#!/bin/bash
# ==============================================================================
# Google 定位纠偏与美区解锁维护工具 (GoogleToUS - Enhanced Dual-Stack Edition)
# 适用场景: IP 被误判送中、Gemini 锁区、IPv6 送中陷阱、Google 地区纠偏、WARP 分流联动
# 快捷指令: us
# ==============================================================================

# ANSI Color Codes
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BLUE='\033[0;34m'
MAGENTA='\033[0;35m'
CYAN='\033[0;36m'
WHITE='\033[1;37m'
BOLD='\033[1m'
NC='\033[0m'

PING_SCRIPT="/usr/local/bin/google_us_ping.sh"
SERVICE_FILE_SYSTEMD="/etc/systemd/system/google-us-ping.service"
SERVICE_FILE_OPENRC="/etc/init.d/google-us-ping"
LOCAL_SCRIPT="/usr/local/bin/google_us_manager.sh"
GAI_CONF="/etc/gai.conf"

show_banner() {
    [ -t 1 ] && [ -n "$TERM" ] && clear 2>/dev/null || true
    echo -e "${BLUE}╔═════════════════════════════════════════════════════════════════════════╗${NC}"
    echo -e "${BLUE}║${WHITE}${BOLD}   ★  ★  ★  ★  ★  ${RED}██████████████████████████████████████████████████████${BLUE}║${NC}"
    echo -e "${BLUE}║${WHITE}${BOLD}    ★  ★  ★  ★    ${NC}                                                        ${BLUE}║${NC}"
    echo -e "${BLUE}║${WHITE}${BOLD}   ★  ★  ★  ★  ★  ${RED}██████████████████████████████████████████████████████${BLUE}║${NC}"
    echo -e "${BLUE}║${WHITE}${BOLD}    ★  ★  ★  ★    ${NC}                                                        ${BLUE}║${NC}"
    echo -e "${BLUE}║${RED}███████████████████████████████████████████████████████████████████████║${NC}"
    echo -e "${BLUE}║${NC}                                                                       ${BLUE}║${NC}"
    echo -e "${BLUE}║${RED}███████████████████████████████████████████████████████████████████████║${NC}"
    echo -e "${BLUE}╚═════════════════════════════════════════════════════════════════════════╝${NC}"
    echo ""
    echo -e "   ${CYAN}${BOLD}GoogleToUS${NC} - ${GREEN}Google 美区定位纠偏 & IPv4/IPv6 双栈解锁维护工具${NC}"
    echo -e "   ${YELLOW}支持架构: Systemd (Debian/Ubuntu/CentOS) & OpenRC (Alpine Linux)${NC}"
    echo ""
}

# ------------------------------------------------------------------------------
# 状态检测逻辑 (IPv4 & IPv6 双栈独立检测)
# ------------------------------------------------------------------------------
is_openrc() {
    if command -v rc-service >/dev/null 2>&1 || [ -f /etc/alpine-release ]; then
        return 0
    fi
    return 1
}

has_ipv6() {
    if curl -6 -s --connect-timeout 2 https://api6.ipify.org >/dev/null 2>&1; then
        return 0
    fi
    return 1
}

check_ping_status() {
    if is_openrc; then
        if rc-service google-us-ping status 2>/dev/null | grep -qi "started"; then
            echo -e "${GREEN}[运行中]${NC}"
        else
            echo -e "${RED}[未运行]${NC}"
        fi
    else
        if systemctl is-active --quiet google-us-ping.service 2>/dev/null; then
            echo -e "${GREEN}[运行中]${NC}"
        else
            echo -e "${RED}[未运行]${NC}"
        fi
    fi
}

check_google_loc_v4() {
    local loc
    loc=$(curl -4 -s -I --connect-timeout 4 https://www.google.com/ncr 2>/dev/null | grep -i "^location:" | awk '{print $2}' | tr -d '\r\n' || true)
    if [ -z "$loc" ]; then
        loc=$(curl -4 -s -I --connect-timeout 4 https://www.google.com 2>/dev/null | grep -i "^location:" | awk '{print $2}' | tr -d '\r\n' || true)
    fi

    if [ -n "$loc" ]; then
        if echo "$loc" | grep -qi "google.cn"; then
            echo -e "${RED}送中 (google.cn)${NC}"
        elif echo "$loc" | grep -qi "google.com.hk"; then
            echo -e "${YELLOW}香港 (google.com.hk)${NC}"
        else
            echo -e "${CYAN}重定向至 $loc${NC}"
        fi
    else
        echo -e "${GREEN}正常 (国际版)${NC}"
    fi
}

check_google_loc_v6() {
    if ! has_ipv6; then
        echo -e "${MAGENTA}无 IPv6${NC}"
        return
    fi
    local loc
    loc=$(curl -6 -s -I --connect-timeout 4 https://www.google.com/ncr 2>/dev/null | grep -i "^location:" | awk '{print $2}' | tr -d '\r\n' || true)
    if [ -z "$loc" ]; then
        loc=$(curl -6 -s -I --connect-timeout 4 https://www.google.com 2>/dev/null | grep -i "^location:" | awk '{print $2}' | tr -d '\r\n' || true)
    fi

    if [ -n "$loc" ]; then
        if echo "$loc" | grep -qi "google.cn"; then
            echo -e "${RED}送中 (google.cn)${NC}"
        elif echo "$loc" | grep -qi "google.com.hk"; then
            echo -e "${YELLOW}香港 (google.com.hk)${NC}"
        else
            echo -e "${CYAN}重定向至 $loc${NC}"
        fi
    else
        echo -e "${GREEN}正常 (国际版)${NC}"
    fi
}

get_country_v4() {
    local code=""
    code=$(curl -4 -s -A "Mozilla/5.0" --connect-timeout 3 https://api.ip.sb/geoip 2>/dev/null | grep -o '"country_code":"[^"]*' | cut -d'"' -f4 || true)
    if [ -z "$code" ] || [ ${#code} -ne 2 ]; then
        code=$(curl -4 -s --connect-timeout 3 https://cloudflare.com/cdn-cgi/trace 2>/dev/null | awk -F= '/loc=/ {print $2}' | tr -d '[:space:]' || true)
    fi
    if [ -z "$code" ] || [ ${#code} -ne 2 ]; then
        code=$(curl -4 -s --connect-timeout 3 https://ipinfo.io/country 2>/dev/null | tr -d '[:space:]' || true)
    fi

    if [ "$code" = "US" ]; then
        echo -e "${GREEN}United States (US)${NC}"
    elif [ "$code" = "CN" ]; then
        echo -e "${RED}China (CN) ⚠️ [送中]${NC}"
    elif [ "$code" = "HK" ]; then
        echo -e "${YELLOW}Hong Kong (HK)${NC}"
    elif [ -n "$code" ] && [ ${#code} -eq 2 ]; then
        echo -e "${CYAN}${code}${NC}"
    else
        echo -e "${YELLOW}未知/超时${NC}"
    fi
}

