From 1c11adc05b0709c288f52ec7cc13dd6e8cf3eb79 Mon Sep 17 00:00:00 2001
From: pofa10 <kingpofa@gmail.com>
Date: Fri, 16 Oct 2026 12:57:21 +0330
Subject: [PATCH 1/8] fix(bulk): expand encoded subscriptions pasted into the
 URL box

The bulk URL box parses one line at a time. A pasted base64 subscription is a
single line, so it reached parseProxyURLSingle(), whose base64 fallback recursed
on the decoded body -- and new URL() strips line breaks, collapsing every config
into the first one's remark. A 28-config subscription was enhanced as a single
VLESS link ("bulk paste shows one link").

- pure.js: add expandBulkLines() so the URL box expands a whole-body,
  line-wrapped or per-line base64 body into its config lines first.
- pure.js: guard parseProxyURLSingle() so a decoded value carrying more than one
  config line returns an error instead of silently merging (covers the Chain
  Builder and any other caller).
- script.js: both URL boxes (ECH + Fragment) use expandBulkLines().
- tests: 8 new cases (expandBulkLines shapes + the parse guard).
- README.md / README-fa.md: note the URL box accepts encoded subscriptions.

Gates: node --check pure.js, node --check script.js, node --test
tests/pure.test.js -> 163/163 pass. jsdom: the pasted 28-config blob now yields
28 enhanced URLs in both the ECH and Fragment URL boxes.
---
 README-fa.md       |  6 ++--
 README.md          |  6 ++--
 pure.js            | 66 ++++++++++++++++++++++++++++++-------
 script.js          |  6 ++--
 tests/pure.test.js | 81 +++++++++++++++++++++++++++++++++++++++++++++-
 5 files changed, 143 insertions(+), 22 deletions(-)

diff --git a/README-fa.md b/README-fa.md
index fe8ff72..1de512c 100644
--- a/README-fa.md
+++ b/README-fa.md
@@ -14,7 +14,7 @@
 
 ### 🛡️ ECH
 <ul dir="rtl" style="direction: rtl; text-align: right;">
-  <li><b>جای‌گذاری و ارتقا</b>: لینک تکی یا چندگانه (تک‌به‌تک در هر خط) از <code>vless://</code> یا <code>trojan://</code> را جای‌گذاری کنید و لینک‌های ارتقایافته با پارامترهای <code>fp</code> و <code>ech</code> دریافت کنید.</li>
+  <li><b>جای‌گذاری و ارتقا</b>: لینک تکی یا چندگانه (تک‌به‌تک در هر خط) از <code>vless://</code> یا <code>trojan://</code> را جای‌گذاری کنید و لینک‌های ارتقایافته با پارامترهای <code>fp</code> و <code>ech</code> دریافت کنید. اگر یک اشتراک رمزگذاری‌شده (یک بلوک base64، بلوک چندخطی یا base64 خط‌به‌خط) را اینجا جای‌گذاری کنید، به همه کانفیگ‌های VLESS/Trojan داخل آن باز می‌شود و به‌جای یک لینک ادغام‌شده، همه را ارتقا می‌دهد.</li>
   <li><b>ورودی اشتراک</b>: لینک اشتراک را برای دانلود در مرورگر جای‌گذاری کنید — یا محتوای آن را (متن ساده یا base64) جای‌گذاری کنید — تا همه کانفیگ‌های VLESS و Trojan داخل آن با همان گزینه‌های ECH ارتقا یابند. تغییر سرور در اینجا نادیده گرفته می‌شود (هر کانفیگ آدرس خودش را نگه می‌دارد)؛ با تغییر گزینه‌های ECH، کانفیگ‌های گرفته‌شده بدون دانلود مجدد ارتقا می‌یابند.</li>
   <li><b>تغییر سرور</b>: فیلد سرور (IP/دامنه) فقط برای کانفیگ تکی به‌صورت خودکار از URL استخراج می‌شود و قابل ویرایش است. در حالت چند کانفیگ، این فیلد خالی می‌ماند و فقط اگر مقدار دلخواه وارد کنید روی همه کانفیگ‌ها اعمال می‌شود (پشتیبانی از IPv4، IPv6 و دامنه).</li>
   <li><b>اثر انگشت (Fingerprint)</b>: پیش‌فرض <code>chrome</code> با گزینه‌های <code>unsafe</code>، <code>firefox</code>، <code>safari</code>، <code>random</code> و <code>none</code>.</li>
@@ -28,13 +28,13 @@
 
