chore(deps): update cargo dependencies

.github/workflows/contract-parity.yml

@@ -1,80 +0,0 @@
-name: Contract Parity
-
-on:
-  pull_request:
-    paths:
-      - "src-tauri/**/*.rs"
-      - "crates/**/*.rs"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "src-tauri/Cargo.toml"
-      - "crates/**/Cargo.toml"
-      - "rust-toolchain.toml"
-      - "src-tauri/tauri.conf*.json"
-      - "src/services/bindings.ts"
-      - "scripts/gen-contract.mjs"
-      - "scripts/check-contract-changes.mjs"
-      - "biome.json"
-      - "biome.jsonc"
-      - "package.json"
-      - "pnpm-lock.yaml"
-      - "pnpm-workspace.yaml"
-      - "scripts/contract-inputs.json"
-      - ".github/workflows/contract-parity.yml"
-      - ".husky/pre-push"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  HUSKY: 0
-
-jobs:
-  contract-parity:
-    runs-on: ubuntu-26.04
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Install Rust Stable
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: stable
-
-      - name: Rust Cache
-        uses: Swatinem/rust-cache@v2
-        with:
-          prefix-key: 'v1-rust'
-          key: 'rust-shared-stable-ubuntu-22.04-x86_64-unknown-linux-gnu-contract'
-          workspaces: |
-            . -> target
-          cache-all-crates: true
-          cache-workspace-crates: true
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libxslt1.1 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v6
-        with:
-          run_install: false
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: '24.22.1'
-          cache: 'pnpm'
-
-      - run: pnpm install --frozen-lockfile
-
-      - name: Provision sidecar placeholders for tauri-build
-        run: |
-          mkdir -p src-tauri/sidecar src-tauri/resources dist
-          touch dist/index.html
-          for bin in clash-verge-service clash-verge-service-install clash-verge-service-uninstall verge-mihomo verge-mihomo-alpha; do
-            touch "src-tauri/sidecar/${bin}-x86_64-unknown-linux-gnu"
-          done
-
-      - name: Check generated contract without changing the checkout
-        run: pnpm gen:contract --check

.github/workflows/frontend-check.yml

@@ -2,23 +2,11 @@ name: Frontend Check
 
 on:
   pull_request:
-    paths:
-      - "src/**"
-      - "**/*.js"
-      - "**/*.ts"
-      - "**/*.tsx"
-      - "**/*.css"
-      - "**/*.scss"
-      - "**/*.json"
-      - "**/*.md"
-      - "pnpm-lock.yaml"
-      - "pnpm-workspace.yaml"
-      - "vite.config.*"
-      - ".github/workflows/frontend-check.yml"
   workflow_dispatch:
 
 permissions:
   contents: read
+  pull-requests: read
 
 env:
   HUSKY: 0
@@ -29,17 +17,46 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Check frontend changes
+        id: check_frontend
+        uses: dorny/paths-filter@v4
+        with:
+          filters: |
+            frontend:
+              - 'src/**'
+              - '**/*.js'
+              - '**/*.ts'
+              - '**/*.tsx'
+              - '**/*.css'
+              - '**/*.scss'
+              - '**/*.json'
+              - '**/*.md'
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
+              - 'knip.json'
+              - 'eslint.config.ts'
+              - 'tsconfig.json'
+              - 'vite.config.*'
+
+      - name: Skip if no frontend changes
+        if: steps.check_frontend.outputs.frontend != 'true'
+        run: echo "No frontend changes, skipping frontend checks."
+
       - name: Install pnpm
+        if: steps.check_frontend.outputs.frontend == 'true'
         uses: pnpm/action-setup@v6
         with:
           run_install: false
 
       - uses: actions/setup-node@v7
+        if: steps.check_frontend.outputs.frontend == 'true'
         with:
           node-version: '24.22.1'
           cache: 'pnpm'
 
       - name: Restore pnpm cache
+        if: steps.check_frontend.outputs.frontend == 'true'
         uses: actions/cache@v6
         with:
           path: ~/.pnpm-store
@@ -48,21 +65,94 @@ jobs:
             pnpm-shared-stable-${{ runner.os }}-
 
       - run: pnpm install --frozen-lockfile
+        if: steps.check_frontend.outputs.frontend == 'true'
 
       - name: Run Prettier check
+        if: steps.check_frontend.outputs.frontend == 'true'
         run: pnpm format:check
 
       - name: Run ESLint
+        if: steps.check_frontend.outputs.frontend == 'true'
         run: pnpm lint
 
       - name: Run TypeScript typecheck
+        if: steps.check_frontend.outputs.frontend == 'true'
         run: pnpm typecheck
 
       - name: Run tests
+        if: steps.check_frontend.outputs.frontend == 'true'
         run: pnpm test
 
       - name: Run Knip
+        if: steps.check_frontend.outputs.frontend == 'true'
         run: pnpm knip:check
 
       - name: Architecture gates (listen/emit only in the event bus, invoke only in services)
+        if: steps.check_frontend.outputs.frontend == 'true'
         run: node scripts/check-architecture.mjs listen emit invoke
+
+  contract-parity:
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Check contract inputs
+        id: check_inputs
+        uses: dorny/paths-filter@v4
+        with:
+          filters: scripts/contract-inputs.json
+
+      - name: Skip if contract inputs unchanged
+        if: steps.check_inputs.outputs.contract != 'true'
+        run: echo "No contract inputs changed, skipping parity check."
+
+      - name: Install Rust Stable
+        if: steps.check_inputs.outputs.contract == 'true'
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+
+      - name: Rust Cache
+        if: steps.check_inputs.outputs.contract == 'true'
+        uses: Swatinem/rust-cache@v2
+        with:
+          prefix-key: 'v1-rust'
+          key: 'rust-shared-stable-ubuntu-22.04-x86_64-unknown-linux-gnu-contract'
+          workspaces: |
+            . -> target
+          cache-all-crates: true
+          cache-workspace-crates: true
+
+      - name: Install dependencies
+        if: steps.check_inputs.outputs.contract == 'true'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libxslt1.1 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
+
+      - name: Install pnpm
+        if: steps.check_inputs.outputs.contract == 'true'
+        uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+
+      - uses: actions/setup-node@v7
+        if: steps.check_inputs.outputs.contract == 'true'
+        with:
+          node-version: '24.22.1'
+          cache: 'pnpm'
+
+      - run: pnpm install --frozen-lockfile
+        if: steps.check_inputs.outputs.contract == 'true'
+
+      - name: Provision sidecar placeholders for tauri-build
+        if: steps.check_inputs.outputs.contract == 'true'
+        run: |
+          mkdir -p src-tauri/sidecar src-tauri/resources dist
+          touch dist/index.html
+          for bin in clash-verge-service clash-verge-service-install clash-verge-service-uninstall verge-mihomo verge-mihomo-alpha; do
+            touch "src-tauri/sidecar/${bin}-x86_64-unknown-linux-gnu"
+          done
+
+      - name: Check generated contract without changing the checkout
+        if: steps.check_inputs.outputs.contract == 'true'
+        run: pnpm gen:contract --check

.github/workflows/lint-clippy.yml

@@ -2,13 +2,6 @@ name: Clippy Lint
 
 on:
   pull_request:
-    paths:
-      - "src-tauri/**"
-      - "crates/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "rust-toolchain.toml"
-      - ".github/workflows/lint-clippy.yml"
   workflow_dispatch:
 env:
   HUSKY: 0
@@ -30,6 +23,28 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
+      - name: Check src-tauri changes
+        if: github.event_name != 'workflow_dispatch'
+        id: check_changes
+        uses: dorny/paths-filter@v4
+        with:
+          filters: |
+            rust:
+              - 'src-tauri/**'
+
+      - name: Skip if src-tauri not changed
+        if: github.event_name != 'workflow_dispatch' && steps.check_changes.outputs.rust != 'true'
+        run: echo "No src-tauri changes, skipping clippy lint."
+
+      - name: Continue if src-tauri changed
+        if: github.event_name != 'workflow_dispatch' && steps.check_changes.outputs.rust == 'true'
+        run: echo "src-tauri changed, running clippy lint."
+
+      - name: Manual trigger - always run
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          echo "Manual trigger detected: skipping changes check and running clippy."
+
       - name: Checkout Repository
         uses: actions/checkout@v7
 
@@ -64,7 +79,7 @@ jobs:
         run: cargo clippy-all
 
       - name: Run Windows security tests
-        if: matrix.os == 'windows-latest'
+        if: matrix.os == 'windows-latest' && (github.event_name == 'workflow_dispatch' || steps.check_changes.outputs.rust == 'true')
         working-directory: ./src-tauri
         run: cargo test --all-features --target ${{ matrix.target }}
 

.github/workflows/rustfmt.yml

@@ -6,10 +6,6 @@ name: Check Formatting
 
 on:
   pull_request:
-    paths:
-      - "src-tauri/**"
-      - "**/*.rs"
-      - ".github/workflows/rustfmt.yml"
 
 permissions:
   contents: read
@@ -23,10 +19,25 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Check Rust changes
+        id: check_rust
+        uses: dorny/paths-filter@v4
+        with:
+          filters: |
+            rust:
+              - 'src-tauri/**'
+              - '**/*.rs'
+
+      - name: Skip if no Rust changes
+        if: steps.check_rust.outputs.rust != 'true'
+        run: echo "No Rust changes, skipping rustfmt."
+
       - name: install Rust stable and rustfmt
+        if: steps.check_rust.outputs.rust == 'true'
         uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
 
       - name: run cargo fmt
+        if: steps.check_rust.outputs.rust == 'true'
         run: cargo fmt --manifest-path ./src-tauri/Cargo.toml --all -- --check

Cargo.toml

@@ -63,11 +63,11 @@ tracing = "0.1.44"
 
 tauri = { version = "2.12.4" }
 tauri-plugin-clipboard-manager = "2.5.0"
-parking_lot = { version = "0.12.5", features = ["hardware-lock-elision"] }
+parking_lot = { version = "0.13.0", features = ["hardware-lock-elision"] }
 anyhow = "1.0.104"
 chrono = "0.4.45"
 criterion = { version = "0.8.2", features = ["async_tokio"] }
-tokio = { version = "1.53.3", features = [
+tokio = { version = "1.54.1", features = [
   "rt-multi-thread",
   "macros",
   "time",

Changelog.md

@@ -7,10 +7,6 @@
 - 修复通过 URL 导入订阅时，即使导入的订阅并非当前使用的订阅，也会重新加载当前配置
 - 修复 首页 网站测速失败后卡片一直显示测试中
 - 修复 代理 页展开分组后不显示最新测速结果，需切换节点才刷新
-- 修复 代理 在全局模式下无法展开节点组
-- 修复 自定义 CSS 无法修改编辑器字体和字号的问题
-- 修复恢复备份的同时修改配置，可能导致配置丢失或错乱的问题
-- 修复切换规则模式与配置变更并发时可能丢失或错乱的问题
 
 **🐧 Linux**
 
@@ -23,7 +19,6 @@
 
 - 新增虚拟网卡设置的「DNS 模式」选项，支持配置 mihomo 系统 DNS 行为
 - 新增「IP 信息」自动刷新开关，关闭后仍可手动刷新
-- 新增 Muse AI 解锁检测，针对 Muse AI 特有的 Cloudflare 人机验证增加「Risky」状态标记
 
 </details>
 

crates/clash-verge-media-unlock/Cargo.toml

@@ -4,7 +4,7 @@ version = "0.1.0"
 edition = "2024"
 
 [dependencies]
-specta = { version = "=2.0.0-rc.25", features = ["derive", "function"] }
+specta = { version = "=2.0.0-rc.27", features = ["derive", "function"] }
 clash-verge-logging = { workspace = true }
 chrono = { workspace = true }
 log = { workspace = true }

crates/clash-verge-media-unlock/src/lib.rs

@@ -11,7 +11,6 @@ mod chatgpt;
 mod claude;
 mod disney_plus;
 mod gemini;
-mod muse;
 mod netflix;
 mod prime_video;
 mod spotify;
@@ -31,7 +30,6 @@ enum UnlockCheck {
     ChatGptWeb,
     Claude,
     Gemini,
-    MuseAi,
     YouTubePremium,
     BahamutAnime,
     Netflix,
@@ -48,7 +46,6 @@ impl UnlockCheck {
         Self::ChatGptWeb,
         Self::Claude,
         Self::Gemini,
-        Self::MuseAi,
         Self::YouTubePremium,
         Self::BahamutAnime,
         Self::Netflix,
@@ -69,7 +66,6 @@ impl UnlockCheck {
             Self::ChatGptWeb => chatgpt::CHATGPT_WEB_NAME,
             Self::Claude => claude::CLAUDE_NAME,
             Self::Gemini => gemini::GEMINI_NAME,
-            Self::MuseAi => muse::MUSE_AI_NAME,
             Self::YouTubePremium => youtube::YOUTUBE_PREMIUM_NAME,
             Self::BahamutAnime => bahamut::BAHAMUT_ANIME_NAME,
             Self::Netflix => netflix::NETFLIX_NAME,
@@ -87,7 +83,6 @@ impl UnlockCheck {
             Self::ChatGptWeb => chatgpt::check_chatgpt(client).await,
             Self::Claude => claude::check_claude(client).await,
             Self::Gemini => gemini::check_gemini(client).await,
-            Self::MuseAi => muse::check_muse_ai(client).await,
             Self::YouTubePremium => youtube::check_youtube_premium(client).await,
             Self::BahamutAnime => bahamut::check_bahamut_anime(client).await,
             Self::Netflix => netflix::check_netflix(client).await,

crates/clash-verge-media-unlock/src/muse.rs

@@ -1,48 +0,0 @@
-use reqwest::Client;
-
-use crate::utils::{classify_restricted_status, get_trace_location};
-
-use super::UnlockItem;
-
-pub(crate) const MUSE_AI_NAME: &str = "Muse AI";
-
-const MUSE_URL: &str = "https://muse.ai";
-const CLOUDFLARE_TRACE_URL: &str = "https://www.cloudflare.com/cdn-cgi/trace";
-
-// The aymh ("Are You a Human") gateway answers plain HTTP requests with a
-// generic Meta error page that always contains the Facebook logo asset.
-const AYMH_ERROR_MARKERS: &[&str] = &["Sorry, something went wrong", "static.facebook.com/images/logos"];
-
-pub(super) async fn check_muse_ai(client: &Client) -> UnlockItem {
-    // muse.ai itself is served by Vercel, so resolve the exit region through
-    // the generic Cloudflare trace endpoint instead of a service-specific one.
-    let region = get_trace_location(client, CLOUDFLARE_TRACE_URL)
-        .await
-        .map(|code| code.trim().to_ascii_uppercase())
-        .map(|code| UnlockItem::region_label(&code));
-
-    let Ok(response) = client.get(MUSE_URL).send().await else {
-        return UnlockItem::checked(MUSE_AI_NAME, "Failed (Network Connection)", region);
-    };
-
-    let status = response.status();
-    let landed_on_aymh = response.url().host_str() == Some("auth.muse.ai");
-    let body = response.text().await.unwrap_or_default();
-
-    // Every region is redirected to the aymh anti-bot gateway before the app
-    // loads, and a non-browser HTTP client cannot finish the JavaScript
-    // challenge. It returns the Meta error page, so reaching this point only
-    // proves the exit can connect to Muse's auth infrastructure; availability
-    // cannot be verified over plain HTTP and is reported as `Risky`.
-    let behind_anti_bot = landed_on_aymh || AYMH_ERROR_MARKERS.iter().any(|marker| body.contains(marker));
-
-    let result = if behind_anti_bot {
-        "Risky"
-    } else if status.is_success() {
-        "Yes"
-    } else {
-        classify_restricted_status(status).unwrap_or("Failed")
-    };
-
-    UnlockItem::checked(MUSE_AI_NAME, result, region)
-}

crates/tauri-plugin-clash-verge-sysinfo/Cargo.toml

@@ -5,7 +5,7 @@ edition = "2024"
 rust-version = "1.91"
 
