fix

.gitignore

@@ -3,3 +3,9 @@
 web/singvis.wasm
 web/singvis.wasm.gz
 web/wasm_exec.js
+
+# wasm build scratch: patched copy of the sing module + its alternate module file
+# (see build.sh). Regenerated on demand.
+wasmbuild/.singtree/
+go.wasm.mod
+go.wasm.sum

build.sh

@@ -6,16 +6,43 @@ set -euo pipefail
 
 cd "$(dirname "$0")"
 
-# The engine's Go dependencies (sing) contain three source files that reference
-# golang.org/x/sys/unix, which has no equivalent for GOARCH=wasm. wasmbuild/
-# supplies wasm-safe stubs and gen-overlay.sh maps them in via `go build
-# -overlay`. Only this wasm build uses the overlay; native builds/tests do not.
-overlay="$(mktemp)"
-trap 'rm -f "$overlay"' EXIT
-bash wasmbuild/gen-overlay.sh > "$overlay"
+# The engine's Go dependency sing contains three source files that reference
+# golang.org/x/sys/unix, which has no GOARCH=wasm equivalent:
+#   common/buf/buffer_unix.go, common/bufio/vectorised_unix.go,
+#   common/bufio/copy_direct_posix.go
+# We can't patch them where they live: the module cache is read-only and, since
+# go1.25, `go build -overlay` refuses to replace files beneath GOMODCACHE. So we
+# materialize a writable copy of the sing module outside the cache, drop the
+# wasm-safe stubs from wasmbuild/_stubs over those three files, and build the wasm
+# against an alternate module file that `replace`s sing with the patched copy.
+# Native builds and tests use the unmodified go.mod and the real sing — none of
+# this touches them. All the files below are gitignored build artifacts.
+go mod download github.com/sagernet/sing
+singdir="$(go list -m -f '{{.Dir}}' github.com/sagernet/sing)"
+singver="$(go list -m -f '{{.Version}}' github.com/sagernet/sing)"
+
+work="$PWD/wasmbuild/.singtree"
+if [ "$(cat "$work/.version" 2>/dev/null || true)" != "$singver" ]; then
+	echo "staging wasm-patched sing $singver…"
+	rm -rf "$work"
+	mkdir -p "$work"
+	cp -a "$singdir/." "$work/"
+	chmod -R u+w "$work"
+	cp wasmbuild/_stubs/buf_buffer_unix.go         "$work/common/buf/buffer_unix.go"
+	cp wasmbuild/_stubs/bufio_vectorised_unix.go   "$work/common/bufio/vectorised_unix.go"
+	cp wasmbuild/_stubs/bufio_copy_direct_posix.go "$work/common/bufio/copy_direct_posix.go"
+	printf '%s\n' "$singver" > "$work/.version"
+fi
+
+# Alternate module file pointing sing at the patched copy. Regenerated each build
+# so it tracks go.mod/go.sum; removed on exit.
+trap 'rm -f go.wasm.mod go.wasm.sum' EXIT
+cp go.mod go.wasm.mod
+cp go.sum go.wasm.sum
+printf '\nreplace github.com/sagernet/sing => %s\n' "$work" >> go.wasm.mod
 
 echo "building web/singvis.wasm (GOOS=js GOARCH=wasm)…"
-GOOS=js GOARCH=wasm go build -overlay "$overlay" -trimpath -ldflags="-s -w" \
+GOOS=js GOARCH=wasm go build -modfile=go.wasm.mod -trimpath -ldflags="-s -w" \
 	-o web/singvis.wasm ./cmd/wasm
 
 # Ship the Go runtime's JS support shim next to the wasm. Newer Go keeps it under

wasmbuild/_stubs/buf_buffer_unix.go

@@ -1,4 +1,5 @@
-// This file is substituted in via `go build -overlay` for the js/wasm build ONLY.
+// This file is copied over the upstream sing source (in a build-local copy of the
+// module) for the js/wasm build ONLY; see build.sh.
 //
 // Upstream common/buf/buffer_unix.go (build tag `!windows`) defines
 // Buffer.Iovec returning golang.org/x/sys/unix.Iovec, which does not exist for

wasmbuild/_stubs/bufio_copy_direct_posix.go

@@ -1,4 +1,5 @@
-// Substituted in via `go build -overlay` for the js/wasm build ONLY.
+// Copied over the upstream sing source (in a build-local copy of the module) for
+// the js/wasm build ONLY; see build.sh.
 //
 // Upstream common/bufio/copy_direct_posix.go (build tag `!windows`) implements
 // the syscall read-waiters using golang.org/x/sys/unix (readv/recvmsg). wait.go

wasmbuild/_stubs/bufio_vectorised_unix.go

@@ -1,4 +1,5 @@
-// Substituted in via `go build -overlay` for the js/wasm build ONLY.
+// Copied over the upstream sing source (in a build-local copy of the module) for
+// the js/wasm build ONLY; see build.sh.
 //
 // Upstream common/bufio/vectorised_unix.go (build tag `!windows`) implements the
 // syscall-based vectorised writers using golang.org/x/sys/unix (Iovec, writev,

wasmbuild/gen-overlay.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-# Generates the -overlay JSON that swaps the three sing source files that pull in
-# golang.org/x/sys/unix (unavailable for GOARCH=wasm) for wasm-safe stubs in
-# ./_stubs. Only the js/wasm build uses this overlay; native builds and tests are
-# unaffected. The stubs live in an underscore-prefixed directory so the go tool
-# ignores them during ./... builds (they carry mixed package names). See
-# _stubs/*.go for the rationale of each substitution.
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-sing="$(cd "$here/.." && go list -m -f '{{.Dir}}' github.com/sagernet/sing)"
-
-cat <<JSON
-{
-  "Replace": {
-    "$sing/common/buf/buffer_unix.go": "$here/_stubs/buf_buffer_unix.go",
-    "$sing/common/bufio/vectorised_unix.go": "$here/_stubs/bufio_vectorised_unix.go",
-    "$sing/common/bufio/copy_direct_posix.go": "$here/_stubs/bufio_copy_direct_posix.go"
-  }
-}
-JSON