Stash

https://stash.wiki/en
Admin
Stash is a powerful network tool and client for the Clash Premium kernel on Apple devices (iOS,...
Tokens:83,236
Snippets:747
Trust Score:7.3
Update:2 hours ago
Show doc for...
Tokens:
Raw
### HTTP Client GET and POST Examples

Source: https://stash.wiki/en/script/syntax-and-interface

Shows how to use $httpClient.get and $httpClient.post. The GET example fetches from httpbin.org and logs the response. The POST example demonstrates the request object with headers, body, timeout, insecure, binary-mode, auto-cookie, and auto-redirect options, including setting X-Stash-Selected-Proxy with encodeURIComponent. The callback signature is callback(error, response, data).

```javascript
$httpClient.get('http://httpbin.org/get', (error, response, data) => {
  if (error) {
    console.log(error)
  } else {
    console.log(data)
  }
})
 
const yourProxyName = 'a fancy name with 😄'
 
$httpClient.post(
  {
    url: 'http://httpbin.org/post',
    headers: {
      'X-Header-Key': 'headerValue',
      'X-Stash-Selected-Proxy': encodeURIComponent(yourProxyName),
    },
    body: '{}', // can be object or string
    timeout: 5,
    insecure: false,
    'binary-mode': true,
    'auto-cookie': true,
    'auto-redirect': true,
  },
  (error, response, data) => {
    if (error) {
      console.log(error)
    } else {
      console.log(data)
    }
  }
)
```

--------------------------------

### Use device domains to reach services on a peer

Source: https://stash.wiki/en/features/nat-traversal

Every device gets a `.stash` domain. Use `<device-name>.stash:<port>` to reach a service on that device. The example shows curling a service and SSHing to the Mac at home.

```bash
# Reach a service running on the Mac at home
curl http://steve-s-mac-mini.stash:9090
 
# SSH to the Mac at home
ssh steve@steve-s-mac-mini.stash
```

--------------------------------

### Stash proxy configuration example

Source: https://stash.wiki/en/configuration/example-config

Example configuration for Stash proxy with server, port, benchmark-url, benchmark-timeout, username, password, tls, and skip-cert-verify settings.

```yaml
server: server
port: 443
benchmark-url: http://www.apple.com
benchmark-timeout: 5
username: username
password: password
tls: true # https
skip-cert-verify: true
```

--------------------------------

### Rule providers configuration

Source: https://stash.wiki/en/configuration/example-config

Example configuration for rule providers with behavior, url, path, and interval settings.

```yaml
rule-providers:
  proxy-domain:
    behavior: domain # Use domain rule sets for more efficient matching
    url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt
    path: ./rules/proxy-domain.yaml
    interval: 86400

  proxy-domain-text:
```

--------------------------------

### Proxy providers configuration

Source: https://stash.wiki/en/configuration/example-config

Example configuration for proxy providers with url, path, interval, and headers settings.

```yaml
proxy-providers:
  provider1:
    url: https://raw.githubusercontent.com/STASH-NETWORKS-LIMITED/stash-example/main/config.yaml
    path: ./providers/provider1.yaml
    interval: 3600
    headers:
      Authorization: Bearer your-token
      Accept: application/yaml
```

--------------------------------

### Snell proxy configuration

Source: https://stash.wiki/en/configuration/example-config

Example configuration for a Snell proxy with psk, version, reuse, and obfs-opts settings.

```yaml
# snell
  - name: 'snell'
    type: snell
    server: server
    port: 44046
    benchmark-url: http://www.apple.com
    benchmark-timeout: 5
    psk: yourpsk
    version: 5
    reuse: true
    obfs-opts:
      mode: http # or tls
      host: bing.com
```

--------------------------------

### ShadowsocksR proxy configuration

Source: https://stash.wiki/en/configuration/example-config

Example configuration for a ShadowsocksR proxy with cipher, password, obfs, protocol, obfs-param, and protocol-param settings.

```yaml
# ShadowsocksR
  # Supported encryption methods: all stream ciphers supported by SS
  # Supported obfuscation methods:
  #   plain http_simple http_post
  #   random_head tls1.2_ticket_auth tls1.2_ticket_fastauth
  # Supported protocols:
  #   origin auth_sha1_v4 auth_aes128_md5
  #   auth_aes128_sha1 auth_chain_a auth_chain_b
  - name: 'ssr'
    type: ssr
    server: server
    port: 443
    benchmark-url: http://www.apple.com
    benchmark-timeout: 5
    cipher: chacha20-ietf
    password: 'password'
    obfs: tls1.2_ticket_auth
    protocol: auth_sha1_v4
    obfs-param: domain.tld
    protocol-param: '#'
```

--------------------------------

### Trojan proxy configuration

Source: https://stash.wiki/en/configuration/example-config

Example configuration for a Trojan proxy with password, sni, alpn, and skip-cert-verify settings.

```yaml
# Trojan
  - name: 'trojan'
    type: trojan
    server: server
    port: 443
    benchmark-url: http://www.apple.com
    benchmark-timeout: 5
    password: yourpsk
    sni: example.com # Server Name Indication, uses server value if empty
    alpn:
      - h2
      - http/1.1
    skip-cert-verify: true
```

