50 Commits

Include renames

Author	SHA1	Message	Date
Tunglies	9a904af3aa	refactor: backend cleanup (#8436) ... * refactor(utils): drop dead reset helper and tidy init_resources - remove resolve_reset_async, which had no callers - drop the duplicated time.*.com entry from the default fake-ip-filter - init_resources no longer recreates app_home (ensure_directories during init_config already created it) and now propagates res_dir creation errors * refactor(profile): remove identical blind retry when switching node The second select_node_for_group call in switch_proxy_node was a zero-interval retry with identical arguments. Its success path was a degraded copy of the first (missing the Refresh::Proxies announcement ever since the old force-refresh emit was removed), and its distinct "回退/最终失败" log wording misled maintainers. Keep a single call, the primary success aftermath, and one error log. * refactor(enhance): simplify tun mode check and lowercase helpers - Drop the always-true second clause in use_tun's enhanced-mode check: the key is absent only when the unwrap_or default already makes current_mode == "fake-ip" true. - Collapse use_lowercase into a delegation to use_lowercase_owned. * refactor(core): drop unreachable hotkey dtor and dedupe tray predicate Remove impl Drop for Hotkey: the instance lives in a OnceLock static via the singleton! macro and is never dropped; exit-time unregistration is already handled by Hotkey::reset(). Spell the include_proxy_groups/display-mode predicate identically at both evaluation sites in tray menu building; behavior is unchanged (Option != Some("disable") is equivalent to unwrap_or("default") != "disable"). * refactor(config): fold port guards into single helper The five IClashTemp port guards duplicated the same read/parse/default logic with drifting defaults: some hardcoded 7895/7898/7899 while others referenced network::ports constants. Route them all through one guard_port_value helper and use the constants everywhere, keeping each guard's name, key and cfg attributes. * refactor(config): dedupe prfitem factories and companion seeding from_rules/from_proxies/from_groups differed only in uid prefix, type string and template, so they now delegate to a shared from_seq_item. The five current_* accessors collapse into a local macro. The identical five-block companion seeding in from_local and from_url moves into ensure_companion_items, preserving seeding order and error propagation. * refactor(config): share patch macro and profiles helpers IVerge::patch_config, IProfiles::patch_item and PrfOption::merge each hand-rolled the same copy-Some-overwrite pattern; they now share one patch_opt_field macro (the or-else merge form is field-for-field equivalent for Option fields). The four profiles *_safe wrappers that inlined Config::profiles().with_data_modify boilerplate delegate to a with_profiles_edit helper, and record/forget_selected_node share the current-item lookup prelude via current_item_mut. * refactor(enhance): merge chain processing and drop unused builtin js payload - collapse the identical process_global_items/process_profile_items into one parameterized process_override_items (entry uid sources unchanged) - fold the identical rules/proxies/groups arms of ChainItem::from_async into a single arm with an inner dispatch - stop embedding builtin JS payloads never executed by any path: the enhance loop dispatches builtin items by uid to native implementations, so ChainItem::builtin now carries empty script data (uids unchanged) - source ProfileItems fallback literals from Default instead of a second hand-written copy in collect_profile_items * refactor(net): reuse webpki tls config and fallback Extract build_webpki_rooted_tls_config so the delay-test TLS connector and the reqwest clients share one static-webpki-roots builder; ALPN stays caller-specific (only reqwest offers h2). Collapse the duplicated platform-verifier -> static-webpki-roots retry in get/get_bytes into request_with_static_webpki_fallback, gated by the caller's certificate-verification setting. * refactor(app): extract common exit cleanup restart_app and quit duplicate the whole exit preparation: set the exiting flag, persist configs, run interactive cleanup, and on a failed core stop clear the flag, restore public DNS under the lifecycle lock on macOS, and send the stop-failed notice. Move that flow into run_exit_cleanup_flow next to clean_async, taking the notice variant as a parameter and returning the CleanupResult so each caller keeps its own tail: restart aborts before shutdown, quit always shuts down and exits with the cleanup code. * refactor(backup): share restore finalize path restore_webdav_backup and restore_local_backup duplicated the credential extraction (backup creation strips the WebDAV credentials, so both re-inject the live ones), the archive extraction and the finalize tail. Move that tail into a private restore_backup_archive helper so the two entries keep only their download/locate logic; the config-write lock scope and the off-runtime extraction land in one place. The webdav entry keeps its downloaded-file cleanup. * refactor(sysopt): drop redundant lock and busy-wait The proxy target pair sat behind an Arc<RwLock> with no readers and an Arc that was never cloned; both writers already serialize on update_lock, so store the pair inside that mutex and delete the RwLock. refresh_guard waited for the guard to become ready with a yield_now spin at full CPU while holding guard_operation_lock; a 10 ms sleep keeps the same wait condition and lock scope without the spin. * refactor(sysopt): share macos bypass formatting The macOS default bypass list and its three-way composition (empty -> default, default + custom, custom only) were maintained twice: in sysopt's format_bypass and inline in proxy_control's service_bypass. Keep the literal once in constants and compose both paths through format_bypass; service_bypass keeps its NUL check and UTF-8 truncation. * refactor(core): dedupe window listeners, elevated runners, backup settings - Collapse the close/focus window listener pairs in lightweight.rs onto a shared WindowListener with per-listener event and log label. - Extract the windows runas-or-direct execution into service::run_maybe_elevated, shared by win_uwp and the service uninstaller, and factor the common uninstaller path resolution and status check shared across platforms. - Make the auto-backup watch channel the single settings source, replacing the duplicate Arc<RwLock> copy with a stored receiver. * refactor(enhance): fold lowercase helpers into single owned function use_lowercase_owned disappears; the surviving use_lowercase takes the owned Mapping and borrowed callers clone at the call site. * refactor(enhance): rename ChainSupport variants to Mihomo names Clash is a legacy name; the variants match the verge-mihomo and verge-mihomo-alpha cores they gate. * refactor(enhance): lowercase takes a reference and chain support is copy use_lowercase borrows the mapping and clones only the values; call sites no longer clone whole configs. ChainSupport is a fieldless enum and now Copy; builtin() registers each support pair without clones. * refactor(config): name prfitem constructor for what it builds new_seq_item states that a fresh item is built from a template; the from_ prefix wrongly implied an existing source. append_companion_item returns the uid directly: append_item bails on a missing uid, so the Option was always Some on the Ok path. * refactor(sysopt): name the proxy state lock for its full role The lock now owns the (Sysproxy, Autoproxy) state, so proxy_state_lock says what it guards; the guard locals follow. constants::proxy held a single sysproxy constant and is renamed sysproxy. * refactor: replace remaining clash meta naming with mihomo Doc comment, generated bindings and the prebuild sidecar helpers stop referring to the legacy Clash Meta name; installer legacy-process cleanup keeps the old executable names on purpose. * refactor(enhance): drop builtin core filtering that never discriminates Both valid cores matched a different ChainSupport variant, yet each variant registered the same uid pair, so the filtered builtin list was identical for stable and alpha. Invalid cores are coerced at startup (validate_and_fix_config / get_valid_clash_core) and the None arm of is_support was unreachable. builtin() now returns the items directly and the clash_core threading through ConfigValues goes away; re-add core discrimination when a builtin actually differs per core. * refactor(enhance): drop unreachable mode script guard merge_default_config overwrites the profile's mode with the verge-owned clash config, whose mode is always present (template seeds rule and patch semantics never clear it) and restricted to rule/global/direct; change_clash_mode is rejected by the core before persisting anything else. mode:script can therefore only arrive through a hand-crafted patch_clash call, and for that path an explicit invalid-mode validation error is more honest than silently rewriting to rule. mihomo rejects mode:script outright (invalid mode), and user merge/script chains run after the builtins, so the guard never covered them anyway. * refactor(enhance): call the hysteria alpn builtin directly builtin() existed to feed the uid-dispatch loop; with a single builtin the vec and match are ceremony. apply_builtin_scripts calls builtin_hy_alpn directly and to_script goes away; tests construct ChainItem literals the way the merge items already did.	2026-11-03 10:48:44 +00:00