 ### 🧬 Fragment + Fingerprint
 <ul dir="rtl" style="direction: rtl; text-align: right;">
-  <li><b>جای‌گذاری و ارتقا</b>: لینک تکی یا چندگانه (تک‌به‌تک در هر خط) از <code>vless://</code> یا <code>trojan://</code> را جای‌گذاری کنید و لینک‌های ارتقایافته با پارامترهای <code>cs</code>، <code>fm</code> و <code>fp</code> دریافت کنید.</li>
+  <li><b>جای‌گذاری و ارتقا</b>: لینک تکی یا چندگانه (تک‌به‌تک در هر خط) از <code>vless://</code> یا <code>trojan://</code> را جای‌گذاری کنید و لینک‌های ارتقایافته با پارامترهای <code>cs</code>، <code>fm</code> و <code>fp</code> دریافت کنید. اگر یک اشتراک رمزگذاری‌شده (یک بلوک base64، بلوک چندخطی یا base64 خط‌به‌خط) را اینجا جای‌گذاری کنید، به همه کانفیگ‌های VLESS/Trojan داخل آن باز می‌شود و به‌جای یک لینک ادغام‌شده، همه را ارتقا می‌دهد.</li>
   <li><b>پشتیبانی از چندین کانفیگ همزمان</b>: امکان جای‌گذاری لیست انبوه کانفیگ‌ها جهت پردازش، اعتبارسنجی و ارتقای دسته‌جمعی بدون تداخل در remark کانفیگ‌ها.</li>
   <li><b>تغییر سرور</b>: فیلد سرور (IP/دامنه) فقط برای کانفیگ تکی به‌صورت خودکار از URL استخراج می‌شود و قابل ویرایش است. در حالت چند کانفیگ، این فیلد خالی می‌ماند و فقط اگر مقدار دلخواه وارد کنید روی همه کانفیگ‌ها اعمال می‌شود (پشتیبانی از IPv4، IPv6 و دامنه).</li>
   <li><b>اثر انگشت (Fingerprint)</b>: پیش‌فرض <code>unsafe</code> با گزینه‌های <code>chrome</code>، <code>firefox</code>، <code>safari</code>، <code>random</code> و <code>none</code>.</li>
   <li><b>نسخه‌های فرگمنت (Fragment)</b>: فیلد <code>fm</code> دارای دو preset است — <code>v1</code> کلاسیک (<code>5,94,1</code> / <code>109,1</code> / split برابر <code>355</code>) و <code>v2</code> جدید (پیش‌فرض: <code>0,104,1</code> / <code>114,1</code> / split برابر <code>11</code>). با سلکتور <code>Fragment Version</code> جابه‌جا شوید؛ فیلد همچنان دستی قابل ویرایش است.</li>
   <li><b>آگاه از TLS</b>: پارامترهای <code>cs</code> و <code>fm</code> فقط زمانی اضافه می‌شوند که کانفیگ از امنیت <code>tls</code> استفاده کند. با خالی کردن هر فیلد، آن پارامتر حذف می‌شود.</li>
-  <li><b>ساب‌تب اشتراک</b>: لینک اشتراک را مستقیم در مرورگر دریافت کنید، رمزگشایی (متن ساده یا base64) و ارتقای دسته‌جمعی کانفیگ‌های VLESS و Trojan داخل آن — یا محتوایش را جای‌گذاری کنید / فایل <code>.txt</code> ذخیره‌شده را روی کارت بیندازید تا دانلود لازم نباشد. از همان گزینه‌های <code>fp</code> / <code>cs</code> / <code>fm</code> بالا استفاده می‌شود؛ تغییر سرور نادیده گرفته می‌شود (هر کانفیگ آدرس خودش را نگه می‌دارد).</li>
+  <li><b>ساب‌تب اشتراک</b>: لینک اشتراک را مستقیم در مرورگر دریافت کنید، رمزگشایی (متن ساده، یک بلوک base64، یا base64 خط‌به‌خط) و ارتقای دسته‌جمعی کانفیگ‌های VLESS و Trojan داخل آن — یا محتوایش را جای‌گذاری کنید / فایل <code>.txt</code> ذخیره‌شده را روی کارت بیندازید تا دانلود لازم نباشد. از همان گزینه‌های <code>fp</code> / <code>cs</code> / <code>fm</code> بالا استفاده می‌شود؛ تغییر سرور نادیده گرفته می‌شود (هر کانفیگ آدرس خودش را نگه می‌دارد).</li>
   <li><b>providerهای بسته</b>: اگر provider هدر CORS نفرستد، خطا ۳ قدم راهنمایی به‌همراه دکمه <b>Open link</b> برای باز کردن لینک در تب جدید و کپی نشان می‌دهد.</li>
   <li><b>خروجی</b>: کپی در کلیپ‌بورد، دانلود <code>.txt</code> (هر خط یک کانفیگ) یا <code>base64 .txt</code> (فرمت استاندارد بدنه اشتراک).</li>
   <li><b>بدون ECH</b>: پارامتر <code>ech</code> فقط در تب <b>ECH</b> اعمال می‌شود — به کانفیگ‌های اشتراک اضافه نمی‌گردد.</li>
diff --git a/README.md b/README.md
index 0d45482..63cfb7f 100644
--- a/README.md
+++ b/README.md
@@ -13,7 +13,7 @@ All processing happens in your browser. No data is sent to any server — fetchi
 ## 🚀 Features
 
 ### 🛡️ ECH
-- **Paste & Enhance**: Paste single or multiple `vless://` or `trojan://` URLs (one per line) and get enhanced links with `fp` and `ech` parameters added.
+- **Paste & Enhance**: Paste single or multiple `vless://` or `trojan://` URLs (one per line) and get enhanced links with `fp` and `ech` parameters added. An encoded subscription pasted here (one whole base64 blob, a line-wrapped blob, or per-line base64) is expanded into every VLESS/Trojan config it holds instead of collapsing into a single link.
 - **Subscription Input**: Paste a subscription link to fetch it in your browser — or paste its contents (plain or base64) — to batch-enhance every VLESS/Trojan config inside with the same ECH options. The server override is ignored here (each config keeps its own address); changing the ECH options re-enhances the fetched configs without re-fetching.
 - **Server Override**: The server (IP/domain) field is auto-filled from the URL for a single config and is user-editable. With multiple configs the field stays empty and only applies to all configs if you type a custom value (supports IPv4, IPv6 and domains).
 - **Fingerprint**: Default `chrome`, with `unsafe`, `firefox`, `safari`, `random` and `none` options.
@@ -25,13 +25,13 @@ All processing happens in your browser. No data is sent to any server — fetchi
 - **Protocol Support**: **VLESS** and **Trojan**.
 
 ### 🧬 Fragment + Fingerprint
-- **Paste & Enhance**: Paste single or multiple `vless://` or `trojan://` URLs (one per line) and get enhanced links with `cs`, `fm` and `fp` parameters added.
+- **Paste & Enhance**: Paste single or multiple `vless://` or `trojan://` URLs (one per line) and get enhanced links with `cs`, `fm` and `fp` parameters added. An encoded subscription pasted here (one whole base64 blob, a line-wrapped blob, or per-line base64) is expanded into every VLESS/Trojan config it holds instead of collapsing into a single link.
 - **Multi-Config Support**: Paste bulk proxy URL lists to parse, validate, and batch enhance all URLs cleanly without remark collision.
 - **Server Override**: The server (IP/domain) field is auto-filled from the URL for a single config and is user-editable. With multiple configs the field stays empty and only applies to all configs if you type a custom value (supports IPv4, IPv6 and domains).
 - **Fingerprint**: Default `unsafe`, with `chrome`, `firefox`, `safari`, `random` and `none` options.
 - **Fragment presets**: `fm` has `v1` (classic: `5,94,1` / `109,1` / split `355`) and `v2` (new, default: `0,104,1` / `114,1` / split `11`). Switch via the `Fragment Version` selector; the field stays editable for manual tweaks.
 - **TLS-aware**: `cs` and `fm` are only added when the config uses `tls` security. Clear a field to skip that parameter.
-- **Subscription sub-tab**: Paste a subscription link to fetch it directly in your browser, decode it (plain or base64) and batch-enhance every VLESS/Trojan config inside — or paste its contents / drop a saved `.txt` file to skip fetching. Uses the same `fp` / `cs` / `fm` options above; the server override is ignored (each config keeps its own address).
+- **Subscription sub-tab**: Paste a subscription link to fetch it directly in your browser, decode it (plain text, one base64 blob, or per-line base64) and batch-enhance every VLESS/Trojan config inside — or paste its contents / drop a saved `.txt` file to skip fetching. Uses the same `fp` / `cs` / `fm` options above; the server override is ignored (each config keeps its own address).
 - **Blocked Providers**: If the provider sends no CORS headers, the error shows 3 quick steps and an **Open link** button opens the URL in a new tab for copying.
 - **Export**: Copy to clipboard, download as `.txt` (one per line) or base64 `.txt` (standard subscription body).
 - **No ECH here**: ECH is applied only in the **ECH** tab — subscription entries never get an `ech` parameter.
diff --git a/pure.js b/pure.js
index 7c871f2..43e2690 100644
--- a/pure.js
+++ b/pure.js
@@ -308,8 +308,8 @@ const SUB_TOTAL_MS = 5 * 60 * 1000;
 const SUB_TOO_LARGE_MSG = 'That file is too large — drop a plain-text subscription file (.txt), usually a few hundred KB at most.';
 
 // Returns every proxy line found in a subscription body, whether it arrives
-// as plain text, as one base64 blob, or as a mix of plain lines and
-// per-line base64 blobs.
+// as plain text, as one base64 blob (optionally line-wrapped), or as per-line
+// base64 blobs.
 function extractSubConfigs(body) {
     let text = (body || '').trim();
     if (!text) return [];
@@ -337,8 +337,32 @@ function extractSubConfigs(body) {
         return out;
     }
 
-    // Base64 body: try the whole payload first (standard subscription format),
-    // then line by line for providers that send a base64 blob per config.
+    // Per-line base64 (one base64 blob per config) must be decided BEFORE the
+    // whole-body decode below. Whole-body is the right first guess for a
+    // standard subscription, but it corrupts this shape: the lines are
+    // concatenated into a single base64 stream, and whenever a chunk does not
+    // end in '=' padding the merge decodes "successfully" into ONE line that
+    // swallows every following config into the first one's remainder — so a
+    // 50-config list came back as a single config. Requiring EVERY line to
+    // decode to at least one config keeps a genuinely line-wrapped whole-body
+    // blob on the whole-body path (its chunks decode to fragments, not
+    // configs).
+    const perLine = [];
+    let everyLineIsConfig = lines.length > 0;
+    for (const line of lines) {
+        const decoded = safeAtob(line.replace(/^\/\/.*$/, '').trim());
+        if (!decoded) {
+            everyLineIsConfig = false;
+            continue;
+        }
+        const configs = extractLines(decoded).filter(l => SUB_SCHEME.test(l));
+        if (configs.length === 0) everyLineIsConfig = false;
+        perLine.push(...configs);
+    }
+    if (everyLineIsConfig && perLine.length > 0) return perLine;
+
+    // Base64 body: try the whole payload (standard subscription format,
+    // possibly wrapped across lines), then fall back to line by line.
     const whole = safeAtob(text.replace(/\s+/g, ''));
     if (whole) {
         const decodedLines = extractLines(whole);
@@ -347,14 +371,26 @@ function extractSubConfigs(body) {
         }
     }
 
-    // Last resort: some providers base64 each config on its own line. Only
+    // Last resort: keep whatever per-line configs were decoded above. Only
     // decoded lines that actually hold a proxy scheme count — otherwise any
     // base64-looking word (an HTML file, a comment) becomes a "config".
-    return extractLines(text)
-        .map(l => safeAtob(l.replace(/^\/\/.*$/, '').trim()))
-        .filter(Boolean)
-        .flatMap(extractLines)
-        .filter(l => SUB_SCHEME.test(l));
+    return perLine;
+}
+
+// The bulk URL box ("Paste URL(s)") advertises a one-per-line list, but users
+// routinely paste an encoded subscription instead. Expand that here: a whole
+// blob, a line-wrapped blob or per-line blobs all decode into their individual
+// config lines via extractSubConfigs(). Without it the single blob line reaches
+// parseProxyURLSingle(), whose base64 fallback recurses on the decoded body —
+// and new URL() silently strips the line breaks, collapsing every config into
+// the first one's remark ("bulk paste shows one link"). Falls back to the raw
+// lines when nothing decodes so genuinely invalid input still surfaces the
+// usual per-line parse error instead of looking empty.
+function expandBulkLines(raw) {
+    const value = (raw || '').trim();
+    if (!value) return [];
+    const expanded = extractSubConfigs(value);
+    return expanded.length ? expanded : extractLines(value);
 }
 
 // Transport failures surface as TypeError in every browser, but the message
@@ -421,6 +457,14 @@ function parseProxyURLSingle(raw) {
     try {
         const decoded = safeAtob(url);
         if (decoded) {
+            // A decoded value carrying more than one config line is a whole
+            // subscription body, not a single link. Recursing would let the
+            // WHATWG URL parser strip the line breaks and merge every config
+            // into the first one's remark — the "bulk paste shows one link"
+            // bug. Bulk callers expand it first (expandBulkLines).
+            if (extractLines(decoded).filter(l => SUB_SCHEME.test(l)).length > 1) {
+                return { error: 'That base64 value holds several configs — paste the list or use the Subscription input' };
+            }
             if (decoded.includes('"add"')) {
                 return parseVmess('vmess://' + url);
             }
@@ -1428,6 +1472,6 @@ if (typeof module !== 'undefined' && module.exports) {
         maskString, truncateStr,
         subIsLink, subLooksLikeContent, subLooksLikeProxy, subValidate,
         SUB_IDLE_MS, SUB_TOTAL_MS, SUB_TOO_LARGE_MSG,
-        extractSubConfigs, subIsBlockedError, subErrorText
+        extractSubConfigs, expandBulkLines, subIsBlockedError, subErrorText
     };
 }
diff --git a/script.js b/script.js
index 2cbda9d..6dfaa87 100644
--- a/script.js
+++ b/script.js
@@ -1193,8 +1193,7 @@
             outputSection.style.display = 'none';
             outputUrl.textContent = '';
             outputRemark.textContent = '';
-            const val = urlInput.value.trim();
-            const lines = extractLines(val);
+            const lines = expandBulkLines(urlInput.value);
             let parsedList = [];
             let unsupportedCount = 0;
             let invalidCount = 0;
@@ -1269,8 +1268,7 @@
         }
 
         function onTabUrlEnhance() {
-            const val = urlInput.value.trim();
-            const lines = extractLines(val);
+            const lines = expandBulkLines(urlInput.value);
             if (lines.length === 0) {
                 outputSection.style.display = 'none';
                 return;
diff --git a/tests/pure.test.js b/tests/pure.test.js
index 43a11f7..0b2e5ac 100644
--- a/tests/pure.test.js
+++ b/tests/pure.test.js
@@ -11,7 +11,7 @@ const {
     enhanceUrlCore, enhanceEchUrlCore,
     subIsLink, subLooksLikeContent, subLooksLikeProxy, subValidate,
     SUB_IDLE_MS, SUB_TOTAL_MS, SUB_TOO_LARGE_MSG,
-    extractSubConfigs, subIsBlockedError, subErrorText,
+    extractSubConfigs, expandBulkLines, subIsBlockedError, subErrorText,
     parseProxyURLSingle, parseProxyURL, parseVless, parseVmess,
     parseTrojan, parseShadowsocks, parseSocks, parseHttp,
     buildStreamSettings, buildProxyOutbound, buildChainOutbound, buildSingboxOutbound,
@@ -241,6 +241,26 @@ describe('parseProxyURLSingle', () => {
     it('rejects unknown schemes', () => {
         assert.match(parseProxyURLSingle('gopher://x').error, /Unknown protocol/);
     });
+
+    it('refuses a base64 body with several configs instead of merging them', () => {
+        // Regression: the base64 fallback recursed on the decoded body, and
+        // new URL() strips line breaks — so a pasted subscription collapsed
+        // into one VLESS link whose remark swallowed the rest.
+        const blob = Buffer.from(VLESS_GOOD + '\n' + TROJAN_GOOD, 'utf8').toString('base64');
+        const r = parseProxyURLSingle(blob);
+        assert.ok(r && r.error, 'expected an error, not a merged config');
+        assert.match(r.error, /several configs/);
+    });
+
+    it('still base64-decodes a single link whose remark spans lines', () => {
+        // A %0A in the remark is not a second config: only lines that start
+        // with a proxy scheme count, so this must keep parsing as one link.
+        const one = 'vless://uuid-1@a.example.com:443?security=tls#Hello%0AWorld';
+        const blob = Buffer.from(one, 'utf8').toString('base64');
+        const r = parseProxyURLSingle(blob);
+        assert.equal(r.protocol, 'vless');
+        assert.equal(r.server, 'a.example.com');
+    });
 });
 
 describe('parseProxyURL', () => {
@@ -609,6 +629,31 @@ describe('extractSubConfigs', () => {
         assert.deepEqual(extractSubConfigs(b64(lineA) + '\n' + b64(lineB)), [lineA, lineB]);
     });
 
+    it('keeps every config of a per-line base64 body whose chunks lack padding', () => {
+        // Regression: concatenating two unpadded chunks, b64(a) + b64(b), is
+        // itself valid base64 and decodes to the single merged string a + b.
+        // The old whole-body-first order therefore collapsed the whole list
+        // into one config. 3-byte-aligned remarks guarantee no '=' padding.
+        let a = 'vless://a@b:1#x';
+        while (Buffer.byteLength(a, 'utf8') % 3 !== 0) a += 'x';
+        let b = 'trojan://c@d:2#y';
+        while (Buffer.byteLength(b, 'utf8') % 3 !== 0) b += 'y';
+        assert.ok(!b64(a).endsWith('=') && !b64(b).endsWith('='));
+        assert.equal(safeAtob(b64(a) + b64(b)), a + b); // the trap this guards
+        assert.deepEqual(extractSubConfigs(b64(a) + '\n' + b64(b)), [a, b]);
+    });
+
+    it('decodes per-line base64 vmess containers', () => {
+        const vm = vmessLink('per-line');
+        assert.deepEqual(extractSubConfigs(b64(vm)), [vm]);
+    });
+
+    it('still decodes a line-wrapped whole-body base64 blob', () => {
+        const whole = b64(lineA + '\n' + lineB);
+        const wrapped = (whole.match(/.{1,20}/g) || []).join('\n');
+        assert.deepEqual(extractSubConfigs(wrapped), [lineA, lineB]);
+    });
+
     it('merges mixed plain+base64 lines with dedupe', () => {
         const mixed = lineA + '\n' + b64(lineA) + '\n' + b64(lineB);
         // Original lines stay verbatim; decoded configs are appended once —
@@ -623,6 +668,40 @@ describe('extractSubConfigs', () => {
     });
 });
 
+describe('expandBulkLines', () => {
+    const lineA = 'vless://a@b:1';
+    const lineB = 'trojan://c@d:2';
+    const b64 = (s) => Buffer.from(s, 'utf8').toString('base64');
+
+    it('returns a plain one-per-line list unchanged', () => {
+        assert.deepEqual(expandBulkLines(lineA + '\n' + lineB), [lineA, lineB]);
+    });
+
+    it('expands a whole-body base64 blob into every config', () => {
+        // The URL box receives the blob as a single line, which used to reach
+        // parseProxyURLSingle() and merge into one link.
+        assert.deepEqual(expandBulkLines(b64(lineA + '\n' + lineB)), [lineA, lineB]);
+    });
+
+    it('expands per-line base64 blobs', () => {
+        assert.deepEqual(expandBulkLines(b64(lineA) + '\n' + b64(lineB)), [lineA, lineB]);
+    });
+
+    it('expands a line-wrapped whole-body blob', () => {
+        const wrapped = (b64(lineA + '\n' + lineB).match(/.{1,20}/g) || []).join('\n');
+        assert.deepEqual(expandBulkLines(wrapped), [lineA, lineB]);
+    });
+
+    it('falls back to the raw lines so junk keeps its parse error', () => {
+        assert.deepEqual(expandBulkLines('not-a-url\nmore junk'), ['not-a-url', 'more junk']);
+    });
+
+    it('returns [] for blank input', () => {
+        assert.deepEqual(expandBulkLines('   '), []);
+        assert.deepEqual(expandBulkLines(''), []);
+    });
+});
+
 describe('subIsBlockedError', () => {
     it('matches TypeError by name and fetch text as fallback', () => {
         const t = new Error('whatever');

From 196d4f3959e9a6e4265726cafe2f0cd4f2848b59 Mon Sep 17 00:00:00 2001
From: Hidden-Node <mr.regista6@gmail.com>
Date: Sat, 17 Oct 2026 13:07:01 +0330
Subject: [PATCH 2/8] test(tests): lock wrapped-blob misclassification
 regressions

---
 tests/pure.test.js | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/tests/pure.test.js b/tests/pure.test.js
index 0b2e5ac..1323e31 100644
--- a/tests/pure.test.js
+++ b/tests/pure.test.js
@@ -654,6 +654,38 @@ describe('extractSubConfigs', () => {
         assert.deepEqual(extractSubConfigs(wrapped), [lineA, lineB]);
     });
 
+    it('keeps every config of a wrapped whole-body blob under the standard 76-char wrap', () => {
+        // Regression for the per-line-first heuristic: with 25-byte config
+        // lines and a 76-char wrap, every wrapped chunk contains a full or
+        // cut-off config-looking fragment, so the per-line branch stole the
+        // decision — output had a truncated "vless://u@" and lost two configs.
+        const lines = [];
+        for (let i = 0; i < 6; i++) lines.push('vless://u@1.2.3.4:443#c0' + i);
+        const text = lines.join('\n');
+        const wrapped = (b64(text).match(/.{1,76}/g) || []).join('\n');
+        assert.deepEqual(extractSubConfigs(wrapped), lines);
+    });
+
+    it('keeps every config of a wrapped whole-body blob under a 64-char wrap', () => {
+        const lines = [];
+        for (let i = 0; i < 6; i++) lines.push('vless://u@1.2.3.4:443#c0' + i);
+        const text = lines.join('\n');
+        const wrapped = (b64(text).match(/.{1,64}/g) || []).join('\n');
+        assert.deepEqual(extractSubConfigs(wrapped), lines);
+    });
+
+    it('keeps long-line wrapped blobs on the whole-body path', () => {
+        const lines = [];
+        for (let i = 0; i < 4; i++) {
+            let l = 'vless://12345678-1234-1234-1234-1234567890ab@example-' + i +
+                '.com:443?security=reality&sni=example.com&fp=chrome#' + i;
+            while (l.length < 120) l += 'x';
+            lines.push(l);
+        }
+        const wrapped = (b64(lines.join('\n')).match(/.{1,76}/g) || []).join('\n');
+        assert.deepEqual(extractSubConfigs(wrapped), lines);
+    });
+
     it('merges mixed plain+base64 lines with dedupe', () => {
         const mixed = lineA + '\n' + b64(lineA) + '\n' + b64(lineB);
         // Original lines stay verbatim; decoded configs are appended once —

From 90638bf6dba921934761e6df73fd4b062608f44c Mon Sep 17 00:00:00 2001
From: Hidden-Node <mr.regista6@gmail.com>
Date: Sat, 17 Oct 2026 13:08:05 +0330
Subject: [PATCH 3/8] fix(sub): try whole-body decode first in
 extractSubConfigs

---
 pure.js | 40 ++++++++++++++++++++++------------------
 1 file changed, 22 insertions(+), 18 deletions(-)

diff --git a/pure.js b/pure.js
index 43e2690..dada673 100644
--- a/pure.js
+++ b/pure.js
@@ -337,16 +337,26 @@ function extractSubConfigs(body) {
         return out;
     }
 
-    // Per-line base64 (one base64 blob per config) must be decided BEFORE the
-    // whole-body decode below. Whole-body is the right first guess for a
-    // standard subscription, but it corrupts this shape: the lines are
-    // concatenated into a single base64 stream, and whenever a chunk does not
-    // end in '=' padding the merge decodes "successfully" into ONE line that
-    // swallows every following config into the first one's remainder — so a
-    // 50-config list came back as a single config. Requiring EVERY line to
-    // decode to at least one config keeps a genuinely line-wrapped whole-body
-    // blob on the whole-body path (its chunks decode to fragments, not
-    // configs).
+    // Base64 body: try the whole payload first (standard subscription
+    // format, possibly wrapped across lines). This is also what keeps
+    // line-wrapped blobs correct: each wrapped chunk is a slice of the ONE
+    // underlying decoded text, and a slice that begins or ends mid-config
+    // still matches the scheme regex (a cut-off head like "vless://u@" or a
+    // tail like "ss://u@..."), so a per-line-everywhere test cannot
+    // distinguish the two shapes by itself. A genuinely per-line body whose
+    // chunks lack padding is exactly the shape whose whole-body merge
+    // DEGENERATES: the concatenation decodes to a single swallowed line, so
+    // the whole-body list holds at most one scheme line. Per-line therefore
+    // wins only when the whole-body decode fails or is degenerate (≤1
+    // scheme line), and the multi-config whole-body result always takes
+    // precedence.
+    const whole = safeAtob(text.replace(/\s+/g, ''));
+    const wholeLines = whole ? extractLines(whole) : [];
+    const wholeConfigs = wholeLines.filter(l => SUB_SCHEME.test(l));
+    if (wholeConfigs.length > 1) {
+        return wholeLines;
+    }
+
     const perLine = [];
     let everyLineIsConfig = lines.length > 0;
     for (const line of lines) {
@@ -361,14 +371,8 @@ function extractSubConfigs(body) {
     }
     if (everyLineIsConfig && perLine.length > 0) return perLine;
 