get_country_v6() {
    if ! has_ipv6; then
        echo -e "${MAGENTA}无公网地址${NC}"
        return
    fi
    local code=""
    code=$(curl -6 -s -A "Mozilla/5.0" --connect-timeout 3 https://api.ip.sb/geoip 2>/dev/null | grep -o '"country_code":"[^"]*' | cut -d'"' -f4 || true)
    if [ -z "$code" ] || [ ${#code} -ne 2 ]; then
        code=$(curl -6 -s --connect-timeout 3 https://cloudflare.com/cdn-cgi/trace 2>/dev/null | awk -F= '/loc=/ {print $2}' | tr -d '[:space:]' || true)
    fi
    if [ -z "$code" ] || [ ${#code} -ne 2 ]; then
        code=$(curl -6 -s --connect-timeout 3 https://ipinfo.io/country 2>/dev/null | tr -d '[:space:]' || true)
    fi

    if [ "$code" = "US" ]; then
        echo -e "${GREEN}United States (US)${NC}"
    elif [ "$code" = "CN" ]; then
        echo -e "${RED}China (CN) ⚠️ [送中隐患!]${NC}"
    elif [ "$code" = "HK" ]; then
        echo -e "${YELLOW}Hong Kong (HK)${NC}"
    elif [ -n "$code" ] && [ ${#code} -eq 2 ]; then
        echo -e "${CYAN}${code}${NC}"
    else
        echo -e "${YELLOW}未知/超时${NC}"
    fi
}

check_gai_status() {
    if [ -f "$GAI_CONF" ] && grep -qE "^precedence\s+::ffff:0:0/96\s+100" "$GAI_CONF" 2>/dev/null; then
        echo -e "${GREEN}[IPv4 优先生效中]${NC}"
    else
        echo -e "${YELLOW}[系统默认 (IPv6 优先)]${NC}"
    fi
}

find_xray_config() {
    XRAY_CONF=""
    for path in "/usr/local/etc/xray/config.json" "/etc/xray/config.json" "/usr/local/etc/v2ray/config.json" "/etc/v2ray/config.json"; do
        if [ -f "$path" ]; then
            XRAY_CONF="$path"
            break
        fi
    done
}

check_xray_status() {
    find_xray_config
    if [ -z "$XRAY_CONF" ]; then
        echo -e "${MAGENTA}[未检测到配置文件]${NC}"
        return
    fi
    local active=false
    if is_openrc; then
        if rc-service xray status 2>/dev/null | grep -qi "started" || rc-service v2ray status 2>/dev/null | grep -qi "started"; then
            active=true
        fi
    else
        if systemctl is-active --quiet xray 2>/dev/null || systemctl is-active --quiet v2ray 2>/dev/null; then
            active=true
        fi
    fi

    local has_useipv4=false
    local has_sniffing=false
    if grep -qi "UseIPv4" "$XRAY_CONF" 2>/dev/null; then
        has_useipv4=true
    fi
    if grep -qi "sniffing" "$XRAY_CONF" 2>/dev/null; then
        has_sniffing=true
    fi

    if [ "$active" = true ]; then
        if [ "$has_useipv4" = true ] && [ "$has_sniffing" = true ]; then
            echo -e "${GREEN}[运行中 | 已防送中 (UseIPv4+嗅探)]${NC}"
        elif [ "$has_useipv4" = true ]; then
            echo -e "${GREEN}[运行中 | 已锁定 UseIPv4]${NC}"
        else
            echo -e "${YELLOW}[运行中 | 未优化 (有 IPv6 走偏风险)]${NC}"
        fi
    else
        echo -e "${RED}[服务未运行]${NC}"
    fi
}

check_xray_warp_status() {
    find_xray_config
    local warp_listening=false
    if ss -tlpn 2>/dev/null | grep -q "127.0.0.1:40000"; then
        warp_listening=true
    fi

    local xray_wired=false
    if [ -n "$XRAY_CONF" ] && grep -qi '"tag":\s*"warp"' "$XRAY_CONF" 2>/dev/null; then
        xray_wired=true
    fi

    if [ "$warp_listening" = true ]; then
        if [ "$xray_wired" = true ]; then
            echo -e "${GREEN}[WARP 已就绪并接入 Xray 分流]${NC}"
        else
            echo -e "${YELLOW}[WARP 本地运行中 (未接入 Xray)]${NC}"
        fi
    else
        if [ "$xray_wired" = true ]; then
            echo -e "${RED}[异常: Xray 已配置但 WARP 未启动]${NC}"
        else
            echo -e "${RED}[未运行]${NC}"
        fi
    fi
}

check_dns_egress_short() {
    local res
    res=$(curl -sL --connect-timeout 2 https://edns.ip-api.com/json 2>/dev/null || true)
    if [ -n "$res" ]; then
        local dns_geo ecs_geo
        dns_geo=$(echo "$res" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data.get('dns', {}).get('geo', ''))" 2>/dev/null || true)
        ecs_geo=$(echo "$res" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data.get('edns', {}).get('geo', ''))" 2>/dev/null || true)
        if [ -n "$ecs_geo" ]; then
            echo -e "${RED}${dns_geo:-未知} (⚠️ 检测到 ECS 泄漏: $ecs_geo)${NC}"
        elif [ -n "$dns_geo" ]; then
            echo -e "${GREEN}${dns_geo} (纯净无 ECS 泄漏)${NC}"
        else
            echo -e "${CYAN}已锁定美区 DoH (无泄漏)${NC}"
        fi
    else
        echo -e "${YELLOW}纯净 DoH / 检测超时${NC}"
    fi
}

check_skk_moe_short() {
    local raw
    raw=$(curl -4 -s --connect-timeout 2 https://ip.skk.moe/cdn-cgi/trace 2>/dev/null || true)
    if [ -n "$raw" ]; then
        local ip colo loc
        ip=$(echo "$raw" | awk -F= '/ip=/ {print $2}')
        colo=$(echo "$raw" | awk -F= '/colo=/ {print $2}')
        loc=$(echo "$raw" | awk -F= '/loc=/ {print $2}')
        echo -e "${GREEN}${ip}${NC} [机房: ${CYAN}${colo}${NC} | 归属: ${YELLOW}${loc}${NC}]"
    else
        echo -e "${YELLOW}检测超时${NC}"
    fi
}

# ------------------------------------------------------------------------------
# 快捷指令与基础环境
# ------------------------------------------------------------------------------
setup_shortcut() {
    if [ ! -f "$LOCAL_SCRIPT" ] || [ "$(readlink -f "$0" 2>/dev/null)" != "$LOCAL_SCRIPT" ]; then
        if [ -f "$0" ] && [ "$0" != "/dev/stdin" ] && [[ "$0" != /dev/fd/* ]]; then
            cp -f "$(readlink -f "$0")" "$LOCAL_SCRIPT" 2>/dev/null || true
        fi
        chmod +x "$LOCAL_SCRIPT" 2>/dev/null || true
    fi
    ln -sf "$LOCAL_SCRIPT" /usr/local/bin/us 2>/dev/null || true
    chmod +x /usr/local/bin/us 2>/dev/null || true
}

install_dependencies() {
    local pkgs=()
    command -v curl >/dev/null 2>&1 || pkgs+=(curl)
    command -v jq >/dev/null 2>&1 || pkgs+=(jq)
    command -v python3 >/dev/null 2>&1 || pkgs+=(python3)
    command -v bash >/dev/null 2>&1 || pkgs+=(bash)

    if [ ${#pkgs[@]} -gt 0 ]; then
        if command -v apk >/dev/null 2>&1; then
            apk update -q
            apk add -q "${pkgs[@]}" gnupg coreutils 2>/dev/null || true
        elif command -v apt-get >/dev/null 2>&1; then
            export DEBIAN_FRONTEND=noninteractive
            apt-get update -qq
            apt-get install -y -qq "${pkgs[@]}" gnupg coreutils 2>/dev/null || true
        elif command -v yum >/dev/null 2>&1; then
            yum install -y -q "${pkgs[@]}" gnupg2 2>/dev/null || true
        fi
    fi
}