Tunglies	b7c4f7d39b	refactor: api cleanup (#7812) ... * refactor(config): unify YAML persistence * refactor(config): remove redundant config APIs * refactor(config): remove unused config APIs * refactor(config): narrow profile APIs * fix(config): preserve profiles on invalid reorder * refactor(startup): narrow resolve helpers * refactor(config): unify mixed port defaults * refactor(network): simplify response APIs * refactor(config): make profile builders infallible * refactor(config): make profile activation infallible * refactor(api): simplify internal runtime APIs * refactor: consolidate internal config and window APIs	2026-08-25 07:19:17 +00:00
wonfen	1b75ea34f9	fix(core): upgrade mihomo atomically instead of letting it self-update ... mihomo's updater truncates its own running executable in place; macOS kills that under Hardened Runtime and leaves a 0-byte core. Verge now downloads the release, verifies a staged copy next to the target, and renames it into place, which never touches the inode the running core executes from. Closes #6834	2026-08-21 14:41:57 +08:00
wonfen	c90de1355e	refactor: core runstate (#7602) ... * refactor(core): introduce core::runstate as the owner of Run State "Is the Service available?" had five caches and three predicates, and prepare_startup consulted all three within thirty lines. This lands the foundation for collapsing that, with no behaviour change: the old owners now delegate into one store. The state model splits observation from intent. Five of ServiceStatus's ten variants were never observations — cmd/service.rs passed ServiceStatus::InstallRequired as the "which operation do you want" argument — which is why narrowing to ServiceInstallState had to be lossy. ServiceHealth now records what we saw, PendingAction records what the session asked for, and ServiceStatus::from_run_state flattens the pair for call sites that still expect the single slot. Reads differ only in freshness: state() is cached, settled() waits for an in-flight privileged operation, probe() forces IPC. What an answer means lives on the snapshot (service_usable, tun_capable), so callers stop writing their own formulas — the tray now asks tun_capable() instead of recomputing "admin or ready". Effects sit behind RunStateEnv with two adapters, RealEnv and FakeEnv. That retires the seven tests that hand-built a private ServiceManager struct literal, and makes the probe and detection paths testable for the first time. Two distinctions are now explicit rather than incidental: - A single failed probe is not an observation and leaves confirmed health intact; exhausting a poll's whole retry budget is one and records unavailable. Both are tested, protecting 389c5342. - Platform evidence that cannot be inspected is unavailable, not absent, so we never offer to install a Service that is already there. RealEnv::is_elevated reads APP_HANDLE without expect(), so reading Run State before the app handle exists degrades to "not elevated" instead of aborting. Tests: 180 -> 218. One test was removed; its assertions moved into runstate::probe. * refactor(core): derive PAC and the core-mode mirror from Run State Running Mode had twelve write sites, PAC availability ten, and the frontend mode mirror seven — all three kept in step by convention, each pairing written out by hand next to the others. Nothing checked the pairing, so a new call site could set a mode and leave PAC serving a script for a proxy port nothing was listening on. Callers now state what happened rather than what to store: core_started(Sidecar|Service) the Core is running and serving core_stopped() the Core is not running core_starting() a start attempt is under way PAC availability and the mode mirror are derived from those transitions inside the store and nowhere else, so they cannot drift. set_mode is private; after_core_process is deleted along with all seven of its calls. Ordering is fail-closed in both directions: PAC closes before the mode changes and opens after it, so a reader that catches a transition mid-flight is refused rather than handed a stale script. core_starting exists for exactly that window during a handover, where the Core being replaced is still the one that holds the mode. Both effects sit behind RunStateEnv, so FakeEnv records them instead of touching process globals, and the derivation is asserted directly. RealEnv publishes the mirror without expect(), so a Core that stops before the app handle exists no longer risks an abort. utils::server's fail-closed test now asserts the default rather than the live flag: PAC follows the Running Mode, so any test driving a Core transition legitimately moves it. The invariant that PAC can never disagree with the mode is asserted in core::runstate instead, where the environment is a fake. Tests: 218 -> 223. * refactor(core): absorb the service wait and owner monitor into Run State Four loops asked the same question — is the Service there? — with four retry policies, and the one that mattered most was the least examined: 112 lines of owner monitor with three copy-pasted counter blocks and no tests, where a missed reset silently changes when the app tears down a working proxy. The readiness wait becomes one interface. Its two callers wanted different things from a failed wait, and the old code expressed that implicitly in whether a poll returned Ok — a poll returned Ok for a readable-but-incompatible reply, which is why one caller recorded "unavailable" and the other did not. ReadyWaitError now says which happened: silence is the caller's to interpret, a rejected reply already recorded its own verdict and must not be flattened into a vaguer one. Retrying is likewise only for silence; twenty retries of a known-bad version would just delay telling the user to reinstall. The owner monitor's decision moves to core::runstate::owner as a state machine over samples. A transport error, an error code and an empty payload were three near-identical blocks; they are one Unreadable sample now, because they mean the same thing: we learned nothing. The two counters are separate and independent — silence says nothing about the Core's PID — and VerifyTransport keeps the rule that a Service we cannot reach while the Core still answers is a broken status channel, not a lost Core. 15 tests, where there were none. Privileged operations run through the environment, so the state around them is testable: a refused uninstall leaves the Service untrusted rather than absent, and a refused install does not claim it is gone. That also retires PrivilegedServiceAction, which duplicated PendingAction — apply_service_status now reads back the one mapping set_status already performed instead of re-deriving it. Fixes a test-isolation regression from the first stage: moving Running Mode out of CoreManager's per-instance State made three tests share one process-wide mode, which flaked once during this work. CoreManager now holds a reference to its Run State, so a test can supervise a Core without racing every other test. Tests: 223 -> 241, verified stable over repeated runs. * test(frontend): wire vitest and revive the orphaned proxy-view tests There was no frontend test runner, and tests/proxy-view.test.mjs — 421 lines covering the proxy view's identity and rebinding rules — was referenced by no script and no workflow. Unsurprisingly it had rotted: three of its ten tests called functions that no longer exist. vitest runs it now, and CI runs vitest. The file keeps node:assert/strict so every surviving assertion means exactly what it did before; only the harness import changed. Of the three broken tests, one was salvageable: rebindNode is still live and the deleted toNodeBinding was just { name, source }, so inlining it restores the test unchanged. The other two covered findGroup and selectRuntimeStandaloneNodes, which are gone; they are deleted rather than guessed at. If the behaviour they described still exists under another name, it is currently uncovered. The revived file is deliberately *not* type-checked. It was written as untyped .mjs — widened literals, runtime asserts that do not narrow — and retyping it would mean rewriting assertions I am trying to preserve. It is registered with ESLint's default project instead. New tests belong under src/**/*.test.ts, which tsconfig already covers, so they get full type checking from the start; untyped tests are how this one rotted. Only vitest is added. Testing-library comes with the first hook test that needs it, so knip does not flag an unused dependency in between. * refactor(core): one Run State snapshot across the IPC seam Three commands described one fact — running mode, service install state, elevation — under three query keys with three refresh intervals, and the frontend kept them coherent by writing two caches by hand after every service action. get_runtime_state replaces all of it with one snapshot under one key. The snapshot carries the derived answers, not just the fields: tunCapable, serviceUsable and serviceNeedsAttention are computed in Rust and travel with it. That is the point — "TUN can work" had three definitions across the tray, the startup path and a React hook, and the migration dialog decoded an enum ladder to decide whether to open. Transitions are pushed. Every Run State change emits verge://run-state-changed carrying the new snapshot, which the frontend writes straight into the cache instead of refetching. Polling drops from 2s-during-startup to a 30s safety net, and the startup grace period goes away: the service reports 'unknown' until it has actually been probed, so the guard no longer has to wait out a fixed 10s to know whether to trust the answer. ServiceInstallState is deleted along with the lossy install_state() narrowing that motivated splitting observation from intent in the first place. So is the isAdmin wrapper — elevation is