qa-bandit: drop UDP-only protocols + retry probe while URLTest converges

Two related improvements that make the QA path complete end-to-end on
TCP outbounds without the bridge needing UDP ASSOCIATE.

config/fetcher: when RADIANCE_OUTBOUND_SOCKS_ADDRESS is set, filter
hysteria/hysteria2/wireguard/tuic/amnezia out of the request's
supportedProtocols list. The bandit then doesn't assign UDP-only tracks
the bridge can't relay, and URLTest converges immediately on a working
TCP outbound (samizdat / reflex / vmess / vless / trojan / shadowsocks
/ etc.). Hysteria-class protocols don't work in Russia today anyway, so
this is a fine match for the test scope.

cmd/qa-bandit: after ConnectVPN, retry the egress probe for up to 30s
(every 3s) while URLTest is settling. With UDP outbounds gone this is
mostly a safety net — most probes will succeed on attempt 1 — but it
also handles transient residential-proxy hiccups (PacketStream
occasionally returns "general SOCKS server failure" on the first dial
of a fresh session). Default --timeout bumped to 180s to match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Adam Fisk

cmd/qa-bandit/main.go

@@ -65,7 +65,7 @@ func main() {
 		// Russia. See cmd/api/maxmind.go LookupCountryASNState.
 		tz      = flag.String("tz", "Europe/Moscow", "TZ env var sent as the request's X-Lantern-Time-Zone")
 		locale  = flag.String("locale", "ru_RU", "locale to pass to the radiance backend (X-Lantern-Locale)")
-		timeout = flag.Duration("timeout", 90*time.Second, "overall timeout")
+		timeout = flag.Duration("timeout", 180*time.Second, "overall timeout (covers config fetch + URLTest convergence + probe retries)")
 	)
 	flag.Parse()
 
@@ -157,13 +157,30 @@ func main() {
 	}
 	defer be.DisconnectVPN()
 
-	fmt.Printf("[qa-bandit] VPN connected; probing %s through %s...\n", *probeURL, *socksIn)
-	body, dur, err := probeViaSocks(ctx, *socksIn, *probeURL)
-	if err != nil {
-		fmt.Printf("[qa-bandit] probe FAILED: %v (%.2fs)\n", err, dur.Seconds())
-		os.Exit(1)
+	// URLTest needs a few seconds to converge on a working outbound. UDP
+	// outbounds (hysteria2/wireguard/tuic) fail immediately through our
+	// bridge — it only does TCP CONNECT. After URLTest marks them dead,
+	// AutoSelect prefers TCP-based ones (samizdat/reflex/vmess/etc.).
+	fmt.Printf("[qa-bandit] VPN connected; waiting up to 30s for URLTest to converge, then probing %s through %s...\n", *probeURL, *socksIn)
+	var (
+		body string
+		dur  time.Duration
+		err2 error
+	)
+	deadline := time.Now().Add(30 * time.Second)
+	for attempt := 1; ; attempt++ {
+		body, dur, err2 = probeViaSocks(ctx, *socksIn, *probeURL)
+		if err2 == nil {
+			fmt.Printf("[qa-bandit] probe OK in %.2fs (attempt %d) — egress IP: %s\n", dur.Seconds(), attempt, body)
+			return
+		}
+		if time.Now().After(deadline) || ctx.Err() != nil {
+			fmt.Printf("[qa-bandit] probe FAILED after %d attempts: %v\n", attempt, err2)
+			os.Exit(1)
+		}
+		fmt.Printf("[qa-bandit]   attempt %d failed (%v) — retrying in 3s...\n", attempt, err2)
+		time.Sleep(3 * time.Second)
 	}
-	fmt.Printf("[qa-bandit] probe OK in %.2fs — egress IP: %s\n", dur.Seconds(), body)
 }
 
 func banner(outboundSocks, platform, version, dataDir, socksIn string) {

config/fetcher.go

@@ -24,6 +24,7 @@ import (
 
 	"github.com/getlantern/radiance/account"
 	"github.com/getlantern/radiance/common"
+	"github.com/getlantern/radiance/common/env"
 	"github.com/getlantern/radiance/common/settings"
 	"github.com/getlantern/radiance/log"
 	"github.com/getlantern/radiance/traces"
@@ -82,7 +83,7 @@ func (f *fetcher) fetchConfig(ctx context.Context, preferred common.PreferredLoc
 		WGPublicKey:    wgPublicKey,
 		Backend:        C.SINGBOX,
 		Locale:         f.locale,
-		Protocols:      protocol.SupportedProtocols(),
+		Protocols:      filterProtocolsForBridge(protocol.SupportedProtocols()),
 	}
 	if preferred.Country != "" {
 		confReq.PreferredLocation = &preferred
@@ -229,3 +230,36 @@ func moduleVersion(modulePath ...string) (string, error) {
 
 	return "", fmt.Errorf("module %s not found", modulePath)
 }
+
+// udpOnlyProtocols are sing-box outbound protocols whose entry-server
+// connection is UDP-only. When radiance's outbound dials are detoured
+// through an upstream SOCKS5 (the QA path), our bridge SOCKS5 listener
+// only implements TCP CONNECT — UDP ASSOCIATE isn't wired — so these
+// outbounds can't be reached and would just clutter URLTest with
+// failures. Drop them from the request so the bandit doesn't pick them.
+var udpOnlyProtocols = map[string]struct{}{
+	"hysteria":  {},
+	"hysteria2": {},
+	"tuic":      {},
+	"wireguard": {},
+	"amnezia":   {}, // wireguard-based; same UDP constraint
+}
+
+// filterProtocolsForBridge returns the input slice unchanged unless
+// RADIANCE_OUTBOUND_SOCKS_ADDRESS is set, in which case UDP-only
+// protocols are filtered out.
+func filterProtocolsForBridge(in []string) []string {
+	if addr, _ := env.Get(env.OutboundSocksAddress); addr == "" {
+		return in
+	}
+	out := in[:0:0]
+	for _, p := range in {
+		if _, drop := udpOnlyProtocols[p]; drop {
+			continue
+		}
+		out = append(out, p)
+	}
+	slog.Info("RADIANCE_OUTBOUND_SOCKS_ADDRESS set — dropping UDP-only protocols from config request",
+		"kept", len(out), "dropped", len(in)-len(out))
+	return out
+}