 [dependencies]
-specta = { version = "=2.0.0-rc.25", features = ["derive", "function"] }
+specta = { version = "=2.0.0-rc.27", features = ["derive", "function"] }
 tauri = { workspace = true }
 tauri-plugin-clipboard-manager = { workspace = true }
 parking_lot = { workspace = true }

package.json

@@ -14,7 +14,7 @@
     "build:fast": "cross-env NODE_OPTIONS='--max-old-space-size=4096' tauri build -- --profile fast-release",
     "tauri": "tauri",
     "web:dev": "vite",
-    "web:build": "tsrs -p . --noEmit && vite build",
+    "web:build": "tsc --noEmit && vite build",
     "web:serve": "vite preview",
     "prebuild": "node scripts/prebuild.mjs",
     "updater": "node scripts/updater.mjs",
@@ -32,7 +32,7 @@
     "i18n:types": "node scripts/generate-i18n-keys.mjs",
     "gen:contract": "node scripts/gen-contract.mjs",
     "arch:check": "node scripts/check-architecture.mjs listen emit invoke",
-    "typecheck": "tsrs -p . --noEmit",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
     "knip:check": "knip",
@@ -128,7 +128,6 @@
     "sass": "^1.104.1",
     "tar": "^7.5.22",
     "terser": "^5.51.2",
-    "tsrs": "0.20.0-ts7.1.0-beta",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.70.0",
     "vite": "^8.3.0",

pnpm-lock.yaml

@@ -416,9 +416,6 @@ importers:
       terser:
         specifier: ^5.51.2
         version: 5.51.2
-      tsrs:
-        specifier: 0.20.0-ts7.1.0-beta
-        version: 0.20.0-ts7.1.0-beta
       typescript:
         specifier: ^6.0.3
         version: 6.0.3
@@ -2221,52 +2218,6 @@ packages:
   '@tauri-apps/plugin-updater@2.14.0':
     resolution: {integrity: sha512-gdylJ9tger4hkyOn24QZd6MNOKVo2Eh53iw5th2Qj1vKTR/+u4PIwJWuiis5hohYvobn6iOvlnALfrqIPSzh7Q==}
 
-  '@tsrs/darwin-arm64@0.20.0-ts7.1.0-beta':
-    resolution: {integrity: sha512-mhHj8QGUmdJDBvJEnMXx5P/jvAKXYU3hy/z3qxrWBo8XHlbLES32PgC0ZpTRbJA960ReTpVqqvCOYaC6EL32/Q==}
-    engines: {node: '>=16.20.0'}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@tsrs/darwin-x64@0.20.0-ts7.1.0-beta':
-    resolution: {integrity: sha512-CsRUnyYRLrhmChS7ol7LgmdqMXTu+mVlDU+7JgbW8RpkJRGLZ/zgEDEOeD8qrndt8rpP9oW1T1SJ36HSzB3/sg==}
-    engines: {node: '>=16.20.0'}
-    cpu: [x64]
-    os: [darwin]
-
-  '@tsrs/linux-arm64-gnu@0.20.0-ts7.1.0-beta':
-    resolution: {integrity: sha512-VNwpdI/iICwQMMlS/MoSZCvKFByEn2+g7D0HREWG+3r3GRayXgbLv8iaNSHKT3QGcu8pXr3lH9170ghJQi2zRg==}
-    engines: {node: '>=16.20.0'}
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
-
-  '@tsrs/linux-arm64-musl@0.20.0-ts7.1.0-beta':
-    resolution: {integrity: sha512-cXnqPpmj5gzeGi4u1OV0ctd5df5t4ivwyeToCa4pBrKtjYodu0EeAo5Y76SHbJwggbiA1gzEJVj1vvuciQm5mQ==}
-    engines: {node: '>=16.20.0'}
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
-
-  '@tsrs/linux-x64-gnu@0.20.0-ts7.1.0-beta':
-    resolution: {integrity: sha512-jlhJSrO9lxNh0TF5EU1i+Frok5sRWsBvCuQhmdqMZKIN2pSHsDZl3CSmKUsJ4tNr50np9USCPpkkxwby2Eiqhg==}
-    engines: {node: '>=16.20.0'}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
-  '@tsrs/linux-x64-musl@0.20.0-ts7.1.0-beta':
-    resolution: {integrity: sha512-pestGEPplhEPzIERc7zwuQ5zhh9ZwMSvAPNQy5TM0je/QuaizmM1zKoPYJ4NiaPzLh2M25HtP4HcpumTqmF3KQ==}
-    engines: {node: '>=16.20.0'}
-    cpu: [x64]
-    os: [linux]
-    libc: [musl]
-
-  '@tsrs/win32-x64@0.20.0-ts7.1.0-beta':
-    resolution: {integrity: sha512-sstxBfhjjOSYvSHFfSmROau2oGAVNLwAnj+H0h+ywLo7N7ueFKIDk14HAkIYa/F9iVboiICCpHDY/pmBO71sSg==}
-    engines: {node: '>=16.20.0'}
-    cpu: [x64]
-    os: [win32]
-
   '@tybys/wasm-util@0.10.4':
     resolution: {integrity: sha512-W3c4gRigFS0T/Ma4qIYF3GDAc5AQdHb1yL5znJT1Zv1YaD9Kitx656wBjvr19qbiosmZT8lWDM5BEMynUqX65A==}
 
@@ -4819,11 +4770,6 @@ packages:
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
-  tsrs@0.20.0-ts7.1.0-beta:
-    resolution: {integrity: sha512-8NifAn2tcna3t/nluu1yFvp0fYE28vElDpnD4jiWik69+MDjiHgxdjH8sUYUEFmf/2hl6QIE5ExVGpJzQbBDPw==}
-    engines: {node: '>=16.20.0'}
-    hasBin: true
-
   tunnel@0.0.6:
     resolution: {integrity: sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==}
     engines: {node: '>=0.6.11 <=0.7.0 || >=0.7.3'}
@@ -6936,27 +6882,6 @@ snapshots:
     dependencies:
       '@tauri-apps/api': 2.12.4
 
-  '@tsrs/darwin-arm64@0.20.0-ts7.1.0-beta':
-    optional: true
-
-  '@tsrs/darwin-x64@0.20.0-ts7.1.0-beta':
-    optional: true
-
-  '@tsrs/linux-arm64-gnu@0.20.0-ts7.1.0-beta':
-    optional: true
-
-  '@tsrs/linux-arm64-musl@0.20.0-ts7.1.0-beta':
-    optional: true
-
-  '@tsrs/linux-x64-gnu@0.20.0-ts7.1.0-beta':
-    optional: true
-
-  '@tsrs/linux-x64-musl@0.20.0-ts7.1.0-beta':
-    optional: true
-
-  '@tsrs/win32-x64@0.20.0-ts7.1.0-beta':
-    optional: true
-
   '@tybys/wasm-util@0.10.4':
     dependencies:
       tslib: 2.8.1
@@ -7297,7 +7222,7 @@ snapshots:
 
   '@wdio/globals@9.31.3(expect-webdriverio@6.1.0)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0))':
     dependencies:
-      expect-webdriverio: 6.1.0(@wdio/globals@9.31.3)(@wdio/logger@9.29.1)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0))
+      expect-webdriverio: 6.1.0(@wdio/globals@9.31.3)(@wdio/logger@10.1.0)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0))
       webdriverio: 10.1.0(supports-color@7.2.0)(yauzl@2.10.0)
 
   '@wdio/logger@10.1.0':
@@ -8281,11 +8206,11 @@ snapshots:
 
   expect-type@1.4.0: {}
 
-  expect-webdriverio@6.1.0(@wdio/globals@9.31.3)(@wdio/logger@9.29.1)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0)):
+  expect-webdriverio@6.1.0(@wdio/globals@9.31.3)(@wdio/logger@10.1.0)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0)):
     dependencies:
       '@vitest/snapshot': 4.1.11
       '@wdio/globals': 9.31.3(expect-webdriverio@6.1.0)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0))
-      '@wdio/logger': 9.29.1
+      '@wdio/logger': 10.1.0
       deep-eql: 5.0.2
       expect: 30.5.2
       jest-matcher-utils: 30.5.2
@@ -9940,16 +9865,6 @@ snapshots:
 
   tslib@2.8.1: {}
 
-  tsrs@0.20.0-ts7.1.0-beta:
-    optionalDependencies:
-      '@tsrs/darwin-arm64': 0.20.0-ts7.1.0-beta
-      '@tsrs/darwin-x64': 0.20.0-ts7.1.0-beta
-      '@tsrs/linux-arm64-gnu': 0.20.0-ts7.1.0-beta
-      '@tsrs/linux-arm64-musl': 0.20.0-ts7.1.0-beta
-      '@tsrs/linux-x64-gnu': 0.20.0-ts7.1.0-beta
-      '@tsrs/linux-x64-musl': 0.20.0-ts7.1.0-beta
-      '@tsrs/win32-x64': 0.20.0-ts7.1.0-beta
-
   tunnel@0.0.6: {}
 
   type-check@0.4.0:

pnpm-workspace.yaml

@@ -10,11 +10,3 @@ allowBuilds:
   unrs-resolver: true
 minimumReleaseAgeExclude:
   - dayjs@1.11.21
-  - "@tsrs/darwin-arm64@0.20.0-ts7.1.0-beta"
-  - "@tsrs/darwin-x64@0.20.0-ts7.1.0-beta"
-  - "@tsrs/linux-arm64-gnu@0.20.0-ts7.1.0-beta"
-  - "@tsrs/linux-arm64-musl@0.20.0-ts7.1.0-beta"
-  - "@tsrs/linux-x64-gnu@0.20.0-ts7.1.0-beta"
-  - "@tsrs/linux-x64-musl@0.20.0-ts7.1.0-beta"
-  - "@tsrs/win32-x64@0.20.0-ts7.1.0-beta"
-  - tsrs@0.20.0-ts7.1.0-beta

renovate.json

@@ -79,13 +79,6 @@
       "matchPackageNames": ["typescript"],
       "allowedVersions": "<7.0.0 || >=7.1.0"
     },
-    {
-      "description": "Review tsrs bumps alone; the version encodes the pinned TypeScript release",
-      "matchPackageNames": ["tsrs", "/^@tsrs//"],
-      "groupName": "tsrs",
-      "rangeStrategy": "pin",
-      "automerge": false
-    },
     {
       "description": "Prevent project from supply chain attack",
       "matchDatasources": ["npm"],

scripts/contract-inputs.json

@@ -17,7 +17,7 @@
     "pnpm-lock.yaml",
     "pnpm-workspace.yaml",
     "scripts/contract-inputs.json",
-    ".github/workflows/contract-parity.yml",
+    ".github/workflows/frontend-check.yml",
     ".husky/pre-push"
   ]
 }

src-tauri/Cargo.toml

@@ -58,8 +58,8 @@ smartstring = { workspace = true, features = ["serde"] }
 bitflags = { workspace = true }
 socket2 = { workspace = true }
 warp = { version = "0.4.3", features = ["server"] }
-open = "5.4.4"
-rfd = { version = "0.16.0", default-features = false, features = ["common-controls-v6"] }
+open = "5.4.5"
+rfd = { version = "0.17.2", default-features = false, features = ["common-controls-v6"] }
 dirs = "7.0.0"
 dunce = "1.0.5"
 nanoid = "0.5"
@@ -79,7 +79,7 @@ tauri-plugin-fs = "2.7.1"
 tauri-plugin-process = "2.4.0"
 tauri-plugin-deep-link = "2.6.2"
 tauri-plugin-window-state = "2.5.0"
-zip = "9.0.4"
+zip = "9.1.2"
 flate2 = "1.1.10"
 reqwest_dav = "0.3.3"
 aes-gcm = { version = "0.11.1" }
@@ -101,16 +101,16 @@ async-trait = "0.1.92"
 clash_verge_service_ipc = { git = "https://github.com/clash-verge-rev/clash-verge-service-ipc.git", tag = "v2.7.6", version = "2.7.6", features = [
   "client",
 ] }
-arc-swap = "1.9.2"
+arc-swap = "1.9.3"
 tokio-rustls = "0.26.6"
 rustls = { version = "0.23.46", features = ["ring"] }
-webpki-roots = "1.0.9"
+webpki-roots = "1.0.11"
 dark-light = "3.0.0"
 bytes = "1.12.1"
 tokio-util = { version = "0.7.20", features = ["time"] }
-specta = { version = "=2.0.0-rc.25", features = ["derive", "function", "serde_json"] }
+specta = { version = "=2.0.0-rc.27", features = ["derive", "function", "serde_json"] }
 tauri-specta = { version = "=2.0.0-rc.25", features = ["derive", "typescript"] }
-specta-typescript = "=0.0.12"
+specta-typescript = "=0.0.14"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2.191"

src-tauri/src/config/clash.rs

@@ -184,41 +184,84 @@ impl IClashTemp {
             _ => None,
         })
     }
-    fn guard_port_value(config: &Mapping, key: &str, default: u16) -> u16 {
+    #[cfg(not(target_os = "windows"))]
+    fn guard_redir_port(config: &Mapping) -> u16 {
         let mut port = config
-            .get(key)
+            .get("redir-port")
             .and_then(|value| match value {
                 Value::String(val_str) => val_str.parse().ok(),
                 Value::Number(val_num) => val_num.as_u64().map(|u| u as u16),
                 _ => None,
             })
-            .unwrap_or(default);
+            .unwrap_or(7895);
         if port == 0 {
-            port = default;
+            port = 7895;
         }
         port
     }
 