part of the snapshot now. app_core_mode is deliberately kept: it is not a redundant mirror, it feeds export_diagnostic_info's "Running Mode" line. The publish effect now carries the whole snapshot and updates both it and the frontend, so the two cannot disagree. Rust tests 241 -> 249, covering the derived answers and that every change — health, pending action, mode, and both edges of an in-flight operation — is announced exactly once. * refactor(core): decide TUN availability where the knowledge is Turning TUN off when it stops being possible was a React effect: six conditions, a ten-second startup grace period, a one-second cooldown ref and a triple-negative predicate, guarding a write to the user's config file — and none of it covered by a test, because until now the frontend had no way to run one. The grace period and the cooldown were both approximations of things the backend actually knows. "Has the service been probed yet" is now ServiceHealth::Unknown rather than a ten-second guess, and "is a disable already being written" is a flag rather than a timer. RunState::tun_should_be_disabled is the decision and is pure, so the cases that must *not* trigger a write are pinned: an unprobed service, an operation in flight, and a decision still sitting in front of the user all mean not-yet-known. Writing the config is a separate concern in feat::tun, because Run State owns state and not actions. Behaviour is unchanged from the user's side: TUN is still switched off in verge.yaml, with the same two notices, which now travel over the existing notice channel as tun_mode::auto_disabled. Worth knowing for review: this puts a config write on the Run State transition path, and patch_verge's bitflag mapping has no tests of its own. The write is guarded against the cascade it can trigger — patching the config produces further transitions, each of which reconciles again — and is spawned so a transition never waits on it. One of the new tests caught a wrong assertion I had written: a ready service mid-operation looked like "cannot work" but is really "not yet known". That is the exact class of bug the fixed grace period was papering over. Rust tests 249 -> 256. * refactor(config): name the two questions asked of the Mixed Port Six call sites hand-copied "the user's selection, else the Merge Config" and the frontend hand-copied a different chain that prefers what the Core reports. Reading them as one duplicated rule is what made this look like a straightforward dedup; they are actually two questions. What have we configured? — needed by anything that writes config or decides what to start, and answerable before the Core exists. What is the Core serving on? — needed by anything pointing a client at the proxy, because a startup fallback or a hand-edited Core config moves the port. MixedPort::desired and MixedPort::effective say which is which, and each call site now picks one on purpose. Two defects fall out of naming them. feat::proxy built the proxy command the user pastes into a shell from verge-or-a-hardcoded-7897, ignoring the Merge Config entirely — it wanted effective(). And the six chains split three-to-three between reading the committed and the draft config layer, with feat::clash reading one of each, so mid-edit they disagreed; there is one layer now. effective() costs a round-trip, so it is used where a user triggered the work, not on paths served per request. PAC stays on desired(): it answers per browser request, and it is closed while the Core is between ports anyway. Each site says which it chose and why. The reserved-ports list in the startup fallback was a second hardcoded listener table. It is derived from the first now, filtered to exclude the Mixed Port itself — which is not a duplicate but a deliberate omission, so it is stated as one rather than left implicit in a literal. On the frontend the same four-source merge was computed twice, once in a hook and once inline in the provider. The provider was mounting two queries solely to recompute what the hook already had; both are gone. Rust tests 256 -> 262. * refactor(config): make a config change roll back by itself Editing configuration meant pairing every edit_draft with an apply or a discard on every exit path, by hand, across three independently committed layers. The startup port fallback wrote the same three-line rollback five times, save_proxy_ports called its rollback helper from eight branches, and apply_config's nested match tree had six discards and three applies. Nothing checked the pairing: a new early return that forgot one left the app describing a configuration it was not in. DraftTransaction commits a set of layers together and rolls them back when dropped, so an early return — a ?, a bail!, a panic — cannot leave a change half-applied. Committing is the explicit act, deliberately: forgetting to commit costs a retry, forgetting to roll back corrupts state. The three call sites lose their hand-written rollback and gain ordinary control flow. apply_config stops touching drafts entirely; whether the staged Runtime Config survives now follows from whether applying it worked, which is the caller's transaction to decide, and its nested matches flatten out. Two rollbacks stay explicit and are commented as to why. Files on disk and a restarted core are not part of the transaction, so those paths still restore snapshots themselves; and rollback_proxy_ports has to clear the drafts *before* it regenerates files from the committed config, which is earlier than drop would. Draft discards drop from 14 sites to 8, applies from 18 to 15. The crate gains 4 tests, including that an early return rolls back without the caller saying so. * refactor(proxy): state the delay sentinel rules once A delay from the core is not just a latency: -2 means a test is running, other negatives mean never tested, zero and anything past the timeout mean it timed out, and absurd values mean error. Every surface agreed on those rules and restated them, and the two sort comparators had already drifted — a non-numeric delay sorted among the timeouts in the proxy list and after the sentinels in the home card. classifyDelay and compareByDelay say it once, with tests, including the case the two copies disagreed on. The trap the ranks exist for is worth naming: zero encodes a timeout, so sorting delays as plain numbers puts the nodes that failed at the top of a fastest-first list. Deliberately not unified: how a *measured* delay is graded. A three-colour chip and a four-bar signal icon draw different distinctions, and collapsing 400/250 into 500/300/200 would be inventing a UI decision rather than removing a duplicated one. Those thresholds stay where they are, next to a comment saying they are a presentation choice. The report that prompted this called them "4 incompatible threshold sets"; on reading them, the sentinel half was duplication and the grading half was not. ProxySortType was declared twice; it is imported now. Frontend tests 8 -> 21. * refactor(enhance): make the app's authoritative fields one value The pipeline derives fields the app owns — ports, the external controller, the tray-driven mode — then lets the user's merge and script overrides run, then puts its own values back. That ordering is a correctness requirement: capture must follow the app's own stages and precede every override, restore must follow all of them. It was four separate calls held together by four comments. AuthoritativeFields captures and restores as one value, so the restore cannot be forgotten, reordered ahead of the overrides, or applied to a config the snapshot did not come from. Five tests state what it is for, including the two cases that are easy to get backwards: an override must not re-add a field the app deliberately left out, and reinstating dns.ipv6 must not conjure a dns block an override removed. merge_default_config now takes enable_external_controller instead of reading it out of the global config from inside its loop. A stage that looks like a function of its arguments and is not is worse than one that admits it, and this is the change that makes it testable at all. Not done here: reshaping the sixteen steps into a stage list. The value in this pipeline is the nine steps with no tests, not the shape of the function that calls them, and the two contracts above were the parts that could silently break. Rust tests 262 -> 267. * refactor(proxy): make the proxy page's outcome a closed set resolveProxyEmptyState returned `reason | 'loading' | null`, which lied twice: 'loading' is not a reason and ProxyEmptyState cannot render it, and `null` meant either "there is content" or "this is direct mode" — so the caller decided direct mode a second time, before even asking. resolveProxyListState returns one closed set of outcomes and the caller switches on it. Ten tests pin the ordering that was previously implicit, including that anything still loading outranks every verdict about emptiness, and that global mode asks about GLOBAL rather than groups. Known gap, left alone deliberately. In chain mode the model asks whether any Selector or URLTest group exists, while the renderer builds its list from selectRuleChainMembers or selectGlobalChainNodes — unrelated questions, and both a false "empty" and a false "not empty" are reachable. Fixing it means the model needs the selected group and the runtime proxies, which is the fold of emptiness into use-render-list that this candidate was really about; guessing at it from outside would add a third derivation rather than remove the second. Frontend tests 21 -> 30. * refactor(events): one subscription with one teardown Four places listened for backend events, three idioms between