`sing-box format` reorders rules & adds/removes items

Operating system

Linux

System version

Linux fedora 7.1.13-200.fc44.x86_64

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.14.0

Environment: go1.26.7 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0,with_musl
Revision: 0b8995879f29a9b98ee027bc17b75e101445b238
CGO: enabled

Description

sing-box format -w changes more than the formatting of my configuration.

It adds some configuration fields, removes some explicitly specified fields, and changes the order of route rules.

I would like to understand whether these transformations are intentional and whether they are guaranteed to preserve the behavior of the original configuration.

Reproduction

Using sing-box 1.14.0, the following minimal configurations reproduce the observed transformations.

1. NTP

Input:

{
  "ntp": {
    "enabled": true,
    "server": "time.cloudflare.com"
  }
}

Command:

sing-box format -c ntp.json

Output:

{
  "ntp": {
    "enabled": true,
    "server": "time.cloudflare.com",
    "server_port": 0
  }
}

2. HTTP client

Input:

{
  "http_clients": [
    {
      "tag": "rules-direct"
    }
  ]
}

Command:

sing-box format -c http_clients.json

Output:

{
  "http_clients": [
    {
      "tag": "rules-direct",
      "version": 2,
      "stream_receive_window": 0,
      "connection_receive_window": 0
    }
  ]
}

3. Route rules

Input:

{
  "route": {
    "rules": [
      {
        "action": "sniff",
        "sniffer": [
          "http",
          "tls",
          "quic"
        ]
      },
      {
        "rule_set": [
          "geosite-malware",
          "geosite-phishing",
          "geosite-cryptominers",
          "geosite-category-ads-all",
          "geoip-malware",
          "geoip-phishing"
        ],
        "action": "reject"
      },
      {
        "inbound": "mixed-in",
        "action": "route",
        "outbound": "✅ Selector"
      },
      {
        "ip_is_private": true,
        "action": "route",
        "outbound": "direct"
      },
      {
        "rule_set": [
          "geosite-ir",
          "geoip-ir"
        ],
        "action": "route",
        "outbound": "direct"
      }
    ],
    "rule_set": [
      {
        "type": "remote",
        "tag": [
          "geosite-ir",
          "geoip-ir",
          "geosite-malware",
          "geosite-phishing",
          "geosite-cryptominers",
          "geosite-category-ads-all",
          "geoip-malware",
          "geoip-phishing"
        ],
        "url": "https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@rule-set/{tag}.srs"
      }
    ],
    "final": "🌐 System Mode",
    "auto_detect_interface": true,
    "default_domain_resolver": "dns-direct"
  }
}

Command:

sing-box format -c routes.json

Output:

{
  "route": {
    "rules": [
      {
        "action": "sniff",
        "sniffer": [
          "http",
          "tls",
          "quic"
        ]
      },
      {
        "rule_set": [
          "geosite-malware",
          "geosite-phishing",
          "geosite-cryptominers",
          "geosite-category-ads-all",
          "geoip-malware",
          "geoip-phishing"
        ],
        "action": "reject"
      },
      {
        "ip_is_private": true,
        "outbound": "direct"
      },
      {
        "rule_set": [
          "geosite-ir",
          "geoip-ir"
        ],
        "outbound": "direct"
      },
      {
        "inbound": "mixed-in",
        "outbound": "✅ Selector"
      }
    ],
    "rule_set": [
      {
        "type": "remote",
        "tag": [
          "geosite-ir",
          "geoip-ir",
          "geosite-malware",
          "geosite-phishing",
          "geosite-cryptominers",
          "geosite-category-ads-all",
          "geoip-malware",
          "geoip-phishing"
        ],
        "url": "https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@rule-set/{tag}.srs"
      }
    ],
    "final": "🌐 System Mode",
    "auto_detect_interface": true,
    "default_domain_resolver": "dns-direct",
    "default_http_client": "rules-direct"
  }
}

In this case, format makes all of the following changes:

• adds ntp.server_port: 0
• adds version: 2, stream_receive_window: 0, and connection_receive_window: 0 to the HTTP client
• adds route.default_http_client
• removes explicit action: "route" from route rules
• moves the mixed-in rule from before the ip_is_private and geosite-ir rules to the end of the rule list

Question

Are these transformations expected behavior of sing-box format?

In particular, is the reordering of route.rules guaranteed to preserve routing semantics, or can it change the behavior of configurations where multiple route rules can match the same connection?

Also, are the added and removed fields simply a canonical serialization of the same configuration, with no behavioral difference?

Version

sing-box version 1.14.0
Environment: go1.26.7 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0,with_musl
Revision: 0b8995879f29a9b98ee027bc17b75e101445b238
CGO: enabled

ai-config.json

Logs

No crash or runtime error occurs. The issue is the configuration transformation performed by `sing-box format`.

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by running sing-box format with the minimal NTP, HTTP client, and route configurations from the report, then trace the formatter and route-rule handling responsible for the added, removed, and reordered fields. Done means determining whether each transformation is intentional and whether route ordering and canonical serialization preserve configuration behavior, with regression coverage or documentation where the repository’s existing conventions indicate it belongs.