Self-review findings: the bus now re-reads the run-state snapshot in
onSubscribed so an event racing the store's initial read cannot leave a
stale snapshot (the ordering the old layout listener guaranteed), and the
patch hooks pass errorNotice:false so GuardState/page handlers remain the
only error toast, matching the pre-migration behavior.
Layering rules for the contract flow: generated contract as the only
wire-typing source, event bus as the only listen/emit site, pure-reducer
store for event-derived state, the mutate funnel for user intent, and
invoke only in the services layer — each backed by the CI gates.
Ports mode switching (page and home card), chain runtime updates, node
selection with tray sync, selection recording, provider updates and
syncs, and lightweight-mode entry onto the funnel; every site keeps its
existing optimistic/revert and error-handling behavior.
Ports profile create/import/reorder/delete/update/patch/save-file and
enhance calls onto the funnel; retry and editor flows keep their own
error handling with errorNotice:false. Per-uid ids keep the update
worker pool concurrent under the funnel's in-flight dedupe.
Ports port saving, webdav/local backup operations, core change/restart/
upgrade, service install/uninstall/repair flows, the system-proxy toggle
queue, the DNS override toggle, and app lifecycle commands onto the single
funnel. Bespoke flows keep their own error handling via errorNotice:false;
simple flows gain the funnel's default error toast and revalidation.
Adds src/services/mutate.ts: one path for optimistic apply, services-layer
invoke, Busy handling, failure rollback, and the error toast, with busy
bookkeeping mirrored into the app store. The patch hooks (verge, clash,
profiles) now route through it. Moves the remaining direct invokes
(unlock ×3, DNS ×4) into cmds.ts and turns on the invoke-only-in-services
architecture gate in CI.
D5 cleanup, frontend and backend in one commit: removes the six
config_validate::* statuses that never receive a backend send and the
set_config::ok send (enum variants, golden list 41→34, send point in
restart_clash_core), their frontend handlers, and the five i18n keys only
those handlers used. The notice table is now typed as a Record over the
generated NoticeStatus union, so a status without a frontend entry fails
to compile. The info status (sent by the silent updater for breaking
change notices, previously dropped with a console warning) now shows an
info toast — the one deliberate behavior delta.
Adds src/services/bus (the only listen/emit site: one handler per contract
event plus the frontend-internal test-all event) and the React
context/reducer app store. Migrates the five scattered subscriptions
(layout events, pending failures, proxy refresh, profile update/timer,
test-all), deletes the old glue (events.ts, use-listen, use-layout-events,
LoadingCacheProvider), moves run state into the store, and adds an
architecture gate script wired into CI. Behavior is unchanged; the
run-state query's poll/focus safety net is preserved by the store
provider.
Adds a zero-dependency `frontend-contract` bin that serializes the real
NoticeStatus variants and FrontendEvent payloads, scripts/gen-contract.mjs
which emits the committed src/services/contract.ts, and a CI job that
regenerates it and fails on a non-empty diff. events.ts now derives its
event map from the generated contract instead of hand-typed shapes.
While the menu order is locked, the sidebar items were still registered as
disabled sortables, so dnd-kit gave each nav button a draggable role
description, aria-disabled=true, aria-pressed and the drag instructions.
Screen readers announced every item as an unavailable draggable toggle.
Only wrap the items in SortableItem while reordering is unlocked.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
When the service watchdog gave up or the core vanished, the owner
monitor marked the core stopped without telling the user, and on macOS
left the system proxy on the dead mixed port (#8029).
- On SameOwnerFailure, clear the proxy through the helper while the
session is still ours; displaced or unreachable owners still leave the
machine-wide setting alone.
- Retain the stop as a core failure with its own message, recorded
under the lifecycle lock and shown now or on next focus; a running
core resets the notice dedup.
- Log each watchdog restart the service reports, since launchd discards
the service's own log.
When the service refuses the app data root because another uid owns it
(code 1012), show a sticky notice with the chown command for this
account. Repairing the service cannot fix this.
Refs #8026
Show unresolved startup failures when the window becomes visible and clear them when either core mode starts successfully. Cover recovery followed by exit and WebView recreation, use neutral service permission wording, and document the Windows startup fix.
* fix(rules): disable auto-capitalization in rule content input
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(rules): pass input hints to the rule content input element
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: wonfen <eiwonfen@gmail.com>
Delegate service and core installation to Service IPC so replacement uses
one elevation. Share fallback occupancy checks and retain the execution
guard until the Sidecar exits.