--------------------------------

### Proxy groups configuration

Source: https://stash.wiki/en/configuration/example-config

Example configuration for proxy groups including relay, url-test, fallback, load-balance, select, and ssid-group.

```yaml
proxy-groups:
  # Proxy forwarding chain. Do not include relay in proxies. UDP is not supported.
  # Traffic: clash <-> http <-> vmess <-> ss1 <-> ss2 <-> Internet
  - name: 'relay'
    type: relay
    icon: https://raw.githubusercontent.com/Koolson/Qure/master/IconSet/Color/Direct.png
    proxies:
      - http
      - vmess
      - ss1
      - ss2

  # url-test automatically selects the server with the lowest latency
  - name: 'auto'
    type: url-test
    proxies:
      - ss1
      - ss2
      - vmess
    interval: 300

  # fallback tries to follow the server order written by the user and automatically selects an available server
  - name: 'fallback-auto'
    type: fallback
    proxies:
      - ss1
      - ss2
      - vmess
    interval: 300

  # load-balance can keep requests for the same eTLD on the same proxy route
  - name: 'load-balance'
    type: load-balance
    proxies:
      - ss1
      - ss2
      - vmess
    interval: 300

  # select allows users to manually choose a proxy server or group
  # You can also use the RESTful API to switch servers, which is recommended for GUI clients
  - name: Proxy
    type: select
    proxies:
      - ss1
      - ss2
      - vmess
      - auto

  # SSID-based strategy, useful for selecting specific proxies in special network environments
  - name: ssid-group
    type: select # The type must be select for compatibility with the original Clash configuration
    proxies:
      - ss1
      - ss2
      - DIRECT
    ssid-policy:
      # Automatically switch to ss1 on Wi-Fi with SSID office
      # Automatically switch to ss2 on Wi-Fi with SSID home
      # Automatically switch to ss3 on cellular data
      # Other SSIDs default to DIRECT
      office: ss1
      home: ss2
      cellular: ss3
      default: DIRECT

  - name: UseProvider
    type: select
    use:
      - provider1
    proxies:
      - Proxy
      - DIRECT
```

--------------------------------

### Rule Providers Configuration Example

Source: https://stash.wiki/en/configuration/example-config

Defines rule providers with different behaviors (domain-text, ipcidr, ipcidr-text, classical) and their remote URLs and update intervals. The classical behavior is noted as not recommended.

```yaml
  proxy-domain:
    behavior: domain-text # The text format is recommended
    url: https://cdn.jsdelivr.net/gh/Loyalsoldier/surge-rules@release/proxy.txt
    interval: 86400
 
  lan-cidr:
    behavior: ipcidr
    url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/lancidr.txt
    interval: 86400
 
  ip-cidr-text:
    behavior: ipcidr-text
    url: https://cdn.jsdelivr.net/gh/17mon/china_ip_list@master/china_ip_list.txt
    interval: 86400
 
  apple-direct:
    behavior: classical # classical rule sets are not recommended
    url: 'https://cdn.jsdelivr.net/gh/Hackl0us/SS-Rule-Snippet@master/Rulesets/Clash/Basic/Apple-direct.yaml'
    interval: 3600
```

--------------------------------

### VLESS proxy configuration

Source: https://stash.wiki/en/configuration/example-config

Example configuration for a VLESS proxy with uuid, flow, skip-cert-verify, network, tls, ws-opts, grpc-opts, and h2-opts settings.

```yaml
- name: 'vless'
    type: vless
    server: server
    port: 443
    benchmark-url: http://www.apple.com
    benchmark-timeout: 5
    uuid: d0529668-8835-11ec-a8a3-0242ac120002
    flow: xtls-rprx-direct
    skip-cert-verify: true
    network: h2
    tls: true
    ws-opts:
      path: /path
      headers:
        Host: v2ray.com
    grpc-opts:
      grpc-service-name: 'example'
    h2-opts:
      host:
        - http.example.com
        - http-alt.example.com
      path: /
```

--------------------------------

### Rules Configuration Example

Source: https://stash.wiki/en/configuration/example-config

Defines routing rules that use the rule providers, GEOIP for China, and a final MATCH rule to Proxy.

```yaml
rules:
  - SCRIPT,quic,REJECT,no-track
  - RULE-SET,proxy-domain,Proxy
  - RULE-SET,apple-direct,DIRECT
  - RULE-SET,lan-cidr,DIRECT
  - RULE-SET,ip-cidr-text,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Proxy
```

--------------------------------

### SCRIPT rule example with shortcuts for QUIC and UDP to CN

Source: https://stash.wiki/en/rules/rule-types

Example configuration showing SCRIPT rules that reference `shortcuts` defined under the `script` key. The `quic` shortcut matches UDP on port 443, `udp-cn` matches UDP destined to China using `geoip` and `resolve_ip`, and `instagram-quic` matches Instagram's QUIC traffic via `match_geosite('instagram')`.

```yaml
rules:
  - SCRIPT,quic,REJECT
  - SCRIPT,udp-cn,ProxyToCN
 
script:
  shortcuts: # Can be referenced in rules
    quic: network == 'udp' and dst_port == 443 # Matches QUIC protocol
    udp-cn: network == 'udp' and geoip(dst_ip if dst_ip != '' else resolve_ip(host)) == 'CN' # Matches UDP to CN
    instagram-quic: network == 'udp' and dst_port == 443 and match_geosite('instagram') # Matches Instagram's QUIC
```