them, and four separate implementations of the same cleanup. One of them — app-data-provider — pushed each unlisten onto its cleanup list only after awaiting registration, with no disposed flag, so a subscription that resolved after unmount was never torn down. That is now handled in one place, because registration being asynchronous is a property of the mechanism rather than of any call site. Event names were string literals on both sides of the IPC seam, so a rename was a silent no-op. The frontend now declares each name once with its payload type, which does not make Rust check itself but does replace a per-call-site `listen<T>` guess with one place to look. use-layout-events loses about fifty lines that were registration plumbing rather than behaviour, and profiles.tsx loses a Promise.allSettled that existed to collect unlisteners. Left alone: window events — onResized, onFocusChanged, WINDOW_CLOSE_REQUESTED. They come from Tauri's window API rather than the app's own bus, and folding them in would widen the registry to things it does not name. * fix(ui): stop AppDataProvider consuming its own context The provider rendered nothing and threw "useClashConfigData must be used within AppDataProvider": a previous commit replaced its inline mixed-port merge with useDisplayedMixedPort, and that hook reads the ClashConfig context which this component is the one providing. The provider resolves the port from its own sources again. The two computations are not the duplicate they looked like — one runs inside the provider and one outside it, and a hook that reads the provider's context cannot run in both places. They share resolveDisplayedMixedPort, which is the part that was ever worth sharing; a comment now says why the hook is not used here. Nothing else in the provider consumed its own context: it imports the Context objects rather than the reader hooks, and useClashInfo and useRuntimeConfig are plain queries. * fix(core): repair regressions found by review An independent review of this branch found several defects, two of them introduced here and reachable on a normal first run. Startup could silently turn TUN off. Service health is observed as NotInstalled before the startup path decides whether to install the service, and the TUN reconciler ran against that captured snapshot — so it wrote enable_tun_mode: false to the user's config, and because prepare_startup reads that same setting, the install prompt that would have fixed the situation never appeared either. The deleted frontend guard covered this with a ten-second grace period; nothing replaced it. The reconciler now re-reads the current Run State instead of taking a snapshot, and refuses to act at all while the Core is not running, because until then no decision has been made to act on. It also overrode a decision that had already been taken. Falling back to Sidecar calls suppress_tun_for_session, which is deliberately not persistent — disable_tun_and_persist exists as the separate explicit act. The reconciler now honours the session suppression rather than escalating it to a config write. Reconciliation was additionally skipped whenever the app handle did not exist yet, because it was spawned after that early return; it is spawned before it now, which is safe since it no longer depends on the snapshot. apply_service_status wrote the requested action into the store and read it back to decide what to run. A concurrent observation clears the pending action, which would have turned a user-authorised install into a silent no-op. It derives the action from its own argument again, as the code it replaced did. save_proxy_ports opened its transaction before its first fallible read, so that early return discarded drafts staged by other code that this function never touched. It also left rollback to drop, which runs after the recovery paths that regenerate files from committed config — and a second time after those paths had already discarded. The transaction now opens after the read and is rolled back explicitly where recovery needs it to have happened already; the same ordering fix applies to the startup port fallback. DraftTransaction gained a consuming rollback for this. Two pre-existing defects the review surfaced are fixed here because this branch's code depends on them. patch_verge's `?` returned past its own `if let Err(..) { discard() }`, which the compiler could never reach, so a failed patch left the edit in the draft — and the TUN reconciler would then read that draft, believe TUN was already off, and never retry. settled() built its Notified future but never registered it before checking the flag, so an operation finishing in that window was a wakeup lost for good; the waiter would then block until some unrelated later operation, or forever. Deferred with reasons: cancellation-safety of the config futures (no cancellation site demonstrated), enter_mode's PAC/mode atomicity (pre-existing, narrow), and the draft-vs-committed reads behind MixedPort::desired (the PAC window is now closed by core_starting at staging time). Rust tests 267 -> 268. * docs(core): inline the boundary rationale into the code The comments pointed at a glossary and an ADR for why Run State owns state but not Core lifecycle. The reason is short enough to say in place, and a reason that travels with the code it constrains is worth more than a pointer to a file a reader has to go and find. * test(ui): mount AppDataProvider so a context misuse fails loudly A provider that reads a context it supplies throws during render and blanks the whole UI. That shipped: AppDataProvider called useDisplayedMixedPort, which reads ClashConfigContext. typecheck, lint, knip and web:build all passed with it present, and so did an independent three-reviewer code review — the frontend reviewer returned nothing on it. Only rendering can see it. The test stubs `invoke` and `listen` and nothing above them. Everything the provider mounts — the SWR queries, the config hooks, the event subscription, the mihomo plugin — goes through those two, so all the real application code still runs. Stubbing the hooks instead would have produced a test that could not catch what this exists to catch. Verified by reintroducing the bug: both cases fail with the production error, "useClashConfigData must be used within AppDataProvider". A smoke test that passes either way is worth nothing, so this one was checked against the defect rather than only against a working tree. Render tests opt into jsdom per file, so the DOM cost is paid only where it buys something; the rest of the suite stays on node. The libraries land in this commit rather than ahead of it, because knip fails on a dependency nothing uses yet. Frontend tests 30 -> 32. * refactor(proxy): let the list say whether it is empty The empty-state model predicted "is there anything to render" beside the renderer instead of asking it. In chain mode the two asked different questions: the model looked for any Selector or URLTest group, while the list is built from selectRuleChainMembers or selectGlobalChainNodes. Both a false "empty" and a false "not empty" were reachable — GLOBAL with standalone nodes but no Selector group showed nodes while the page said no-proxy-info, and Selector groups with no global and no standalone nodes said content over an empty list. Emptiness is now an observation. hasRenderableItems reads the list that is about to be drawn, and the two list components render the empty state themselves when it comes back with nothing. resolveProxyListState keeps only what is knowable without building a list — direct mode, still loading, and having no usable subscription — which drops proxyView and isChainMode from its input and leaves it with one job. Two details worth stating rather than leaving to be rediscovered. A group header counts as content only when the group is visible, matching what the old predicate meant by "some group is not hidden". Rows inside a hidden but expanded group now count, where the old predicate called the page empty; the user can see those rows, so claiming otherwise was a lie. Frontend tests 32 -> 38, including the chain case that was wrong in both directions. * test(enhance): cover the config transforms that had none Seven of the pipeline's steps had zero references from any test. Four of them are pure functions of their arguments and are now covered; the other three are not, and the difference is the point. use_tun, ensure_fake_ip_range6, use_sort and merge_default_config decide what ends up in the file the core reads, and each has behaviour that is easy to get backwards and impossible to notice: - a disabled listener has its port *removed*, not merely skipped, so the profile's own value cannot open a listener the user switched off - a disabled external controller is blanked rather than deleted, because an absent key lets mihomo fall back to its default and listen anyway - an empty fake-ip-range6 counts as missing, since YAML edited by hand leaves the key present with nothing after the colon - a deliberate redir-host DNS setup is left alone; only fake-ip is ours - turning TUN off does not rewrite DNS, only the system resolver - sorting drops nothing, and is stable when applied twice get_config_values and collect_profile_items are left uncovered on purpose: their whole job is reading global config, so a test would assert that a mock returns what the mock was given. apply_dns_settings and apply_builtin_scripts read the filesystem and run JS respectively; covering those means giving them a seam, which is a change to the code rather than a test of it. Rust tests 268 -> 289. * refactor(proxy): re-sort when a delay test settles Sorting a group by delay read the delay store