-    #[cfg(not(target_os = "windows"))]
-    fn guard_redir_port(config: &Mapping) -> u16 {
-        Self::guard_port_value(config, "redir-port", network::ports::DEFAULT_REDIR)
-    }
-
     #[cfg(target_os = "linux")]
     fn guard_tproxy_port(config: &Mapping) -> u16 {
-        Self::guard_port_value(config, "tproxy-port", network::ports::DEFAULT_TPROXY)
+        let mut port = config
+            .get("tproxy-port")
+            .and_then(|value| match value {
+                Value::String(val_str) => val_str.parse().ok(),
+                Value::Number(val_num) => val_num.as_u64().map(|u| u as u16),
+                _ => None,
+            })
+            .unwrap_or(network::ports::DEFAULT_TPROXY);
+        if port == 0 {
+            port = network::ports::DEFAULT_TPROXY;
+        }
+        port
     }
 
     fn guard_mixed_port(config: &Mapping) -> u16 {
-        Self::guard_port_value(config, "mixed-port", network::ports::DEFAULT_MIXED)
+        let raw_value = config.get("mixed-port");
+
+        let mut port = raw_value
+            .and_then(|value| match value {
+                Value::String(val_str) => val_str.parse().ok(),
+                Value::Number(val_num) => val_num.as_u64().map(|u| u as u16),
+                _ => None,
+            })
+            .unwrap_or(network::ports::DEFAULT_MIXED);
+
+        if port == 0 {
+            port = network::ports::DEFAULT_MIXED;
+        }
+
+        port
     }
 
     fn guard_socks_port(config: &Mapping) -> u16 {
-        Self::guard_port_value(config, "socks-port", network::ports::DEFAULT_SOCKS)
+        let mut port = config
+            .get("socks-port")
+            .and_then(|value| match value {
+                Value::String(val_str) => val_str.parse().ok(),
+                Value::Number(val_num) => val_num.as_u64().map(|u| u as u16),
+                _ => None,
+            })
+            .unwrap_or(7898);
+        if port == 0 {
+            port = 7898;
+        }
+        port
     }
 
     fn guard_port(config: &Mapping) -> u16 {
-        Self::guard_port_value(config, "port", network::ports::DEFAULT_HTTP)
+        let mut port = config
+            .get("port")
+            .and_then(|value| match value {
+                Value::String(val_str) => val_str.parse().ok(),
+                Value::Number(val_num) => val_num.as_u64().map(|u| u as u16),
+                _ => None,
+            })
+            .unwrap_or(7899);
+        if port == 0 {
+            port = 7899;
+        }
+        port
     }
 
     pub(super) fn guard_server_ctrl(config: &Mapping) -> String {

src-tauri/src/config/mod.rs

@@ -14,15 +14,6 @@ mod verge;
 pub(crate) use self::config::Config;
 pub use self::{clash::*, encrypt::*, mixed_port::*, prfitem::*, profiles::*, verge::*};
 
-macro_rules! patch_opt_field {
-    ($lv:expr, $rv:expr, $key:tt) => {
-        if ($rv.$key).is_some() {
-            $lv.$key = $rv.$key.clone();
-        }
-    };
-}
-pub(crate) use patch_opt_field;
-
 pub const DEFAULT_PAC: &str = r#"function FindProxyForURL(url, host) {
   return "PROXY 127.0.0.1:%mixed-port%; SOCKS5 127.0.0.1:%mixed-port%; DIRECT;";
 }

src-tauri/src/config/prfitem.rs

@@ -1,5 +1,3 @@
-use super::patch_opt_field;
-
 use crate::{
     config::profiles,
     utils::{
@@ -133,18 +131,19 @@ impl PrfOption {
         match (one, other) {
             (Some(a_ref), Some(b_ref)) => {
                 let mut result = a_ref.clone();
-                patch_opt_field!(result, b_ref, user_agent);
-                patch_opt_field!(result, b_ref, with_proxy);
-                patch_opt_field!(result, b_ref, self_proxy);
-                patch_opt_field!(result, b_ref, danger_accept_invalid_certs);
-                patch_opt_field!(result, b_ref, allow_auto_update);
-                patch_opt_field!(result, b_ref, update_interval);
-                patch_opt_field!(result, b_ref, merge);
-                patch_opt_field!(result, b_ref, script);
-                patch_opt_field!(result, b_ref, rules);
-                patch_opt_field!(result, b_ref, proxies);
-                patch_opt_field!(result, b_ref, groups);
-                patch_opt_field!(result, b_ref, timeout_seconds);
+                result.user_agent = b_ref.user_agent.clone().or(result.user_agent);
+                result.with_proxy = b_ref.with_proxy.or(result.with_proxy);
+                result.self_proxy = b_ref.self_proxy.or(result.self_proxy);
+                result.danger_accept_invalid_certs =
+                    b_ref.danger_accept_invalid_certs.or(result.danger_accept_invalid_certs);
+                result.allow_auto_update = b_ref.allow_auto_update.or(result.allow_auto_update);
+                result.update_interval = b_ref.update_interval.or(result.update_interval);
+                result.merge = b_ref.merge.clone().or(result.merge);
+                result.script = b_ref.script.clone().or(result.script);
+                result.rules = b_ref.rules.clone().or(result.rules);
+                result.proxies = b_ref.proxies.clone().or(result.proxies);
+                result.groups = b_ref.groups.clone().or(result.groups);
+                result.timeout_seconds = b_ref.timeout_seconds.or(result.timeout_seconds);
                 Some(result)
             }
             (Some(a_ref), None) => Some(a_ref.clone()),
@@ -182,36 +181,6 @@ impl PrfItem {
         }
     }
 
-    async fn append_companion_item(item: &mut Self) -> Result<Option<String>> {
-        profiles::profiles_append_item_safe(item).await?;
-        Ok(item.uid.clone())
-    }
-
-    async fn ensure_companion_items(
-        merge: &mut Option<String>,
-        script: &mut Option<String>,
-        rules: &mut Option<String>,
-        proxies: &mut Option<String>,
-        groups: &mut Option<String>,
-    ) -> Result<()> {
-        if merge.is_none() {
-            *merge = Self::append_companion_item(&mut Self::from_merge(None)).await?;
-        }
-        if script.is_none() {
-            *script = Self::append_companion_item(&mut Self::from_script(None)).await?;
-        }
-        if rules.is_none() {
-            *rules = Self::append_companion_item(&mut Self::from_rules()).await?;
-        }
-        if proxies.is_none() {
-            *proxies = Self::append_companion_item(&mut Self::from_proxies()).await?;
-        }
-        if groups.is_none() {
-            *groups = Self::append_companion_item(&mut Self::from_groups()).await?;
-        }
-        Ok(())
-    }
-
     async fn from_local(
         name: String,
         desc: String,
@@ -228,7 +197,31 @@ impl PrfItem {
         let mut proxies = opt_ref.and_then(|o| o.proxies.clone());
         let mut groups = opt_ref.and_then(|o| o.groups.clone());
 
-        Self::ensure_companion_items(&mut merge, &mut script, &mut rules, &mut proxies, &mut groups).await?;
+        if merge.is_none() {
+            let merge_item = &mut Self::from_merge(None);
+            profiles::profiles_append_item_safe(merge_item).await?;
+            merge = merge_item.uid.clone();
+        }
+        if script.is_none() {
+            let script_item = &mut Self::from_script(None);
+            profiles::profiles_append_item_safe(script_item).await?;
+            script = script_item.uid.clone();
+        }
+        if rules.is_none() {
+            let rules_item = &mut Self::from_rules();
+            profiles::profiles_append_item_safe(rules_item).await?;
+            rules = rules_item.uid.clone();
+        }
+        if proxies.is_none() {
+            let proxies_item = &mut Self::from_proxies();
+            profiles::profiles_append_item_safe(proxies_item).await?;
+            proxies = proxies_item.uid.clone();
+        }
+        if groups.is_none() {
+            let groups_item = &mut Self::from_groups();
+            profiles::profiles_append_item_safe(groups_item).await?;
+            groups = groups_item.uid.clone();
+        }
         Ok(Self {
             uid: Some(uid),
             itype: Some("local".into()),
@@ -382,7 +375,31 @@ impl PrfItem {
             bail!("profile does not contain `proxies` or `proxy-providers`");
         }
 
-        Self::ensure_companion_items(&mut merge, &mut script, &mut rules, &mut proxies, &mut groups).await?;
+        if merge.is_none() {
+            let merge_item = &mut Self::from_merge(None);
+            profiles::profiles_append_item_safe(merge_item).await?;
+            merge = merge_item.uid.clone();
+        }
+        if script.is_none() {
+            let script_item = &mut Self::from_script(None);
+            profiles::profiles_append_item_safe(script_item).await?;
+            script = script_item.uid.clone();
+        }
+        if rules.is_none() {
+            let rules_item = &mut Self::from_rules();
+            profiles::profiles_append_item_safe(rules_item).await?;
+            rules = rules_item.uid.clone();
+        }
+        if proxies.is_none() {
+            let proxies_item = &mut Self::from_proxies();
+            profiles::profiles_append_item_safe(proxies_item).await?;
+            proxies = proxies_item.uid.clone();
+        }
+        if groups.is_none() {
+            let groups_item = &mut Self::from_groups();
+            profiles::profiles_append_item_safe(groups_item).await?;
+            groups = groups_item.uid.clone();
+        }
 
         Ok(Self {
             uid: Some(uid),
@@ -444,30 +461,46 @@ impl PrfItem {
         }
     }
 
-    fn from_seq_item(prefix: &str, itype: &str, template: &str) -> Self {
-        let uid = help::get_uid(prefix).into();
+    fn from_rules() -> Self {
+        let uid = help::get_uid("r").into();
         let file = format!("{uid}.yaml").into(); // yaml ext
 
         Self {
             uid: Some(uid),
-            itype: Some(itype.into()),
+            itype: Some("rules".into()),
             file: Some(file),
             updated: Some(chrono::Local::now().timestamp() as usize),
-            file_data: Some(template.into()),
+            file_data: Some(tmpl::ITEM_RULES.into()),
             ..Default::default()
         }
     }
 
-    fn from_rules() -> Self {
-        Self::from_seq_item("r", "rules", tmpl::ITEM_RULES)
-    }
-
     fn from_proxies() -> Self {
-        Self::from_seq_item("p", "proxies", tmpl::ITEM_PROXIES)
+        let uid = help::get_uid("p").into();
+        let file = format!("{uid}.yaml").into(); // yaml ext
+
+        Self {
+            uid: Some(uid),
+            itype: Some("proxies".into()),
+            file: Some(file),
+            updated: Some(chrono::Local::now().timestamp() as usize),
+            file_data: Some(tmpl::ITEM_PROXIES.into()),
+            ..Default::default()
+        }
     }
 
     fn from_groups() -> Self {
-        Self::from_seq_item("g", "groups", tmpl::ITEM_GROUPS)
+        let uid = help::get_uid("g").into();
+        let file = format!("{uid}.yaml").into(); // yaml ext
+
+        Self {
+            uid: Some(uid),
+            itype: Some("groups".into()),
+            file: Some(file),
+            updated: Some(chrono::Local::now().timestamp() as usize),
+            file_data: Some(tmpl::ITEM_GROUPS.into()),
+            ..Default::default()
+        }
     }
 
     pub(crate) async fn read_file(&self) -> Result<String> {
@@ -483,20 +516,26 @@ impl PrfItem {
     }
 }
 
-macro_rules! current_field {
-    ($name:ident, $field:ident) => {
-        pub(crate) fn $name(&self) -> Option<&String> {
-            self.option.as_ref().and_then(|o| o.$field.as_ref())
-        }
-    };
-}
-
 impl PrfItem {
-    current_field!(current_merge, merge);
-    current_field!(current_script, script);
-    current_field!(current_rules, rules);
-    current_field!(current_proxies, proxies);
-    current_field!(current_groups, groups);
+    pub(crate) fn current_merge(&self) -> Option<&String> {
+        self.option.as_ref().and_then(|o| o.merge.as_ref())
+    }
+
+    pub(crate) fn current_script(&self) -> Option<&String> {
+        self.option.as_ref().and_then(|o| o.script.as_ref())
+    }
+
+    pub(crate) fn current_rules(&self) -> Option<&String> {
+        self.option.as_ref().and_then(|o| o.rules.as_ref())
+    }
+
+    pub(crate) fn current_proxies(&self) -> Option<&String> {
+        self.option.as_ref().and_then(|o| o.proxies.as_ref())
+    }
+
+    pub(crate) fn current_groups(&self) -> Option<&String> {
+        self.option.as_ref().and_then(|o| o.groups.as_ref())
+    }
 }
 
 fn allow_auto_update_enabled(option: Option<&PrfOption>) -> bool {

src-tauri/src/config/profiles.rs

@@ -1,5 +1,5 @@
 use super::{
-    PrfOption, patch_opt_field,
+    PrfOption,
     prfitem::{PrfItem, PrfSelected, normalize_profile_home_url},
 };
 use crate::core::notify::{Refresh, announce};
@@ -86,6 +86,14 @@ impl ProfileDeletePlan {
     }
 }
 