# ------------------------------------------------------------------------------
# 核心功能 1: IPv4 / IPv6 双栈美区遥测训练守护进程
# ------------------------------------------------------------------------------
create_us_ping_service() {
    cat << 'EOF' > "$PING_SCRIPT"
#!/bin/bash
# ==============================================================================
# Google US Telemetry & Dual-Stack Keep-Alive Daemon
# Simulates authentic US residential IPv4 & IPv6 device behaviors
# ==============================================================================

USER_AGENTS=(
    "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro Build/UD1A.230803.041) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.113 Mobile Safari/537.36"
    "Mozilla/5.0 (iPhone; CPU iPhone OS 17_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1"
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36"
)

US_IPV4_ECS=(
    "12.164.0.0/16"
    "73.150.0.0/16"
    "108.56.0.0/16"
    "142.129.0.0/16"
    "68.80.0.0/16"
)

US_IPV6_ECS=(
    "2001:558::/32"
    "2600:1700::/28"
    "2600:1000::/28"
)

ENDPOINTS=(
    "https://www.google.com/generate_204"
    "https://connectivitycheck.gstatic.com/generate_204"
    "https://clients3.google.com/generate_204"
    "https://play.googleapis.com/generate_204"
    "https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch"
)

SEARCH_QUERIES=(
    "weather+in+new+york"
    "best+coffee+shops+seattle"
    "los+angeles+traffic+updates"
    "costco+hours+near+me"
    "usps+tracking+portal"
    "fedex+dropoff+locations"
)

has_local_v6() {
    curl -6 -s --connect-timeout 2 https://api6.ipify.org >/dev/null 2>&1
}

while true; do
    RAND_UA="${USER_AGENTS[$((RANDOM % ${#USER_AGENTS[@]}))]}"
    RAND_V4_ECS="${US_IPV4_ECS[$((RANDOM % ${#US_IPV4_ECS[@]}))]}"
    RAND_V6_ECS="${US_IPV6_ECS[$((RANDOM % ${#US_IPV6_ECS[@]}))]}"
    RAND_QUERY="${SEARCH_QUERIES[$((RANDOM % ${#SEARCH_QUERIES[@]}))]}"

    # 1. DoH Queries with IPv4 & IPv6 ECS
    curl -s --connect-timeout 5 \
         "https://dns.google/dns-query?name=www.google.com&type=A&edns_client_subnet=${RAND_V4_ECS}" >/dev/null 2>&1 || true
    curl -s --connect-timeout 5 \
         "https://1.1.1.1/dns-query?name=gemini.google.com&type=AAAA&edns_client_subnet=${RAND_V6_ECS}" >/dev/null 2>&1 || true

    # 2. IPv4 Endpoints Telemetry
    for url in "${ENDPOINTS[@]}"; do
        curl -4 -s -A "$RAND_UA" \
             -H "Accept-Language: en-US,en;q=0.9" \
             -H "Sec-CH-UA-Platform: \"Windows\"" \
             -H "Cache-Control: no-cache" \
             --connect-timeout 6 \
             "$url" >/dev/null 2>&1 || true
    done

    # 3. IPv6 Endpoints Telemetry (if IPv6 supported on this server)
    if has_local_v6; then
        for url in "${ENDPOINTS[@]}"; do
            curl -6 -s -A "$RAND_UA" \
                 -H "Accept-Language: en-US,en;q=0.9" \
                 -H "Sec-CH-UA-Platform: \"Windows\"" \
                 -H "Cache-Control: no-cache" \
                 --connect-timeout 6 \
                 "$url" >/dev/null 2>&1 || true
        done
    fi

    # 4. Localized Search Telemetry
    curl -4 -s -A "$RAND_UA" \
         -H "Accept-Language: en-US,en;q=0.9" \
         --connect-timeout 6 \
         "https://www.google.com/search?q=${RAND_QUERY}&hl=en&gl=us" >/dev/null 2>&1 || true

    # Jitter interval between 90-240s
    SLEEP_INTERVAL=$((90 + RANDOM % 150))
    sleep $SLEEP_INTERVAL
done
EOF
    chmod +x "$PING_SCRIPT"

    if is_openrc; then
        cat << 'EOF' > "$SERVICE_FILE_OPENRC"
#!/sbin/openrc-run

name="google-us-ping"
description="Google US Dual-Stack Telemetry Service"
command="/usr/local/bin/google_us_ping.sh"
command_background=true
pidfile="/run/${RC_SVCNAME}.pid"

depend() {
    need net
}
EOF
        chmod +x "$SERVICE_FILE_OPENRC"
        rc-update add google-us-ping default >/dev/null 2>&1 || true
        rc-service google-us-ping restart >/dev/null 2>&1 || true
    else
        cat << EOF > "$SERVICE_FILE_SYSTEMD"
[Unit]
Description=Google US Dual-Stack Location Keep-Alive & Telemetry Service
After=network.target

[Service]
Type=simple
ExecStart=$PING_SCRIPT
Restart=always
RestartSec=10
KillMode=process

[Install]
WantedBy=multi-user.target
EOF
        systemctl daemon-reload >/dev/null 2>&1 || true
        systemctl enable google-us-ping.service >/dev/null 2>&1 || true
        systemctl restart google-us-ping.service >/dev/null 2>&1 || true
    fi
}

start_us_ping() {
    echo -e "${YELLOW}正在配置并启动 IPv4/IPv6 双栈美区遥测守护进程...${NC}"
    create_us_ping_service
    echo -e "${GREEN}✅ 遥测进程已就绪运行！${NC}"
    echo -e "   ${CYAN}机制:${NC} 轮换美国家宽 IPv4/IPv6 双栈 ECS + 真实搜索流。"
}

stop_us_ping() {
    echo -e "${YELLOW}正在停止美区遥测守护进程...${NC}"
    if is_openrc; then
        rc-service google-us-ping stop >/dev/null 2>&1 || true
        rc-update del google-us-ping default >/dev/null 2>&1 || true
    else
        systemctl stop google-us-ping.service >/dev/null 2>&1 || true
        systemctl disable google-us-ping.service >/dev/null 2>&1 || true
    fi
    echo -e "${GREEN}✅ 服务已停止。${NC}"
}