inside a memo that had no dependency on it, so the order only refreshed when something else forced a recompute. Both places that sort by delay had their own way of forcing it, and both hooked only the "test all" path: retesting a single proxy updated that row's own number and left it sitting in the wrong place. The fix is a subscription, but the granularity is the whole design. The store already coalesces notifications onto an animation frame, so the cost was never the render count — announcing per result would re-sort continuously while a batch is still running, with rows moving out from under the pointer. So the group listener now means "a test settled": once per single test, once per batch however many proxies it covered. Measured against the code before this, a 20-proxy batch would have announced 21 times. That granularity is the thing that normally cannot be asserted, because its symptom is jumpy scrolling rather than a wrong value. Moving the trigger into the store turns it into a number a test can count, and the batch test was checked against the defect: with per-result announcements restored it fails with 21 where it expects 1. The hooks hand over a snapshot rather than a revision counter. A counter has to be listed as a dependency the memo never reads, and exhaustive-deps is right to reject that — the code this replaces satisfied the rule with a `refreshTick >= 0 ? … : 0` ternary whose only purpose was to make the counter look used. A snapshot makes sorting a pure function of a value it is handed. Both invalidation hacks and that ternary are gone. Group listeners are a set now, each with its own unsubscribe. They were one-per-group, so two views watching the same group would have silently replaced each other. Frontend tests 38 -> 43. * fix(proxy): repair the delay reactivity found by review A review of the previous commit found four defects, two of them worse than the code they replaced. The snapshot hook returned a new object on nearly every render. Its state started keyed to a null group, and in the home card the group name resolves after the first render, so the derived branch was taken until some test settled — which, with auto-testing off, is never. The sort memo therefore re-ran on every render and handed a new array downstream. The counter it replaced was at least stable. Both hooks also read during render while the store notifies from an animation frame, so a settle landing between render and the passive effect that subscribes was dropped with nothing to re-trigger it. Both are now built on useSyncExternalStore, which is the mechanism for exactly this and fixes the identity churn at the same time: the store hands out a per-group handle whose identity changes only on settle. A single test could announce while a batch was still running. The per-row delay button and "test all" hold separate locks, so a user can start one inside the other, and sorting from a half-measured group is precisely the reordering this design exists to prevent. Batches are now counted per group and a settle inside one is suppressed until it exits — in a finally, so a throw cannot leave the group unannounced with its proxies pinned at "testing" and nothing later to repair the order. One settle also invalidated every group's cached order, because all groups shared a single token. Each group carries its own handle now, so a test in one group no longer makes its neighbours re-sort. Both new behaviours were checked against their absence: removing the batch counter fails the coordination test, and the earlier granularity test still fails with 21 where it expects 1. The review's other three findings are left alone with reasons — TTL expiry mutating during a read is pre-existing and needs 30 idle minutes, NUL cannot appear in a group name from mihomo's config, and the batch-count assertion already rules out mid-flight fires because a 500ms floor per proxy prevents them collapsing into one frame. Frontend tests 43 -> 45. * feat(core): reload the core in place when switching profiles in Service mode Switching a profile in Service mode stopped and restarted the core, roughly 1.2s of dropped traffic every time. This is pre-existing, from #7569 rather than from this branch: before it, apply_config had no Service branch at all. Two independent reasons, both now addressed. The service protocol had no verb for "change the configuration" other than stop plus start, so a companion change adds `/clash/stage-runtime`. And config reaches the core differently in the two modes — in Sidecar the core reads the app's own directory, in Service it reads a directory the service materialised, with the provider paths rewritten to match. That asymmetry, not session ownership, is why the else-branch could never simply be shared. apply_config now has one shape for both modes: put the configuration where the core can read it, ask the core to reload, replace the core if that did not work. Only the first step differs. Service mode asks the service to stage the runtime in place and, if it did, points the core at the service's copy over the mihomo IPC the app already has open — the app has always been able to command the core in Service mode; only materialising the config needed the service. Every way of not staging leads back to exactly what happened before: a service too old to stage, a service that declined, a request that never came back, or a reload the core refused. `plan_config_application` is the whole of that decision and is a pure function of the attempt, so all four are unit tests rather than things you can only observe against a live service. Verified against the defects they target: treating a refusal as reloadable, and dropping the provider url during collection, both make them fail. The capability is learned once when the core starts and is held with the owner session rather than cached globally. It describes the service instance that owns this core, which is the only scope where acting on it is safe — a service upgraded underneath a running core does not silently gain abilities the core it owns was not started under. A failed protocol query reads as "no", because the only cost is the fast path. `collect_runtime_bundle` now also declares remote providers. It is not an optimisation: the core will not re-fetch a provider whose file already exists, so a download cache left from a different url keeps being served after the switch. The service can only tell a reusable cache from a stale one if the bundle says which url produced it. Not done, and it gates pushing: the dependency pin still names v2.5.3, because v2.6.0 does not exist yet. `^2.5.3` admits 2.6.0 and a local `[patch]` in ~/.cargo/config.toml supplies it, so this builds and tests here but not anywhere else. Cargo.lock is deliberately not in this commit — it currently records a filesystem path. Both need a follow-up once the service-ipc branch is pushed. Nothing here has been run in the real app. The fast path has been exercised against a real service and a real child process in the companion repository's integration tests, and mihomo's reload behaviour was measured directly before any of it was designed, but a `pnpm dev` profile switch in Service mode has not happened. * fix(core): keep a working core when the service refuses the bundle Follow-up to the review of the staging change, on the app side. Every service answer was funnelled into the same fallback. A service that looked at the bundle and refused it — an asset that is gone, a destination it will not accept, a session we no longer own — is telling us something deterministic: the fresh start that follows materialises the same bundle and fails the same way, so stopping the running core adds an outage to a failure that has already happened. `StageAttempt` now distinguishes a refusal from silence, and a refusal leaves the core running and reports why. Silence still replaces the core, because not hearing back says nothing about whether starting would work. This was not a regression — before staging existed the core was stopped in these cases too — but the information to do better only exists now, and throwing it away was the wrong default. `collect_provider_assets` decided a provider was remote by whether it carried a `url`. The core decides by `type`, so the two disagreed: a `file` provider with a stray `url` was treated as remote, its local file left uncopied, and the core could then not find what the rewritten path pointed at. It now reads `type`, and a `http` provider without a usable url is an error rather than a silent reclassification. Remote destinations now claim their slot in the same set local ones do. A path claimed by both a file the service copies and a file the core downloads is refused here rather than reaching the service, which refuses it as well — the copy would otherwise win and both records would match from then on, pinning the wrong content for the life of the generation. Verified by reintroducing each defect: treating a refusal as a restart, and losing the provider url during collection, both make their tests fail. * fix(core): only treat a bundle refusal as a reason not to restart Verification found the previous commit had over-applied its own idea, and the mistake mattered. It routed *every* non-zero service response to "leave the core running and report the error", on the premise that a fresh start would be refused the same way. That premise holds only for refusals about the bundle. `StageRuntime` also answers with a code for a protocol mismatch, a malformed request, an unauthorised owner, and a stale owner session — and for a stale session the premise is exactly backwards: `start_clash` proposes a new session rather than presenting the