ITEM6 B3: agent sing-box runtime (parallel path)

Agent consumes singbox_config alongside xray: candidate->check->
flush->swap activation with .previous rollback, wire-level v2ray_api
stats client with NexusGate epoch discipline (mid-query flip voids
the round, new epoch counts in full, agent-first snapshot baselines),
access-log online tracker (authenticated-connection lines, ANSI-safe,
merged with snapshot-active users), per-core traffic baselines with
the sing-box one carrying its epoch. install-agent.sh installs the
self-built sing-box v1.13.21 next to xray (xray/geo removal deferred
to the B5 switchover). Env-gated real-core E2E covers vless-reality,
ss2022, mixed, trojan and the forwarding leg end to end; hysteria2 is
probe-gated (sandbox blocks UDP replies) and stays a B5 pilot item.

install-agent.sh

@@ -116,6 +116,22 @@ curl -fL -o geosite.dat "${RELEASE_BASE}/geosite.dat" || error "geosite 下载
 [[ -s geosite.dat ]] || error "geosite 下载得到空文件: ${RELEASE_BASE}/geosite.dat"
 cd - >/dev/null
 
+# 第 6 条 B3 起 agent 为双能力：除 xray 外再装 sing-box 核心（自编
+# v1.13.21，with_v2ray_api with_utls with_quic），主控下发 sing-box
+# 配置时即由它承载。sing-box 资产在 NexusGate 仓的专用发行里（与
+# NexusGate 共用同一自编件）。其 version 输出为 unknown（自编件无
+# 版本戳），故另写版本记录文件供 agent 遥测读取。xray 与 geo 的
+# 下载暂保留——现行运行时仍是 xray，B5 正式切换后才在本脚本移除。
+SINGBOX_VER="1.13.21"
+SINGBOX_BASE="https://git.881218.xyz/rogue/NexusGate/releases/download/sing-box-v${SINGBOX_VER}"
+SINGBOX_URL="${SINGBOX_URL:-${SINGBOX_BASE}/nexusgate-sing-box-linux-${BIN_ARCH}}"
+info "下载 sing-box v${SINGBOX_VER}..."
+curl -fL -o "${XUI_HOME}/bin/sing-box-linux-${BIN_ARCH}.new" "$SINGBOX_URL" || error "sing-box 下载失败: $SINGBOX_URL"
+[[ -s "${XUI_HOME}/bin/sing-box-linux-${BIN_ARCH}.new" ]] || error "sing-box 下载得到空文件: $SINGBOX_URL"
+chmod +x "${XUI_HOME}/bin/sing-box-linux-${BIN_ARCH}.new"
+mv -f "${XUI_HOME}/bin/sing-box-linux-${BIN_ARCH}.new" "${XUI_HOME}/bin/sing-box-linux-${BIN_ARCH}"
+printf '%s\n' "$SINGBOX_VER" > "${XUI_HOME}/bin/sing-box.version"
+
 # 安装收尾自检（第 17 条）：文件在不等于能用——xray 本体须存在、可执行、
 # version 能真实跑通；geo 须存在且非空；agent 本体须可执行。任一不过即
 # 报错退出并指出缺什么，不许带病进入写配置/起服务阶段。
@@ -131,6 +147,14 @@ self_check() {
     info "自检通过：$(printf '%s' "$ver_out" | head -n 1)"
     [[ -s "${XUI_HOME}/bin/geoip.dat" ]] || error "自检失败：geoip.dat 缺失或为空（${XUI_HOME}/bin/geoip.dat）"
     [[ -s "${XUI_HOME}/bin/geosite.dat" ]] || error "自检失败：geosite.dat 缺失或为空（${XUI_HOME}/bin/geosite.dat）"
+    local sb_bin="${XUI_HOME}/bin/sing-box-linux-${BIN_ARCH}"
+    [[ -x "$sb_bin" ]] || error "自检失败：sing-box 本体缺失或不可执行 ${sb_bin}"
+    local sb_out
+    if ! sb_out=$("$sb_bin" version 2>/dev/null); then
+        error "自检失败：sing-box 本体无法运行（${sb_bin} version 退出非零）"
+    fi
+    [[ -n "$sb_out" ]] || error "自检失败：sing-box version 无输出（${sb_bin}）"
+    info "sing-box 自检通过：$(printf '%s' "$sb_out" | head -n 1)（版本记录 ${SINGBOX_VER}）"
     [[ -x "$AGENT_BIN" ]] || error "自检失败：agent 二进制不可执行 ${AGENT_BIN}"
 }
 self_check