--------------------------------

### Hysteria proxy configuration

Source: https://stash.wiki/en/configuration/example-config

Example configuration for a Hysteria proxy with up-speed, down-speed, auth-str, protocol, obfs, sni, alpn, and skip-cert-verify settings.

```yaml
# hysteria https://github.com/HyNetwork/hysteria/wiki/%E9%AB%98%E7%BA%A7%E7%94%A8%E6%B3%95
  - name: 'hysteria'
    type: hysteria
    server: server
    port: 443
    benchmark-url: http://www.apple.com
    benchmark-timeout: 5
    up-speed: 100 # Upload bandwidth in Mbps
    down-speed: 100 # Download bandwidth in Mbps
    auth-str: your-password
    # auth: aHR0cHM6Ly9oeXN0ZXJpYS5uZXR3b3JrL2RvY3MvYWR2YW5jZWQtdXNhZ2Uv # bytes encoded in base64
    protocol: '' # udp / wechat-video
    obfs: '' # obfs password
    sni: example.com # Server Name Indication, uses server value if empty
    alpn:
      - hysteria
    skip-cert-verify: true
```

--------------------------------

### $script.startTime

Source: https://stash.wiki/en/script/syntax-and-interface

Returns the time when the script starts running.

```APIDOC
## $script.startTime

### Description
Returns the time when the script starts running.

### Method
Property access

### Endpoint
$script.startTime

### Parameters
None

### Response
- **value** (Date) - The start time of the script.
```

--------------------------------

### SRC-IP rule example with DIRECT and Proxy outbounds

Source: https://stash.wiki/en/rules/rule-types

Use SRC-IP to match the source address of a connection, either a single address or a CIDR range. This example assigns different outbounds to different devices sharing one Stash instance, such as in gateway mode or over a personal hotspot. The source address is the client that reached Stash.

```yaml
rules:
  - SRC-IP,192.168.1.20,DIRECT # The TV connects directly
  - SRC-IP,192.168.1.0/24,Proxy # Other LAN devices go through the proxy
  - MATCH,DIRECT
```

--------------------------------

### Stash YAML configuration example

Source: https://stash.wiki/en/configuration/example-config

A complete Stash configuration file in YAML format. It includes rule mode, log level, HTTP engine settings, MitM, URL rewrites, scripts, cron tasks, script providers, hosts, and DNS configuration. All fields have defaults, so only fields to change need to be filled in.

```yaml
# Configuration based on https://github.com/Hackl0us/SS-Rule-Snippet
 
# Rule mode: rule / global / direct
mode: rule
 
# Set the log level. The default is silent, which prints nothing to avoid memory overflow caused by excessive logs.
# Available levels: silent / info / warning / error / debug. Higher levels output more logs and are more useful for debugging. Enable them only when needed.
log-level: info
 
# HTTP engine
http:
  # Force the HTTP engine to process TCP connections
  # Captured connections can use advanced features such as rewrites and scripts
  force-http-engine:
    - '*:80'
    - '*:4480' # BiliBili CDN
    - '*:9102' # BiliBili CDN
 
  # CA certificate encoded in PKCS #12
  ca: ''
  # Certificate password
  ca-passphrase: ''
  # Domains with MitM enabled. Make sure the CA certificate above is trusted by the system.
  mitm:
    - g.cn
    - '*.google.cn'
    - weather-data.apple.com # Enabled only for port 443 by default
    - weather-data.apple.com:* # Use a wildcard to enable all ports
    - '*.weather-data.apple.com' # Wildcards can also be used in domains
    - '-exclude.weather-data.apple.com' # Use the - prefix to exclude domains
 
  # HTTP(S) rewrite, supporting header, 302, 307, reject, and other strategies
  url-rewrite:
    - ^http://g\.cn http://www.google.com header # Rewrite the request header domain
    - ^https?://www\.google\.cn https://www.google.com 302 # Return a 302 redirect response directly
    - ^https?://ad\.example - reject # Reject the request
 
  # Rewrite HTTP(S) requests with JavaScript scripts
  script:
    - match: https://weather-data.apple.com/v2/weather/[\w-]+/-?[0-9]+\.[0-9]+/-?[0-9]+\.[0-9]+\?
      name: weather-us-aqi # Reference the script in script-providers
      type: response # Script type: request / response
      require-body: true # Set to true if the request / response body is needed
      timeout: 10 # script timeout in second (optional)
      argument: '' # script argument (optional)
      binary-mode: false # Get the body in binary mode
      max-size: 1048576 # 1MB
 
# Scheduled tasks
cron:
  # Run JavaScript scripts on a schedule
  script:
    - name: weather-us-aqi # Reference the script in script-providers
      cron: '* * * * *' # Cron expression. See https://crontab.guru/ for more details.
      timeout: 10 # script timeout in second (optional)
      argument: '' # script argument (optional)
 
script-providers:
  weather-us-aqi:
    url: https://raw.githubusercontent.com/STASH-NETWORKS-LIMITED/stash-example/main/script/iOS15_Weather_AQI_Standard.js
    interval: 86400
 
script:
  shortcuts: # Write custom rules with Python expressions
    # 4483 and 9305 are BiliBili QUIC CDN ports
    quic: network == 'udp' and (dst_port == 443 or dst_port == 4483 or dst_port == 9305) # Can be referenced in rules
 
# Wildcard domains are supported, such as *.clash.dev and *.foo.*.example.com
# Domains without wildcards have higher priority than wildcard domains, such as foo.example.com > *.example.com > .example.com
# Note: +.foo.com is equivalent to .foo.com and foo.com
hosts:
  '*.clash.dev': 127.0.0.1
  '.dev': 127.0.0.1
  'alpha.clash.dev': '::1'
 
# DNS server configuration
dns:
  # Resolves other DNS server hostnames; except for system, the server address must use an IP
  default-nameserver:
    - 'https://1.1.1.1/dns-query#h3=true' # DNS over HTTP/3
    - system # Use iOS system DNS
  # DNS services over UDP / TCP / DoT / DoH / DoH3 / DoQ are supported, and specific connection ports can be specified.
  # All DNS requests are sent directly to the server without going through any proxy.
  # Stash replies to DNS requests with the first resolved record it receives.
  nameserver:
    # Configuring more than 2 DNS servers is not recommended because it increases system power consumption.
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query
    - quic://dns.adguard.com:853
    - doq://test.dns.nextdns.io:853
    - system # Use iOS system DNS
 
  # Skip certificate verification to work around some compatibility issues: https://help.nextdns.io/t/g9hdkjz
  skip-cert-verify: true
```