old one, so starting is how that gets resolved. Worse, the restart path is what notices ownership was lost: `stop_core_by_service` clears the proxy and PAC and marks the core stopped when the session is stale, and skipping it left that undone until the owner monitor came round two seconds later. Only `InvalidRuntimeAsset` and `InvalidInstallLocation` now leave the core alone; everything else replaces it, as before. `collect_provider_assets` was refusing two providers that name the same file *and* the same url. The service folds that — it is one file with two names for it, not a conflict — and mihomo accepts such a config; measured, not assumed. Since this function is also where a Service-mode *start* gets its bundle, the refusal stopped the core coming up at all. It now compares urls and refuses only genuine disagreement. Deciding remote by `type == "http"` was right, but failing the whole bundle when that classification does not fit was not. Measured against mihomo v1.19.26: it accepts a `http` provider with no url, an `inline` provider carrying both a url and a path that does not exist, and a `file` provider whose path is missing. Each of those had become "this configuration cannot be applied at all", where before it merely behaved oddly. A provider that cannot be classified now keeps the path the core was given, is not declared to the service, and is logged. Each correction has a test, and the error-code split is pinned by one that walks the codes rather than trusting a message. * build(deps): resolve the service protocol crate from its pushed branch The staging work needed protocol revision 2, which did not exist anywhere yet, so the last three commits built against a local checkout supplied by an untracked `[patch]` and deliberately left `Cargo.lock` out. That branch is pushed now, so the pin names it and the lock records the commit rather than a path on one machine — this tree builds for anyone again. Still a branch and not a tag: the protocol has only been exercised by the service's own tests and by this client compiling against it, never by the two running together. Moving to v2.6.0 is worth doing once it has. * build(deps): take the kode-bridge listener-mode fix Only reaches this repository through the service protocol crate, but the lock is where the commit is recorded, so it has to move here too. kode-bridge applied a listener's permission mode as a bind-time option on every unix except macOS, where the umask filters it — a service asking for 0o666 got 0o644 or 0o600 depending on the host. That is why the service published a control socket on Linux that no unprivileged client could open. * build(deps): advance the service protocol pin to the branch head The lock still named the commit the branch had when it was first pinned, five commits ago; two of those are the Windows CI fixes. Nothing in them changes what this repository compiles — the parts they touch are behind the `test` feature, which this dependency does not enable — but a lock that names a commit the branch has moved past means the next person to rebuild gets something different from what was tested here. Only the commit changes. `cargo update -p clash_verge_service_ipc` also rewrites twelve unrelated crates from `windows-sys 0.61.2` down to 0.60.2 and 0.52.0, which has nothing to do with this pin and is not wanted; `cargo check --locked` confirms the 0.61.2 resolution is still valid, so the downgrade is the resolver's preference rather than a requirement. * fix(ci): unblock Windows Rust checks	2026-07-27 00:44:53 -07:00
Tunglies	fa27d3eae5	Revert "feat(cvd): add device-bound subscription protocol" ... This reverts commit 2cb9c13ab6.	2026-06-02 21:02:19 +08:00
wonfen	2cb9c13ab6	feat(cvd): add device-bound subscription protocol	2026-06-02 13:43:54 +08:00
Tunglies	dc094033b8	Revert "refactor: remove subscription TLS roots fallback" ... This reverts commit 746279fa03.	2026-05-28 02:42:13 +08:00
Tunglies	746279fa03	refactor: remove subscription TLS roots fallback	2026-05-26 00:23:55 +08:00
Tunglies	e2d14a5ea7	fix: support empty basic auth passwords	2026-05-25 23:12:44 +08:00
Tunglies	ec9ef0f85e	fix: report legacy TLS subscription failures	2026-05-25 22:22:24 +08:00
wonfen	2056930f9f	fix: preserve reqwest error chain for TLS fallback detection	2026-05-01 20:49:34 +08:00
wonfen	33d7988ac9	feat: retry subscription downloads with webpki roots on TLS failures	2026-04-27 08:43:30 +08:00
git-sac	7b7dc79c74	fix: decode percent-encoded username/password before building Basic Auth header (#6716) ... URLs with percent-encoded characters in credentials (e.g. %40 for @) were being double-encoded after Url::parse() + as_str() serialization, causing the constructed Basic Auth header to contain the wrong credentials and resulting in 401 Unauthorized errors.	2026-04-03 11:29:38 +00:00
Tunglies	9e4e0c81a4	refactor: clean up and improve code structure (#6010)	2026-01-04 19:21:45 +08:00
Tunglies	2ca8e6716d	style: adjust rustfmt max_width to 120	2025-12-06 10:31:31 +08:00
Tunglies	a611f7d8a7	fix: switch reqwest client to use rustls-tls for improved security #5559	2025-12-01 22:22:26 +08:00
wonfen	c4e558d377	refactor: replace isahc with reqwest (#5463)	2025-11-14 23:10:56 +08:00
Tunglies	f3a3d0e8b0	refactor: update update_icon method to require a non-optional verge reference and adjust related calls (#5417)	2025-11-12 07:36:24 +08:00
Tunglies	5a8e83cd49	refactor: change function definitions to const for improved performance and clarity	2025-11-06 10:47:25 +08:00
Tunglies	651513c826	refactor: optimize error message handling and improve cloning in various functions	2025-11-06 10:26:40 +08:00
Tunglies	69a706b438	refactor: streamline error handling and resource management in various modules	2025-11-06 10:19:06 +08:00
Tunglies	2287ea5f0b	Refactor configuration access to use latest_arc() instead of latest_ref() ... - Updated multiple instances in the codebase to replace calls to latest_ref() with latest_arc() for improved performance and memory management. - This change affects various modules including validate, enhance, feat (backup, clash, config, profile, proxy, window), utils (draft, i18n, init, network, resolve, server). - Ensured that all references to configuration data are now using the new arc-based approach to enhance concurrency and reduce cloning overhead. refactor: update imports to explicitly include ClashInfo and Config in command files	2025-11-04 06:06:20 +08:00
Tunglies	34cac0fa3a	feat: improve subscription update method and enhance error handling for profile updates	2025-11-02 22:41:51 +08:00
Tunglies	a05ea64bcd	perf: utilize smartstring for string handling (#5149) ... * perf: utilize smartstring for string handling - Updated various modules to replace standard String with smartstring::alias::String for improved performance and memory efficiency. - Adjusted string manipulations and conversions throughout the codebase to ensure compatibility with the new smartstring type. - Enhanced readability and maintainability by using `.into()` for conversions where applicable. - Ensured that all instances of string handling in configuration, logging, and network management leverage the benefits of smartstring. * fix: replace wrap_err with stringify_err for better error handling in UWP tool invocation * refactor: update import path for StringifyErr and adjust string handling in sysopt * fix: correct import path for CmdResult in UWP module * fix: update argument type for execute_sysproxy_command to use std::string::String * fix: add missing CmdResult import in UWP platform module * fix: improve string handling and error messaging across multiple files * style: format code for improved readability and consistency across multiple files * fix: remove unused file	2025-10-22 16:25:44 +08:00
Tunglies	e6b7d512fb	feat: implement draft management system for concurrent editing and committing of data	2025-10-15 08:32:52 +08:00
Tunglies	251678493c	edition 2024 (#4702) ... * feat: update Cargo.toml for 2024 edition and optimize release profiles * feat: refactor environment variable settings for Linux and improve code organization * Refactor conditional statements to use `&&` for improved readability - Updated multiple files to combine nested `if let` statements using `&&` for better clarity and conciseness. - This change enhances the readability of the code by reducing indentation levels and making the conditions more straightforward. - Affected files include: media_unlock_checker.rs, profile.rs, clash.rs, profiles.rs, async_proxy_query.rs, core.rs, handle.rs, hotkey.rs, service.rs, timer.rs, tray/mod.rs, merge.rs, seq.rs, config.rs, proxy.rs, window.rs, general.rs, dirs.rs, i18n.rs, init.rs, network.rs, and window.rs in the resolve module. * refactor: streamline conditional checks using `&&` for improved readability * fix: update release profile settings for panic behavior and optimization * fix: adjust optimization level in Cargo.toml and reorder imports in lightweight.rs	2025-09-10 09:49:06 +08:00
Tunglies	55b95a1985	Revert "feat: update Cargo.toml for 2024 edition and optimize release profiles (#4681)" ... This reverts commit 31e3104c7f.	2025-09-08 21:48:09 +08:00
Tunglies	31e3104c7f	feat: update Cargo.toml for 2024 edition and optimize release profiles (#4681) ... * feat: update Cargo.toml for 2024 edition and optimize release profiles * feat: refactor environment variable settings for Linux and improve code organization * Refactor conditional statements to use `&&` for improved readability - Updated multiple files to combine nested `if let` statements using `&&` for better clarity and conciseness. - This change enhances the readability of the code by reducing indentation levels and making the conditions more straightforward. - Affected files include: media_unlock_checker.rs, profile.rs, clash.rs, profiles.rs, async_proxy_query.rs, core.rs, handle.rs, hotkey.rs, service.rs, timer.rs, tray/mod.rs, merge.rs, seq.rs, config.rs, proxy.rs, window.rs, general.rs, dirs.rs, i18n.rs, init.rs, network.rs, and window.rs in the resolve module. * refactor: streamline conditional checks using `&&` for improved readability	2025-09-08 13:57:32 +08:00