+macro_rules! patch {
+    ($lv: expr, $rv: expr, $key: tt) => {
+        if ($rv.$key).is_some() {
+            $lv.$key = $rv.$key.to_owned();
+        }
+    };
+}
+
 impl IProfiles {
     fn take_item_file_by_uid(items: &mut Vec<PrfItem>, target_uid: Option<&str>) -> Option<String> {
         let index = items.iter().position(|item| item.uid.as_deref() == target_uid)?;
@@ -236,15 +244,15 @@ impl IProfiles {
 
         for each in items.iter_mut() {
             if each.uid.as_deref() == Some(uid) {
-                patch_opt_field!(each, item, itype);
-                patch_opt_field!(each, item, name);
-                patch_opt_field!(each, item, desc);
-                patch_opt_field!(each, item, file);
-                patch_opt_field!(each, item, url);
-                patch_opt_field!(each, item, selected);
-                patch_opt_field!(each, item, extra);
-                patch_opt_field!(each, item, updated);
-                patch_opt_field!(each, item, option);
+                patch!(each, item, itype);
+                patch!(each, item, name);
+                patch!(each, item, desc);
+                patch!(each, item, file);
+                patch!(each, item, url);
+                patch!(each, item, selected);
+                patch!(each, item, extra);
+                patch!(each, item, updated);
+                patch!(each, item, option);
 
                 self.items = Some(items);
                 return self.save_file().await;
@@ -412,21 +420,6 @@ pub(crate) async fn profiles_append_item_with_filedata_safe(item: &PrfItem, file
     profiles_append_item_safe(item).await
 }
 
-/// Applies `edit` to the committed profiles; commits only when the edit succeeds.
-async fn with_profiles_edit<F, Fut>(edit: F) -> Result<()>
-where
-    F: FnOnce(IProfiles) -> Fut + Send,
-    Fut: std::future::Future<Output = Result<IProfiles>> + Send,
-{
-    Config::profiles()
-        .await
-        .with_data_modify(|profiles| async move {
-            let profiles = edit(profiles).await?;
-            Ok((profiles, ()))
-        })
-        .await
-}
-
 pub(crate) async fn profiles_append_item_safe(item: &mut PrfItem) -> Result<()> {
     let profiles = Config::profiles().await;
     profiles_append_item_to_safe(&profiles, item).await
@@ -442,19 +435,43 @@ pub(super) async fn profiles_append_item_to_safe(profiles: &Draft<IProfiles>, it
 }
 
 pub(crate) async fn profiles_patch_item_safe(index: &str, item: &PrfItem) -> Result<()> {
-    with_profiles_edit(|mut profiles| async move { profiles.patch_item(index, item).await.map(|_| profiles) }).await
+    Config::profiles()
+        .await
+        .with_data_modify(|mut profiles| async move {
+            profiles.patch_item(index, item).await?;
+            Ok((profiles, ()))
+        })
+        .await
 }
 
 pub(crate) async fn profiles_reorder_safe(active_id: &str, over_id: &str) -> Result<()> {
-    with_profiles_edit(|mut profiles| async move { profiles.reorder(active_id, over_id).await.map(|_| profiles) }).await
+    Config::profiles()
+        .await
+        .with_data_modify(|mut profiles| async move {
+            profiles.reorder(active_id, over_id).await?;
+            Ok((profiles, ()))
+        })
+        .await
 }
 
 pub(crate) async fn profiles_save_file_safe() -> Result<()> {
-    with_profiles_edit(|profiles| async move { profiles.save_file().await.map(|_| profiles) }).await
+    Config::profiles()
+        .await
+        .with_data_modify(|profiles| async move {
+            profiles.save_file().await?;
+            Ok((profiles, ()))
+        })
+        .await
 }
 
 pub(crate) async fn profiles_update_item_safe(index: &str, item: &mut PrfItem) -> Result<()> {
-    with_profiles_edit(|mut profiles| async move { profiles.update_item(index, item).await.map(|_| profiles) }).await
+    Config::profiles()
+        .await
+        .with_data_modify(|mut profiles| async move {
+            profiles.update_item(index, item).await?;
+            Ok((profiles, ()))
+        })
+        .await
 }
 
 #[derive(Debug, PartialEq, Eq)]
@@ -696,21 +713,19 @@ where
     Ok(())
 }
 
-fn current_item_mut(profiles: &mut IProfiles) -> Option<&mut PrfItem> {
-    let current = profiles.current.clone()?;
-    profiles
-        .items
-        .as_mut()?
-        .iter_mut()
-        .find(|item| item.uid.as_ref() == Some(&current))
-}
-
 /// Records a backend-made selection so the next core start restores it.
 pub(crate) async fn record_selected_node(group_name: &str, node: &str) -> Result<()> {
     let group_name = String::from(group_name);
     let node = String::from(node);
     persist_selected_update(true, move |mut profiles| async move {
-        let Some(item) = current_item_mut(&mut profiles) else {
+        let Some(current) = profiles.current.clone() else {
+            return Ok((profiles, false));
+        };
+        let Some(item) = profiles
+            .items
+            .as_mut()
+            .and_then(|items| items.iter_mut().find(|item| item.uid.as_ref() == Some(&current)))
+        else {
             return Ok((profiles, false));
         };
 
@@ -745,7 +760,14 @@ fn remove_selected_node(selected: &mut Vec<PrfSelected>, group_name: &str) -> bo
 
 pub(crate) async fn forget_selected_node(group_name: &str) -> Result<()> {
     persist_selected_update(true, move |mut profiles| async move {
-        let Some(item) = current_item_mut(&mut profiles) else {
+        let Some(current) = profiles.current.clone() else {
+            return Ok((profiles, false));
+        };
+        let Some(item) = profiles
+            .items
+            .as_mut()
+            .and_then(|items| items.iter_mut().find(|item| item.uid.as_ref() == Some(&current)))
+        else {
             return Ok((profiles, false));
         };
 

src-tauri/src/config/verge.rs

@@ -1,6 +1,6 @@
 use crate::config::Config;
 use crate::{
-    config::{DEFAULT_PAC, deserialize_encrypted, patch_opt_field, serialize_encrypted},
+    config::{DEFAULT_PAC, deserialize_encrypted, serialize_encrypted},
     constants::network,
     utils::{dirs, help},
 };
@@ -432,90 +432,98 @@ impl IVerge {
 
     #[allow(clippy::cognitive_complexity)]
     pub fn patch_config(&mut self, patch: &Self) {
-        patch_opt_field!(self, patch, app_log_level);
-        patch_opt_field!(self, patch, app_log_max_size);
-        patch_opt_field!(self, patch, app_log_max_count);
+        macro_rules! patch {
+            ($key: tt) => {
+                if patch.$key.is_some() {
+                    self.$key = patch.$key.clone();
+                }
+            };
+        }
 
-        patch_opt_field!(self, patch, language);
-        patch_opt_field!(self, patch, theme_mode);
-        patch_opt_field!(self, patch, tray_event);
-        patch_opt_field!(self, patch, env_type);
-        patch_opt_field!(self, patch, start_page);
-        patch_opt_field!(self, patch, startup_script);
-        patch_opt_field!(self, patch, traffic_graph);
-        patch_opt_field!(self, patch, enable_memory_usage);
-        patch_opt_field!(self, patch, enable_group_icon);
-        patch_opt_field!(self, patch, pause_render_traffic_stats_on_blur);
+        patch!(app_log_level);
+        patch!(app_log_max_size);
+        patch!(app_log_max_count);
+
+        patch!(language);
+        patch!(theme_mode);
+        patch!(tray_event);
+        patch!(env_type);
+        patch!(start_page);
+        patch!(startup_script);
+        patch!(traffic_graph);
+        patch!(enable_memory_usage);
+        patch!(enable_group_icon);
+        patch!(pause_render_traffic_stats_on_blur);
         #[cfg(target_os = "macos")]
-        patch_opt_field!(self, patch, tray_icon);
-        patch_opt_field!(self, patch, menu_icon);
-        patch_opt_field!(self, patch, menu_order);
-        patch_opt_field!(self, patch, proxy_group_tools_position);
-        patch_opt_field!(self, patch, notice_position);
-        patch_opt_field!(self, patch, collapse_navbar);
-        patch_opt_field!(self, patch, common_tray_icon);
-        patch_opt_field!(self, patch, sysproxy_tray_icon);
-        patch_opt_field!(self, patch, tun_tray_icon);
+        patch!(tray_icon);
+        patch!(menu_icon);
+        patch!(menu_order);
+        patch!(proxy_group_tools_position);
+        patch!(notice_position);
+        patch!(collapse_navbar);
+        patch!(common_tray_icon);
+        patch!(sysproxy_tray_icon);
+        patch!(tun_tray_icon);
 
-        patch_opt_field!(self, patch, enable_tun_mode);
-        patch_opt_field!(self, patch, enable_auto_launch);
-        patch_opt_field!(self, patch, enable_silent_start);
-        patch_opt_field!(self, patch, enable_hover_jump_navigator);
-        patch_opt_field!(self, patch, hover_jump_navigator_delay);
+        patch!(enable_tun_mode);
+        patch!(enable_auto_launch);
+        patch!(enable_silent_start);
+        patch!(enable_hover_jump_navigator);
+        patch!(hover_jump_navigator_delay);
         #[cfg(not(target_os = "windows"))]
-        patch_opt_field!(self, patch, verge_redir_port);
+        patch!(verge_redir_port);
         #[cfg(not(target_os = "windows"))]
-        patch_opt_field!(self, patch, verge_redir_enabled);
+        patch!(verge_redir_enabled);
         #[cfg(target_os = "linux")]
-        patch_opt_field!(self, patch, verge_tproxy_port);
+        patch!(verge_tproxy_port);
         #[cfg(target_os = "linux")]
-        patch_opt_field!(self, patch, verge_tproxy_enabled);
-        patch_opt_field!(self, patch, verge_mixed_port);
-        patch_opt_field!(self, patch, verge_socks_port);
-        patch_opt_field!(self, patch, verge_socks_enabled);
-        patch_opt_field!(self, patch, verge_port);
-        patch_opt_field!(self, patch, verge_http_enabled);
-        patch_opt_field!(self, patch, enable_system_proxy);
-        patch_opt_field!(self, patch, enable_proxy_guard);
-        patch_opt_field!(self, patch, enable_bypass_check);
-        patch_opt_field!(self, patch, use_default_bypass);
-        patch_opt_field!(self, patch, system_proxy_bypass);
-        patch_opt_field!(self, patch, proxy_guard_duration);
-        patch_opt_field!(self, patch, proxy_auto_config);
-        patch_opt_field!(self, patch, pac_file_content);
-        patch_opt_field!(self, patch, proxy_host);
-        patch_opt_field!(self, patch, theme_setting);
-        patch_opt_field!(self, patch, web_ui_list);
-        patch_opt_field!(self, patch, clash_core);
-        patch_opt_field!(self, patch, hotkeys);
-        patch_opt_field!(self, patch, enable_global_hotkey);
+        patch!(verge_tproxy_enabled);
+        patch!(verge_mixed_port);
+        patch!(verge_socks_port);
+        patch!(verge_socks_enabled);
+        patch!(verge_port);
+        patch!(verge_http_enabled);
+        patch!(enable_system_proxy);
+        patch!(enable_proxy_guard);
+        patch!(enable_bypass_check);
+        patch!(use_default_bypass);
+        patch!(system_proxy_bypass);
+        patch!(proxy_guard_duration);
+        patch!(proxy_auto_config);
+        patch!(pac_file_content);
+        patch!(proxy_host);
+        patch!(theme_setting);
+        patch!(web_ui_list);
+        patch!(clash_core);
+        patch!(hotkeys);
+        patch!(enable_global_hotkey);
 
-        patch_opt_field!(self, patch, auto_close_connection);
-        patch_opt_field!(self, patch, auto_check_update);
-        patch_opt_field!(self, patch, default_latency_test);
-        patch_opt_field!(self, patch, default_latency_timeout);
-        patch_opt_field!(self, patch, enable_auto_delay_detection);
-        patch_opt_field!(self, patch, auto_delay_detection_interval_minutes);
-        patch_opt_field!(self, patch, enable_builtin_enhanced);
-        patch_opt_field!(self, patch, proxy_layout_column);
-        patch_opt_field!(self, patch, test_list);
-        patch_opt_field!(self, patch, auto_log_clean);
-        patch_opt_field!(self, patch, enable_auto_backup_schedule);
-        patch_opt_field!(self, patch, auto_backup_interval_hours);
-        patch_opt_field!(self, patch, auto_backup_on_change);
+        patch!(auto_close_connection);
+        patch!(auto_check_update);
+        patch!(default_latency_test);
+        patch!(default_latency_timeout);
+        patch!(enable_auto_delay_detection);
+        patch!(auto_delay_detection_interval_minutes);
+        patch!(enable_builtin_enhanced);
+        patch!(proxy_layout_column);
+        patch!(test_list);
+        patch!(auto_log_clean);
+        patch!(enable_auto_backup_schedule);
+        patch!(auto_backup_interval_hours);
+        patch!(auto_backup_on_change);
 
