fix(naive): stop sending unsupported alpn/insecure to sing-box naive outbound

[Sway-Chan]

Problem

FlowZ builds the naive outbound's TLS block with alpn and insecure:

outbound.tls = {
  enabled: true,
  server_name: server.tlsSettings?.serverName || server.address,
  insecure: server.tlsSettings?.allowInsecure || false,
  alpn: server.tlsSettings?.alpn || undefined,
};

But sing-box's naive outbound uses Cronet, which manages its own TLS, and only server_name / certificate / certificate_path / ech are supported. Passing alpn, or insecure: true, makes sing-box hard-fail at startup:

FATAL: initialize outbound: alpn is not supported on naive outbound
FATAL: initialize outbound: insecure is not supported on naive outbound

So a naive node that carries an ALPN (e.g. from an imported subscription) or has "allow insecure" enabled causes the core to refuse to start. Reproduced with the bundled sing-box check (1.13.3): alpn:["h3"] → alpn is not supported on naive outbound; insecure:true → insecure is not supported on naive outbound; server_name-only → accepted.

Fix

Emit only server_name for the naive outbound TLS. The alpn / allowInsecure the user may have set on the node are ignored, since sing-box's naive cannot honour them anyway (and the docs explicitly advise against self-signed certs for naive).

References

• sing-box docs — Naive outbound TLS supports only server_name / certificate / certificate_path / ech: https://sing-box.sagernet.org/configuration/outbound/naive/
• sing-box source — protocol/naive/outbound.go (v1.13.x), ~L47: if len(options.TLS.ALPN) > 0 { return nil, E.New("alpn is not supported on naive outbound") } (plus the analogous insecure check).

Testing

tsc -p tsconfig.main.json, eslint, prettier clean; the post-fix naive outbound (server_name only) validated by the bundled sing-box check.

🤖 Generated with Claude Code

[dododook]

Merged into main branch via local git merge, included in v3.5.0 release. Thank you for your contribution!