Tunglies	893188d693	fix: add basic authorization header support for URL parsing in NetworkManager #4618	2025-09-03 01:07:45 +08:00
Tunglies	b989aeb7b0	refactor: clean up imports and remove unused initialization in NetworkManager	2025-09-02 23:48:27 +08:00
Tunglies	89f3adcbef	fix: add redirect policy to HTTP client builder	2025-09-01 00:45:39 +08:00
Tunglies	6eecd70bd5	fix(subscription): resolve issues causing import failures in some cases #4534, #4436, #4552, #4519, #4517, #4503, #4336, #4301 (#4553) ... * fix(subscription): resolve issues causing import failures in some cases #4534, #4436, #4552, #4519, #4517, #4503, #4336, #4301 * fix(profile): update profile creation to include file data handling * fix(app): improve singleton instance exit handling * fix: remove unsued handle method	2025-08-29 17:46:46 +08:00
Tunglies	355a18e5eb	refactor(async): migrate from sync-blocking async execution to true async with unified AsyncHandler::spawn (#4502) ... * feat: replace all tokio::spawn with unified AsyncHandler::spawn - 🚀 Core Improvements: * Replace all tokio::spawn calls with AsyncHandler::spawn for unified Tauri async task management * Prioritize converting sync functions to async functions to reduce spawn usage * Use .await directly in async contexts instead of spawn - 🔧 Major Changes: * core/hotkey.rs: Use AsyncHandler::spawn for hotkey callback functions * module/lightweight.rs: Async lightweight mode switching * feat/window.rs: Convert window operation functions to async, use .await internally * feat/proxy.rs, feat/clash.rs: Async proxy and mode switching functions * lib.rs: Window focus handling with AsyncHandler::spawn * core/tray/mod.rs: Complete async tray event handling - ✨ Technical Advantages: * Unified task tracking and debugging capabilities (via tokio-trace feature) * Better error handling and task management * Consistency with Tauri runtime * Reduced async boundaries for better performance - 🧪 Verification: * Compilation successful with 0 errors, 0 warnings * Maintains complete original functionality * Optimized async execution flow * feat: complete tokio fs migration and replace tokio::spawn with AsyncHandler 🚀 Major achievements: - Migrate 8 core modules from std::fs to tokio::fs - Create 6 Send-safe wrapper functions using spawn_blocking pattern - Replace all tokio::spawn calls with AsyncHandler::spawn for unified async task management - Solve all 19 Send trait compilation errors through innovative spawn_blocking architecture 🔧 Core changes: - config/profiles.rs: Add profiles_*_safe functions to handle Send trait constraints - cmd/profile.rs: Update all Tauri commands to use Send-safe operations - config/prfitem.rs: Replace append_item calls with profiles_append_item_safe - utils/help.rs: Convert YAML operations to async (read_yaml, save_yaml) - Multiple modules: Replace tokio::task::spawn_blocking with AsyncHandler::spawn_blocking ✅ Technical innovations: - spawn_blocking wrapper pattern resolves parking_lot RwLock Send trait conflicts - Maintain parking_lot performance while achieving Tauri async command compatibility - Preserve backwards compatibility with gradual migration strategy 🎯 Results: - Zero compilation errors - Zero warnings - All async file operations working correctly - Complete Send trait compliance for Tauri commands * feat: refactor app handle and command functions to use async/await for improved performance * feat: update async handling in profiles and logging functions for improved error handling and performance * fix: update TRACE_MINI_SIZE constant to improve task logging threshold * fix(windows): convert service management functions to async for improved performance * fix: convert service management functions to async for improved responsiveness * fix(ubuntu): convert install and reinstall service functions to async for improved performance * fix(linux): convert uninstall_service function to async for improved performance * fix: convert uninstall_service call to async for improved performance * fix: convert file and directory creation calls to async for improved performance * fix: convert hotkey functions to async for improved responsiveness * chore: update UPDATELOG.md for v2.4.1 with major improvements and performance optimizations	2025-08-26 01:49:51 +08:00
Tunglies	e4c243de2d	refactor: Replace tokio::spawn with AsyncHandler::spawn for better task management ... - Replace direct tokio::spawn calls with AsyncHandler::spawn across multiple modules - Improves task lifecycle management and error handling consistency - Affected files: - src-tauri/src/cmd/network.rs - src-tauri/src/core/core.rs - src-tauri/src/core/event_driven_proxy.rs - src-tauri/src/enhance/tun.rs - src-tauri/src/ipc/logs.rs - src-tauri/src/ipc/memory.rs - src-tauri/src/ipc/monitor.rs - src-tauri/src/ipc/traffic.rs - src-tauri/src/utils/network.rs - src-tauri/src/utils/resolve.rs This change provides better control over async task spawning and helps prevent potential issues with unmanaged background tasks.	2025-08-22 03:41:14 +08:00
Tunglies	537d27d10b	fix: clippy errors with new config (#4428) ... * refactor: improve code quality with clippy fixes and standardized logging - Replace dangerous unwrap()/expect() calls with proper error handling - Standardize logging from log:: to logging\! macro with Type:: classifications - Fix app handle panics with graceful fallback patterns - Improve error resilience across 35+ modules without breaking functionality - Reduce clippy warnings from 300+ to 0 in main library code * chore: update Cargo.toml configuration * refactor: resolve all clippy warnings - Fix Arc clone warnings using explicit Arc::clone syntax across 9 files - Add #[allow(clippy::expect_used)] to test functions for appropriate expect usage - Remove no-effect statements from debug code cleanup - Apply clippy auto-fixes for dbg\! macro removals and path statements - Achieve zero clippy warnings on all targets with -D warnings flag * chore: update Cargo.toml clippy configuration * refactor: simplify macOS job configuration and improve caching * refactor: remove unnecessary async/await from service and proxy functions * refactor: streamline pnpm installation in CI configuration * refactor: simplify error handling and remove unnecessary else statements * refactor: replace async/await with synchronous locks for core management * refactor: add workflow_dispatch trigger to clippy job * refactor: convert async functions to synchronous for service management * refactor: convert async functions to synchronous for UWP tool invocation * fix: change wrong logging * refactor: convert proxy restoration functions to async * Revert "refactor: convert proxy restoration functions to async" This reverts commit b82f5d250b. * refactor: update proxy restoration functions to return Result types * fix: handle errors during proxy restoration and update async function signatures * fix: handle errors during proxy restoration and update async function signatures * refactor: update restore_pac_proxy and restore_sys_proxy functions to async * fix: convert restore_pac_proxy and restore_sys_proxy functions to async * fix: await restore_sys_proxy calls in proxy restoration logic * fix: suppress clippy warnings for unused async functions in proxy restoration * fix: suppress clippy warnings for unused async functions in proxy restoration	2025-08-18 02:02:25 +08:00
Tunglies	3eb2a5b3ef	refactor: optimize timer and network management with atomic operations	2025-08-01 23:02:11 +08:00
Tunglies	b1e2940db6	refactor: optimize singleton macro usage with Default trait implementations (#4279) ... * refactor: implement DRY principle improvements across backend Major DRY violations identified and addressed: 1. **IPC Stream Monitor Pattern**: - Created `utils/ipc_monitor.rs` with generic `IpcStreamMonitor` trait - Added `IpcMonitorManager` for common async task management patterns - Eliminates duplication across traffic.rs, memory.rs, and logs.rs 2. **Singleton Pattern Duplication**: - Created `utils/singleton.rs` with `singleton\!` and `singleton_with_logging\!` macros - Replaces 16+ duplicate singleton implementations across codebase - Provides consistent, tested patterns for global instances 3. **macOS Activation Policy Refactoring**: - Consolidated 3 duplicate methods into single parameterized `set_activation_policy()` - Eliminated code duplication while maintaining backward compatibility - Reduced maintenance burden for macOS-specific functionality These improvements enhance maintainability, reduce bug potential, and ensure consistent patterns across the backend codebase. * fix: resolve test failures and clippy warnings - Fix doctest in singleton.rs by using rust,ignore syntax and proper code examples - Remove unused time::Instant import from ipc_monitor.rs - Add #[allow(dead_code)] attributes to future-use utility modules - All 11 unit tests now pass successfully - All clippy checks pass with -D warnings strict mode - Documentation tests properly ignore example code that requires full context * refactor: migrate code to use new utility tools (partial) Progress on systematic migration to use created utility tools: 1. **Reorganized IPC Monitor**: - Moved ipc_monitor.rs to src-tauri/src/ipc/monitor.rs for better organization - Updated module structure to emphasize IPC relationship 2. **IpcManager Singleton Migration**: - Replaced manual OnceLock singleton pattern with singleton_with_logging\! macro - Simplified initialization code and added consistent logging - Removed unused imports (OnceLock, logging::Type) 3. **ProxyRequestCache Singleton Migration**: - Migrated from once_cell::sync::OnceCell to singleton\! macro - Cleaner, more maintainable singleton pattern - Consistent with project-wide singleton approach These migrations demonstrate the utility and effectiveness of the created tools: - Less boilerplate code - Consistent patterns across codebase - Easier maintenance and debugging * feat: complete migration to new utility tools - phase 1 Successfully migrated core components to use the created utility tools: - Moved `ipc_monitor.rs` to `src-tauri/src/ipc/monitor.rs` - Better organization emphasizing IPC relationship - Updated module exports and imports - **IpcManager**: Migrated to `singleton_with_logging\!