if m.closedConnections.Len() >= closedConnectionsLimit {
+			m.closedConnections.PopFront()
+		}
+		m.closedConnections.PushBack(metadataCopy)
+		m.closedConnectionsAccess.Unlock()
+		if m.eventSubscriber != nil {
+			m.eventSubscriber.Emit(ConnectionEvent{
+				Type:     ConnectionEventClosed,
+				ID:       metadata.ID,
+				Metadata: &metadataCopy,
+				ClosedAt: closedAt,
+			})
+		}
+	}
+}
+
+func (m *Manager) PushUploaded(size int64) {
+	m.uploadTotal.Add(size)
+}
+
+func (m *Manager) PushDownloaded(size int64) {
+	m.downloadTotal.Add(size)
+}
+
+func (m *Manager) Total() (up int64, down int64) {
+	return m.uploadTotal.Load(), m.downloadTotal.Load()
+}
+
+func (m *Manager) ConnectionsLen() int {
+	return m.connections.Len()
+}
+
+func (m *Manager) Connections() []*TrackerMetadata {
+	var connections []*TrackerMetadata
+	m.connections.Range(func(_ uuid.UUID, value Tracker) bool {
+		connections = append(connections, value.Metadata())
+		return true
+	})
+	return connections
+}
+
+func (m *Manager) ClosedConnections() []*TrackerMetadata {
+	m.closedConnectionsAccess.Lock()
+	values := m.closedConnections.Array()
+	m.closedConnectionsAccess.Unlock()
+	if len(values) == 0 {
+		return nil
+	}
+	connections := make([]*TrackerMetadata, len(values))
+	for i := range values {
+		connections[i] = &values[i]
+	}
+	return connections
+}
+
+func (m *Manager) Connection(id uuid.UUID) Tracker {
+	connection, loaded := m.connections.Load(id)
+	if !loaded {
+		return nil
+	}
+	return connection
+}
+
+func (m *Manager) Snapshot() *Snapshot {
+	var connections []Tracker
+	m.connections.Range(func(_ uuid.UUID, value Tracker) bool {
+		if value.Metadata().OutboundType != C.TypeDNS {
+			connections = append(connections, value)
+		}
+		return true
+	})
+
+	var memStats runtime.MemStats
+	runtime.ReadMemStats(&memStats)
+	m.memory = memStats.StackInuse + memStats.HeapInuse + memStats.HeapIdle - memStats.HeapReleased
+
+	return &Snapshot{
+		Upload:      m.uploadTotal.Load(),
+		Download:    m.downloadTotal.Load(),
+		Connections: connections,
+		Memory:      m.memory,
+	}
+}
+
+func (m *Manager) ResetStatistic() {
+	m.uploadTotal.Store(0)
+	m.downloadTotal.Store(0)
+}
+
+type Snapshot struct {
+	Download    int64
+	Upload      int64
+	Connections []Tracker
+	Memory      uint64
+}
+
+func (s *Snapshot) MarshalJSON() ([]byte, error) {
+	return json.Marshal(map[string]any{
+		"downloadTotal": s.Download,
+		"uploadTotal":   s.Upload,
+		"connections":   common.Map(s.Connections, func(t Tracker) *TrackerMetadata { return t.Metadata() }),
+		"memory":        s.Memory,
+	})
+}
--- a/experimental/clashapi/trafficontrol/tracker.go
+++ b/experimental/clashapi/trafficontrol/tracker.go
@@ -0,0 +1,254 @@
+package trafficontrol
+
+import (
+	"net"
+	"sync/atomic"
+	"time"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/bufio"
+	F "github.com/sagernet/sing/common/format"
+	"github.com/sagernet/sing/common/json"
+	N "github.com/sagernet/sing/common/network"
+
+	"github.com/gofrs/uuid/v5"
+)
+
+type TrackerMetadata struct {
+	ID           uuid.UUID
+	Metadata     adapter.InboundContext
+	CreatedAt    time.Time
+	ClosedAt     time.Time
+	Upload       *atomic.Int64
+	Download     *atomic.Int64
+	Chain        []string
+	Rule         adapter.Rule
+	Outbound     string
+	OutboundType string
+}
+
+func (t TrackerMetadata) MarshalJSON() ([]byte, error) {
+	var inbound string
+	if t.Metadata.Inbound != "" {
+		inbound = t.Metadata.InboundType + "/" + t.Metadata.Inbound
+	} else {
+		inbound = t.Metadata.InboundType
+	}
+	var domain string
+	if t.Metadata.Domain != "" {
+		domain = t.Metadata.Domain
+	} else {
+		domain = t.Metadata.Destination.Fqdn
+	}
+	var processPath string
+	if t.Metadata.ProcessInfo != nil {
+		if t.Metadata.ProcessInfo.ProcessPath != "" {
+			processPath = t.Metadata.ProcessInfo.ProcessPath
+		} else if len(t.Metadata.ProcessInfo.AndroidPackageNames) > 0 {
+			processPath = t.Metadata.ProcessInfo.AndroidPackageNames[0]
+		}
+		if processPath == "" {
+			if t.Metadata.ProcessInfo.UserId != -1 {
+				processPath = F.ToString(t.Metadata.ProcessInfo.UserId)
+			}
+		} else if t.Metadata.ProcessInfo.UserName != "" {
+			processPath = F.ToString(processPath, " (", t.Metadata.ProcessInfo.UserName, ")")
+		} else if t.Metadata.ProcessInfo.UserId != -1 {
+			processPath = F.ToString(processPath, " (", t.Metadata.ProcessInfo.UserId, ")")
+		}
+	}
+	var rule string
+	if t.Rule != nil {
+		rule = F.ToString(t.Rule, " => ", t.Rule.Action())
+	} else {
+		rule = "final"