-        patch_opt_field!(self, patch, webdav_url);
-        patch_opt_field!(self, patch, webdav_username);
-        patch_opt_field!(self, patch, webdav_password);
+        patch!(webdav_url);
+        patch!(webdav_username);
+        patch!(webdav_password);
         #[cfg(target_os = "macos")]
-        patch_opt_field!(self, patch, enable_tray_speed);
-        patch_opt_field!(self, patch, tray_proxy_groups_display_mode);
-        patch_opt_field!(self, patch, tray_inline_outbound_modes);
-        patch_opt_field!(self, patch, enable_auto_light_weight_mode);
-        patch_opt_field!(self, patch, auto_light_weight_minutes);
-        patch_opt_field!(self, patch, enable_dns_settings);
-        patch_opt_field!(self, patch, home_cards);
-        patch_opt_field!(self, patch, enable_external_controller);
+        patch!(enable_tray_speed);
+        patch!(tray_proxy_groups_display_mode);
+        patch!(tray_inline_outbound_modes);
+        patch!(enable_auto_light_weight_mode);
+        patch!(auto_light_weight_minutes);
+        patch!(enable_dns_settings);
+        patch!(home_cards);
+        patch!(enable_external_controller);
     }
 
     pub fn get_log_level(&self) -> LevelFilter {

src-tauri/src/constants.rs

@@ -14,13 +14,6 @@ pub mod network {
     }
 }
 
-pub mod proxy {
-    /// Single source of the macOS default bypass list; both proxy backends compose from it.
-    #[cfg(target_os = "macos")]
-    pub const MACOS_DEFAULT_BYPASS: &str =
-        "127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,localhost,*.local,*.crashlytics.com,<local>";
-}
-
 pub mod timing {
     use super::Duration;
 

src-tauri/src/core/auto_backup.rs

@@ -7,10 +7,11 @@ use crate::{
 use anyhow::Result;
 use chrono::Local;
 use clash_verge_logging::{Type, logging};
+use parking_lot::RwLock;
 use std::{
     path::PathBuf,
     sync::{
-        OnceLock,
+        Arc, OnceLock,
         atomic::{AtomicBool, AtomicI64, Ordering},
     },
     time::{Duration, UNIX_EPOCH},
@@ -81,9 +82,8 @@ impl Default for AutoBackupSettings {
 }
 
 pub struct AutoBackupManager {
+    settings: Arc<RwLock<AutoBackupSettings>>,
     settings_tx: watch::Sender<AutoBackupSettings>,
-    // The watch channel is the single settings store; no duplicate copies.
-    settings_rx: watch::Receiver<AutoBackupSettings>,
     runner_started: AtomicBool,
     exec_lock: Mutex<()>,
     last_backup: AtomicI64,
@@ -93,10 +93,10 @@ impl AutoBackupManager {
     pub fn global() -> &'static Self {
         static INSTANCE: OnceLock<AutoBackupManager> = OnceLock::new();
         INSTANCE.get_or_init(|| {
-            let (settings_tx, settings_rx) = watch::channel(AutoBackupSettings::default());
+            let (tx, _rx) = watch::channel(AutoBackupSettings::default());
             Self {
-                settings_tx,
-                settings_rx,
+                settings: Arc::new(RwLock::new(AutoBackupSettings::default())),
+                settings_tx: tx,
                 runner_started: AtomicBool::new(false),
                 exec_lock: Mutex::new(()),
                 last_backup: AtomicI64::new(0),
@@ -106,6 +106,9 @@ impl AutoBackupManager {
 
     pub async fn init(&self) -> Result<()> {
         let settings = Self::load_settings().await;
+        {
+            *self.settings.write() = settings;
+        }
         let _ = self.settings_tx.send(settings);
         self.maybe_start_runner(settings);
         Ok(())
@@ -113,6 +116,9 @@ impl AutoBackupManager {
 
     pub async fn refresh_settings(&self) -> Result<()> {
         let settings = Self::load_settings().await;
+        {
+            *self.settings.write() = settings;
+        }
         let _ = self.settings_tx.send(settings);
         self.maybe_start_runner(settings);
         Ok(())
@@ -187,7 +193,7 @@ impl AutoBackupManager {
     }
 
     async fn execute_trigger(&self, trigger: AutoBackupTrigger) -> Result<()> {
-        let snapshot = *self.settings_rx.borrow();
+        let snapshot = *self.settings.read();
 
         if trigger.is_schedule() && !snapshot.schedule_enabled {
             return Ok(());

src-tauri/src/core/hotkey.rs

@@ -466,3 +466,12 @@ impl Hotkey {
         (del_list, add_list)
     }
 }
+
+impl Drop for Hotkey {
+    fn drop(&mut self) {
+        let app_handle = handle::Handle::app_handle();
+        if let Err(e) = app_handle.global_shortcut().unregister_all() {
+            logging!(error, Type::Hotkey, "Error unregistering all hotkeys: {:?}", e);
+        }
+    }
+}

src-tauri/src/core/lightweight.rs

@@ -40,47 +40,8 @@ impl LightweightState {
 
 static LIGHTWEIGHT_STATE: AtomicU8 = AtomicU8::new(LightweightState::Normal as u8);
 
-struct WindowListener {
-    handler_id: AtomicU32,
-    event: &'static str,
-    label: &'static str,
-}
-
-impl WindowListener {
-    fn setup(&self, on_event: impl Fn() + Send + 'static) {
-        if let Some(window) = WindowManager::get_main_window() {
-            let previous_handler_id = self.handler_id.swap(0, Ordering::AcqRel);
-            if previous_handler_id != 0 {
-                window.unlisten(previous_handler_id);
-                logging!(debug, Type::Lightweight, "覆盖旧的{}监听", self.label);
-            }
-            let handler_id = window.listen(self.event, move |_event| on_event());
-            self.handler_id.store(handler_id, Ordering::Release);
-        }
-    }
-
-    fn cancel(&self) {
-        let id = self.handler_id.swap(0, Ordering::AcqRel);
-        if id != 0 {
-            if let Some(window) = WindowManager::get_main_window() {
-                window.unlisten(id);
-            }
-            logging!(debug, Type::Lightweight, "取消了{}监听", self.label);
-        }
-    }
-}
-
-static WINDOW_CLOSE_LISTENER: WindowListener = WindowListener {
-    handler_id: AtomicU32::new(0),
-    event: "tauri://close-requested",
-    label: "窗口关闭",
-};
-
-static WEBVIEW_FOCUS_LISTENER: WindowListener = WindowListener {
-    handler_id: AtomicU32::new(0),
-    event: "tauri://focus",
-    label: "窗口焦点",
-};
+static WINDOW_CLOSE_HANDLER_ID: AtomicU32 = AtomicU32::new(0);
+static WEBVIEW_FOCUS_HANDLER_ID: AtomicU32 = AtomicU32::new(0);
 
 static CANCEL_TX: Mutex<Option<oneshot::Sender<()>>> = Mutex::new(None);
 
@@ -193,27 +154,55 @@ pub async fn add_light_weight_timer() {
 }
 
 fn setup_window_close_listener() {
-    WINDOW_CLOSE_LISTENER.setup(|| {
-        std::mem::drop(AsyncHandler::spawn(|| async {
-            setup_light_weight_timer().await;
-        }));
-        logging!(info, Type::Lightweight, "监听到关闭请求，开始轻量模式计时");
-    });
+    if let Some(window) = WindowManager::get_main_window() {
+        let previous_handler_id = WINDOW_CLOSE_HANDLER_ID.swap(0, Ordering::AcqRel);
+        if previous_handler_id != 0 {
+            window.unlisten(previous_handler_id);
+            logging!(debug, Type::Lightweight, "覆盖旧的窗口关闭监听");
+        }
+        let handler_id = window.listen("tauri://close-requested", move |_event| {
+            std::mem::drop(AsyncHandler::spawn(|| async {
+                setup_light_weight_timer().await;
+            }));
+            logging!(info, Type::Lightweight, "监听到关闭请求，开始轻量模式计时");
+        });
+        WINDOW_CLOSE_HANDLER_ID.store(handler_id, Ordering::Release);
+    }
 }
 
 fn cancel_window_close_listener() {
-    WINDOW_CLOSE_LISTENER.cancel();
+    let id = WINDOW_CLOSE_HANDLER_ID.swap(0, Ordering::AcqRel);
+    if id != 0 {
+        if let Some(window) = WindowManager::get_main_window() {
+            window.unlisten(id);
+        }
+        logging!(debug, Type::Lightweight, "取消了窗口关闭监听");
+    }
 }
 
 fn setup_webview_focus_listener() {
-    WEBVIEW_FOCUS_LISTENER.setup(|| {
-        cancel_light_weight_timer();
-        logging!(debug, Type::Lightweight, "监听到窗口获得焦点，取消轻量模式计时");
-    });
+    if let Some(window) = WindowManager::get_main_window() {
+        let previous_handler_id = WEBVIEW_FOCUS_HANDLER_ID.swap(0, Ordering::AcqRel);
+        if previous_handler_id != 0 {
+            window.unlisten(previous_handler_id);
+            logging!(debug, Type::Lightweight, "覆盖旧的窗口焦点监听");
+        }
+        let handler_id = window.listen("tauri://focus", move |_event| {
+            cancel_light_weight_timer();
+            logging!(debug, Type::Lightweight, "监听到窗口获得焦点，取消轻量模式计时");
+        });
+        WEBVIEW_FOCUS_HANDLER_ID.store(handler_id, Ordering::Release);
+    }
 }
 
 fn cancel_webview_focus_listener() {
-    WEBVIEW_FOCUS_LISTENER.cancel();
+    let id = WEBVIEW_FOCUS_HANDLER_ID.swap(0, Ordering::AcqRel);
+    if id != 0 {
+        if let Some(window) = WindowManager::get_main_window() {
+            window.unlisten(id);
+        }
+        logging!(debug, Type::Lightweight, "取消了窗口焦点监听");
+    }
 }
 
 async fn setup_light_weight_timer() {

src-tauri/src/core/proxy_control.rs

@@ -6,7 +6,7 @@ use crate::{
         notification::{self, FailedOperation},
         runstate::RUN_STATE,
         service,
-        sysopt::{Sysopt, format_bypass},
+        sysopt::Sysopt,
     },
     process::AsyncHandler,
     utils::{
@@ -204,6 +204,8 @@ const fn refusal_classification(service_usable: Option<bool>) -> SysproxyFailure
 }
 
 const LOOPBACK_HOST: &str = "127.0.0.1";
+const MACOS_DEFAULT_BYPASS: &str =
+    "127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,localhost,*.local,*.crashlytics.com,<local>";
 const MAX_SERVICE_BYPASS_LEN: usize = 8192;
 
 static SERVICE_PROXY_OPERATIONS: ServiceProxyOperations = ServiceProxyOperations::new();
@@ -325,7 +327,13 @@ fn service_bypass(verge: &IVerge) -> Result<String> {
     let custom = verge.system_proxy_bypass.as_deref().unwrap_or("");
     ensure!(!custom.contains('\0'), "system proxy bypass contains NUL");
 
-    let mut bypass: String = format_bypass(verge.use_default_bypass.unwrap_or(true), custom).into();
+    let mut bypass = if custom.is_empty() {
+        MACOS_DEFAULT_BYPASS.to_owned()
+    } else if verge.use_default_bypass.unwrap_or(true) {
+        format!("{MACOS_DEFAULT_BYPASS},{custom}")
+    } else {
+        custom.to_owned()
+    };
     truncate_utf8(&mut bypass, MAX_SERVICE_BYPASS_LEN);
     Ok(bypass)
 }

src-tauri/src/core/service.rs

@@ -593,71 +593,50 @@ fn packaged_service_tool_path(file_name: &str, packaged_path: impl FnOnce() -> R
 }
 
 #[cfg(target_os = "windows")]
-pub(super) fn run_maybe_elevated(program: &Path, hide_window: bool) -> Result<std::process::ExitStatus> {
+fn uninstall_service() -> Result<()> {
+    logging!(info, Type::Service, "uninstall service");
+
     use deelevate::{PrivilegeLevel, Token};
     use runas::Command as RunasCommand;
     use std::os::windows::process::CommandExt as _;
 
-    let token = Token::with_current_process()?;
-    let level = token.privilege_level()?;
-    let status = match level {
-        PrivilegeLevel::NotPrivileged => {
-            let mut command = RunasCommand::new(program);
-            if hide_window {
-                command.show(false);
-            }
-            command.status()?
-        }
-        _ => {
-            let mut command = StdCommand::new(program);
-            if hide_window {
-                // 0x08000000 is CREATE_NO_WINDOW, the direct counterpart of runas's show(false).
-                command.creation_flags(0x08000000);
-            }
-            command.status()?
-        }
-    };
-    Ok(status)
-}
+    let uninstall_path = packaged_service_tool_path("clash-verge-service-uninstall.exe", || {
+        Ok(dirs::service_path()?.with_file_name("clash-verge-service-uninstall.exe"))
+    })?;
 
-fn uninstaller_tool_path(file_name: &str, packaged_path: impl FnOnce() -> Result<PathBuf>) -> Result<PathBuf> {
-    let uninstall_path = packaged_service_tool_path(file_name, packaged_path)?;
     if !uninstall_path.exists() {
         bail!(format!("uninstaller not found: {uninstall_path:?}"));
     }
-    Ok(uninstall_path)
-}
 
-fn ensure_uninstall_success(status: &std::process::ExitStatus) -> Result<()> {
+    let token = Token::with_current_process()?;
+    let level = token.privilege_level()?;
+    let status = match level {
+        PrivilegeLevel::NotPrivileged => RunasCommand::new(uninstall_path).show(false).status()?,
+        _ => StdCommand::new(uninstall_path).creation_flags(0x08000000).status()?,
+    };
+
     if !status.success() {
         bail!(
             "failed to uninstall service with status {}",
             status.code().unwrap_or(-1)
         );
     }
+
     Ok(())
 }
 
-#[cfg(target_os = "windows")]
-fn uninstall_service() -> Result<()> {
-    logging!(info, Type::Service, "uninstall service");
-
-    let uninstall_path = uninstaller_tool_path("clash-verge-service-uninstall.exe", || {
-        Ok(dirs::service_path()?.with_file_name("clash-verge-service-uninstall.exe"))
-    })?;
-
-    let status = run_maybe_elevated(&uninstall_path, true)?;
-    ensure_uninstall_success(&status)
-}
-
 #[cfg(target_os = "linux")]
 fn uninstall_service() -> Result<()> {
     logging!(info, Type::Service, "uninstall service");
 
-    let uninstall_path = uninstaller_tool_path("clash-verge-service-uninstall", || {
+    let uninstall_path = packaged_service_tool_path("clash-verge-service-uninstall", || {
         Ok(tauri::utils::platform::current_exe()?.with_file_name("clash-verge-service-uninstall"))
     })?;
 
+    if !uninstall_path.exists() {
+        bail!(format!("uninstaller not found: {uninstall_path:?}"));
+    }
+
     let elevator = crate::utils::help::linux_elevator();
     let status = if linux_running_as_root() {
         StdCommand::new(&uninstall_path).status()?
@@ -687,7 +666,14 @@ fn uninstall_service() -> Result<()> {
         status.code().unwrap_or(-1)
     );
 
-    ensure_uninstall_success(&status)
+    if !status.success() {
+        bail!(
+            "failed to uninstall service with status {}",
+            status.code().unwrap_or(-1)
+        );
+    }
+
+    Ok(())
 }
 
 #[cfg(target_os = "linux")]
@@ -702,10 +688,14 @@ fn linux_running_as_root() -> bool {
 fn uninstall_service() -> Result<()> {
     logging!(info, Type::Service, "uninstall service");
 