# ------------------------------------------------------------------------------
# 核心功能 2: 系统级 IPv4 优先级调整 (/etc/gai.conf 规避 IPv6 送中陷阱)
# ------------------------------------------------------------------------------
toggle_ipv4_priority() {
    echo -e "${CYAN}=== 系统级出站协议优先级调整 (RFC 3484) ===${NC}"
    if [ -f "$GAI_CONF" ] && grep -qE "^precedence\s+::ffff:0:0/96\s+100" "$GAI_CONF" 2>/dev/null; then
        echo -e "${YELLOW}检测到当前已开启 IPv4 优先，正在恢复系统默认 (IPv6 优先)...${NC}"
        sed -i -E '/^precedence\s+::ffff:0:0\/96\s+100/d' "$GAI_CONF" 2>/dev/null || true
        echo -e "${GREEN}✅ 已恢复系统默认网络优先级配置。${NC}"
    else
        echo -e "${YELLOW}正在启用系统级 IPv4 优先策略（保留 IPv6，但对外连接默认走纯净 IPv4）...${NC}"
        [ ! -f "$GAI_CONF" ] && touch "$GAI_CONF"
        sed -i -E '/^precedence\s+::ffff:0:0\/96/d' "$GAI_CONF" 2>/dev/null || true
        echo "precedence ::ffff:0:0/96  100" >> "$GAI_CONF"
        echo -e "${GREEN}✅ IPv4 优先配置已生效！${NC}"
        echo -e "   ${CYAN}原理:${NC} 彻底杜绝因机房 IPv6 广播混乱被判定为中国大陆而拖累 Google / Gemini 的问题！"
    fi
}

# ------------------------------------------------------------------------------
# 核心功能 3: Xray / V2Ray 节点深度防送中与 IPv4 锁定
# ------------------------------------------------------------------------------
optimize_xray_node() {
    find_xray_config
    if [ -z "$XRAY_CONF" ]; then
        echo -e "${RED}未检测到 Xray / V2Ray 配置文件，跳过配置。${NC}"
        return
    fi

    echo -e "${CYAN}=== Xray / V2Ray 节点深度防送中配置 ===${NC}"
    echo -e "${YELLOW}说明: 节点部署后无法使用 Gemini，通常是因为 Xray 出站默认优先走 IPv6，而机房 IPv6 尚未送美（判定为香港）。${NC}"
    echo -e "${YELLOW}本优化将执行三重保障:${NC}"
    echo -e "  1. 开启域名智能嗅探 (Sniffing: HTTP/TLS/QUIC)，防止客户端本地解析错误将香港 IP 传入服务端"
    echo -e "  2. 强制直连出站锁定纯 IPv4 (domainStrategy: UseIPv4)，100% 走已送美的原生美国 IPv4"
    echo -e "  3. 配置纯净美区 DoH (Cloudflare + Google)，锁定 UseIPv4 解析策略"
    echo ""

    cp "$XRAY_CONF" "${XRAY_CONF}.us_bak"

    python3 -c "
import json

conf_path = '$XRAY_CONF'
with open(conf_path, 'r') as f:
    data = json.load(f)

# 1. Ensure all inbounds have sniffing enabled
for ib in data.get('inbounds', []):
    ib['sniffing'] = {
        'enabled': True,
        'destOverride': ['http', 'tls', 'quic']
    }

# 2. Ensure all freedom outbounds have domainStrategy: UseIPv4
for ob in data.get('outbounds', []):
    if ob.get('protocol') == 'freedom':
        if 'settings' not in ob or not isinstance(ob['settings'], dict):
            ob['settings'] = {}
        ob['settings']['domainStrategy'] = 'UseIPv4'

# 3. Lock geosite:google-deepmind to direct outbound
routing = data.get('routing', {})
if 'domainStrategy' not in routing or routing.get('domainStrategy') == 'AsIs':
    routing['domainStrategy'] = 'IPIfNonMatch'
rules = routing.get('rules', [])
# Ensure geosite:google-deepmind rule exists pointing to direct
has_dm = any('geosite:google-deepmind' in r.get('domain', []) for r in rules)
if not has_dm:
    rules.append({
        'type': 'field',
        'outboundTag': 'direct',
        'domain': ['geosite:google-deepmind']
    })
routing['rules'] = rules
data['routing'] = routing

# 4. Pure US DoH upstream + force UseIPv4 query strategy
data['dns'] = {
    'servers': [
        'https://1.1.1.1/dns-query',
        'https://dns.google/dns-query',
        '8.8.8.8',
        '1.1.1.1'
    ],
    'queryStrategy': 'UseIPv4'
}

with open(conf_path, 'w') as f:
    json.dump(data, f, indent=2)
"

    # Configuration validation
    local test_ok=true
    if command -v xray >/dev/null 2>&1; then
        if ! xray run -test -config "$XRAY_CONF" >/dev/null 2>&1; then
            test_ok=false
        fi
    elif command -v v2ray >/dev/null 2>&1; then
        if ! v2ray test -config "$XRAY_CONF" >/dev/null 2>&1; then
            test_ok=false
        fi
    fi

    if [ "$test_ok" = false ]; then
        echo -e "${RED}❌ 配置文件语法校验未通过！正在自动回滚原有配置...${NC}"
        cp "${XRAY_CONF}.us_bak" "$XRAY_CONF"
        return 1
    fi

    if is_openrc; then
        rc-service xray restart >/dev/null 2>&1 || rc-service v2ray restart >/dev/null 2>&1 || true
    else
        systemctl restart xray >/dev/null 2>&1 || systemctl restart v2ray >/dev/null 2>&1 || true
    fi

    echo -e "${GREEN}✅ Xray 节点防送中优化已完成并已重启服务！${NC}"
    echo -e "   ${CYAN}• 出站策略:${NC} domainStrategy = UseIPv4 (锁定走已送美的原生 IPv4)"
    echo -e "   ${CYAN}• 域名嗅探:${NC} TLS/HTTP/QUIC 嗅探已启用 (防止客户端本地 DNS 污染)"
    echo -e "   ${CYAN}• DNS 净化:${NC} Cloudflare + Google DoH (UseIPv4 策略)"
    echo ""
    echo -e "${YELLOW}💡 客户端提示:${NC} 请在客户端打开【无痕/隐私窗口】访问 https://gemini.google.com 避免旧 Cookie 干扰。"
}

# ------------------------------------------------------------------------------
# 核心功能 4: Cloudflare WARP 管理与 Xray 智能分流
# ------------------------------------------------------------------------------
get_warp_trace_info() {
    local trace
    trace=$(curl -s --connect-timeout 3 --socks5 127.0.0.1:40000 https://cloudflare.com/cdn-cgi/trace 2>/dev/null || true)
    if [ -n "$trace" ]; then
        WARP_IP=$(echo "$trace" | awk -F= '/ip=/ {print $2}')
        WARP_LOC=$(echo "$trace" | awk -F= '/loc=/ {print $2}')
        WARP_COLO=$(echo "$trace" | awk -F= '/colo=/ {print $2}')
    else
        WARP_IP=""
        WARP_LOC=""
        WARP_COLO=""
    fi
}

start_or_install_warp() {
    echo -e "${YELLOW}正在检查 Cloudflare WARP 客户端安装状态...${NC}"
    if ! command -v warp-cli >/dev/null 2>&1; then
        if command -v apt-get >/dev/null 2>&1; then
            apt-get update -qq && apt-get install -y -qq gnupg curl 2>/dev/null || true
            mkdir -p /usr/share/keyrings
            curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg 2>/dev/null || true
            local codename
            codename=$(lsb_release -cs 2>/dev/null || echo "bookworm")
            echo "deb [arch=amd64 signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $codename main" > /etc/apt/sources.list.d/cloudflare-client.list
            apt-get update -qq && apt-get install -y -qq cloudflare-warp 2>/dev/null || true
        elif command -v yum >/dev/null 2>&1; then
            rpm -ivh http://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo 2>/dev/null || true
            yum install -y -q cloudflare-warp 2>/dev/null || true
        fi
    fi

