The journal cannot tell an upgrade's prerm removal from an explicit
uninstall, nor restore the previous enablement, so it must not trigger
an automatic reinstall. Upgrades from packages whose prerm removes the
Service are left unrecovered.
Refs #8515
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reinstall a Service removed by a previous prerm only when the old prerm
uninstalls unconditionally, this dpkg run completed a stop job for it,
and its group comes from that same invocation's stdout journal entries.
Hand the evidence to the postinst through a single-use file tied to the
old version and cleared by every preinst.
Refs #8515
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reinstall an existing Service while keeping its enabled, runtime-masked
and active state. Detect, from the journal, a running Service removed by
a previous deb prerm and reinstall it with its recorded group. Package
script output never reaches the app, so leave a /run marker that makes
the app offer a reinstall once when the Service is not ready.
Hold the core lifecycle until the package manager exits, even after the
startup install times out, so no core start overlaps the Service
reinstall; restart the app once a late install succeeds.
Refs #8515
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The deb postinst and rpm %post now reinstall the Service in place when an
upgrade finds its systemd unit, reusing the unit's group so package-manager
runs without a sudo/pkexec user keep the same IPC access. First installs and
disabled, masked, or group-less units are left alone; failures warn and exit
0 because neither dpkg nor rpm can restore the previous Service from a failed
postinst.
The in-app updater stops a Service-run core before installing on Linux and
restarts it if the install fails, so the post-update restart does not fail on
the session lost when the Service restarts.
Refs #8515
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
delete_profile already forces a Core update with the planned profiles when
the current or last profile is removed, and restores state on rejection,
so the frontend enhance_profiles call repeated the same reload.
Assign Copilot once per eligible Renovate PR when current-head lint or
type checks fail. Reuse repository guidance and COPILOT_GITHUB_TOKEN.
Analyze minor dependency version sets separately, deduplicate dispatches,
and publish adoption suggestions without changing code or merge state.
Quote plain hex short-id values before YAML parsing, since a value like 1234e123 becomes a float that cannot be restored. Keep the rewrite only when nothing else changes, and let the editor save check a quoted copy.
- Drop tauri-plugin-process: no frontend or Rust consumer; exit and
restart already go through the exit_app/restart_app commands backed
by AppHandle::exit/restart. Remove the registration and the unused
process:allow-exit capability.
- Replace the glob dev dependency with Node's built-in fs.globSync in
prebuild's service permission step (Node baseline is 26.13.0).
- Remove unused direct Cargo declarations: bitflags and regex (source
and workspace entries), and src-tauri's criterion dev-dependency;
clash-verge-draft keeps criterion for its bench.
- Narrow sysinfo to the network/system features actually consumed.
- Use futures::StreamExt for DelayQueue in the timer and drop the
tokio-stream direct declaration (still transitively present via
clash-verge-service-ipc).
Refresh the tray menu, icon, and tooltip after service operations so restored TUN capability is reflected without changing the saved TUN setting.
Ref: e60285b4ae
* docs(agents): add frontend liveness constraints
Add six liveness rules to the frontend guardrails covering dead state,
unused exposed surface, unreachable fallback paths, duplicate side
effects per interaction, unreachable mounts and unbounded resource
lifecycles. These target defect classes that the existing CI gates
(knip, eslint, arch:check) cannot detect mechanically.
* refactor(frontend): remove dead states, refs and unreachable branches
Drop state that can only hold its initial value (profiles page disabled
flag, traffic graph currentFPS), a write-only window controls ref with
its unconsumed imperative handle, a no-op appendData ref method, an
unreachable gradient branch, an invisible fadeIn shell, constant-true
subexpressions in the system info card, an empty click handler and a
pointless useMemo.
* refactor(frontend): drop unused params, props and api surface
Remove the never-read _revalidate argument of mutateVerge and its 16
call-site placeholders, seven never-passed props of the split chip
editor, the unconsumed refreshDecorated context member, the now-orphaned
toggleFullscreen control, the unused translate argument of the notice
message handler, the reserved-but-unset ServiceConfig.timeout field and
unreachable branches in parseNoticeExtras.
* refactor(types): remove dead provider view types superseded by bindings
Drop the handwritten IProxyProviderItem and IRuleProviderItem
interfaces: IProxyProviderItem is a stale duplicate of the generated
ProxyProviderView contract, and neither has any references left in
the tree.
Keep IProxyItem and IProxyGroupItem: IConfigData still declares
'proxy-groups'?: IProxyGroupItem[], which builds on IProxyItem.
* fix(rules): refresh once per visibility trigger
The mount effect fired refreshRules and refreshRuleProviders
unconditionally and again under the page-visible flag, double-firing
both queries on mount and on every hide-to-show transition. Gate the
refresh on visibility once so each trigger performs exactly one
revalidation.
* fix(setting): write auto launch patch once per toggle
GuardState applies the optimistic onChange write before onGuard runs,
so repeating the same onChangeData patch inside the guard handler
duplicated every cache write and subscriber notification for the auto
launch switch.