--------------------------------

### Tile script example using $httpClient.get and $done

Source: https://stash.wiki/en/script/tile

Fetches the current IP address and updates the Tile panel with title, content, background color, and icon. Must call `$done(value)` at the end to release resources.

```javascript
$httpClient.get('https://api.my-ip.io/ip', function (error, response, data) {
  $done({
    title: 'Current IP Address',
    content: data,
    backgroundColor: '#663399',
    icon: 'network',
  })
})
```

--------------------------------

### https://link.stash.ws/start

Source: https://stash.wiki/en/faq/url-schema

Starts Stash using the standard URL format.

```APIDOC
## [https://link.stash.ws/start]

### Description
Starts Stash using the standard URL format.

### Method
GET

### Endpoint
https://link.stash.ws/start

### Parameters
No parameters.

### Request Example
https://link.stash.ws/start

### Response
#### Success Response (200)
No response body specified.

#### Response Example
No response body specified.
```

--------------------------------

### pre-matching rule option

Source: https://stash.wiki/en/rules/rule-types

Lets a REJECT rule take effect before a connection exists, refusing at an earlier stage (DNS, connection setup, first UDP datagram, or ingress). Only REJECT or REJECT-DROP targets are allowed; other targets cause the profile to fail to load. Only rule types that can be judged before a connection exists are permitted; PROCESS-NAME, PROCESS-PATH, USER-AGENT, URL-REGEX, PROTOCOL, and SCRIPT are rejected with pre-matching.

```yaml
rules:
  - DOMAIN-SUFFIX,ads.example,REJECT,pre-matching
  - RULE-SET,advertising,REJECT-DROP,pre-matching
  - AND,((DOMAIN-KEYWORD,track),(DST-PORT,443)),REJECT,pre-matching
```

--------------------------------

### Merge Example with Default and #!replace

Source: https://stash.wiki/en/configuration/override

Shows how Stash merges an override file into the original configuration. Arrays merge by default (k3), while #!replace forces a full replacement (k4). The merged result combines the original keys with the override's additions and replacements.

```yaml
dict:
  k1: true
  k2: 1
  k3:
    - 1
    - 2
    - 3
  k4:
    - 1
    - 2
    - 3

```

```yaml
key: value
dict:
  k3:
    - 0
  k4: #!replace
    - 1
  k5: null

```

```yaml
key: value
dict:
  k1: true
  k2: 1
  k3:
    - 0
    - 1
    - 2
    - 3
  k4:
    - 1
  k5: null

```

--------------------------------

### stash://start

Source: https://stash.wiki/en/faq/url-schema

Starts Stash using the stash:// URL scheme.

```APIDOC
## [stash://start]

### Description
Starts Stash using the stash:// URL scheme.

### Method
stash:// URL scheme

### Endpoint
stash://start

### Parameters
No parameters.

### Request Example
stash://start

### Response
#### Success Response (200)
No response body specified.

#### Response Example
No response body specified.
```

--------------------------------

### Configure a response script with engine selection

Source: https://stash.wiki/en/script/rewrite-requests

YAML configuration for a response script that matches URLs starting with https://example.com/. The engine is set to 'auto', which prefers WebKit on iOS/macOS and JavaScriptCore on tvOS. Available engines are 'auto', 'webkit', and 'jsc'.

```yaml
http:
  script:
    - name: your-script-name
      match: ^https://example\.com/
      type: response
      engine: auto
```

--------------------------------

### Parameter reference syntax examples in YAML

Source: https://stash.wiki/en/configuration/override

Shows how to reference parameters in override values using ${args.name}. Single references preserve the parameter's type (Boolean, integer); combined with text they become strings; escaping with $$ yields literal text. References must be declared in arguments and are not expanded in display fields or comments.

```yaml
ipv6: '${args.ipv6_enabled}'
```

```yaml
port: '${args.port}'
```

```yaml
name: 'Node ${args.region}'
```

```yaml
text: '$${args.region}'
```