    if command -v warp-cli >/dev/null 2>&1; then
        warp-cli --accept-tos registration new >/dev/null 2>&1 || warp-cli --accept-tos register >/dev/null 2>&1 || true
        warp-cli --accept-tos mode proxy >/dev/null 2>&1 || warp-cli --accept-tos set-mode proxy >/dev/null 2>&1 || true
        warp-cli --accept-tos proxy port 40000 >/dev/null 2>&1 || warp-cli --accept-tos set-proxy-port 40000 >/dev/null 2>&1 || true
        warp-cli --accept-tos connect >/dev/null 2>&1 || true
        sleep 2
        if ss -tlpn 2>/dev/null | grep -q "127.0.0.1:40000"; then
            echo -e "${GREEN}✅ Cloudflare WARP 本地代理已在 127.0.0.1:40000 成功监听！${NC}"
        else
            echo -e "${RED}⚠️ WARP 进程启动但 40000 端口未处于监听状态，请尝试重启服务。${NC}"
        fi
    else
        echo -e "${RED}无法自动安装 cloudflare-warp 官方客户端包。${NC}"
    fi
}

wire_warp_to_xray() {
    local mode="$1" # "smart" or "all_ai"
    find_xray_config
    if [ -z "$XRAY_CONF" ]; then
        echo -e "${RED}未检测到 Xray / V2Ray 配置文件，无法对接分流！${NC}"
        return
    fi

    if ! ss -tlpn 2>/dev/null | grep -q "127.0.0.1:40000"; then
        echo -e "${YELLOW}WARP (127.0.0.1:40000) 尚未运行，正在先行启动 WARP 客户端...${NC}"
        start_or_install_warp
    fi

    echo -e "${YELLOW}正在备份原配置文件并配置 Xray 对接 WARP 分流...${NC}"
    cp "$XRAY_CONF" "${XRAY_CONF}.warp_bak"

    python3 -c "
import json

conf_path = '$XRAY_CONF'
mode = '$mode'

with open(conf_path, 'r') as f:
    data = json.load(f)

# 1. Ensure WARP socks outbound exists
outbounds = data.get('outbounds', [])
warp_ob = None
for ob in outbounds:
    if ob.get('tag') == 'warp':
        warp_ob = ob
        break
if not warp_ob:
    warp_ob = {
        'tag': 'warp',
        'protocol': 'socks',
        'settings': {
            'servers': [
                {
                    'address': '127.0.0.1',
                    'port': 40000
                }
            ]
        }
    }
    outbounds.append(warp_ob)
data['outbounds'] = outbounds

# 2. Configure routing
routing = data.get('routing', {})
if 'domainStrategy' not in routing or routing.get('domainStrategy') == 'AsIs':
    routing['domainStrategy'] = 'IPIfNonMatch'
rules = routing.get('rules', [])
# Remove old warp rules
rules = [r for r in rules if r.get('outboundTag') != 'warp']

if mode == 'smart':
    # Route geosite:google-deepmind strictly to direct (Native US IPv4)
    rules.insert(0, {
        'type': 'field',
        'outboundTag': 'direct',
        'domain': [
            'geosite:google-deepmind'
        ]
    })
    # Route OpenAI/Claude to WARP
    rules.insert(0, {
        'type': 'field',
        'outboundTag': 'warp',
        'domain': [
            'geosite:openai',
            'domain:anthropic.com',
            'domain:claude.ai'
        ]
    })
elif mode == 'all_ai':
    # Route OpenAI + Google/Gemini (DeepMind) to WARP
    rules.insert(0, {
        'type': 'field',
        'outboundTag': 'warp',
        'domain': [
            'geosite:openai',
            'geosite:google-deepmind',
            'domain:anthropic.com',
            'domain:claude.ai'
        ]
    })

routing['rules'] = rules
data['routing'] = routing

with open(conf_path, 'w') as f:
    json.dump(data, f, indent=2)
"

    # Test
    local test_ok=true
    if command -v xray >/dev/null 2>&1; then
        if ! xray run -test -config "$XRAY_CONF" >/dev/null 2>&1; then
            test_ok=false
        fi
    elif command -v v2ray >/dev/null 2>&1; then
        if ! v2ray test -config "$XRAY_CONF" >/dev/null 2>&1; then
            test_ok=false
        fi
    fi

    if [ "$test_ok" = false ]; then
        echo -e "${RED}❌ Xray 配置校验失败！正在自动回滚...${NC}"
        cp "${XRAY_CONF}.warp_bak" "$XRAY_CONF"
        return 1
    fi

    if is_openrc; then
        rc-service xray restart >/dev/null 2>&1 || rc-service v2ray restart >/dev/null 2>&1 || true
    else
        systemctl restart xray >/dev/null 2>&1 || systemctl restart v2ray >/dev/null 2>&1 || true
    fi

    echo -e "${GREEN}✅ Xray 对接 WARP 分流配置成功并已重启生效！${NC}"
    if [ "$mode" = "smart" ]; then
        echo -e "   ${CYAN}分流模式:${NC} 智能分流 (OpenAI/Claude 走 WARP，Google/Gemini 走原生美国 IPv4)"
    else
        echo -e "   ${CYAN}分流模式:${NC} 全 AI 分流 (OpenAI/Claude/Google/Gemini 全部走 WARP)"
    fi
}

unwire_warp_from_xray() {
    find_xray_config
    if [ -z "$XRAY_CONF" ]; then
        echo -e "${RED}未检测到 Xray / V2Ray 配置文件！${NC}"
        return
    fi

    echo -e "${YELLOW}正在从 Xray 中移除 WARP 出站与分流规则，恢复 100% 原生直连出站...${NC}"
    cp "$XRAY_CONF" "${XRAY_CONF}.dewarp_bak"

    python3 -c "
import json

conf_path = '$XRAY_CONF'
with open(conf_path, 'r') as f:
    data = json.load(f)

if 'outbounds' in data:
    data['outbounds'] = [ob for ob in data['outbounds'] if ob.get('tag') != 'warp']

if 'routing' in data and 'rules' in data['routing']:
    rules = [r for r in data['routing']['rules'] if r.get('outboundTag') != 'warp']
    # Ensure geosite:google-deepmind is preserved for direct
    if not any('geosite:google-deepmind' in r.get('domain', []) for r in rules):
        rules.append({
            'type': 'field',
            'outboundTag': 'direct',
            'domain': ['geosite:google-deepmind']
        })
    data['routing']['rules'] = rules

with open(conf_path, 'w') as f:
    json.dump(data, f, indent=2)
"

    if is_openrc; then
        rc-service xray restart >/dev/null 2>&1 || rc-service v2ray restart >/dev/null 2>&1 || true
    else
        systemctl restart xray >/dev/null 2>&1 || systemctl restart v2ray >/dev/null 2>&1 || true
    fi

