qlinter
singbox-proxymanager-forclaude

singbox-watch

Tray switch + fail-closed kill-switch

Make sure a sing-box tunnel never silently falls back to your raw connection.

A Windows tray controller, watchdog and fail-safe toolkit for a sing-box tunnel with a static exit IP. Two small Rust binaries: proxy-tray.exe and singbox-watch.exe.

  • Windows 10 / 11 x64
  • Rust, winapi only
  • MIT
  • macOS (beta)

Read this first: by design, the kill-switch closes claude.exe and Claude Code’s node.exe whenever the tunnel is off or the exit IP is wrong. See What gets killed.

01

What the setup does

Run the downloaded file and follow the wizard.

This is the project’s own one-file installer.

  1. Installs into your existing install’s folder, else next to a running sing-box.exe, else %USERPROFILE%\singbox-watch. No admin needed.
  2. Turns on login autostart for both apps and adds the per-minute keep-alive task.
  3. Offers to pin your current public IP as expected-exit-ip.txt if none exists.
  4. Adds an Apps entry. Uninstalling keeps your config, state and logs. Re-run it to upgrade.

Other ways to install

Installer options 
singbox-watch-setup-1.0.0.exe --silent [--dir <path>]
singbox-watch-setup-1.0.0.exe --uninstall [--silent]
singbox-watch-setup-1.0.0.exe --extract <dir>
Build from source 
build-installer.cmd

On a Mac

  1. Beta: the macOS edition builds cleanly, but its README says it hasn’t been run on a real Mac yet.
  2. Unpack it, then in Terminal: cd singbox-watch-mac && xattr -dr com.apple.quarantine . && ./install.sh
  3. That adds a per-minute keep-alive LaunchAgent and a login LaunchAgent for the menu-bar app.

02

What it does

From the project’s README.

Tray switch

Green when the exit IP matches the pinned IP, red when it doesn’t. Left-click toggles the tunnel.

Fail-closed kill-switch

Turning the proxy off first kills every matched app with a native path. Measured under 100 ms.

Warning banner

An always-on-top red “TUNNEL BYPASSED” banner when the exit IP changes unexpectedly.

Auto-enable guard

If a matched app starts while the tunnel is down, it is suspended until the tunnel is up and the exit IP is verified.

Keep-alive

A hidden per-minute task brings back the tray app, the banner watcher and the tunnel. A crashed tunnel heals in under a minute.

Doctor

proxy-tray.exe --doctor prints a full health report: exit IP, processes, tasks, autostart, WebRTC policy.

03

Requirements

  • Windows 10 or 11, x64.
  • sing-box installed and runnable through a scheduled task (default name sing-box-tun).
  • A single static exit IP. Multi-exit setups need their own logic.