--------------------------------

### clash://start

Source: https://stash.wiki/en/faq/url-schema

Starts Stash using the clash:// URL scheme.

```APIDOC
## [clash://start]

### Description
Starts Stash using the clash:// URL scheme.

### Method
clash:// URL scheme

### Endpoint
clash://start

### Parameters
No parameters.

### Request Example
clash://start

### Response
#### Success Response (200)
No response body specified.

#### Response Example
No response body specified.
```

--------------------------------

### POST /proxies/{name}/tailscale/login

Source: https://stash.wiki/en/features/http-api

Starts login for a Tailscale proxy.

```APIDOC
## POST /proxies/{name}/tailscale/login

### Description
Starts login for a Tailscale proxy.

### Method
POST

### Endpoint
/proxies/{name}/tailscale/login

### Parameters
#### Path Parameters
- **name** (string) - Required - The name of the proxy.

```

--------------------------------

### $httpClient.get(url, callback)

Source: https://stash.wiki/en/script/syntax-and-interface

Performs an HTTP GET request.

```APIDOC
## $httpClient.get(url, callback)

### Description
Performs an HTTP GET request.

### Method
GET

### Endpoint
$httpClient.get(url, callback)

### Parameters
- **url** (string) - Required. The request URL.
- **callback** (Function) - Required. Callback with signature (error, response, data).

### Response
- **error** (string|null) - Error message on failure.
- **response** (object) - Contains status (or statusCode) and headers.
- **data** (string|Uint8Array) - The response body.
```

--------------------------------

### Enable Stash Helper with launchctl load

Source: https://stash.wiki/en/faq/stash-mac-helper

Run in Terminal to enable the Stash Helper. Enter your system password when prompted. If you see 'service already loaded' or 'Operation already in progress', you can ignore it. This is the second troubleshooting step after removing the Helper.

```bash
sudo /bin/launchctl load -w /Library/LaunchDaemons/ws.stash.app.mac.daemon.helper.plist
```

--------------------------------

### $httpClient.get(request, callback)

Source: https://stash.wiki/en/script/syntax-and-interface

Performs an HTTP GET request with a request object.

```APIDOC
## $httpClient.get(request, callback)

### Description
Performs an HTTP GET request with a request object.

### Method
GET

### Endpoint
$httpClient.get(request, callback)

### Parameters
- **request** (object) - Required. The request configuration.
  - **url** (string) - Required. The request URL.
  - **headers** (object) - Optional. Request headers.
  - **body** (string|object|Uint8Array|ArrayBuffer) - Optional. Request body.
  - **timeout** (number) - Optional. Timeout in seconds, default 5.
  - **insecure** (boolean) - Optional. Skip HTTPS verification, default false.
  - **binary-mode** (boolean) - Optional. Return data as Uint8Array, default false.
  - **auto-cookie** (boolean) - Optional. Handle cookies automatically, default true.
  - **auto-redirect** (boolean) - Optional. Follow redirects, default true.
- **callback** (Function) - Required. Callback with signature (error, response, data).

### Response
- **error** (string|null) - Error message on failure.
- **response** (object) - Contains status (or statusCode) and headers.
- **data** (string|Uint8Array) - The response body.
```

--------------------------------

### $httpClient.get(url, callback)

Source: https://stash.wiki/en/script/tile

Performs an HTTP GET request. Used in Tile scripts to fetch data from a remote service. The callback receives error, response, and data parameters. When long-pressing a node to display proxy details, requests are forwarded through that node.

```APIDOC
## $httpClient.get(url, callback)

### Description
Performs an HTTP GET request. Used in Tile scripts to fetch data from a remote service. The callback receives error, response, and data parameters. When long-pressing a node to display proxy details, requests are forwarded through that node.

### Method
Function call

### Parameters
- **url** (string) - Required - The URL to request.
- **callback** (function) - Required - Callback function with signature `(error, response, data)`.

### Request Example
```javascript
$httpClient.get('https://api.my-ip.io/ip', function (error, response, data) {
  $done({
    title: 'Current IP Address',
    content: data,
    backgroundColor: '#663399',
    icon: 'network',
  })
})
```

### Response
No direct return value; results are passed to the callback.
```

--------------------------------

### Proxy configuration with udp-nameserver parameter

Source: https://stash.wiki/en/proxy-protocols/proxy-types

Example YAML configuration showing the `udp-nameserver` parameter for specifying DNS servers used during UDP forwarding. Only UDP protocol is supported for the DNS server addresses.

```yaml
name: proxy
type: ss
udp-nameserver: ['8.8.4.4', '8.8.8.8:53']
# ...
```

--------------------------------

### NOT logical rule

Source: https://stash.wiki/en/rules/rule-types

Negates a rule. Logical rules can be combined, as shown in the example that sends example.com through the proxy only when it does not resolve to an address in mainland China.

```plaintext
NOT,((#Rule1)),PROXY
```

```plaintext
AND,((NOT,((GEOIP,CN))),(DOMAIN-SUFFIX,example.com)),Proxy
```

