A single invalid VLESS node panics the whole config (sing-box 1.13.0) — "unknown value", connection keeps dropping

[zackroad]

Search first

• I searched and no similar issues were found

Platform/OS

Windows

OS version

Windows 11

Hiddify Version

4.1.1

What Happened?

Environment

• Hiddify 4.1.1 (Windows, build 26200), sing-box core v1.13.0
• The exact same subscription works fine on iOS Hiddify (different bundled core),
  so this looks specific to the sing-box 1.13.0 build shipped in the Windows app.

Description

When a subscription contains one VLESS node with an invalid/unsupported field
value, the app throws a FATAL panic during config validation. Because validation
runs over the whole config, that single bad node makes the entire profile fail to
load, and the connection keeps dropping repeatedly.

Steps to reproduce

1. Import a subscription that includes a VLESS node with an invalid value
   (e.g. an unknown flow, or flow set without the required TLS/Reality transport,
   or an unsupported packet_encoding).
2. Start the connection.
3. App crashes with a FATAL panic; the whole profile is rejected.

Expected vs actual

• Expected: skip/disable the single invalid outbound (or show a clean per-node
  error) and load the rest of the config.
• Actual: FATAL panic in vless.NewOutbound, the entire config is rejected.

Stack trace (key frames)

FATAL unknown value
panic(...)
github.com/sagernet/sing/common/format.ToString(...)
github.com/sagernet/sing/common/exceptions.New(...)
github.com/sagernet/sing-box/protocol/vless.NewOutbound(...) outbound.go:86
github.com/sagernet/sing-box/adapter/outbound.(*Manager).Create(...)
github.com/sagernet/sing-box/experimental/libbox.CheckConfigOptions(...)
github.com/hiddify/hiddify-core/v2/config.validateResult(...) parser.go:152

Possible fix

• Handle the unknown value in VLESS outbound parsing gracefully (skip/disable the
  bad outbound) instead of panicking on the whole config.
• The panic happens inside the error-construction path (format.ToString called
  from exceptions.New), which itself looks like a bug.
• Consider updating the bundled sing-box core — the iOS build (different core
  version) does not hit this.

Minimal Reproducible Example (MRE)

It just silently dropped "Connected" status.

Expected Behavior

No response

Additional Context

No response

Application Config Options

No response

Relevant log output

No response

Are you willing to submit a PR? If you know how to fix the bug.

• I'm willing to submit a PR (Thank you!)