    echo -e "${GREEN}✅ 已解除 Xray 与 WARP 的绑定！全部流量已恢复为原生纯净出站。${NC}"
}

stop_warp_service() {
    echo -e "${YELLOW}正在停止并禁用 Cloudflare WARP 服务...${NC}"
    if command -v warp-cli >/dev/null 2>&1; then
        warp-cli --accept-tos disconnect >/dev/null 2>&1 || true
    fi
    if is_openrc; then
        rc-service warp-svc stop >/dev/null 2>&1 || true
    else
        systemctl stop warp-svc >/dev/null 2>&1 || true
        systemctl disable warp-svc >/dev/null 2>&1 || true
    fi
    echo -e "${GREEN}✅ Cloudflare WARP 客户端已停止运行。${NC}"
}

test_warp_connectivity() {
    echo -e "${CYAN}=== 正在测试本地 127.0.0.1:40000 WARP 连通性 ===${NC}"
    if ! ss -tlpn 2>/dev/null | grep -q "127.0.0.1:40000"; then
        echo -e "${RED}❌ WARP 代理未在 127.0.0.1:40000 监听，请先启动 WARP！${NC}"
        return
    fi

    get_warp_trace_info
    echo -e "1. WARP 出口 IP:     ${GREEN}${WARP_IP:-未知}${NC}"
    echo -e "2. WARP 接入机房:   ${CYAN}${WARP_COLO:-未知}${NC}"
    echo -e "3. WARP 地理归属:   ${YELLOW}${WARP_LOC:-未知}${NC}"

    echo -n "4. WARP 测试 Google 访问: "
    local g_res
    g_res=$(curl -s -i --connect-timeout 4 --socks5 127.0.0.1:40000 https://www.google.com/ncr 2>/dev/null | grep -i "^location:" | awk '{print $2}' | tr -d '\r\n' || true)
    if [ -z "$g_res" ]; then
        echo -e "${GREEN}正常 (未重定向)${NC}"
    else
        echo -e "${YELLOW}$g_res${NC}"
    fi

    echo -n "5. WARP 测试 Gemini 网页: "
    local gem_code
    gem_code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --socks5 127.0.0.1:40000 https://gemini.google.com 2>/dev/null || echo "000")
    if [ "$gem_code" = "200" ] || [ "$gem_code" = "302" ]; then
        echo -e "${GREEN}可连通 (HTTP $gem_code)${NC}"
    else
        echo -e "${RED}受限 (HTTP $gem_code)${NC}"
    fi

    echo -n "6. WARP 测试 OpenAI 准入: "
    local oai_code
    oai_code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --socks5 127.0.0.1:40000 https://chatgpt.com 2>/dev/null || echo "000")
    if [ "$oai_code" = "200" ] || [ "$oai_code" = "307" ] || [ "$oai_code" = "403" ]; then
        echo -e "${GREEN}可达 (HTTP $oai_code)${NC}"
    else
        echo -e "${YELLOW}HTTP $oai_code${NC}"
    fi
}

manage_warp_and_xray() {
    show_banner
    echo -e "${CYAN}=== Cloudflare WARP 管理与 Xray 智能分流控制台 ===${NC}"
    echo ""

    # Check status
    local warp_listening=false
    if ss -tlpn 2>/dev/null | grep -q "127.0.0.1:40000"; then
        warp_listening=true
        get_warp_trace_info
        echo -e "  [WARP 本地服务]  状态: ${GREEN}运行中 (127.0.0.1:40000)${NC}"
        echo -e "  [WARP 出口信息]  IP: ${CYAN}${WARP_IP:-未知}${NC} | 机房: ${CYAN}${WARP_COLO:-未知}${NC} | 归属地: ${YELLOW}${WARP_LOC:-未知}${NC}"
    else
        echo -e "  [WARP 本地服务]  状态: ${RED}未启动 / 未安装${NC}"
    fi

    find_xray_config
    if [ -n "$XRAY_CONF" ] && grep -qi '"tag":\s*"warp"' "$XRAY_CONF" 2>/dev/null; then
        echo -e "  [Xray 对接状态]  ${GREEN}已对接 (Xray 已配置 WARP socks 出站与分流规则)${NC}"
    else
        echo -e "  [Xray 对接状态]  ${YELLOW}未对接 (节点流量全部走 VPS 直连，WARP 未介入分流)${NC}"
    fi

    echo ""
    echo -e "${BLUE}─────────────────────────────────────────────────────────────────────────${NC}"
    echo -e "${WHITE}${BOLD}💡【原理解析与场景说明】${NC}"
    echo -e "  1. ${BOLD}为什么单纯启动 WARP 不生效？${NC}"
    echo -e "     WARP 客户端仅在 127.0.0.1:40000 开启本地 SOCKS5 代理。必须在 Xray 中添加"
    echo -e "     outbound（tag: warp）并配置 routing 分流规则，流量才会真正走 WARP。"
    echo -e "  2. ${BOLD}为什么 WARP 在香港机房分配的是香港 IP？${NC}"
    echo -e "     WARP 采用 Anycast 就近路由，香港 VPS 连的是 Cloudflare 香港机房（HKG），"
    echo -e "     分配的也是香港出口（loc=HK）。由于 Gemini 屏蔽香港，走 WARP 反而可能打不开！"
    echo -e "  3. ${BOLD}最佳实践推荐 (双剑合璧):${NC}"
    echo -e "     • ${GREEN}Google / Gemini${NC}: 走已送美成功的【原生 IPv4 直连】，原生速度快且零风控。"
    echo -e "     • ${CYAN}OpenAI / ChatGPT${NC}: 机房 IP 通常被 OpenAI 封禁，可分流走【WARP】实现完美解锁。"
    echo -e "${BLUE}─────────────────────────────────────────────────────────────────────────${NC}"
    echo ""
    echo -e " 1. ${GREEN}启动 / 重启 Cloudflare WARP 客户端 (127.0.0.1:40000)${NC}"
    echo -e " 2. ${CYAN}一键配置 Xray 智能分流 (OpenAI/Claude 走 WARP，Google/Gemini 走原生直连) ★ 推荐${NC}"
    echo -e " 3. ${YELLOW}一键配置 Xray 全 AI 分流 (OpenAI + Google/Gemini 全部走 WARP)${NC}"
    echo -e " 4. ${MAGENTA}从 Xray 中解除 WARP 分流 (恢复 100% 原生纯净直连出站)${NC}"
    echo -e " 5. ${RED}停止 / 禁用 Cloudflare WARP 服务 (释放系统内存)${NC}"
    echo -e " 6. 实时测试 WARP 出口质量与连通性"
    echo -e " 0. 返回主菜单"
    echo ""
    read -p "请输入操作序号 [0-6]: " warp_choice

    case "$warp_choice" in
        1)
            start_or_install_warp
            read -p "按回车键继续..."
            manage_warp_and_xray
            ;;
        2)
            wire_warp_to_xray "smart"
            read -p "按回车键继续..."
            manage_warp_and_xray
            ;;
        3)
            wire_warp_to_xray "all_ai"
            read -p "按回车键继续..."
            manage_warp_and_xray
            ;;
        4)
            unwire_warp_from_xray
            read -p "按回车键继续..."
            manage_warp_and_xray
            ;;
        5)
            stop_warp_service
            read -p "按回车键继续..."
            manage_warp_and_xray
            ;;
        6)
            test_warp_connectivity
            read -p "按回车键继续..."
            manage_warp_and_xray
            ;;
        0)
            return
            ;;
        *)
            echo -e "${RED}输入无效，请重新选择！${NC}"
            sleep 1
            manage_warp_and_xray
            ;;
    esac
}