--------------------------------

### Declare a stashlink proxy to use a device as egress

Source: https://stash.wiki/en/features/nat-traversal

Add a `type: stashlink` proxy to your configuration to route traffic through another device. The `device-id` is shown on the peer device under “Tools” → “System Info”. The example includes routing rules that send home LAN traffic and selected domains through the proxy.

```yaml
proxies:
  - name: HOME-MAC
    type: stashlink
    device-id: 1a2b3c4d5e6f7a8b
 
rules:
  # Home LAN goes through the Mac at home
  - IP-CIDR,192.168.1.0/24,HOME-MAC,no-resolve
  # Selected sites use the home IP
  - DOMAIN-SUFFIX,example.com,HOME-MAC
```

--------------------------------

### GET /

Source: https://stash.wiki/en/features/http-api

Retrieves basic runtime information including app version, OS version, device ID, architecture, and platform.

```APIDOC
## GET /

### Description
Retrieves basic runtime information including app version, OS version, device ID, architecture, and platform.

### Method
GET

### Endpoint
/

### Authentication
Authorization: Bearer <API secret>

### Response
#### Success Response (200)
- **app version** (string) - App version
- **OS version** (string) - OS version
- **device ID** (string) - Device ID
- **architecture** (string) - Architecture
- **platform** (string) - Platform

```

--------------------------------

### Tile configuration format with script-providers

Source: https://stash.wiki/en/script/tile

Defines a Tile panel with default fields and a script provider. The `interval` is in seconds; `icon` supports SF Symbols or a remote image URL starting with `http`. Fields can be overridden by `$done(object)`.

```yaml
tiles:
  - name: your-fancy-script
    interval: 600
    title: 'Awesome Tile'
    content: 'This is Super Cool'
    icon: 'theatermasks.circle.fill' # or https://stash.ws/amazing.png
    backgroundColor: '#663399'
 
script-providers:
  your-fancy-script:
    url: https://your-fancy-script.com/your-fancy-script.js
    interval: 86400
```

--------------------------------

### MASQUE proxy configuration example

Source: https://stash.wiki/en/proxy-protocols/proxy-types

Configuration for a MASQUE proxy using CONNECT-IP mode, as used by Cloudflare WARP. Requires a base64-encoded P-256 SEC1 private key and SPKI public key. At least one of 'ip' or 'ipv6' must be set; defaults for 'dns', 'network', 'sni', 'connect-uri', 'mtu', and 'keepalive' apply when omitted.

```yaml
name: WARP-MASQUE
type: masque
server: 162.159.198.1
port: 443
private-key: 'BASE64_ENCODED_P256_SEC1_PRIVATE_KEY'
public-key: 'BASE64_ENCODED_P256_SPKI_PUBLIC_KEY'
ip: 172.16.0.2/32
# ipv6: '2606:4700:110:84c0::2/128'
# dns: [1.1.1.1, '2606:4700:4700::1111']
# network: h3
# sni: consumer-masque.cloudflareclient.com
# connect-uri: https://cloudflareaccess.com
# mtu: 1280
# keepalive: 30
```

--------------------------------

### GET /providers/scripts

Source: https://stash.wiki/en/features/http-api

Retrieves scripts.

```APIDOC
## GET /providers/scripts

### Description
Retrieves scripts.

### Method
GET

### Endpoint
/providers/scripts

```

--------------------------------

### GET /diagnosis/availableMemory

Source: https://stash.wiki/en/features/http-api

Returns the available memory.

```APIDOC
## GET /diagnosis/availableMemory

### Description
Returns the available memory.

### Method
GET

### Endpoint
/diagnosis/availableMemory

```

--------------------------------

### GET /providers/rules

Source: https://stash.wiki/en/features/http-api

Retrieves rule sets.

```APIDOC
## GET /providers/rules

### Description
Retrieves rule sets.

### Method
GET

### Endpoint
/providers/rules

```

--------------------------------

### GET /stash/proxy/count

Source: https://stash.wiki/en/features/http-api

Retrieves the proxy count.

```APIDOC
## GET /stash/proxy/count

### Description
Retrieves the proxy count.

### Method
GET

### Endpoint
/stash/proxy/count

```

--------------------------------

### GET /stash/proxies

Source: https://stash.wiki/en/features/http-api

Retrieves proxy names.

```APIDOC
## GET /stash/proxies

### Description
Retrieves proxy names.

### Method
GET

### Endpoint
/stash/proxies

```

--------------------------------

### GET /diagnosis/dns/latency

Source: https://stash.wiki/en/features/http-api

Returns DNS resolution latency.

```APIDOC
## GET /diagnosis/dns/latency

### Description
Returns DNS resolution latency.

### Method
GET

### Endpoint
/diagnosis/dns/latency

```

--------------------------------

### GET /rules

Source: https://stash.wiki/en/features/http-api

Retrieves the rules currently in effect.

```APIDOC
## GET /rules

### Description
Retrieves the rules in effect.

### Method
GET

### Endpoint
/rules

### Response
#### Success Response (200)
- **rules** (array) - List of rules in effect, including those with `preMatching: true`.