` macro - **ProxyRequestCache**: Migrated to `singleton\!` macro - Eliminated ~30 lines of boilerplate singleton code - Consistent logging and initialization patterns - Removed unused imports (OnceLock, once_cell, logging::Type) - Cleaner, more maintainable code structure - All 11 unit tests pass successfully - Zero compilation warnings - **Lines of code reduced**: ~50+ lines of boilerplate - **Consistency improved**: Unified singleton patterns - **Maintainability enhanced**: Centralized utility functions - **Test coverage maintained**: 100% test pass rate Remaining complex monitors (traffic, memory, logs) will be migrated to use the shared IPC monitoring patterns in the next phase, which requires careful refactoring of their streaming logic. * refactor: complete singleton pattern migration to utility macros Migrate remaining singleton patterns across the backend to use standardized utility macros, achieving significant code reduction and consistency improvements. - **LogsMonitor** (ipc/logs.rs): `OnceLock` → `singleton_with_logging\!` - **Sysopt** (core/sysopt.rs): `OnceCell` → `singleton_lazy\!` - **Tray** (core/tray/mod.rs): Complex `OnceCell` → `singleton_lazy\!` - **Handle** (core/handle.rs): `OnceCell` → `singleton\!` - **CoreManager** (core/core.rs): `OnceCell` → `singleton_lazy\!` - **TrafficMonitor** (ipc/traffic.rs): `OnceLock` → `singleton_lazy_with_logging\!` - **MemoryMonitor** (ipc/memory.rs): `OnceLock` → `singleton_lazy_with_logging\!` - `singleton_lazy\!` - For complex initialization patterns - `singleton_lazy_with_logging\!` - For complex initialization with logging - **Code Reduction**: -33 lines of boilerplate singleton code - **DRY Compliance**: Eliminated duplicate initialization patterns - **Consistency**: Unified singleton approach across codebase - **Maintainability**: Centralized singleton logic in utility macros - **Zero Breaking Changes**: All existing APIs remain compatible All tests pass and clippy warnings resolved. * refactor: optimize singleton macros using Default trait implementation Simplify singleton macro usage by implementing Default trait for complex initialization patterns, significantly improving code readability and maintainability. - **MemoryMonitor**: Move IPC client initialization to Default impl - **TrafficMonitor**: Move IPC client initialization to Default impl - **Sysopt**: Move Arc<Mutex> initialization to Default impl - **Tray**: Move struct field initialization to Default impl - **CoreManager**: Move Arc<Mutex> initialization to Default impl ```rust singleton_lazy_with_logging\!(MemoryMonitor, INSTANCE, "MemoryMonitor", || { let ipc_path_buf = ipc_path().unwrap(); let ipc_path = ipc_path_buf.to_str().unwrap_or_default(); let client = IpcStreamClient::new(ipc_path).unwrap(); MemoryMonitor::new(client) }); ``` ```rust impl Default for MemoryMonitor { /* initialization logic */ } singleton_lazy_with_logging\!(MemoryMonitor, INSTANCE, "MemoryMonitor", MemoryMonitor::default); ``` - **Code Reduction**: -17 lines of macro closure code (80%+ simplification) - **Separation of Concerns**: Initialization logic moved to proper Default impl - **Readability**: Single-line macro calls vs multi-line closures - **Testability**: Default implementations can be tested independently - **Rust Idioms**: Using standard Default trait pattern - **Performance**: Function calls more efficient than closures All tests pass and clippy warnings resolved. * refactor: implement MonitorData and StreamingParser traits for IPC monitors * refactor: add timeout and retry_interval fields to IpcStreamMonitor; update TrafficMonitorState to derive Default * refactor: migrate AppHandleManager to unified singleton control - Replace manual singleton implementation with singleton_with_logging\! macro - Remove std::sync::Once dependency in favor of OnceLock-based pattern - Improve error handling for macOS activation policy methods - Maintain thread safety with parking_lot::Mutex for AppHandle storage - Add proper initialization check to prevent duplicate handle assignment - Enhance logging consistency across AppHandleManager operations * refactor: improve hotkey management with enum-based operations - Add HotkeyFunction enum for type-safe function selection - Add SystemHotkey enum for predefined system shortcuts - Implement Display and FromStr traits for type conversions - Replace string-based hotkey registration with enum methods - Add register_system_hotkey() and unregister_system_hotkey() methods - Maintain backward compatibility with string-based register() method - Migrate singleton pattern to use singleton_with_logging\! macro - Extract hotkey function execution logic into centralized execute_function() - Update lib.rs to use new enum-based SystemHotkey operations - Improve type safety and reduce string manipulation errors Benefits: - Type safety prevents invalid hotkey function names - Centralized function execution reduces code duplication - Enum-based API provides better IDE autocomplete support - Maintains full backward compatibility with existing configurations * fix: resolve LightWeightState initialization order panic - Modify with_lightweight_status() to safely handle unmanaged state using try_state() - Return Option<R> instead of R to gracefully handle state unavailability - Update is_in_lightweight_mode() to use unwrap_or(false) for safe defaults - Add state availability check in auto_lightweight_mode_init() before access - Maintain singleton check priority while preventing early state access panics - Fix clippy warnings for redundant pattern matching Resolves runtime panic: "state() called before manage() for LightWeightState" * refactor: add unreachable patterns for non-macOS in hotkey handling * refactor: simplify SystemHotkey enum by removing redundant cfg attributes * refactor: add macOS conditional compilation for system hotkey registration methods * refactor: streamline hotkey unregistration and error logging for macOS	2025-07-31 14:35:13 +08:00
Tunglies	ac3afe4dee	fix: manage setup Mutex crash (#3995) ... * Revert "Revert "refactor: Replace std::sync::Mutex with parking_lot::Mutex for improved performance and consistency in multiple files" (#3990)" This reverts commit 667844aa12. * refactor: Manage lightweight state in the app setup and clean up unused proxy client code * refactor: Move macOS-specific Manager import under conditional compilation	2025-07-06 02:14:48 +08:00
Dyna	667844aa12	Revert "refactor: Replace std::sync::Mutex with parking_lot::Mutex for improved performance and consistency in multiple files" (#3990)	2025-07-05 12:17:02 +08:00
Tunglies	6d192233d1	refactor: Replace std::sync::Mutex with parking_lot::Mutex for improved performance and consistency in multiple files	2025-07-05 00:33:53 +08:00
Tunglies	764ef48fd1	refactor(Draft): Replace latest() with latest_ref() and data() with data_mut() in multiple files for improved mutability handling and consistency across the codebase (#3987) ... * feat: add benchmarking for draft operations and new draft management structure * Refactor Config Access: Replace `latest()` with `latest_ref()` and `data()` with `data_mut()` in multiple files for improved mutability handling and consistency across the codebase. * refactor: remove DraftNew implementation and related benchmarks for cleaner codebase	2025-07-04 22:43:23 +08:00
Tunglies	a574ced428	Refactor logging statements to use the new formatting syntax for improved readability and consistency across the codebase. This includes updating error, warning, and info logs in various modules such as system commands, configuration, core functionalities, and utilities. Additionally, minor adjustments were made to string formatting in backup and proxy features to enhance clarity.	2025-06-27 23:30:59 +08:00
Tunglies	53a46d0dc6	refactor: simplify proxy type handling and improve error handling in network commands	2025-05-16 00:09:47 +08:00
wonfen	95231e7cd3	fix: http request error	2025-05-12 22:10:46 +08:00
Tunglies	5b6c9be99f	feat: better service status and TUN mode usable checks in Setting Page	2025-05-12 19:04:21 +08:00
wonfen	8cae9d4e0a	refactor: use async approach to restructure UI startup logic and resolve various freeze issues during launch	2025-05-10 01:26:03 +08:00
wonfen	779291151e	fix: network request failure termination logic and add connection pool optimization	2025-05-04 10:14:52 +08:00
wonfen	3983762202	feat: add more network control methods	2025-05-03 23:17:51 +08:00
wonfen	73b9a71c84	feat: add retry mechanism to optimize network requests, improve async message handling and timeout for scheduled tasks	2025-05-03 09:38:25 +08:00
wonfen	32b6821b8a	feat: add network manager to optimize network request handling	2025-04-30 21:30:28 +08:00