* fix(setting): build viewer form defaults from a single source
sysproxy, misc and tunnels viewers duplicated their form default
literals in useState and open(), and the two copies in misc-viewer had
already diverged (app log max size, app log max count, auto log clean).
Extract a buildInitialValues factory per viewer and unify on the open()
values, which are the only ones users could ever see.
* fix(setting): mount only reachable proxy control viewers
ProxyControlSwitches unconditionally mounted both SysproxyViewer and
TunViewer while its switch rows are mutually exclusive, so every
instance carried a dialog that could never open, each firing
getEmbeddedServerPort or a clash query subscription on mount. Mount
each viewer under the same condition as the switch row that opens it.
SettingSystem also mounted its own SysproxyViewer and TunViewer whose
refs were never opened there; the reachable entries are the
ProxyControlSwitches rows, so the dead pair is removed. Viewer mounts
across the app drop from eight (setting-system: two own + two per
instance, proxy-tun-card: two) to three (one per rendered switch
variant).
* fix(delay): write pending state once per node in batch checks
checkListDelay pre-marked every node as checking, help() re-marked it
when picked up and measureDelay marked it a third time on entry, so
each batch run queued three identical pending updates per node. Keep
the pre-mark (immediate feedback for queued nodes) and drop the
redundant marks along the chain.
* fix(services): make retries viable and align polling freshness window
Share no abort signal across retry attempts: after a timeout abort the
old signal stays dead and every later fetch rejects immediately, so
retries only burned backoff time. Also drop the system state query's
staleTime: the wrapper maps it to SWR's dedupingInterval, which
swallowed every other 3s poll tick while it exceeded the interval.
* refactor(traffic): drop unreachable inline monitor fallback
The inline traffic monitor duplicated the worker's message loop,
snapshot throttling and aging logic but only runs when Worker is
undefined or its constructor throws, which no supported Tauri webview
or browser hits. Keep the worker as the single implementation and
remove the mode switch and the pending-message queue that could only
ever buffer the init message.
* refactor(shared): replace the traffic error boundary with ErrorBoundary
TrafficErrorBoundary maintained a second boundary system beside
BaseErrorBoundary: a report builder that only console.logged constants
in the Tauri webview, an onError that re-logged what componentDidCatch
already logged, and a fallback wrapper with a single consumer. Fold
both mount points into react-error-boundary (the primitive behind
BaseErrorBoundary) with local fallbacks that keep the panel styling,
message text and retry reset, log each error once, and drop the retry
attempt cap and the stack-details collapse along with it.
* refactor(hooks): drop the write-only error channel and key-rotating refresh
The mihomo ws subscription's next callback accepted an error half that
baseNext silently discarded while traffic, memory and log consumers
kept constructing fallback payloads for it. Refresh minted a fresh
SWR key per call via a localStorage timestamp, abandoning old keys in
the cache forever. Reduce next to its data half and reset the snapshot
under a stable key instead.
* refactor(hooks): trim dead surface from proxy selection
Drop the connection-cleanup option nobody ever disabled (behavior now
unconditional), the returned changeProxy no consumer called and the two
one-caller argument adapters; both call sites use the shared select
entry directly.
* refactor(services): drop the bespoke retry engine from the query wrapper
The custom onErrorRetry existed only to honor a function-form
retryDelay, which exactly one caller (the app data provider) used for
exponential backoff. Fall back to SWR's built-in error retry and
express that caller's cadence with constant options.
* fix(backup): serialize restore with config write lock
Acquire the configuration write lock at the entry of
finalize_restored_verge_config so the clash, profiles and verge draft
applies all happen under it, instead of only the verge layer. A
concurrent patch (patch_clash / patch_verge via try_lock_config_write)
could otherwise stage a draft that the unlocked restore applies
overwrite, or interleave its persistence with the restore.
Also drop the pointless clones in the clash and profiles edit_draft
closures; edit_draft takes FnOnce so the restored values can be moved
in. The lock is released before patch_verge, which re-acquires it via
try_lock_config_write.
* perf(backup): extract archive off the runtime
Run File::open, ZipArchive::new and the extraction of the backup
archive inside spawn_blocking. Extracting a multi-file backup blocked
a tokio worker for hundreds of milliseconds to seconds while the
runtime kept serving other work on the remaining workers.
Move the PROFILE_WRITE_LOCK acquisition after the extraction, right
before finalize_restored_verge_config: the lock protects the
config-data transition (extracted files reloaded into drafts), not the
plain filesystem writes, so profile operations no longer queue behind
the blocking unzip.
* fix(clash): take config write lock when changing mode
change_clash_mode committed the clash draft and saved config.yaml without
claiming CONFIG_WRITE_LOCK, so a concurrent patch_clash transaction could
have its staged draft committed here or its file-snapshot rollback swallow
the mode change. Take lock_config_write (waiting) rather than
try_lock_config_write: two of the three callers (hotkey, tray) discard the
result, so fail-fast would silently drop the switch, and the lock is only
attempted after the mihomo patch already applied, where an Err would roll
the frontend back while the core runs the new mode.