# ------------------------------------------------------------------------------
# 综合连通性与解锁检测 (同时针对 IPv4 与 IPv6，包含 AI Studio 终极验证)
# ------------------------------------------------------------------------------
run_diagnostics() {
    echo -e "${CYAN}=== 正在执行双栈连通性与 Google AI Studio / Gemini 深度检测 ===${NC}"
    echo -n "1. 检测 IPv4 Google 搜索重定向: "
    local g4_res
    g4_res=$(curl -4 -s -I --connect-timeout 4 https://www.google.com/ncr 2>/dev/null | grep -i "^location:" | awk '{print $2}' | tr -d '\r\n' || true)
    if [ -z "$g4_res" ]; then
        echo -e "${GREEN}正常 (国际版未跳转)${NC}"
    else
        echo -e "${YELLOW}$g4_res${NC}"
    fi

    if has_ipv6; then
        echo -n "2. 检测 IPv6 Google 搜索重定向: "
        local g6_res
        g6_res=$(curl -6 -s -I --connect-timeout 4 https://www.google.com/ncr 2>/dev/null | grep -i "^location:" | awk '{print $2}' | tr -d '\r\n' || true)
        if [ -z "$g6_res" ]; then
            echo -e "${GREEN}正常 (国际版未跳转)${NC}"
        elif echo "$g6_res" | grep -qi "google.cn"; then
            echo -e "${RED}$g6_res ⚠️ (IPv6 已被送中! 建议在菜单开启 IPv4 优先)${NC}"
        else
            echo -e "${YELLOW}$g6_res${NC}"
        fi
    else
        echo -e "2. IPv6 支持状态: ${MAGENTA}无公网 IPv6${NC}"
    fi

    echo -n "3. 检测 Google Gemini 网页端可用性: "
    local gemini_code
    gemini_code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 6 https://gemini.google.com 2>/dev/null || echo "000")
    if [ "$gemini_code" = "200" ] || [ "$gemini_code" = "302" ]; then
        echo -e "${GREEN}✅ 正常 (HTTP $gemini_code)${NC}"
    else
        echo -e "${RED}⚠️ 受限 (HTTP $gemini_code)${NC}"
    fi

    echo -n "4. 检测 Google AI Studio 核心锁区 (aistudio.google.com/api-keys): "
    local aistudio_url
    aistudio_url=$(curl -sL -o /dev/null -w "%{url_effective}" --connect-timeout 6 "https://aistudio.google.com/api-keys" 2>/dev/null || true)
    if echo "$aistudio_url" | grep -qi "available-regions"; then
        echo -e "${RED}❌ 锁区！(被强制重定向到 /docs/available-regions，该 IP 不被支持)${NC}"
    elif echo "$aistudio_url" | grep -qi "accounts.google.com\|aistudio.google.com"; then
        echo -e "${GREEN}✅ 完全可用！(未触发 available-regions 跳转，允许访问 API-Keys)${NC}"
    else
        echo -e "${YELLOW}检测超时或无法访问${NC}"
    fi

    echo -n "5. 检测 Gemini API 网关区域准入 (generativelanguage.googleapis.com): "
    local api_res
    api_res=$(curl -s --connect-timeout 6 "https://generativelanguage.googleapis.com/v1beta/models?key=AIzaSyFakeKeyForRegionTestCheck12345" 2>/dev/null || true)
    if echo "$api_res" | grep -qi "User location is not supported"; then
        echo -e "${RED}❌ 区域受限 (Location Not Supported，无法调用 API)${NC}"
    elif echo "$api_res" | grep -qi "API_KEY_INVALID"; then
        echo -e "${GREEN}✅ 准入成功 (通过地理位置审查，API 端口开放)${NC}"
    else
        echo -e "${YELLOW}检测超时${NC}"
    fi

    # 6. WARP check if running
    if ss -tlpn 2>/dev/null | grep -q "127.0.0.1:40000"; then
        echo -n "6. 检测 Cloudflare WARP 代理状态: "
        local w_trace
        w_trace=$(curl -s --connect-timeout 3 --socks5 127.0.0.1:40000 https://cloudflare.com/cdn-cgi/trace 2>/dev/null || true)
        local w_loc
        w_loc=$(echo "$w_trace" | awk -F= '/loc=/ {print $2}')
        local w_colo
        w_colo=$(echo "$w_trace" | awk -F= '/colo=/ {print $2}')
        echo -e "${GREEN}活跃 (127.0.0.1:40000 | 机房: ${w_colo} | 归属: ${w_loc})${NC}"
    fi

    # 7. DNS egress & ECS detection (ip.skk.moe core mechanism)
    echo -n "7. 检测 DNS 递归出口与 ECS 泄漏 (借鉴 ip.skk.moe 深度诊断): "
    local dns_res
    dns_res=$(curl -sL --connect-timeout 4 https://edns.ip-api.com/json 2>/dev/null || true)
    if [ -n "$dns_res" ]; then
        local d_geo e_geo
        d_geo=$(echo "$dns_res" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data.get('dns', {}).get('geo', ''))" 2>/dev/null || true)
        e_geo=$(echo "$dns_res" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data.get('edns', {}).get('geo', ''))" 2>/dev/null || true)
        if [ -n "$e_geo" ]; then
            echo -e "${RED}⚠️ 存在泄漏！(递归节点: $d_geo | 发现客户端子网 ECS: $e_geo)${NC}"
            echo -e "   ${YELLOW}提示: 客户端子网会直接暴露国内位置，建议使用菜单选项 4 锁定纯净美区 DoH！${NC}"
        else
            echo -e "${GREEN}✅ 纯净安全！(递归节点: $d_geo | 未携带 ECS 客户端子网)${NC}"
        fi
    else
        echo -e "${YELLOW}检测超时或已锁定纯净 DoH${NC}"
    fi

    # 8. 直接引用并展示 https://ip.skk.moe 权威实测数据
    echo -e "8. 引用 ${CYAN}https://ip.skk.moe${NC} 实时权威探测结果:"
    local skk_v4 skk_v6 skk_warp
    skk_v4=$(curl -4 -s --connect-timeout 3 https://ip.skk.moe/cdn-cgi/trace 2>/dev/null || true)
    if [ -n "$skk_v4" ]; then
        local v4_ip=$(echo "$skk_v4" | awk -F= '/ip=/ {print $2}')
        local v4_colo=$(echo "$skk_v4" | awk -F= '/colo=/ {print $2}')
        local v4_loc=$(echo "$skk_v4" | awk -F= '/loc=/ {print $2}')
        local v4_warp=$(echo "$skk_v4" | awk -F= '/warp=/ {print $2}')
        echo -e "   • ${WHITE}IPv4 出口:${NC} ${GREEN}${v4_ip}${NC} | 命中机房: ${CYAN}${v4_colo}${NC} | 归属地区: ${YELLOW}${v4_loc}${NC} | WARP: ${v4_warp}"
    fi