-    let uninstall_path = uninstaller_tool_path("clash-verge-service-uninstall", || {
+    let uninstall_path = packaged_service_tool_path("clash-verge-service-uninstall", || {
         Ok(dirs::service_path()?.with_file_name("clash-verge-service-uninstall"))
     })?;
 
+    if !uninstall_path.exists() {
+        bail!(format!("uninstaller not found: {uninstall_path:?}"));
+    }
+
     let uninstall_path = macos_service_tool_path(&uninstall_path)?;
     let uninstall_shell: String = uninstall_path.to_string_lossy().into_owned();
 
@@ -721,7 +711,14 @@ fn uninstall_service() -> Result<()> {
 
     let status = StdCommand::new("osascript").args(vec!["-e", &command]).status()?;
 
-    ensure_uninstall_success(&status)
+    if !status.success() {
+        bail!(
+            "failed to uninstall service with status {}",
+            status.code().unwrap_or(-1)
+        );
+    }
+
+    Ok(())
 }
 
 fn install_service() -> Result<()> {

src-tauri/src/core/sysopt.rs

@@ -241,19 +241,20 @@ async fn current_os_proxy_state(sys: Sysproxy, auto: Autoproxy) -> OsProxyState
 }
 
 pub(crate) struct Sysopt {
-    // Owns the proxy target pair; every reader and writer goes through this lock.
-    update_lock: TokioMutex<(Sysproxy, Autoproxy)>,
+    update_lock: TokioMutex<()>,
     guard_operation_lock: TokioMutex<()>,
     reset_sysproxy: AtomicBool,
+    inner_proxy: Arc<RwLock<(Sysproxy, Autoproxy)>>,
     guard: Arc<RwLock<GuardMonitor>>,
 }
 
 impl Default for Sysopt {
     fn default() -> Self {
         Self {
-            update_lock: TokioMutex::new((Sysproxy::default(), Autoproxy::default())),
+            update_lock: TokioMutex::new(()),
             guard_operation_lock: TokioMutex::new(()),
             reset_sysproxy: AtomicBool::new(false),
+            inner_proxy: Arc::new(RwLock::new((Sysproxy::default(), Autoproxy::default()))),
             guard: Arc::new(RwLock::new(GuardMonitor::new(GuardType::None, Duration::from_secs(30)))),
         }
     }
@@ -268,9 +269,10 @@ static DEFAULT_BYPASS: &str = "localhost,127.0.0.1,192.168.0.0/16,10.0.0.0/8,172
 #[cfg(any(target_os = "linux", target_os = "macos"))]
 static BYPASS_SEPARATOR: &str = ",";
 #[cfg(target_os = "macos")]
-static DEFAULT_BYPASS: &str = crate::constants::proxy::MACOS_DEFAULT_BYPASS;
+static DEFAULT_BYPASS: &str =
+    "127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,localhost,*.local,*.crashlytics.com,<local>";
 
-pub(super) fn format_bypass(use_default: bool, custom_bypass: &str) -> String {
+fn format_bypass(use_default: bool, custom_bypass: &str) -> String {
     if custom_bypass.is_empty() {
         DEFAULT_BYPASS.into()
     } else if use_default {
@@ -359,7 +361,7 @@ impl Sysopt {
             }
         }
         while self.access_guard().read().get_state().is_pendding() {
-            tokio::time::sleep(Duration::from_millis(10)).await;
+            tokio::task::yield_now().await;
         }
         // `start()` false may also mean a guard was already running.
         !self.access_guard().read().get_state().is_stopped()
@@ -411,17 +413,14 @@ impl Sysopt {
     }
 
     /// init the sysproxy
-    #[allow(
-        clippy::significant_drop_tightening,
-        reason = "the update lock must stay held until the OS write finishes; wait_idle relies on it"
-    )]
     pub(super) async fn update_sysproxy(&self) -> Result<()> {
-        let mut inner_proxy = self.update_lock.lock().await;
+        let _lock = self.update_lock.lock().await;
         let verge = Config::verge().await.latest_arc();
         // Configured, not live: this runs while the Core is being started or restarted, and
         // asking a Core that is not up yet would only fall back here anyway.
         let port = MixedPort::desired().await;
         let pac_port = server::embedded_server_port()?;
+        // 先 await, 避免持有锁导致的 Send 问题
         let bypass = get_bypass().await;
 
         let (sys_enable, pac_enable, proxy_host, proxy_guard) = (
@@ -432,7 +431,7 @@ impl Sysopt {
         );
 
         let (sys, auto, guard_type) = {
-            let (sys, auto) = &mut *inner_proxy;
+            let (sys, auto) = &mut *self.inner_proxy.write();
             sys.host = proxy_host.into();
             sys.port = port;
             sys.bypass = bypass.into();
@@ -529,10 +528,6 @@ impl Sysopt {
     }
 
     /// reset the sysproxy
-    #[allow(
-        clippy::significant_drop_tightening,
-        reason = "the update lock must stay held until the disable finishes; wait_idle relies on it"
-    )]
     pub(super) async fn reset_sysproxy(&self) -> Result<()> {
         if self
             .reset_sysproxy
@@ -544,13 +539,13 @@ impl Sysopt {
         defer! {
             self.reset_sysproxy.store(false, Ordering::SeqCst);
         }
-        let mut inner_proxy = self.update_lock.lock().await;
+        let _lock = self.update_lock.lock().await;
         let _guard_operation = self.guard_operation_lock.lock().await;
         let drained = self.stop_proxy_guard_locked().await;
 
         // 直接关闭所有代理
         let (sys, auto) = {
-            let (sys, auto) = &mut *inner_proxy;
+            let (sys, auto) = &mut *self.inner_proxy.write();
             sys.enable = false;
             auto.enable = false;
             (sys.clone(), auto.clone())

src-tauri/src/core/tray/mod.rs

@@ -636,8 +636,7 @@ async fn create_tray_menu(
         .tray_proxy_groups_display_mode
         .as_deref()
         .unwrap_or("default");
-    let include_proxy_groups =
-        options.include_proxy_groups && verge_settings.tray_proxy_groups_display_mode.as_deref() != Some("disable");
+    let include_proxy_groups = options.include_proxy_groups && tray_proxy_groups_display_mode != "disable";
 
     let proxy_group_order_map = runtime_proxy_groups_order;
 

src-tauri/src/core/win_uwp.rs

@@ -1,7 +1,10 @@
 #![cfg(target_os = "windows")]
 
-use crate::{core::service, utils::dirs};
+use crate::utils::dirs;
 use anyhow::{Result, bail};
+use deelevate::{PrivilegeLevel, Token};
+use runas::Command as RunasCommand;
+use std::process::Command as StdCommand;
 
 pub fn invoke_uwptools() -> Result<()> {
     let resource_dir = dirs::app_resources_dir()?;
@@ -11,7 +14,13 @@ pub fn invoke_uwptools() -> Result<()> {
         bail!("enableLoopback exe not found");
     }
 
-    service::run_maybe_elevated(&tool_path, false)?;
+    let token = Token::with_current_process()?;
+    let level = token.privilege_level()?;
+
+    match level {
+        PrivilegeLevel::NotPrivileged => RunasCommand::new(tool_path).status()?,
+        _ => StdCommand::new(tool_path).status()?,
+    };
 
     Ok(())
 }

src-tauri/src/enhance/builtin/meta_guard.js

@@ -0,0 +1,8 @@
+// This function is exported for use by the Clash core
+// eslint-disable-next-line unused-imports/no-unused-vars
+function main(config, _name) {
+  if (config.mode === 'script') {
+    config.mode = 'rule'
+  }
+  return config
+}

src-tauri/src/enhance/builtin/meta_hy_alpn.js

@@ -0,0 +1,12 @@
+// This function is exported for use by the Clash core
+// eslint-disable-next-line unused-imports/no-unused-vars
+function main(config, _name) {
+  if (Array.isArray(config.proxies)) {
+    config.proxies.forEach((p, i) => {
+      if (p.type === 'hysteria' && typeof p.alpn === 'string') {
+        config.proxies[i].alpn = [p.alpn]
+      }
+    })
+  }
+  return config
+}

src-tauri/src/enhance/chain.rs

@@ -24,8 +24,8 @@ pub enum ChainType {
 
 #[derive(Debug, Clone)]
 pub enum ChainSupport {
-    Mihomo,
-    MihomoAlpha,
+    ClashMeta,
+    ClashMetaAlpha,
 }
 
 // Helper trait to allow async conversion
@@ -53,14 +53,26 @@ impl AsyncChainItemFrom for Option<ChainItem> {
                 uid,
                 data: ChainType::Merge(help::read_mapping(&path).await.ok()?),
             }),
-            "rules" | "proxies" | "groups" => {
+            "rules" => {
                 let seq_map = help::read_yaml::<SeqMap>(&path).await.ok()?;
-                let data = match itype {
-                    "rules" => ChainType::Rules(seq_map),
-                    "proxies" => ChainType::Proxies(seq_map),
-                    _ => ChainType::Groups(seq_map),
-                };
-                Some(ChainItem { uid, data })
+                Some(ChainItem {
+                    uid,
+                    data: ChainType::Rules(seq_map),
+                })
+            }
+            "proxies" => {
+                let seq_map = help::read_yaml::<SeqMap>(&path).await.ok()?;
+                Some(ChainItem {
+                    uid,
+                    data: ChainType::Proxies(seq_map),
+                })
+            }
+            "groups" => {
+                let seq_map = help::read_yaml::<SeqMap>(&path).await.ok()?;
+                Some(ChainItem {
+                    uid,
+                    data: ChainType::Groups(seq_map),
+                })
             }
             _ => None,
         }
@@ -69,15 +81,23 @@ impl AsyncChainItemFrom for Option<ChainItem> {
 impl ChainItem {
     /// 内建支持一些脚本
     pub fn builtin() -> Vec<(ChainSupport, Self)> {
-        // data intentionally empty: the enhance loop dispatches on uid to native implementations
-        let hy_alpn = Self::to_script("verge_hy_alpn", "");
-        let meta_guard = Self::to_script("verge_meta_guard", "");
+        // meta 的一些处理
+        let meta_guard = Self::to_script("verge_meta_guard", include_str!("./builtin/meta_guard.js"));
+
+        // meta 1.13.2 alpn string 转 数组
+        let hy_alpn = Self::to_script("verge_hy_alpn", include_str!("./builtin/meta_hy_alpn.js"));
+
+        // meta 的一些处理
+        let meta_guard_alpha = Self::to_script("verge_meta_guard", include_str!("./builtin/meta_guard.js"));
+
+        // meta 1.13.2 alpn string 转 数组
+        let hy_alpn_alpha = Self::to_script("verge_hy_alpn", include_str!("./builtin/meta_hy_alpn.js"));
 
         vec![
-            (ChainSupport::Mihomo, hy_alpn.clone()),
-            (ChainSupport::Mihomo, meta_guard.clone()),
-            (ChainSupport::MihomoAlpha, hy_alpn),
-            (ChainSupport::MihomoAlpha, meta_guard),
+            (ChainSupport::ClashMeta, hy_alpn),
+            (ChainSupport::ClashMeta, meta_guard),
+            (ChainSupport::ClashMetaAlpha, hy_alpn_alpha),
+            (ChainSupport::ClashMetaAlpha, meta_guard_alpha),
         ]
     }
 
@@ -94,7 +114,7 @@ impl ChainSupport {
         match core {
             Some(core) => matches!(
                 (self, core.as_str()),
-                (Self::Mihomo, "verge-mihomo") | (Self::MihomoAlpha, "verge-mihomo-alpha")
+                (Self::ClashMeta, "verge-mihomo") | (Self::ClashMetaAlpha, "verge-mihomo-alpha")
             ),
             None => true,
         }

src-tauri/src/enhance/field.rs

@@ -24,7 +24,18 @@ fn lowercase_key(key: &str) -> Value {
     Value::from(key.as_str())
 }
 
-pub fn use_lowercase(config: Mapping) -> Mapping {
+pub fn use_lowercase(config: &Mapping) -> Mapping {
+    let mut lowercased = Mapping::new();
+
+    for (key, value) in config.into_iter() {
+        if let Some(key_str) = key.as_str() {
+            lowercased.insert(lowercase_key(key_str), value.clone());
+        }
+    }
+    lowercased
+}
+
+pub fn use_lowercase_owned(config: Mapping) -> Mapping {
     let mut lowercased = Mapping::new();
 
     for (key, value) in config {

src-tauri/src/enhance/merge.rs

@@ -17,7 +17,7 @@ fn deep_merge(a: &mut Value, b: Value) {
 }
 
 pub fn use_merge(merge: &Mapping, mut config: Mapping) -> Mapping {
-    for (key, value) in use_lowercase(merge.clone()) {
+    for (key, value) in use_lowercase(merge) {
         match (config.get_mut(&key), value) {
             (Some(Value::Mapping(existing)), Value::Mapping(overlay)) if key.as_str() == Some("dns") => {
                 existing.extend(overlay);

src-tauri/src/enhance/mod.rs

@@ -8,7 +8,7 @@ mod tun;
 
 use self::{
     chain::{AsyncChainItemFrom as _, ChainItem, ChainType},
-    field::{use_keys, use_lowercase, use_sort},
+    field::{use_keys, use_lowercase_owned, use_sort},
     merge::use_merge,
     script::use_script,
     seq::{SeqMap, use_seq},
@@ -199,25 +199,35 @@ async fn collect_profile_items(profiles: &IProfiles) -> Result<ProfileItems> {
 
     let name = current_item.name.clone().unwrap_or_default();
 
