feat(singbox): bump to v1.13.9 + fix VLESS xtls-rprx-vision flow for injected users

[abpestov-cpu]

Problem

Two distinct issues addressed by this branch:

1. VLESS xtls-rprx-vision flow not propagated to injected users

sing-box strictly validates that VLESS user flow matches inbound flow (sagernet/sing-vmess vless/service.go:68-69). When an inbound advertises flow: xtls-rprx-vision but marznode injects a VLESSUser entry without it, the handshake fails with "flow mismatch".

Previously, marznode's sing-box backend never set flow on users. This left REALITY+Vision inbounds unusable via the sing-box backend — only the xray backend was fixed (#30).

This PR mirrors that behaviour for sing-box.

2. sing-box 1.11.3 (from dawsh/marznode:latest) cannot serve modern Xray-core REALITY clients

The old overlay base image ships sing-box 1.11.3, which is incompatible with recent Xray-core REALITY clients — they receive [EOF] right after TLS handshake, and the server log shows REALITY: processed invalid connection. sing-box 1.13.x reworked the TLS stack and fixes this.

The official ghcr.io/sagernet/sing-box:v1.13.9 image is built without with_v2ray_api (needed for FetchUsersStats) and with_grpc (v2ray gRPC transports), so we build from source keeping full tag parity with dawsh/marznode, minus tags that 1.13.x absorbed:

• with_reality_server → merged into with_utls
• with_ech → migrated to Go stdlib

Changes

Code

• _resolve_inbounds: detect VLESS+REALITY over raw TCP, set the inbound's flow to xtls-rprx-vision (mirrors xray _config.py).
• append_user: when the resolved inbound carries a flow, pass it as kwarg to the account constructor so sing-box sees it on the injected VLESSUser.
• _runner.start(): add sing-box config pre-check — fail fast with a clear error instead of silent crash-loop on invalid configs.

Build / Dockerfile

• Multi-stage Dockerfile.patch: builder compiles sing-box v1.13.9 from source with full tag set, stage-1 layers patched Python on top of dawsh/marznode:latest.
• Build flags learned the hard way:
  • -checklinkname=0 is required — sing-box uses //go:linkname into crypto/tls internals (handlePostHandshakeMessage) which Go 1.23+ rejects by default.
  • -X internal/godebug.defaultGODEBUG=multipathtcp=0 matches upstream release/LDFLAGS.
  • GOTOOLCHAIN=local pins to the image's Go (go.mod may request a newer patch version).

Consumer-side effect (BREAKING for 1.13.x)

sing-box 1.13.x drops the legacy WireGuard outbound format. It must be migrated to top-level endpoints:

"endpoints": [
  { "type": "wireguard", "tag": "warp", "address": [...], "peers": [...] }
]

Refs

• flow isn't set when xray transport is raw #29 (report)
• fix(xray): consider flow when transport is raw in the config #30 (xray-side flow fix)

---

Commits:

• 0573b82 fix(sing-box): support VLESS xtls-rprx-vision flow for injected users
• 65fc377 feat(singbox): bump to v1.13.9, build from source with required tags
• 1943032 refactor(singbox): simplify VLESS flow injection before upstream PR

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud