feat(ipc): 暴露服务安装卸载到 CLI 命令，VLESS flow 改为透传

新增 `singcast service install --home <dir>` / `singcast service uninstall` 命令，
InstallService 接受 homeDir 参数而非内部获取工作目录。VLESS flow 字段不再写死
为 xtls-rprx-vision，改为直接透传用户配置值由 sing-box 运行时校验。

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: mapleafgo

cmd/singcast/main.go

@@ -20,6 +20,7 @@ func main() {
 			ipcCommand(),
 			convertCommand(),
 			checkCommand(),
+			serviceCommand(),
 			versionCommand(),
 		},
 	}

cmd/singcast/service.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/urfave/cli/v3"
+
+	"github.com/mapleafgo/singcast/ipc"
+)
+
+func serviceCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "service",
+		Usage: "Manage system service",
+		Commands: []*cli.Command{
+			{
+				Name:  "install",
+				Usage: "Install the system service",
+				Flags: []cli.Flag{
+					&cli.StringFlag{
+						Name:     "home",
+						Usage:    "home directory for the service",
+						Required: true,
+					},
+				},
+				Action: func(ctx context.Context, cmd *cli.Command) error {
+					if err := ipc.InstallService(cmd.String("home")); err != nil {
+						return fmt.Errorf("install service: %w", err)
+					}
+					fmt.Println("service installed")
+					return nil
+				},
+			},
+			{
+				Name:  "uninstall",
+				Usage: "Uninstall the system service",
+				Action: func(ctx context.Context, cmd *cli.Command) error {
+					if err := ipc.UninstallService(); err != nil {
+						return fmt.Errorf("uninstall service: %w", err)
+					}
+					fmt.Println("service uninstalled")
+					return nil
+				},
+			},
+		},
+	}
+}

ipc/handler.go

@@ -75,7 +75,7 @@ func (h *Handler) Handle(req *JSONRPCRequest) JSONRPCResponse {
 	case MethodSetLogLevel:
 		return h.handleSetLogLevel(req, id)
 	case MethodServiceInstall:
-		return h.handleVoid(req, id, func() error { return InstallService() })
+		return h.handleServiceInstall(req, id)
 	case MethodServiceUninstall:
 		return h.handleVoid(req, id, func() error { return UninstallService() })
 	default:
@@ -176,6 +176,17 @@ func (h *Handler) handleSetLogLevel(req *JSONRPCRequest, id int64) JSONRPCRespon
 	return newEmptyResult(id)
 }
 
+func (h *Handler) handleServiceInstall(req *JSONRPCRequest, id int64) JSONRPCResponse {
+	var params InstallServiceParams
+	if err := json.Unmarshal(req.Params, &params); err != nil {
+		return newError(id, -32602, "invalid params: "+err.Error())
+	}
+	if err := InstallService(params.Home); err != nil {
+		return newError(id, 1, err.Error())
+	}
+	return newEmptyResult(id)
+}
+
 func (h *Handler) handleVoid(req *JSONRPCRequest, id int64, fn func() error) JSONRPCResponse {
 	if err := fn(); err != nil {
 		return newError(id, 1, err.Error())

ipc/service_posix.go

@@ -4,7 +4,7 @@ package ipc
 
 import "errors"
 
-func InstallService() error {
+func InstallService(_ string) error {
 	return errors.New("service management is only supported on Windows")
 }
 

ipc/service_windows.go

@@ -13,17 +13,12 @@ import (
 
 const ServiceName = "SingcastService"
 
-func InstallService() error {
+func InstallService(homeDir string) error {
 	exe, err := os.Executable()
 	if err != nil {
 		return fmt.Errorf("get executable: %w", err)
 	}
 
-	homeDir, err := os.Getwd()
-	if err != nil {
-		return fmt.Errorf("get working directory: %w", err)
-	}
-
 	m, err := mgr.Connect()
 	if err != nil {
 		return fmt.Errorf("connect to SCM: %w", err)
@@ -65,13 +60,20 @@ func UninstallService() error {
 	}
 	defer m.Disconnect()
 
-	s, err := m.OpenService(ServiceName)
+	namePtr, err := windows.UTF16PtrFromString(ServiceName)
 	if err != nil {
-		return fmt.Errorf("service %s not found: %w", ServiceName, err)
+		return err
 	}
-	defer s.Close()
 
-	if err := s.Delete(); err != nil {
+	// Use windows.OpenService with DELETE only — mgr.OpenService hardcodes
+	// SERVICE_ALL_ACCESS which requires standard rights the DACL does not grant.
+	h, err := windows.OpenService(m.Handle, namePtr, windows.DELETE)
+	if err != nil {
+		return fmt.Errorf("open service %s: %w", ServiceName, err)
+	}
+	defer windows.CloseServiceHandle(h)
+
+	if err := windows.DeleteService(h); err != nil {
 		return fmt.Errorf("delete service: %w", err)
 	}
 	return nil
@@ -83,15 +85,11 @@ func UninstallService() error {
 //
 // Access mask:
 //
-//	SERVICE_QUERY_STATUS  = 0x0004
-//	SERVICE_START         = 0x0010
-//	SERVICE_STOP          = 0x0020
-//	SERVICE_INTERROGATE   = 0x0080
-//	Total                 = 0x00B4
-//
-// SIDs: AU = Authenticated Users, BA = Built-in Administrators, SY = Local System.
+//	AU (Authenticated Users): 0x100B4 — DELETE + query status + start + stop + interrogate
+//	BA (Built-in Admins):     0xF01FF — SERVICE_ALL_ACCESS
+//	SY (Local System):        0xF01FF — SERVICE_ALL_ACCESS
 func setServiceDACL(serviceName string) error {
-	sddl := "D:(A;;0x00B4;;;AU)(A;;0x01FF;;;BA)(A;;0x01FF;;;SY)"
+	sddl := "D:(A;;0x100B4;;;AU)(A;;0xF01FF;;;BA)(A;;0xF01FF;;;SY)"
 
 	sd, err := windows.SecurityDescriptorFromString(sddl)
 	if err != nil {

ipc/types.go

@@ -150,6 +150,11 @@ type SetLogLevelParams struct {
 	Level int32 `json:"level"`
 }
 
+// InstallServiceParams holds parameters for service.install.
+type InstallServiceParams struct {
+	Home string `json:"home"`
+}
+
 // --- Notification payload types ---
 
 // StateUpdatePayload represents a kernel state change.

translator/proxy/vless.go

@@ -17,10 +17,10 @@ func TranslateVLESS(m map[string]any, warn func(string)) map[string]any {
 		return nil
 	}
 
-	// sing-box only supports "xtls-rprx-vision"; normalize all variants.
+	// Pass flow as-is; sing-box validates at runtime.
 	// https://github.com/mapleafgo/clash-for-flutter/issues/66
 	if flow := GetStr(m, "flow"); flow != "" {
-		outbound["flow"] = "xtls-rprx-vision"
+		outbound["flow"] = flow
 	}
 
 	// Packet encoding