```

--------------------------------

### GET /diagnosis/usedMemory

Source: https://stash.wiki/en/features/http-api

Returns the memory the core currently uses.

```APIDOC
## GET /diagnosis/usedMemory

### Description
Returns the memory the core currently uses.

### Method
GET

### Endpoint
/diagnosis/usedMemory

```

--------------------------------

### $environment["stash-build"]

Source: https://stash.wiki/en/script/syntax-and-interface

Returns the Stash build number.

```APIDOC
## $environment["stash-build"]

### Description
Returns the Stash build number.

### Method
Property access

### Endpoint
$environment["stash-build"]

### Parameters
None

### Response
- **value** (string) - The Stash build number.
```

--------------------------------

### GET /diagnosis/proxies

Source: https://stash.wiki/en/features/http-api

Tests each proxy for HTTP and UDP connectivity.

```APIDOC
## GET /diagnosis/proxies

### Description
Tests each proxy for HTTP and UDP connectivity.

### Method
GET

### Endpoint
/diagnosis/proxies

```

--------------------------------

### GET /dns/count

Source: https://stash.wiki/en/features/http-api

Returns the number of cached DNS entries.

```APIDOC
## GET /dns/count

### Description
Returns the number of cached DNS entries.

### Method
GET

### Endpoint
/dns/count

```

--------------------------------

### Single-choice list parameter with options

Source: https://stash.wiki/en/configuration/override

Defines a select parameter with options; each value goes into the configuration and label is the text shown in the form, falling back to value when omitted. Values in one list are unique and either all strings or all integers; default must be one of the values.

```yaml
arguments:
  region:
    type: select
    title: Region
    default: HK
    options:
      - value: HK
        label: Hong Kong
      - value: JP
        label: Japan
      - value: US
```

--------------------------------

### GET /providers/geodb

Source: https://stash.wiki/en/features/http-api

Retrieves GeoIP / ASN database information.

```APIDOC
## GET /providers/geodb

### Description
Retrieves GeoIP / ASN database information.

### Method
GET

### Endpoint
/providers/geodb

```

--------------------------------

### Disable QUIC with Script Shortcuts

Source: https://stash.wiki/en/faq/effective-stash

Use this configuration to reject UDP traffic on port 443 (HTTP3/QUIC) when forwarding through a proxy, as UDP forwarding is less efficient in some proxy protocols. The script shortcut defines a condition for UDP traffic on destination port 443, and the rule rejects matching traffic.

```yaml
script:
  shortcuts:
    quic: network == 'udp' and dst_port == 443
 
rules:
  - GEOIP,CN,DIRECT
  - SCRIPT,quic,REJECT
  - MATCH,PROXY
```

--------------------------------

### GET /providers/proxies

Source: https://stash.wiki/en/features/http-api

Retrieves remote proxy sets and their nodes.

```APIDOC
## GET /providers/proxies

### Description
Retrieves remote proxy sets and their nodes.

### Method
GET

### Endpoint
/providers/proxies

```

--------------------------------

### GET /proxies/{name}/info

Source: https://stash.wiki/en/features/http-api

Retrieves details of the proxy.

```APIDOC
## GET /proxies/{name}/info

### Description
Retrieves details of the proxy.

### Method
GET

### Endpoint
/proxies/{name}/info

### Parameters
#### Path Parameters
- **name** (string) - Required - The name of the proxy.

```

--------------------------------

### GET /version

Source: https://stash.wiki/en/features/http-api

Returns the version number of the Stash application.

```APIDOC
## GET /version

### Description
Returns the version number of the Stash application.

### Method
GET

### Endpoint
/version

### Authentication
Authorization: Bearer <API secret>

### Response
#### Success Response (200)
- **version** (string) - Version number

```

--------------------------------

### Declaring override parameters with arguments-version and arguments

Source: https://stash.wiki/en/configuration/override

Adds arguments-version and arguments at the top level of an override file and references parameters in the body with ${args.name}. arguments-version is always 1; arguments and arguments-version only build the form and are not part of the final configuration.

```yaml
name: Custom DNS
desc: Set the DNS address, log level and IPv6
arguments-version: 1
arguments:
  dns_server:
    type: input
    title: DNS address
    description: The upstream DNS address
    default: https://dns.alidns.com/dns-query
    required: true
    max-length: 2048
  log_level:
    type: select
    title: Log level
    default: info
    options:
      - value: info
        label: Normal
      - value: debug
        label: Debug
  ipv6_enabled:
    type: switch
    title: Enable IPv6
    default: false
 
dns:
  nameserver: #!replace
    - '${args.dns_server}'
log-level: '${args.log_level}'
ipv6: '${args.ipv6_enabled}'
```

--------------------------------

### Tailscale proxy configuration with auth-key

Source: https://stash.wiki/en/features/nat-traversal

Declare a `type: tailscale` proxy in Stash to join a tailnet. Onboarding completes automatically with an `auth-key`. Requires iOS/tvOS 3.4+ or macOS 4.2+.

```yaml
proxies:
  - name: ts-main
    type: tailscale
    auth-key: tskey-auth-xxxxxxxxxxxxxxxx
```

--------------------------------

### $notification.post(title, subtitle, body)

Source: https://stash.wiki/en/script/syntax-and-interface

Sends a system notification.

```APIDOC
## $notification.post(title, subtitle, body)

### Description
Sends a system notification.

### Method
Function call

### Endpoint
$notification.post(title, subtitle, body)

### Parameters
- **title** (string) - Required. The notification title.
- **subtitle** (string) - Required. The notification subtitle.
- **body** (string) - Required. The notification body.

### Response
None
```

--------------------------------

### GET /http

Source: https://stash.wiki/en/features/http-api

Retrieves recent requests captured by the HTTP engine.

```APIDOC
## GET /http

### Description
Retrieves recent requests captured by the HTTP engine.

### Method
GET

### Endpoint
/http

### Response
#### Success Response (200)
- **requests** (array) - List of recent captured HTTP requests.

