qlinter
singbox-proxymanager-forclaude

singbox-watch

Tray switch + fail-closed kill-switch

Make sure a sing-box tunnel never silently falls back to your raw connection.

A Windows tray controller, watchdog and fail-safe toolkit for a sing-box tunnel with a static exit IP. Two small Rust binaries: proxy-tray.exe and singbox-watch.exe, plus an Android app that watches the phone’s own tunnel.

  • Windows 10 / 11 x64
  • Rust, winapi only
  • MIT
  • macOS (beta)
  • Android (beta)

Read this first: by design, the kill-switch closes claude.exe and Claude Code’s node.exe whenever the tunnel is off or the exit IP is wrong. See What gets killed.

01

What the setup does

Run the downloaded file and follow the wizard.

This is the project’s own one-file installer.

  1. Installs into your existing install’s folder, else next to a running sing-box.exe, else %USERPROFILE%\singbox-watch. No admin needed.
  2. Turns on login autostart for both apps and adds the per-minute keep-alive task.
  3. Offers to pin your current public IP as expected-exit-ip.txt if none exists.
  4. Adds an Apps entry. Uninstalling keeps your config, state and logs. Re-run it to upgrade.

Other ways to install

Installer options 
singbox-watch-setup-1.1.0.exe --silent [--dir <path>]
singbox-watch-setup-1.1.0.exe --uninstall [--silent]
singbox-watch-setup-1.1.0.exe --extract <dir>
Build from source 
build-installer.cmd
Android, from source 
cd android
gradlew assembleRelease

On a Mac

  1. Beta: the macOS edition builds cleanly, but its README says it hasn’t been run on a real Mac yet.
  2. Unpack it, then in Terminal: cd singbox-watch-mac && xattr -dr com.apple.quarantine . && ./install.sh
  3. That adds a per-minute keep-alive LaunchAgent and a login LaunchAgent for the menu-bar app.
  4. The Mac edition is still 1.0.0: it doesn’t have 1.1.0’s Settings menu or the amber switching icon yet.

On Android

  1. Beta, new in 1.1.0: it watches the phone’s own sing-box tunnel, next to the sing-box app (SFA). It doesn’t control the PC.
  2. Open the APK on the phone and allow the install. Then turn sing-box on, open the app and tap Pin current IP.
  3. For Android’s built-in kill switch, use the app’s shortcut to the VPN settings and turn on Always-on VPN and Block connections without VPN for sing-box.

02

What it does

From the project’s README.

Tray switch

Left-click toggles the tunnel. Red when off, amber while switching on, green the moment the exit IP matches the pinned IP. It turns red the instant sing-box exits.

Settings

Right-click → Settings switches each part on or off: closing apps when off, the keep-closed pop-up, auto-enable, the DNS trigger, the banner and the renewal countdown. Saved in settings.txt.

Fail-closed kill-switch

Turning the proxy off first kills every matched app with a native path. Measured under 100 ms.

Warning banner

An always-on-top red “TUNNEL BYPASSED” banner when the exit IP changes unexpectedly.

Auto-enable guard

If a matched app starts while the tunnel is down, it is suspended until the tunnel is up and the exit IP is verified.

Keep-alive

A hidden per-minute task brings back the tray app, the banner watcher and the tunnel. A crashed tunnel heals in under a minute.

Doctor

proxy-tray.exe --doctor prints a full health report: exit IP, processes, tasks, autostart, WebRTC policy.

Phone tunnel watch

The Android app alerts the moment Android reports the VPN gone, and checks the phone’s exit IP against your pinned IP.

03

Requirements

  • Windows 10 or 11, x64.
  • sing-box installed and runnable through a scheduled task (default name sing-box-tun).
  • A single static exit IP. Multi-exit setups need their own logic.