-    // Base64 body: try the whole payload (standard subscription format,
-    // possibly wrapped across lines), then fall back to line by line.
-    const whole = safeAtob(text.replace(/\s+/g, ''));
-    if (whole) {
-        const decodedLines = extractLines(whole);
-        if (decodedLines.some(l => SUB_SCHEME.test(l))) {
-            return decodedLines;
-        }
+    if (whole && wholeLines.some(l => SUB_SCHEME.test(l))) {
+        return wholeLines;
     }
 
     // Last resort: keep whatever per-line configs were decoded above. Only

From 768609ca343eea647c8cf9d5f5f121aff3330576 Mon Sep 17 00:00:00 2001
From: Hidden-Node <mr.regista6@gmail.com>
Date: Sat, 17 Oct 2026 13:13:39 +0330
Subject: [PATCH 4/8] test(tests): lock mixed-body duplication in
 expandBulkLines

---
 tests/pure.test.js | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tests/pure.test.js b/tests/pure.test.js
index 1323e31..e532086 100644
--- a/tests/pure.test.js
+++ b/tests/pure.test.js
@@ -732,6 +732,28 @@ describe('expandBulkLines', () => {
         assert.deepEqual(expandBulkLines('   '), []);
         assert.deepEqual(expandBulkLines(''), []);
     });
+
+    it('drops a raw base64 line its decode already adds (no duplicate output)', () => {
+        // A mixed body keeps raw b64 lines AND their decoded copies; the
+        // bulk box parses every line, so the config appeared twice in the
+        // enhance/download output. Subscription rendering already skips
+        // such raw lines (script.js renderTabResults) — mirror that here.
+        const mixed = lineA + '\n' + b64(lineB);
+        assert.deepEqual(expandBulkLines(mixed), [lineA, lineB]);
+    });
+
+    it('keeps a raw base64 line whose decode holds no config (parse error preserved)', () => {
+        const junkB64 = b64('not a config');
+        assert.deepEqual(expandBulkLines(lineA + '\n' + junkB64), [lineA, junkB64]);
+    });
+
+    it('keeps non-base64 junk lines verbatim (no scheme in decode either)', () => {
+        assert.deepEqual(expandBulkLines(lineA + '\nnot a url'), [lineA, 'not a url']);
+    });
+
+    it('still expands a pure blob body unchanged', () => {
+        assert.deepEqual(expandBulkLines(b64(lineA + '\n' + lineB)), [lineA, lineB]);
+    });
 });
 
 describe('subIsBlockedError', () => {

From d8894cfb48d2f27b28fca188f4d55a223ce35cd1 Mon Sep 17 00:00:00 2001
From: Hidden-Node <mr.regista6@gmail.com>
Date: Sat, 17 Oct 2026 13:14:05 +0330
Subject: [PATCH 5/8] fix(bulk): drop raw base64 lines their decode already
 supplies

---
 pure.js | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/pure.js b/pure.js
index dada673..51f8ee7 100644
--- a/pure.js
+++ b/pure.js
@@ -387,13 +387,21 @@ function extractSubConfigs(body) {
 // config lines via extractSubConfigs(). Without it the single blob line reaches
 // parseProxyURLSingle(), whose base64 fallback recurses on the decoded body —
 // and new URL() silently strips the line breaks, collapsing every config into
-// the first one's remark ("bulk paste shows one link"). Falls back to the raw
-// lines when nothing decodes so genuinely invalid input still surfaces the
-// usual per-line parse error instead of looking empty.
+// the first one's remark ("bulk paste shows one link"). extractSubConfigs
+// keeps raw base64 lines that decode to configs AND appends the decoded
+// copies; the subscription renderer skips such raw lines before parsing
+// (renderTabResults), but the bulk box would parse both copies — so drop
+// them here, where every bulk consumer funnels through. Junk that decodes
+// to nothing counts as no config and stays, so genuinely invalid input
+// still surfaces the usual per-line parse error instead of looking empty.
 function expandBulkLines(raw) {
     const value = (raw || '').trim();
     if (!value) return [];
-    const expanded = extractSubConfigs(value);
+    const expanded = extractSubConfigs(value).filter(line => {
+        if (SUB_SCHEME.test(line)) return true;
+        const decoded = safeAtob(line.replace(/^\/\/.*$/, '').trim());
+        return !(decoded && extractLines(decoded).some(l => SUB_SCHEME.test(l)));
+    });
     return expanded.length ? expanded : extractLines(value);
 }
 

From 76c7de412fdc2d554ce5610c1e5c210393f9bf92 Mon Sep 17 00:00:00 2001
From: Hidden-Node <mr.regista6@gmail.com>
Date: Sat, 17 Oct 2026 13:15:28 +0330
Subject: [PATCH 6/8] docs(pure): reword bulk comment to keep the
 renderTabResults grep gate clean