    if has_ipv6; then
        skk_v6=$(curl -6 -s --connect-timeout 3 https://ip.skk.moe/cdn-cgi/trace 2>/dev/null || true)
        if [ -n "$skk_v6" ]; then
            local v6_ip=$(echo "$skk_v6" | awk -F= '/ip=/ {print $2}')
            local v6_colo=$(echo "$skk_v6" | awk -F= '/colo=/ {print $2}')
            local v6_loc=$(echo "$skk_v6" | awk -F= '/loc=/ {print $2}')
            local v6_warp=$(echo "$skk_v6" | awk -F= '/warp=/ {print $2}')
            echo -e "   • ${WHITE}IPv6 出口:${NC} ${GREEN}${v6_ip}${NC} | 命中机房: ${CYAN}${v6_colo}${NC} | 归属地区: ${YELLOW}${v6_loc}${NC} | WARP: ${v6_warp}"
        fi
    fi

    if ss -tlpn 2>/dev/null | grep -q "127.0.0.1:40000"; then
        skk_warp=$(curl -s --connect-timeout 3 --socks5 127.0.0.1:40000 https://ip.skk.moe/cdn-cgi/trace 2>/dev/null || true)
        if [ -n "$skk_warp" ]; then
            local w_ip=$(echo "$skk_warp" | awk -F= '/ip=/ {print $2}')
            local w_colo=$(echo "$skk_warp" | awk -F= '/colo=/ {print $2}')
            local w_loc=$(echo "$skk_warp" | awk -F= '/loc=/ {print $2}')
            local w_warp=$(echo "$skk_warp" | awk -F= '/warp=/ {print $2}')
            echo -e "   • ${WHITE}WARP 出口:${NC} ${GREEN}${w_ip}${NC} | 命中机房: ${CYAN}${w_colo}${NC} | 归属地区: ${YELLOW}${w_loc}${NC} | WARP: ${w_warp}"
        fi
    fi
    echo ""
    echo -e "${BLUE}─────────────────────────────────────────────────────────────────────────${NC}"
    echo -e "${WHITE}${BOLD}💡【端到端客户端终极闭环核验 (建议在本地浏览器配合测试)】${NC}"
    echo -e "   服务端底层就绪后，请在本地电脑/手机连接节点，在【无痕/隐私窗口】打开:"
    echo -e "   👉 ${CYAN}${BOLD}https://ip.skk.moe/${NC} 并重点确认以下三项:"
    echo -e "   1. ${BOLD}WebRTC 泄漏检测:${NC} 确认【未显示中国大陆真实 IP】(防止被 WebRTC 旁路穿透)"
    echo -e "   2. ${BOLD}境外访问出口:${NC}   确认显示为当前 VPS 的已送美 IPv4 (${IPV4:-服务器公网 IPv4} - US)"
    echo -e "   3. ${BOLD}DNS 解析出口:${NC}   确认解析服务器位于境外 (无国内 114/阿里 DNS 泄漏)"
    echo -e "${BLUE}─────────────────────────────────────────────────────────────────────────${NC}"
    echo ""
}

show_guide() {
    echo ""
    echo -e "${CYAN}=== Google 官方 IP 纠错提交指引 ===${NC}"
    echo -e "申诉地址: ${BOLD}https://support.google.com/websearch/workflow/9308722${NC}"
    echo -e "1. 填入 VPS 的当前公网 IP"
    echo -e "2. 期望国家选择: ${GREEN}United States (美国)${NC}"
    echo -e "3. 申诉理由可填写: 'Our server IP is located in US data center, but improperly categorized. Please re-evaluate.'"
    echo -e "注意: 如果是 IPv6 送中，务必将 VPS 的公网 IPv6 地址也同时填入提交！"
    echo ""
}

print_status() {
    echo "========================================================================="
    echo -e "  [IPv4 状态] 归属: $(get_country_v4) | Google 表现: $(check_google_loc_v4)"
    echo -e "  [IPv6 状态] 归属: $(get_country_v6) | Google 表现: $(check_google_loc_v6)"
    echo -e "  [系统底层]  /etc/gai.conf: $(check_gai_status) | 遥测服务: $(check_ping_status)"
    echo -e "  [Xray 状态] 节点配置: $(check_xray_status) | WARP 联动: $(check_xray_warp_status)"
    echo -e "  [DNS 出口]  递归解析: $(check_dns_egress_short)"
    echo -e "  [skk.moe]   权威实测: $(check_skk_moe_short)"
    echo "========================================================================="
}

# ------------------------------------------------------------------------------
# 交互式菜单
# ------------------------------------------------------------------------------
show_menu() {
    setup_shortcut
    show_banner
    print_status
    echo -e " 1. ${GREEN}启动/更新 美区遥测训练守护进程 (IPv4 & IPv6 双栈 US-ECS 模拟)${NC}"
    echo -e " 2. ${RED}停止美区遥测训练守护进程${NC}"
    echo -e " 3. ${CYAN}一键切换系统 IPv4 出站优先策略 (/etc/gai.conf 规避 IPv6 送中)${NC}"
    echo -e " 4. ${YELLOW}一键优化 Xray 节点防送中 (锁定 UseIPv4 出站 + 开启 Sniffing + 美区 DoH)${NC}"
    echo -e " 5. ${BLUE}Cloudflare WARP 管理与 Xray 智能分流 (查看状态 / 一键对接 Xray / 还原直连)${NC}"
    echo -e " 6. 立即运行 IPv4/IPv6 双栈连通性与 Gemini/WARP 综合检测"
    echo -e " 7. 查看 Google 官方纠错表单提交指引"
    echo -e " 0. 退出管理控制台"
    echo "========================================================================="
    echo -e " 💡 提示：在命令行随时输入 ${GREEN}us${NC} 即可呼出本控制台"
    echo "========================================================================="
    read -p "请输入操作序号 [0-7]: " choice

    case "$choice" in
        1)
            start_us_ping
            read -p "按回车键继续..."
            show_menu
            ;;
        2)
            stop_us_ping
            read -p "按回车键继续..."
            show_menu
            ;;
        3)
            toggle_ipv4_priority
            read -p "按回车键继续..."
            show_menu
            ;;
        4)
            optimize_xray_node
            read -p "按回车键继续..."
            show_menu
            ;;
        5)
            manage_warp_and_xray
            show_menu
            ;;
        6)
            run_diagnostics
            read -p "按回车键继续..."
            show_menu
            ;;
        7)
            show_guide
            read -p "按回车键继续..."
            show_menu
            ;;
        0)
            exit 0
            ;;
        *)
            echo -e "${RED}输入无效，请重新选择！${NC}"
            sleep 1
            show_menu
            ;;
    esac
}

# ------------------------------------------------------------------------------
# 主执行入口 (支持命令行参数无阻塞调用，以及被 source 时不自动阻塞)
# ------------------------------------------------------------------------------
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    setup_shortcut
    if [ -n "$1" ]; then
        case "$1" in
            1|start) start_us_ping ;;
            2|stop) stop_us_ping ;;
            3|ipv4) toggle_ipv4_priority ;;
            4|xray|dns) optimize_xray_node ;;
            5|warp) manage_warp_and_xray ;;
            6|test|diag) run_diagnostics ;;
            7|guide) show_guide ;;
            status) print_status ;;
            *)
                echo "用法: us [1-7|start|stop|ipv4|xray|warp|test|status]"
                exit 1
                ;;
        esac
        exit 0
    fi
    install_dependencies
    show_menu
fi