-    let ProfileItems {
-        merge_item: default_merge,
-        script_item: default_script,
-        rules_item: default_rules,
-        proxies_item: default_proxies,
-        groups_item: default_groups,
-        global_merge: default_global_merge,
-        global_script: default_global_script,
-        ..
-    } = ProfileItems::default();
-
     let (merge_item, script_item, rules_item, proxies_item, groups_item, global_merge, global_script) = tokio::join!(
-        chain_item_or_default(profiles.get_item(&merge_uid).ok(), || default_merge,),
-        chain_item_or_default(profiles.get_item(&script_uid).ok(), || default_script,),
-        chain_item_or_default(profiles.get_item(&rules_uid).ok(), || default_rules,),
-        chain_item_or_default(profiles.get_item(&proxies_uid).ok(), || default_proxies,),
-        chain_item_or_default(profiles.get_item(&groups_uid).ok(), || default_groups,),
-        chain_item_or_default(profiles.get_item("Merge").ok(), || default_global_merge,),
-        chain_item_or_default(profiles.get_item("Script").ok(), || default_global_script,),
+        chain_item_or_default(profiles.get_item(&merge_uid).ok(), || ChainItem {
+            uid: "".into(),
+            data: ChainType::Merge(Mapping::new()),
+        },),
+        chain_item_or_default(profiles.get_item(&script_uid).ok(), || ChainItem {
+            uid: "".into(),
+            data: ChainType::Script(tmpl::ITEM_SCRIPT.into()),
+        },),
+        chain_item_or_default(profiles.get_item(&rules_uid).ok(), || ChainItem {
+            uid: "".into(),
+            data: ChainType::Rules(SeqMap::default()),
+        },),
+        chain_item_or_default(profiles.get_item(&proxies_uid).ok(), || ChainItem {
+            uid: "".into(),
+            data: ChainType::Proxies(SeqMap::default()),
+        },),
+        chain_item_or_default(profiles.get_item(&groups_uid).ok(), || ChainItem {
+            uid: "".into(),
+            data: ChainType::Groups(SeqMap::default()),
+        },),
+        chain_item_or_default(profiles.get_item("Merge").ok(), || ChainItem {
+            uid: "Merge".into(),
+            data: ChainType::Merge(Mapping::new()),
+        },),
+        chain_item_or_default(profiles.get_item("Script").ok(), || ChainItem {
+            uid: "Script".into(),
+            data: ChainType::Script(tmpl::ITEM_SCRIPT.into()),
+        },),
     );
 
     Ok(ProfileItems {
@@ -233,16 +243,16 @@ async fn collect_profile_items(profiles: &IProfiles) -> Result<ProfileItems> {
     })
 }
 
-async fn process_override_items(
+async fn process_global_items(
     mut config: Mapping,
     mut exists_keys: Vec<String>,
     mut result_map: HashMap<String, ResultLog>,
-    merge_item: ChainItem,
-    script_item: ChainItem,
+    global_merge: ChainItem,
+    global_script: ChainItem,
     profile_name: &String,
     authoritative: &AuthoritativeFields,
 ) -> (Mapping, Vec<String>, HashMap<String, ResultLog>) {
-    if let ChainType::Merge(merge) = merge_item.data {
+    if let ChainType::Merge(merge) = global_merge.data {
         exists_keys.extend(use_keys(&merge));
         let before = authoritative.current(&config);
         config = use_merge(&merge, config);
@@ -252,11 +262,11 @@ async fn process_override_items(
             .map(discarded_note)
             .collect();
         if !notes.is_empty() {
-            result_map.entry(merge_item.uid).or_default().extend(notes);
+            result_map.entry(global_merge.uid).or_default().extend(notes);
         }
     }
 
-    if let ChainType::Script(script) = script_item.data {
+    if let ChainType::Script(script) = global_script.data {
         let before = authoritative.current(&config);
         let (res_config, changed_keys, mut logs) = use_script(script, config, profile_name.clone()).await;
         exists_keys.extend(changed_keys);
@@ -267,7 +277,7 @@ async fn process_override_items(
                 .into_iter()
                 .map(discarded_note),
         );
-        result_map.insert(script_item.uid, logs);
+        result_map.insert(global_script.uid, logs);
     }
 
     (config, exists_keys, result_map)
@@ -534,6 +544,46 @@ fn ensure_lan_bind_address(mut config: Mapping) -> Mapping {
     config
 }
 
+async fn process_profile_items(
+    mut config: Mapping,
+    mut exists_keys: Vec<String>,
+    mut result_map: HashMap<String, ResultLog>,
+    merge_item: ChainItem,
+    script_item: ChainItem,
+    profile_name: &String,
+    authoritative: &AuthoritativeFields,
+) -> (Mapping, Vec<String>, HashMap<String, ResultLog>) {
+    if let ChainType::Merge(merge) = merge_item.data {
+        exists_keys.extend(use_keys(&merge));
+        let before = authoritative.current(&config);
+        config = use_merge(&merge, config);
+        let notes: ResultLog = authoritative
+            .overridden(&before, &authoritative.current(&config))
+            .into_iter()
+            .map(discarded_note)
+            .collect();
+        if !notes.is_empty() {
+            result_map.entry(merge_item.uid).or_default().extend(notes);
+        }
+    }
+
+    if let ChainType::Script(script) = script_item.data {
+        let before = authoritative.current(&config);
+        let (res_config, changed_keys, mut logs) = use_script(script, config, profile_name.clone()).await;
+        exists_keys.extend(changed_keys);
+        config = res_config;
+        logs.extend(
+            authoritative
+                .overridden(&before, &authoritative.current(&config))
+                .into_iter()
+                .map(discarded_note),
+        );
+        result_map.insert(script_item.uid, logs);
+    }
+
+    (config, exists_keys, result_map)
+}
+
 /// Merges the app's clash config over the profile; switches are parameters to keep it pure.
 fn merge_default_config(
     mut config: Mapping,
@@ -614,7 +664,7 @@ fn apply_builtin_scripts(mut config: Mapping, clash_core: Option<String>, enable
             .collect();
         if !items.is_empty() {
             // The JS path saw a lowercased view; lowercase once, only when a builtin runs.
-            config = use_lowercase(config);
+            config = use_lowercase_owned(config);
             for item in items {
                 logging!(debug, Type::Core, "run builtin script {}", item.uid);
                 config = match item.uid.as_str() {
@@ -885,7 +935,7 @@ pub async fn enhance(
 
     let authoritative = AuthoritativeFields::capture(&config, &gui_tun_keys, dns_settings);
 
-    let (config, exists_keys, result_map) = process_override_items(
+    let (config, exists_keys, result_map) = process_global_items(
         config,
         exists_keys,
         result_map,
@@ -896,7 +946,7 @@ pub async fn enhance(
     )
     .await;
 
-    let (config, exists_keys, result_map) = process_override_items(
+    let (config, exists_keys, result_map) = process_profile_items(
         config,
         exists_keys,
         result_map,
@@ -1378,7 +1428,7 @@ mod authoritative_field_tests {
 mod tests {
     use super::{
         AuthoritativeFields, ChainItem, ChainType, Mapping, cleanup_proxy_groups, ensure_lan_bind_address,
-        process_override_items, use_keys,
+        process_global_items, process_profile_items, use_keys,
     };
     use std::collections::HashMap;
 
@@ -1426,7 +1476,7 @@ mod tests {
                 data: ChainType::Merge(merge.clone()),
             };
             let profile_name = "test-profile".into();
-            let (config, keys, logs) = process_override_items(
+            let (config, keys, logs) = process_global_items(
                 config,
                 vec![],
                 HashMap::new(),
@@ -1436,7 +1486,7 @@ mod tests {
                 &authoritative,
             )
             .await;
-            let (config, _, logs) = process_override_items(
+            let (config, _, logs) = process_profile_items(
                 config,
                 keys,
                 logs,
@@ -1514,7 +1564,7 @@ mod tests {
 
         let profile_name = "test-profile".into();
         let authoritative = AuthoritativeFields::capture(&config, &[], Mapping::new());
-        let (config, exists_keys, result_map) = process_override_items(
+        let (config, exists_keys, result_map) = process_global_items(
             config,
             exists_keys,
             HashMap::new(),
@@ -1524,7 +1574,7 @@ mod tests {
             &authoritative,
         )
         .await;
-        let (config, exists_keys, _) = process_override_items(
+        let (config, exists_keys, _) = process_profile_items(
             config,
             exists_keys,
             result_map,

src-tauri/src/enhance/script.rs

@@ -1,6 +1,6 @@
 use crate::{process::AsyncHandler, utils::tmpl};
 
-use super::field::use_lowercase;
+use super::field::{use_lowercase, use_lowercase_owned};
 use anyhow::{Error, Result};
 use boa_engine::{Context, JsString, JsValue, Source, js_string, native_function::NativeFunction, property::Attribute};
 use clash_verge_logging::{Type, logging};
@@ -22,10 +22,10 @@ type EvalOutcome = (Result<Mapping, std::string::String>, Vec<(String, String)>)
 pub(super) async fn use_script(script: String, config: Mapping, name: String) -> ScriptResult {
     // The template is identity-plus-lowercasing; skip the Boa round-trip.
     if script == tmpl::ITEM_SCRIPT {
-        return (use_lowercase(config), vec![], vec![]);
+        return (use_lowercase_owned(config), vec![], vec![]);
     }
 
-    let json = match serde_json::to_string(&use_lowercase(config.clone())) {
+    let json = match serde_json::to_string(&use_lowercase(&config)) {
         Ok(json) if json.len() <= MAX_JSON_SIZE => json,
         Ok(_) => {
             let message = "Configuration size exceeds maximum allowed size";
@@ -173,7 +173,7 @@ fn eval_script(script: &str, config_json: &str, name: &String) -> EvalOutcome {
     }
 
     match parse_json_safely(&result) {
-        Ok(config) => (Ok(use_lowercase(config)), outputs.lock().to_vec()),
+        Ok(config) => (Ok(use_lowercase_owned(config)), outputs.lock().to_vec()),
         Err(err) => {
             logging!(
                 error,

src-tauri/src/enhance/tun.rs

@@ -28,7 +28,7 @@ pub fn use_tun(mut config: Mapping, enable: bool) -> Mapping {
             .and_then(|v| v.as_str())
             .unwrap_or("fake-ip");
 
-        if current_mode == "fake-ip" {
+        if current_mode == "fake-ip" || !dns_val.contains_key(Value::from("enhanced-mode")) {
             revise!(dns_val, "enable", true);
             revise!(dns_val, "ipv6", ipv6_val);
 

src-tauri/src/feat/backup.rs

@@ -33,9 +33,6 @@ async fn finalize_restored_verge_config(
     webdav_username: Option<String>,
     webdav_password: Option<String>,
 ) -> Result<()> {
-    // The lock must cover every restored layer; an unlocked apply races a concurrently staged draft.
-    let config_write = Config::lock_config_write().await;
-
     // A broken restored `verge.yaml` is a restore failure, not a reason to load defaults.
     let mut restored = help::read_yaml::<IVerge>(&verge_path()?).await?;
     restored.webdav_url = webdav_url;
@@ -46,42 +43,43 @@ async fn finalize_restored_verge_config(
     let restored_clash = IClashTemp::new().await;
     let clash_draft = Config::clash().await;
     clash_draft.edit_draft(|d| {
-        *d = restored_clash;
+        *d = restored_clash.clone();
     });
     clash_draft.apply();
 
     let restored_profiles = IProfiles::new().await;
     let profiles_draft = Config::profiles().await;
     profiles_draft.edit_draft(|d| {
-        *d = restored_profiles;
+        *d = restored_profiles.clone();
     });
     profiles_draft.apply();
 
     let verge_draft = Config::verge().await;
-    verge_draft.edit_draft(|d| {
-        *d = restored.clone();
-    });
-    verge_draft.apply();
+    {
+        // Hold the write lock so a concurrent patch cannot stage a draft the proxy write reads.
+        let _config_write = Config::lock_config_write().await;
+        verge_draft.edit_draft(|d| {
+            *d = restored.clone();
+        });
+        verge_draft.apply();
 
-    // Turn it off here; a failing core side effect below would otherwise skip this step.
-    if !restored.enable_system_proxy.unwrap_or_default() {
-        let result = async {
-            let _lifecycle = CoreManager::global().lifecycle_lock.lock().await;
-            proxy_control::apply().await?;
-            proxy_control::refresh_guard().await
-        }
-        .await;
-        if let Err(err) = result {
-            logging!(error, Type::Backup, "Failed to turn the system proxy off: {err:#}");
-            if SystemProxyStateUnknown::is_in(&err) {
-                return Err(err);
+        // Turn it off here; a failing core side effect below would otherwise skip this step.
+        if !restored.enable_system_proxy.unwrap_or_default() {
+            let result = async {
+                let _lifecycle = CoreManager::global().lifecycle_lock.lock().await;
+                proxy_control::apply().await?;
+                proxy_control::refresh_guard().await
+            }
+            .await;
+            if let Err(err) = result {
+                logging!(error, Type::Backup, "Failed to turn the system proxy off: {err:#}");
+                if SystemProxyStateUnknown::is_in(&err) {
+                    return Err(err);
+                }
             }
         }
     }
 
-    // `patch_verge` re-acquires the lock through `try_lock_config_write`.
-    drop(config_write);
-
     // Run configuration side effects without rewriting the already-restored file.
     if let Err(err) = super::patch_verge(&restored, true).await {
         logging!(error, Type::Backup, "Failed to apply restored verge config: {err:#}");
@@ -136,35 +134,14 @@ pub async fn delete_webdav_backup(filename: String) -> Result<()> {
     })
 }
 
-/// Backup creation strips the WebDAV credentials, so the live ones are kept.
-async fn restore_backup_archive(path: PathBuf) -> Result<()> {
-    let (webdav_url, webdav_username, webdav_password) = {
-        let verge = Config::verge().await;
-        let verge = verge.latest_arc();
-        (
-            verge.webdav_url.clone(),
-            verge.webdav_username.clone(),
-            verge.webdav_password.clone(),
-        )
-    };
-
-    let home_dir = app_home_dir()?;
-    AsyncHandler::spawn_blocking(move || -> Result<()> {
-        let file = std::fs::File::open(&path)?;
-        let mut zip = zip::ZipArchive::new(file)?;
-        zip.extract(&home_dir)?;
-        Ok(())
-    })
-    .await
-    .map_err(|join| anyhow!("backup extraction task failed: {join}"))??;
-
-    // Held for the config-data transition only; extraction is plain filesystem work.
-    let _profile_write = crate::config::profiles::PROFILE_WRITE_LOCK.lock().await;
-    finalize_restored_verge_config(webdav_url, webdav_username, webdav_password).await
-}
-
 #[tracing::instrument(skip_all, level = "info", fields(filename = %filename))]
 pub async fn restore_webdav_backup(filename: String) -> Result<()> {
+    let verge = Config::verge().await;
+    let verge_data = verge.latest_arc();
+    let webdav_url = verge_data.webdav_url.clone();
+    let webdav_username = verge_data.webdav_username.clone();
+    let webdav_password = verge_data.webdav_password.clone();
+
     let backup_storage_path = app_home_dir()
         .map_err(|e| anyhow::anyhow!("Failed to get app home dir: {e}"))?
         .join(filename.as_str());
@@ -181,7 +158,12 @@ pub async fn restore_webdav_backup(filename: String) -> Result<()> {
             err
         })?;
 