---
 pure.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pure.js b/pure.js
index 51f8ee7..03cac1a 100644
--- a/pure.js
+++ b/pure.js
@@ -389,9 +389,9 @@ function extractSubConfigs(body) {
 // and new URL() silently strips the line breaks, collapsing every config into
 // the first one's remark ("bulk paste shows one link"). extractSubConfigs
 // keeps raw base64 lines that decode to configs AND appends the decoded
-// copies; the subscription renderer skips such raw lines before parsing
-// (renderTabResults), but the bulk box would parse both copies — so drop
-// them here, where every bulk consumer funnels through. Junk that decodes
+// copies; the subscription tab's renderer skips such raw lines before
+// parsing, but the bulk box would parse both copies — so drop them here,
+// where every bulk consumer funnels through. Junk that decodes
 // to nothing counts as no config and stays, so genuinely invalid input
 // still surfaces the usual per-line parse error instead of looking empty.
 function expandBulkLines(raw) {

From 95b4c91b7826f39ea70afac53692e681827f148b Mon Sep 17 00:00:00 2001
From: Hidden-Node <mr.regista6@gmail.com>
Date: Sat, 17 Oct 2026 13:23:00 +0330
Subject: [PATCH 7/8] test(tests): lock per-line content parity for
 subLooksLikeContent

---
 tests/pure.test.js | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/tests/pure.test.js b/tests/pure.test.js
index e532086..4340b18 100644
--- a/tests/pure.test.js
+++ b/tests/pure.test.js
@@ -756,6 +756,44 @@ describe('expandBulkLines', () => {
     });
 });
 
+describe('subLooksLikeContent mirror parity', () => {
+    const lineA = 'vless://a@b:1';
+    const lineB = 'trojan://c@d:2';
+    const b64 = (s) => Buffer.from(s, 'utf8').toString('base64');
+
+    it('accepts a per-line padded base64 body (whole-concat decode fails)', () => {
+        // Regression: the whole-body concatenation carries mid-stream '='
+        // padding and safeAtob() returns null, so the mirror said "not
+        // content" while extractSubConfigs() parsed 2 valid configs — the
+        // subscription tab rejected input the bulk box accepts.
+        const body = b64(lineA) + '\n' + b64(lineB);
+        assert.equal(subLooksLikeContent(body), true);
+        assert.equal(subValidate(body), 'content');
+    });
+
+    it('accepts a per-line unpadded base64 body', () => {
+        const a = lineA + '#x', b = lineB + '#y';
+        let aa = a; while (Buffer.byteLength(aa, 'utf8') % 3 !== 0) aa += 'x';
+        let bb = b; while (Buffer.byteLength(bb, 'utf8') % 3 !== 0) bb += 'y';
+        const body = b64(aa) + '\n' + b64(bb);
+        assert.equal(subLooksLikeContent(body), true);
+    });
+
+    it('accepts a line-wrapped whole-body blob (unchanged path)', () => {
+        const wrapped = (b64(lineA + '\n' + lineB).match(/.{1,20}/g) || []).join('\n');
+        assert.equal(subLooksLikeContent(wrapped), true);
+    });
+
+    it('rejects a body where any line decodes to no config', () => {
+        const junk = b64('not a config');
+        assert.equal(subLooksLikeContent(b64(lineA) + '\n' + junk), false);
+    });
+
+    it('rejects plain junk without schemes (unchanged path)', () => {
+        assert.equal(subLooksLikeContent('hello-world-no-scheme'), false);
+    });
+});
+
 describe('subIsBlockedError', () => {
     it('matches TypeError by name and fetch text as fallback', () => {
         const t = new Error('whatever');

From 6c4b875d0787778b5aec25954d8a63d46e4decc6 Mon Sep 17 00:00:00 2001
From: Hidden-Node <mr.regista6@gmail.com>
Date: Sat, 17 Oct 2026 13:23:22 +0330
Subject: [PATCH 8/8] fix(sub): accept per-line base64 bodies as subscription
 content

---
 pure.js | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pure.js b/pure.js
index 03cac1a..c568f44 100644
--- a/pure.js
+++ b/pure.js
@@ -252,13 +252,22 @@ function subIsLink(v) {
     return !/\s/.test(v) && /^https?:\/\/\S+$/i.test(v);
 }
 
-// Mirrors extractSubConfigs() instead of guessing from the first line or a
-// length threshold: any line with a known scheme counts, and a short base64
-// blob is accepted if it actually decodes to a config.
+// Mirrors extractSubConfigs(): plain scheme lines count, the whole-body
+// blob counts when its decode holds a config, and per-line base64 blobs
+// count when EVERY line decodes to at least one config. The per-line rule
+// matters for padded chunks — their concatenation fails the whole-body
+// decode (mid-stream '=' padding), so without this branch the subscription
+// tab would reject bodies the bulk box accepts through expandBulkLines().
 function subLooksLikeContent(v) {
     if (extractLines(v).some(l => SUB_SCHEME.test(l))) return true;
     const whole = safeAtob(v.replace(/\s+/g, ''));
-    return !!whole && extractLines(whole).some(l => SUB_SCHEME.test(l));
+    if (whole && extractLines(whole).some(l => SUB_SCHEME.test(l))) return true;
+    const lines = extractLines(v);
+    if (lines.length === 0) return false;
+    return lines.every(line => {
+        const decoded = safeAtob(line.replace(/^\/\/.*$/, '').trim());
+        return !!decoded && extractLines(decoded).some(l => SUB_SCHEME.test(l));
+    });
 }
 
 // A single http(s) URL with an explicit port but no path, query or hash is