stable 1.2.7: phobos:// pad missing fields with '= none' (PhobosWG import fix)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

VERSION

@@ -1 +1 @@
-1.2.6
+1.2.7

app.py

@@ -721,11 +721,46 @@ def build_phone_config(cid, mode="android"):
     if os.path.exists(instpath):
         inst = open(instpath).read().strip()
     conf = wg + "\n\n" + inst + "\n"
-    b64 = base64.urlsafe_b64encode(conf.encode()).decode().rstrip("=")
-    link = "phobos://" + b64 + "#" + urllib.parse.quote(cid)
+    # PhobosWG requires ALL fields present; missing -> "= none" before base64
+    # (spec 2.3). Ground-Zerro configs lack PresharedKey -> import fails otherwise.
+    padded = _pad_conf_with_none(conf)
+    b64 = base64.urlsafe_b64encode(padded.encode()).decode().rstrip("=")
+    link = "phobos://" + b64 + "#" + urllib.parse.quote(cid or "none")
     return conf, link
 
 
+def _pad_conf_with_none(conf):
+    """Insert '<key> = none' for every missing mandatory PhobosWG field
+    (phobos:// spec 2.3). Only for phobos:// payload, NOT raw .conf."""
+    mandatory = {
+        "[interface]": ["PrivateKey", "Address", "MTU", "DNS"],
+        "[peer]": ["PublicKey", "PresharedKey", "AllowedIPs", "PersistentKeepalive", "Endpoint"],
+        "[instance]": ["source-if", "source-lport", "target", "key", "masking",
+                       "verbose", "idle-timeout", "max-dummy"],
+    }
+    sections = []
+    cur = None
+    for ln in conf.split("\n"):
+        s = ln.strip()
+        if s.startswith("[") and s.endswith("]"):
+            cur = [s, []]
+            sections.append(cur)
+        elif cur is not None:
+            cur[1].append(ln)
+    out = []
+    for header, lines in sections:
+        keys = {ln.split("=", 1)[0].strip().lower() for ln in lines if "=" in ln}
+        while lines and lines[-1].strip() == "":
+            lines.pop()
+        for req in mandatory.get(header.lower(), []):
+            if req.lower() not in keys:
+                lines.append("%s = none" % req)
+        out.append(header)
+        out.extend(lines)
+        out.append("")
+    return "\n".join(out).rstrip("\n") + "\n"
+
+
 def qr_datauri(data):
     try:
         import qrcode, io, base64

install.sh

@@ -98,7 +98,7 @@ for _am in "aarch64:linux-arm64" "mipsel:linux-mipsel-mips32" "mips:linux-mips-m
     _t=$(mktemp -d)
     curl -fsSL -m30 "${_CB}/wg-obfuscator-${_OBF_TAG}-${_ss}.tar.gz" -o "$_t/o.tgz" 2>/dev/null &&
       tar -xzf "$_t/o.tgz" -C "$_t" 2>/dev/null &&
-      _b=$(find "$_t" -name "wg-obfuscator" | head -1) &&
+      _b=$(find "$_t" -name "wg-obfuscator" -type f | head -1) &&
       [ -n "$_b" ] && cp "$_b" "$PHOBOS_DIR/bin/wg-obfuscator-${_da}" && chmod +x "$PHOBOS_DIR/bin/wg-obfuscator-${_da}" && echo "  +wg-obfuscator-${_da} (ClusterM ${_OBF_TAG})"
     rm -rf "$_t"
   fi

overlay/phobos-client.sh

@@ -6,6 +6,12 @@ check_root
 load_env
 ensure_dirs
 
+# server.env stores OBFUSCATOR_PORTS (plural, comma list). Client obfuscator
+# must target an ACTUAL listening port. lib-core load_env defaults OBFUSCATOR_PORT
+# to 51821 (NOT listened on) -> handshake failed. Override unconditionally from
+# the real port list when present.
+[ -n "${OBFUSCATOR_PORTS:-}" ] && export OBFUSCATOR_PORT="$(echo "$OBFUSCATOR_PORTS" | cut -d',' -f1)"
+
 CMD="${1:-help}"
 CLIENT_ARG="${2:-}"
 EXTRA_ARG="${3:-}"
@@ -209,8 +215,21 @@ action_package() {
   cp "$dir/${id}.conf" "$pkg_root/${id}.conf"
   cp "$dir/wg-obfuscator.conf" "$pkg_root/wg-obfuscator.conf"
 
-  for arch in mipsel mips aarch64 armv7 x86_64; do
-    [[ -f "$PHOBOS_DIR/bin/wg-obfuscator-$arch" ]] && cp "$PHOBOS_DIR/bin/wg-obfuscator-$arch" "$pkg_root/bin/"
+  # Fetch missing router-arch binaries from ClusterM on-demand
+  local _tag; _tag=$(curl -fsSL -m10 https://api.github.com/repos/ClusterM/wg-obfuscator/releases/latest 2>/dev/null | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\(.*\)".*/
/')
+  local _cb="https://github.com/ClusterM/wg-obfuscator/releases/download/${_tag}"
+  declare -A _am=([aarch64]="linux-arm64" [mipsel]="linux-mipsel-mips32" [mips]="linux-mips-mips32" [armv7]="linux-armv7-hf" [x86_64]="linux-x64")
+  for _arch in aarch64 mipsel mips armv7 x86_64; do
+    if [[ ! -f "$PHOBOS_DIR/bin/wg-obfuscator-$_arch" ]] && [[ -n "$_tag" ]]; then
+      local _t; _t=$(mktemp -d)
+      if curl -fsSL -m30 "${_cb}/wg-obfuscator-${_tag}-${_am[$_arch]}.tar.gz" -o "$_t/o.tgz" 2>/dev/null; then
+        tar -xzf "$_t/o.tgz" -C "$_t" 2>/dev/null || true
+        local _b; _b=$(find "$_t" -name "wg-obfuscator" -type f | head -1)
+        [[ -n "$_b" ]] && cp "$_b" "$PHOBOS_DIR/bin/wg-obfuscator-$_arch" && chmod +x "$PHOBOS_DIR/bin/wg-obfuscator-$_arch" && log_info "+wg-obfuscator-$_arch (ClusterM ${_tag})"
+      fi
+      rm -rf "$_t"
+    fi
+    [[ -f "$PHOBOS_DIR/bin/wg-obfuscator-$_arch" ]] && cp "$PHOBOS_DIR/bin/wg-obfuscator-$_arch" "$pkg_root/bin/"
   done
 
   local tpl_dir="$REPO_DIR/client/templates"
@@ -249,7 +268,7 @@ action_package() {
   source "$PHOBOS_DIR/server/server.env"
   cat > "$pkg_root/failover.conf" <<FAILEOF
 # Phobos Failover Configuration
-SERVER_1=${SERVER_PUBLIC_IP_V4}:51821,51822,51823
+SERVER_1=${SERVER_PUBLIC_IP_V4}:${OBFUSCATOR_PORTS:-51821,51822,51823}
 KEY_1=${OBFUSCATOR_KEY}
 FAILEOF