From 3f44e4fb44a63766d71a28bb4dea53ca31df1462 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 31 Mar 2026 08:29:05 +0000
Subject: [PATCH] fix: address code review feedback (glob guard, CN relay
 comments)

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/ddb1f363-5bb4-457a-b769-794c1fe0489a

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
---
 server/proxy/deploy-proxy.sh                | 3 ++-
 server/proxy/service/subscription-server.js | 2 ++
 server/proxy/setup/setup-cn-relay.sh        | 2 ++
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/server/proxy/deploy-proxy.sh b/server/proxy/deploy-proxy.sh
index 7fba7999..d82b748a 100644
--- a/server/proxy/deploy-proxy.sh
+++ b/server/proxy/deploy-proxy.sh
@@ -300,7 +300,8 @@ update() {
 
         # 移除旧的SSL配置 (不再通过Xray回落提供HTTPS)
         for conf in /etc/nginx/sites-enabled/ssl-*.conf; do
-            if [ -f "$conf" ] && grep -q "listen.*443\|listen.*8443" "$conf" 2>/dev/null; then
+            [ -e "$conf" ] || continue
+            if grep -q "listen.*443\|listen.*8443" "$conf" 2>/dev/null; then
                 echo "  移除旧SSL配置: $conf"
                 rm -f "$conf"
             fi
diff --git a/server/proxy/service/subscription-server.js b/server/proxy/service/subscription-server.js
index 4f26ebea..17774048 100644
--- a/server/proxy/service/subscription-server.js
+++ b/server/proxy/service/subscription-server.js
@@ -148,6 +148,8 @@ function generateClashYaml(keys, serverHost) {
   const cnRelayPort = getCnRelayPort();
 
   // CN中转节点 (如果已配置)
+  // 注: CN中转是透明TCP转发(CN:2053 → SG:443)，所以Reality设置仍指向SG的配置
+  // servername/public-key/short-id 与SG直连节点完全相同，因为TLS握手实际发生在SG端
   const cnProxyBlock = cnRelayHost ? `
   - name: "🇨🇳 铸渊专线-CN中转"
     type: vless
diff --git a/server/proxy/setup/setup-cn-relay.sh b/server/proxy/setup/setup-cn-relay.sh
index 85434c6e..68dc64c1 100644
--- a/server/proxy/setup/setup-cn-relay.sh
+++ b/server/proxy/setup/setup-cn-relay.sh
@@ -22,6 +22,8 @@
 # ═══════════════════════════════════════════════
 
 set -uo pipefail
+# 注意: 不使用 set -e，因为 grep/nc 等命令在无匹配时返回非零
+# 关键步骤手动检查错误
 
 # 颜色
 RED='\033[0;31m'