+	}
+	return json.Marshal(map[string]any{
+		"id": t.ID,
+		"metadata": map[string]any{
+			"network":         t.Metadata.Network,
+			"type":            inbound,
+			"sourceIP":        t.Metadata.Source.Addr,
+			"destinationIP":   t.Metadata.Destination.Addr,
+			"sourcePort":      F.ToString(t.Metadata.Source.Port),
+			"destinationPort": F.ToString(t.Metadata.Destination.Port),
+			"host":            domain,
+			"dnsMode":         "normal",
+			"processPath":     processPath,
+		},
+		"upload":      t.Upload.Load(),
+		"download":    t.Download.Load(),
+		"start":       t.CreatedAt,
+		"chains":      t.Chain,
+		"rule":        rule,
+		"rulePayload": "",
+	})
+}
+
+type Tracker interface {
+	Metadata() *TrackerMetadata
+	Close() error
+}
+
+type TCPConn struct {
+	N.ExtendedConn
+	metadata TrackerMetadata
+	manager  *Manager
+}
+
+func (tt *TCPConn) Metadata() *TrackerMetadata {
+	return &tt.metadata
+}
+
+func (tt *TCPConn) Close() error {
+	tt.manager.Leave(tt)
+	return tt.ExtendedConn.Close()
+}
+
+func (tt *TCPConn) Upstream() any {
+	return tt.ExtendedConn
+}
+
+func (tt *TCPConn) ReaderReplaceable() bool {
+	return true
+}
+
+func (tt *TCPConn) WriterReplaceable() bool {
+	return true
+}
+
+func NewTCPTracker(conn net.Conn, manager *Manager, metadata adapter.InboundContext, outboundManager adapter.OutboundManager, matchRule adapter.Rule, matchOutbound adapter.Outbound) *TCPConn {
+	id, _ := uuid.NewV4()
+	var (
+		chain        []string
+		next         string
+		outbound     string
+		outboundType string
+	)
+	if matchOutbound != nil {
+		next = matchOutbound.Tag()
+	} else {
+		next = outboundManager.Default().Tag()
+	}
+	for {
+		detour, loaded := outboundManager.Outbound(next)
+		if !loaded {
+			break
+		}
+		chain = append(chain, next)
+		outbound = detour.Tag()
+		outboundType = detour.Type()
+		group, isGroup := detour.(adapter.OutboundGroup)
+		if !isGroup {
+			break
+		}
+		next = group.Now()
+	}
+	upload := new(atomic.Int64)
+	download := new(atomic.Int64)
+	tracker := &TCPConn{
+		ExtendedConn: bufio.NewCounterConn(conn, []N.CountFunc{func(n int64) {
+			upload.Add(n)
+			manager.PushUploaded(n)
+		}}, []N.CountFunc{func(n int64) {
+			download.Add(n)
+			manager.PushDownloaded(n)
+		}}),
+		metadata: TrackerMetadata{
+			ID:           id,
+			Metadata:     metadata,
+			CreatedAt:    time.Now(),
+			Upload:       upload,
+			Download:     download,
+			Chain:        common.Reverse(chain),
+			Rule:         matchRule,
+			Outbound:     outbound,
+			OutboundType: outboundType,
+		},
+		manager: manager,
+	}
+	manager.Join(tracker)
+	return tracker
+}
+
+type UDPConn struct {
+	N.PacketConn `json:"-"`
+	metadata     TrackerMetadata
+	manager      *Manager
+}
+
+func (ut *UDPConn) Metadata() *TrackerMetadata {
+	return &ut.metadata
+}
+
+func (ut *UDPConn) Close() error {
+	ut.manager.Leave(ut)
+	return ut.PacketConn.Close()
+}
+
+func (ut *UDPConn) Upstream() any {
+	return ut.PacketConn
+}
+
+func (ut *UDPConn) ReaderReplaceable() bool {
+	return true
+}
+
+func (ut *UDPConn) WriterReplaceable() bool {
+	return true
+}
+
+func NewUDPTracker(conn N.PacketConn, manager *Manager, metadata adapter.InboundContext, outboundManager adapter.OutboundManager, matchRule adapter.Rule, matchOutbound adapter.Outbound) *UDPConn {
+	id, _ := uuid.NewV4()
+	var (
+		chain        []string
+		next         string
+		outbound     string
+		outboundType string
+	)
+	if matchOutbound != nil {
+		next = matchOutbound.Tag()
+	} else {
+		next = outboundManager.Default().Tag()
+	}
+	for {
+		detour, loaded := outboundManager.Outbound(next)
+		if !loaded {
+			break
+		}
+		chain = append(chain, next)
+		outbound = detour.Tag()
+		outboundType = detour.Type()
+		group, isGroup := detour.(adapter.OutboundGroup)
+		if !isGroup {
+			break
+		}
+		next = group.Now()
+	}
+	upload := new(atomic.Int64)
+	download := new(atomic.Int64)
+	trackerConn := &UDPConn{
+		PacketConn: bufio.NewCounterPacketConn(conn, []N.CountFunc{func(n int64) {
+			upload.Add(n)
+			manager.PushUploaded(n)
+		}}, []N.CountFunc{func(n int64) {
+			download.Add(n)
+			manager.PushDownloaded(n)
+		}}),
+		metadata: TrackerMetadata{
+			ID:           id,
+			Metadata:     metadata,
+			CreatedAt:    time.Now(),
+			Upload:       upload,
+			Download:     download,
+			Chain:        common.Reverse(chain),
+			Rule:         matchRule,
+			Outbound:     outbound,
+			OutboundType: outboundType,
+		},
+		manager: manager,
+	}
+	manager.Join(trackerConn)
+	return trackerConn
+}