fix(singbox): handle unsafe uTLS fingerprint

[dr-hoseyn]

Summary

• Replace Xray's unsupported unsafe fingerprint with chrome in every sing-box TLS profile.
• Normalize unsafe to chrome for Clash Meta/Mihomo proxy and xHTTP download fingerprints as well.
• Keep supported fingerprints unchanged.

Fixes #808

Type of change

• Bug fix
• New feature
• Breaking change
• Refactor / cleanup
• Documentation
• Tests / CI

Checklist

• I tested the change locally or explained why it cannot be tested.
• I added or updated tests for behavior changes.
• I updated documentation, translations, or examples if needed.
• I checked database migrations when models or schema changed.
• I did not include secrets, tokens, private keys, or unrelated changes.

Testing

.\.venv\Scripts\python.exe -m pytest tests/test_subscription_clash_hysteria.py tests/test_subscription_clash_xhttp.py -q
11 passed

.\.venv\Scripts\ruff.exe check .
All checks passed!

.\.venv\Scripts\ruff.exe format --check app/subscription/singbox.py app/subscription/clash.py
2 files already formatted

git diff --check
Passed

A direct generator check also confirmed that unsafe renders as chrome in sing-box, Clash Meta, and Mihomo xHTTP download settings.

Screenshots

Not applicable; backend subscription generation only.

Notes for reviewers

Both sing-box and Mihomo reject or do not support Xray's unsafe uTLS fingerprint. The generated client configurations now use the supported chrome fingerprint consistently, without changing the stored host setting used by Xray.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 03746025-910b-41c4-8552-797e07eab7dd

📥 Commits

Reviewing files that changed from the base of the PR and between a2c7a02 and 038642e.

📒 Files selected for processing (2)

• app/subscription/singbox.py
• tests/test_subscription_singbox_tls.py

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

Sing-box TLS generation now normalizes the unsafe fingerprint. Reality uses the chrome uTLS fingerprint. Other TLS connections omit utls. Tests cover both configurations.

Changes

Sing-box TLS handling

Layer / File(s)	Summary
Normalize TLS fingerprints and validate output app/subscription/singbox.py, tests/test_subscription_singbox_tls.py	The generator maps unsafe to chrome for Reality and to native TLS for other connections. Tests verify the emitted configurations.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 03864

The change prevents invalid uTLS fingerprints in generated sing-box profiles while preserving native TLS behavior and using a supported Reality fallback; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: immohammad20000

Poem

A rabbit checks the TLS trail,
Chrome hops where Reality sails.
Unsafe fades from native light,
Tests guard each profile right.
Sing-box starts with paths made clear.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes prevent unsupported unsafe fingerprints in sing-box profiles and add regression tests for standard TLS and Reality configurations [#808].
Out of Scope Changes check	✅ Passed	The changes are limited to sing-box TLS fingerprint handling and related regression tests.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: handling the unsupported unsafe uTLS fingerprint in SingBox.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dr-hoseyn]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[ImMohammad20000]

Remove the tests and dont add a check for reality if it set to unsafe use chrome also update clash config if require

[dr-hoseyn]

@ImMohammad20000 Done in b1b0a26:

• removed the added tests;
• removed the Reality-specific branch — sing-box now maps unsafe to chrome in all cases;
• updated Clash Meta/Mihomo, including both regular proxy TLS and xHTTP download settings, because Mihomo does not support unsafe either.

Existing subscription tests pass (11 passed) and Ruff is clean.