cee120cb23
The Custom box validated for a vless:// prefix and rejected anything else, so a provider's subscription URL — the thing most people are handed — got "paste a vless:// URL first" with no hint that the Subscription card two sections down was what it wanted. Now an http(s):// paste in that box is detected and routed to the subscription importer, the placeholder says both are accepted, and the dropdown option reads "Custom — vless:// or subscription URL". Also renames the three bundled entries' status from "coming-soon" to "awaiting-key-issuer". The exits exist and are running xray; what is missing is a way to hand a client credentials without shipping a shared secret. DESIGN.md now records why that list stays empty, since this is the second time the shortcut looked attractive: a vless:// URL is the credential, so writing one into the tarball (immutable, mirrored) or onto a public Sia object (mutable but world-readable) are the same category of mistake. Per-session minting is the fix, because then no shared credential exists to leak. Parser verified against plain-text, standard-base64 and url-safe unpadded-base64 subscription bodies; an HTML error page correctly yields zero entries instead of a JSON parse crash. |
||
|---|---|---|
| .. | ||
| aegis | ||
| docx-editor | ||
| notepad | ||
| pdf-editor | ||
| screenshot | ||
| translate | ||
| vpn | ||