Run official Xray-core on nodes with full Reality, TLS, and routing.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/db/clients.go

@@ -231,7 +231,7 @@ func ClientSubscriptionHosts(db *sql.DB, client *models.Client) ([]models.SubHos
 	rows, err := db.Query(`
 SELECT i.id, i.tag, i.remark, p.code, p.name, i.port, i.network, i.security,
        i.path, i.host, i.sni, i.fingerprint, i.flow, i.alpn,
-       i.reality_public_key, i.reality_short_id, i.ss_method, i.password,
+       i.reality_public_key, i.reality_short_id, i.spider_x, i.ss_method, i.password,
        COALESCE(n.host, ''), COALESCE(n.name, ''),
        COALESCE(n.status = 'online', FALSE),
        COALESCE(ni.enabled AND n.status = 'online', FALSE)
@@ -256,7 +256,7 @@ ORDER BY i.sort_order ASC, i.tag ASC, n.name ASC NULLS LAST`, client.ID)
 			&h.InboundID, &h.Tag, &h.Remark, &h.ProtocolCode, &h.ProtocolName,
 			&h.Port, &h.Network, &h.Security,
 			&h.Path, &h.HostHeader, &h.SNI, &h.Fingerprint, &h.Flow, &h.ALPN,
-			&h.PublicKey, &h.ShortID, &h.SSMethod, &h.Password,
+			&h.PublicKey, &h.ShortID, &h.SpiderX, &h.SSMethod, &h.Password,
 			&h.Address, &h.NodeName,
 			&h.NodeOnline, &h.Available,
 		); err != nil {
@@ -363,6 +363,13 @@ func buildVLESSLink(uid, name string, h *models.SubHost) string {
 	if h.ShortID != "" {
 		parts = append(parts, "sid="+url.QueryEscape(h.ShortID))
 	}
+	spx := h.SpiderX
+	if spx == "" && h.Security == "reality" {
+		spx = "/"
+	}
+	if spx != "" {
+		parts = append(parts, "spx="+url.QueryEscape(spx))
+	}
 	return fmt.Sprintf("vless://%s@%s:%d?%s#%s", uid, h.Address, h.Port, strings.Join(parts, "&"), name)
 }