fix: backend lock safety (#8439)

* fix(backup): serialize restore with config write lock

Acquire the configuration write lock at the entry of
finalize_restored_verge_config so the clash, profiles and verge draft
applies all happen under it, instead of only the verge layer. A
concurrent patch (patch_clash / patch_verge via try_lock_config_write)
could otherwise stage a draft that the unlocked restore applies
overwrite, or interleave its persistence with the restore.

Also drop the pointless clones in the clash and profiles edit_draft
closures; edit_draft takes FnOnce so the restored values can be moved
in. The lock is released before patch_verge, which re-acquires it via
try_lock_config_write.

* perf(backup): extract archive off the runtime

Run File::open, ZipArchive::new and the extraction of the backup
archive inside spawn_blocking. Extracting a multi-file backup blocked
a tokio worker for hundreds of milliseconds to seconds while the
runtime kept serving other work on the remaining workers.

Move the PROFILE_WRITE_LOCK acquisition after the extraction, right
before finalize_restored_verge_config: the lock protects the
config-data transition (extracted files reloaded into drafts), not the
plain filesystem writes, so profile operations no longer queue behind
the blocking unzip.

* fix(clash): take config write lock when changing mode

change_clash_mode committed the clash draft and saved config.yaml without
claiming CONFIG_WRITE_LOCK, so a concurrent patch_clash transaction could
have its staged draft committed here or its file-snapshot rollback swallow
the mode change. Take lock_config_write (waiting) rather than
try_lock_config_write: two of the three callers (hotkey, tray) discard the
result, so fail-fast would silently drop the switch, and the lock is only
attempted after the mihomo patch already applied, where an Err would roll
the frontend back while the core runs the new mode.

src-tauri/src/feat/backup.rs

@@ -33,6 +33,8 @@ async fn finalize_restored_verge_config(
     webdav_username: Option<String>,
     webdav_password: Option<String>,
 ) -> Result<()> {
+    let config_write = Config::lock_config_write().await;
+
     // A broken restored `verge.yaml` is a restore failure, not a reason to load defaults.
     let mut restored = help::read_yaml::<IVerge>(&verge_path()?).await?;
     restored.webdav_url = webdav_url;
@@ -55,14 +57,10 @@ async fn finalize_restored_verge_config(
     profiles_draft.apply();
 
     let verge_draft = Config::verge().await;
-    {
-        // Hold the write lock so a concurrent patch cannot stage a draft the proxy write reads.
-        let _config_write = Config::lock_config_write().await;
-        verge_draft.edit_draft(|d| {
-            *d = restored.clone();
-        });
-        verge_draft.apply();
-    }
+    verge_draft.edit_draft(|d| {
+        *d = restored.clone();
+    });
+    verge_draft.apply();
 
     // Turn it off here; a failing core side effect below would otherwise skip this step.
     if !restored.enable_system_proxy.unwrap_or_default() {
@@ -80,6 +78,9 @@ async fn finalize_restored_verge_config(
         }
     }
 
+    // `patch_verge` re-acquires the configuration write lock.
+    drop(config_write);
+
     // Run configuration side effects without rewriting the already-restored file.
     if let Err(err) = super::patch_verge(&restored, true).await {
         logging!(error, Type::Backup, "Failed to apply restored verge config: {err:#}");
@@ -145,10 +146,17 @@ async fn restore_backup_archive(path: PathBuf) -> Result<()> {
         )
     };
 
-    let file = AsyncHandler::spawn_blocking(move || std::fs::File::open(&path)).await??;
-    let mut zip = zip::ZipArchive::new(file)?;
+    let home_dir = app_home_dir()?;
+    AsyncHandler::spawn_blocking(move || -> Result<()> {
+        let file = std::fs::File::open(&path)?;
+        let mut zip = zip::ZipArchive::new(file)?;
+        zip.extract(&home_dir)?;
+        Ok(())
+    })
+    .await
+    .map_err(|join| anyhow!("backup extraction task failed: {join}"))??;
+
     let _profile_write = crate::config::profiles::PROFILE_WRITE_LOCK.lock().await;
-    zip.extract(app_home_dir()?)?;
     finalize_restored_verge_config(webdav_url, webdav_username, webdav_password).await
 }
 

src-tauri/src/feat/clash.rs

@@ -67,11 +67,13 @@ pub async fn change_clash_mode(mode: String) -> Result<(), String> {
     }
 
     let clash = Config::clash().await;
-    clash.edit_draft(|d| d.patch_config(&mapping));
-    clash.apply();
-
-    let clash_data = clash.data_arc();
-    if clash_data.save_config().await.is_ok() {
+    let save_result = {
+        let _config_write = Config::lock_config_write().await;
+        clash.edit_draft(|d| d.patch_config(&mapping));
+        clash.apply();
+        clash.data_arc().save_config().await
+    };
+    if save_result.is_ok() {
         announce(Refresh::Clash);
         tray::Tray::global().update_menu_and_icon().await;
     }