```

--------------------------------

### GET /stash/speed

Source: https://stash.wiki/en/features/http-api

Returns current rates and totals for upload and download.

```APIDOC
## GET /stash/speed

### Description
Returns current rates and totals for upload and download.

### Method
GET

### Endpoint
/stash/speed

### Authentication
Authorization: Bearer <API secret>

### Response
#### Success Response (200)
- **upload** (number) - Current upload rate
- **download** (number) - Current download rate
- **totals** (object) - Total upload and download

```

--------------------------------

### $httpClient.options(request, callback)

Source: https://stash.wiki/en/script/syntax-and-interface

Performs an HTTP OPTIONS request.

```APIDOC
## $httpClient.options(request, callback)

### Description
Performs an HTTP OPTIONS request.

### Method
OPTIONS

### Endpoint
$httpClient.options(request, callback)

### Parameters
- **request** (object) - Required. The request configuration.
  - **url** (string) - Required. The request URL.
  - **headers** (object) - Optional. Request headers.
  - **body** (string|object|Uint8Array|ArrayBuffer) - Optional. Request body.
  - **timeout** (number) - Optional. Timeout in seconds, default 5.
  - **insecure** (boolean) - Optional. Skip HTTPS verification, default false.
  - **binary-mode** (boolean) - Optional. Return data as Uint8Array, default false.
  - **auto-cookie** (boolean) - Optional. Handle cookies automatically, default true.
  - **auto-redirect** (boolean) - Optional. Follow redirects, default true.
- **callback** (Function) - Required. Callback with signature (error, response, data).

### Response
- **error** (string|null) - Error message on failure.
- **response** (object) - Contains status (or statusCode) and headers.
- **data** (string|Uint8Array) - The response body.
```

--------------------------------

### Custom hosts mapping with wildcard support

Source: https://stash.wiki/en/features/dns-server

Defines custom DNS host mappings. Supports wildcard domain names (e.g., `*.clash.dev`, `*.foo.*.example.com`). Non-wildcard domains take precedence over wildcards (e.g., `foo.example.com` > `*.example.com` > `.example.com`). The effect of `+.foo.com` is equivalent to `.foo.com` and `foo.com`.

```yaml
# Support wildcard domain names (e.g., *.clash.dev, *.foo.*.example.com)
# Non-wildcard domain names take precedence over wildcard domain names (e.g., foo.example.com > *.example.com > .example.com)
# Note: The effect of +.foo.com is equivalent to .foo.com and foo.com
hosts:
  '*.clash.dev': 127.0.0.1
  '.dev': 127.0.0.1
  'alpha.clash.dev': ::1
```

--------------------------------

### $environment["stash-version"]

Source: https://stash.wiki/en/script/syntax-and-interface

Returns the Stash version number.

```APIDOC
## $environment["stash-version"]

### Description
Returns the Stash version number.

### Method
Property access

### Endpoint
$environment["stash-version"]

### Parameters
None

### Response
- **value** (string) - The Stash version number.
```

--------------------------------

### GET /dashboard

Source: https://stash.wiki/en/features/http-api

Serves the built-in web dashboard, which can be opened directly in a browser.

```APIDOC
## GET /dashboard

### Description
Serves the built-in web dashboard, which can be opened directly in a browser.

### Method
GET

### Endpoint
/dashboard

```

--------------------------------

### VLESS basic configuration

Source: https://stash.wiki/en/proxy-protocols/proxy-types

Base VLESS proxy configuration with server, port, and UUID. Optional flow, TLS, and Reality settings are commented out.

```yaml
name: vless
type: vless
server: server
port: 443
uuid: d0529668-8835-11ec-a8a3-0242ac120002
# flow: xtls-rprx-vision
# skip-cert-verify: true
# tls: true
# client-fingerprint: chrome
# reality-opts:
#   public-key:
#   short-id:
```

--------------------------------

### GET /script/runtime/store/{key}

Source: https://stash.wiki/en/features/http-api

Reads script persistent storage for the given key.

```APIDOC
## GET /script/runtime/store/{key}

### Description
Reads script persistent storage for the given key.

### Method
GET

### Endpoint
/script/runtime/store/{key}

### Parameters
#### Path Parameters
- **key** (string) - Required - The storage key to read.

```

--------------------------------

### clash://install-config

Source: https://stash.wiki/en/faq/url-schema

Imports a configuration file into Stash using the clash:// URL scheme. The URL parameter must be URL-encoded.

```APIDOC
## [clash://install-config]

### Description
Imports a configuration file into Stash using the clash:// URL scheme. The URL parameter must be URL-encoded.

### Method
clash:// URL scheme

### Endpoint
clash://install-config?url=${url-encoded}

### Parameters
#### Query Parameters
- **url** (string) - Required - The URL-encoded URL of the configuration file to import.

### Request Example
clash://install-config?url=https%3A%2F%2Fexample.com%2Fstash.yaml

### Response
#### Success Response (200)
No response body specified.

#### Response Example
No response body specified.
```
Tokens:
Raw