Track missing approved cores and start refusals as unavailable, and show
when no core is running. Build matching service tools from the local IPC
dependency and pass both core executables through the Dev installer.
Save the DNS override switch and session confirmation per profile so automatic protection only disables the affected profile. Preserve the legacy switch as the initial preference and show the profile scope beside the settings gear and in the DNS editor.
Refs #7993
Address #7983 with a recovery dialog for Windows service error 1003, including startup refusals received before the UI subscribes. Reinstall the service and require service mode before reporting recovery.
Translate the 174 frontend strings and 8 tray/notification strings that were
still English copies in the Turkish locale. Values only; no keys changed.
Co-authored-by: qwist1233-cpu <qwist1233-cpu@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Delay test inputs now reject non-http(s) URLs with a warning toast and
fall back to the default URL instead of erroring every node in the
core. Subscription import and profile card host parsing reuse the same
validator, fixing bare-domain URLs shown as local files and
credential-bearing URLs leaking into the card.
Preserve TUN settings and restore proxy operation after fallback.
Deliver fallback notices after UI subscription and stop retrying
deterministic bundle refusals. Publish fallback state atomically
and avoid conflicting service startup notifications.
* fix(profile): virtualize editor lists for rule/proxy/group editors
* refactor(list): remove feedbackClone from sortable item and list integration
* refactor(profile): use type instead of export type for category
* refactor(ui): rename measureElementRef to measureElement in sortable components
Manual update-check failures surfaced as red error toasts that read as
an app fault. Add a warning severity to the notice service and use it
in both check entry points alongside a console.warn; automatic checks
and install failures keep their existing behavior.
* fix(traffic): avoid scientific notation in traffic display near 1000 threshold
When a traffic value in any unit (KB, MB, etc.) falls in the 999.5–1000
range, toPrecision(3) rounds it to 1000 but outputs scientific notation
"1.00e+3" instead of plain "1000". Check Math.round(dat) >= 1000 instead
of dat >= 1000 to catch this rounding boundary.
Signed-off-by: Alec <alechron@outlook.com>
* fix(traffic): avoid scientific notation in formatConnectionTraffic
Signed-off-by: Alec <alechron@outlook.com>
---------
Signed-off-by: Alec <alechron@outlook.com>
Add `mips` to the TUN stack switch so the stack shipped in mihomo
v1.19.31 is selectable from the GUI. Older cores reject the value,
which the changelog entry discloses.
Limit GUI authority to saved TUN fields while preserving custom overrides.
Sync provider caches after service startup, reloads and updates.
Publish copies atomically with session, runtime and cache metadata checks.
Removes zero-consumer surface verified by repo-wide grep: the
reference-count render machinery, the never-called clearData chain,
unread snapshot fields (rangeMinutes, reason), dead refresh callbacks
on the connection hooks, the write-only wsRef sync, and the worker's
unreachable DEFAULT_CONFIG placeholder (now definite assignment under
the init-first client contract). No behavior change; the compressed
sampler path, samplerStats diagnostics, and lastTimestamp perf
contract stay. Net -120 lines across six files.
The traffic pipeline re-rendered twice per second (worker snapshot
plus a 1 s now-tick), cloned the 10-minute and 60-minute arrays
through every snapshot, and re-filtered them on the main thread.
Snapshots now carry only the range slice the graph renders, a 1 s
worker-side heartbeat re-broadcasts only when points age out of the
window, and snapshot ingestion pauses while the window is hidden.
Perf harness A/B: hidden-phase webview CPU 2.45% -> 0.77%, main
0.90% -> 0.37%, webview RSS about -3 MB; visible phases unchanged.
* fix(ui): use utf-8 encoding for inline SVG icons to support non-latin characters
* chore(test-item): re-add data-sortable-handle to TestItem box
* docs: update changelog
Locks both sides to upstream main 17c7757: the WS channel now uses a
single Json transport (connections wire shrinks ~3.4x) and count-stream
error frames are forwarded unchanged; JS/Rust API surfaces stay
identical, so upper-layer code is untouched except the card below.
The home Active Connections card now subscribes to the count-only
ws_connections_count stream instead of parsing the full connections
snapshot every second; the full stream runs only while the Connections
page is mounted.
Tunglies