A pasted sing-box config carrying services (api/ssm-api), endpoints
(wireguard/tailscale), or experimental controllers (clash/v2ray/debug)
could bind non-loopback listeners or alter host networking once the
full include registries are enabled. Strip those sections so the
proxy record can only forward traffic; outbounds, route and dns still
pass through. Align the README outbound list (dns outbound was
removed in sing-box 1.12) and document the stripped sections.
Register the full sing-box include registries instead of the
anytls-only outbound registry so the vault proxy record may use any
core outbound type (direct, socks, http, shadowsocks, vmess, vless,
trojan, anytls, shadowtls, snell, ssh, tor, block, dns, selector or
urltest) plus route and dns sections. Reject configs without
outbounds early. The forced loopback mixed inbound and disabled log
are unchanged.
mizorewww