-    let res = restore_backup_archive(backup_storage_path.clone()).await;
+    let value = backup_storage_path.clone();
+    let file = AsyncHandler::spawn_blocking(move || std::fs::File::open(&value)).await??;
+    let mut zip = zip::ZipArchive::new(file)?;
+    let _profile_write = crate::config::profiles::PROFILE_WRITE_LOCK.lock().await;
+    zip.extract(app_home_dir()?)?;
+    let res = finalize_restored_verge_config(webdav_url, webdav_username, webdav_password).await;
     let _ = backup_storage_path.remove_if_exists().await;
     res
 }
@@ -350,7 +332,22 @@ pub async fn restore_local_backup(filename: String) -> Result<()> {
         return Err(anyhow!("Backup file not found: {}", filename));
     }
 
-    restore_backup_archive(target_path).await
+    let (webdav_url, webdav_username, webdav_password) = {
+        let verge = Config::verge().await;
+        let verge = verge.latest_arc();
+        (
+            verge.webdav_url.clone(),
+            verge.webdav_username.clone(),
+            verge.webdav_password.clone(),
+        )
+    };
+
+    let file = AsyncHandler::spawn_blocking(move || std::fs::File::open(&target_path)).await??;
+    let mut zip = zip::ZipArchive::new(file)?;
+    let _profile_write = crate::config::profiles::PROFILE_WRITE_LOCK.lock().await;
+    zip.extract(app_home_dir()?)?;
+    finalize_restored_verge_config(webdav_url, webdav_username, webdav_password).await?;
+    Ok(())
 }
 
 #[tracing::instrument(skip_all, level = "info", fields(filename = %filename, destination = %destination))]

src-tauri/src/feat/clash.rs

@@ -3,7 +3,7 @@ use crate::core::notify::{Refresh, announce};
 use crate::{
     config::{Config, MixedPort},
     core::{CoreManager, handle, tray},
-    feat::run_exit_cleanup_flow,
+    feat::clean_async,
     process::AsyncHandler,
     utils,
 };
@@ -14,8 +14,15 @@ use smartstring::alias::String;
 use std::sync::{Arc, LazyLock};
 
 #[allow(clippy::expect_used)]
-static TLS_CONFIG: LazyLock<Arc<rustls::ClientConfig>> =
-    LazyLock::new(|| Arc::new(utils::network::build_webpki_rooted_tls_config().expect("Failed to set TLS versions")));
+static TLS_CONFIG: LazyLock<Arc<rustls::ClientConfig>> = LazyLock::new(|| {
+    let root_store = rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
+    let config = rustls::ClientConfig::builder_with_provider(Arc::new(rustls::crypto::ring::default_provider()))
+        .with_safe_default_protocol_versions()
+        .expect("Failed to set TLS versions")
+        .with_root_certificates(root_store)
+        .with_no_client_auth();
+    Arc::new(config)
+});
 
 pub async fn restart_clash_core() {
     match CoreManager::global().restart_core().await {
@@ -31,9 +38,38 @@ pub async fn restart_clash_core() {
 
 pub async fn restart_app() {
     logging!(debug, Type::System, "启动重启应用流程");
-    let cleanup_result = run_exit_cleanup_flow(NoticeStatus::AppRestartCoreStopFailed).await;
+    handle::Handle::global().set_is_exiting();
+
+    Config::apply_all_and_save_file().await;
+
+    let cleanup_result = clean_async().await;
+
+    logging!(
+        info,
+        Type::System,
+        "资源清理完成，退出代码: {}",
+        if cleanup_result.all_success { 0 } else { 1 }
+    );
 
     if !cleanup_result.core_stopped {
+        handle::Handle::global().clear_is_exiting();
+        // A failed stop may still have marked the core stopped, and exit cleanup skipped the DNS restore.
+        // A core that kept running keeps its DNS, whatever an unapplied config draft says.
+        #[cfg(target_os = "macos")]
+        {
+            let manager = CoreManager::global();
+            let _lifecycle = manager.lifecycle_lock.lock().await;
+            if matches!(
+                *manager.get_running_mode(),
+                crate::core::manager::RunningMode::NotRunning
+            ) {
+                crate::utils::resolve::dns::sync_public_dns().await;
+            }
+        }
+        handle::Handle::notice(
+            NoticeStatus::AppRestartCoreStopFailed,
+            cleanup_result.stop_error.unwrap_or_default(),
+        );
         return;
     }
 
@@ -67,14 +103,11 @@ pub async fn change_clash_mode(mode: String) -> Result<(), String> {
     }
 
     let clash = Config::clash().await;
-    // Serialize with patch transactions: an unlocked commit can flush a staged draft mid-rollback.
-    let save_result = {
-        let _config_write = Config::lock_config_write().await;
-        clash.edit_draft(|d| d.patch_config(&mapping));
-        clash.apply();
-        clash.data_arc().save_config().await
-    };
-    if save_result.is_ok() {
+    clash.edit_draft(|d| d.patch_config(&mapping));
+    clash.apply();
+
+    let clash_data = clash.data_arc();
+    if clash_data.save_config().await.is_ok() {
         announce(Refresh::Clash);
         tray::Tray::global().update_menu_and_icon().await;
     }

src-tauri/src/feat/profile.rs

@@ -47,11 +47,26 @@ pub async fn switch_proxy_node(group_name: &str, proxy_name: &str) {
             record_switched_node(group_name, proxy_name).await;
             announce(Refresh::Proxies);
             let _ = tray::Tray::global().update_menu().await;
+            return;
         }
         Err(err) => {
             logging!(error, Type::Tray, "切换代理失败: {err:?}");
         }
     }
+
+    match handle::Handle::mihomo()
+        .select_node_for_group(group_name, proxy_name)
+        .await
+    {
+        Ok(_) => {
+            logging!(info, Type::Tray, "代理切换回退成功: {} -> {}", group_name, proxy_name);
+            record_switched_node(group_name, proxy_name).await;
+            let _ = tray::Tray::global().update_menu().await;
+        }
+        Err(err) => {
+            logging!(error, Type::Tray, "代理切换最终失败: {err:?}");
+        }
+    }
 }
 
 async fn should_update_profile(uid: &String, ignore_auto_update: bool) -> Result<Option<(String, Option<PrfOption>)>> {

src-tauri/src/feat/window.rs

@@ -130,7 +130,9 @@ pub async fn open_or_close_dashboard() {
     logging!(info, Type::Window, "Window toggle result: {result:?}");
 }
 
-pub(crate) async fn run_exit_cleanup_flow(stop_failed_notice: NoticeStatus) -> CleanupResult {
+pub async fn quit() {
+    logging!(debug, Type::System, "启动退出流程");
+    // 设置退出标志
     handle::Handle::global().set_is_exiting();
 
     Config::apply_all_and_save_file().await;
@@ -160,18 +162,11 @@ pub(crate) async fn run_exit_cleanup_flow(stop_failed_notice: NoticeStatus) -> C
             }
         }
         handle::Handle::notice(
-            stop_failed_notice,
-            cleanup_result.stop_error.clone().unwrap_or_default(),
+            NoticeStatus::AppQuitCoreStopFailed,
+            cleanup_result.stop_error.unwrap_or_default(),
         );
     }
 
-    cleanup_result
-}
-
-pub async fn quit() {
-    logging!(debug, Type::System, "启动退出流程");
-    let cleanup_result = run_exit_cleanup_flow(NoticeStatus::AppQuitCoreStopFailed).await;
-
     utils::server::shutdown_embedded_server();
     let app_handle = handle::Handle::app_handle();
     app_handle.exit(if cleanup_result.all_success { 0 } else { 1 });

src-tauri/src/utils/init.rs

@@ -354,6 +354,7 @@ pub(super) async fn init_dns_config() -> Result<()> {
                 Value::String("*.arpa".into()),
                 Value::String("time.*.com".into()),
                 Value::String("ntp.*.com".into()),
+                Value::String("time.*.com".into()),
                 Value::String("+.market.xiaomi.com".into()),
                 Value::String("localhost.ptlogin2.qq.com".into()),
                 Value::String("*.msftncsi.com".into()),
@@ -508,9 +509,11 @@ pub async fn init_resources() -> Result<()> {
     let app_dir = dirs::app_home_dir()?;
     let res_dir = dirs::app_resources_dir()?;
 
-    // app_home is created by `ensure_directories` in `init_config`, which always runs first.
+    if !app_dir.exists() {
+        std::mem::drop(fs::create_dir_all(&app_dir).await);
+    }
     if !res_dir.exists() {
-        fs::create_dir_all(&res_dir).await?;
+        std::mem::drop(fs::create_dir_all(&res_dir).await);
     }
 
     let file_list = ["Country.mmdb", "ASN.mmdb", "geoip.dat", "geosite.dat"];

src-tauri/src/utils/network.rs

@@ -48,17 +48,6 @@ enum TlsRootMode {
     StaticWebpkiRoots,
 }
 
-/// ALPN stays unset: raw TLS connectors offer none, while reqwest needs the h2 offer.
-pub(crate) fn build_webpki_rooted_tls_config() -> Result<rustls::ClientConfig> {
-    let root_store = rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
-    let config = rustls::ClientConfig::builder_with_provider(Arc::new(rustls::crypto::ring::default_provider()))
-        .with_safe_default_protocol_versions()?
-        .with_root_certificates(root_store)
-        .with_no_client_auth();
-
-    Ok(config)
-}
-
 pub struct NetworkManager;
 
 impl NetworkManager {
@@ -113,7 +102,13 @@ impl NetworkManager {
     }
 
     fn build_static_webpki_tls_config() -> Result<rustls::ClientConfig> {
-        let mut config = build_webpki_rooted_tls_config()?;
+        let root_store = rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
+        let mut config =
+            rustls::ClientConfig::builder_with_provider(Arc::new(rustls::crypto::ring::default_provider()))
+                .with_safe_default_protocol_versions()?
+                .with_root_certificates(root_store)
+                .with_no_client_auth();
+
         config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
 
         Ok(config)
@@ -160,23 +155,6 @@ impl NetworkManager {
         detail.contains("protocolversion") || detail.contains("protocol version")
     }
 
-    /// `allow_fallback` stays false when the caller already disabled certificate verification.
-    async fn request_with_static_webpki_fallback<T, F, Fut>(allow_fallback: bool, mut request: F) -> Result<T>
-    where
-        F: FnMut(TlsRootMode) -> Fut,
-        Fut: std::future::Future<Output = Result<T>>,
-    {
-        match request(TlsRootMode::PlatformVerifier).await {
-            Ok(value) => Ok(value),
-            Err(err) if allow_fallback && Self::should_retry_with_static_webpki_roots(&err) => {
-                request(TlsRootMode::StaticWebpkiRoots).await.map_err(|fallback_err| {
-                    fallback_err.context("static webpki roots fallback failed after platform TLS verifier failed")
-                })
-            }
-            Err(err) => Err(err),
-        }
-    }
-
     async fn get_with_tls_mode(
         &self,
         url: &str,
@@ -286,21 +264,34 @@ impl NetworkManager {
         user_agent: Option<String>,
         accept_invalid_certs: bool,
     ) -> Result<HttpResponse> {
-        Self::request_with_static_webpki_fallback(!accept_invalid_certs, |tls_root_mode| {
-            let user_agent = user_agent.clone();
-            async move {
-                self.get_with_tls_mode(
+        let platform_result = self
+            .get_with_tls_mode(
+                url,
+                proxy_type,
+                timeout_secs,
+                user_agent.clone(),
+                accept_invalid_certs,
+                TlsRootMode::PlatformVerifier,
+            )
+            .await;
+
+        match platform_result {
+            Ok(response) => Ok(response),
+            Err(err) if !accept_invalid_certs && Self::should_retry_with_static_webpki_roots(&err) => self
+                .get_with_tls_mode(
                     url,
                     proxy_type,
                     timeout_secs,
                     user_agent,
                     accept_invalid_certs,
-                    tls_root_mode,
+                    TlsRootMode::StaticWebpkiRoots,
                 )
                 .await
-            }
-        })
-        .await
+                .map_err(|fallback_err| {
+                    fallback_err.context("static webpki roots fallback failed after platform TLS verifier failed")
+                }),
+            Err(err) => Err(err),
+        }
     }
 
     async fn get_bytes_with_tls_mode(
@@ -349,10 +340,19 @@ impl NetworkManager {
         timeout_secs: Option<u64>,
         max_bytes: usize,
     ) -> Result<Vec<u8>> {
-        Self::request_with_static_webpki_fallback(true, |tls_root_mode| async move {
-            self.get_bytes_with_tls_mode(url, proxy_type, timeout_secs, max_bytes, tls_root_mode)
+        let platform_result = self
+            .get_bytes_with_tls_mode(url, proxy_type, timeout_secs, max_bytes, TlsRootMode::PlatformVerifier)
+            .await;
+
+        match platform_result {
+            Ok(body) => Ok(body),
+            Err(err) if Self::should_retry_with_static_webpki_roots(&err) => self
+                .get_bytes_with_tls_mode(url, proxy_type, timeout_secs, max_bytes, TlsRootMode::StaticWebpkiRoots)
                 .await
-        })
-        .await
+                .map_err(|fallback_err| {
+                    fallback_err.context("static webpki roots fallback failed after platform TLS verifier failed")
+                }),
+            Err(err) => Err(err),
+        }
     }
 }

src-tauri/src/utils/resolve/mod.rs

@@ -1,6 +1,8 @@
 use crate::core::notify::NoticeStatus;
 use std::sync::atomic::{AtomicBool, Ordering};
 
+use anyhow::Result;
+
 use crate::{
     config::Config,
     core::{
@@ -95,6 +97,18 @@ async fn resolve_setup() {
     resolve_done();
 }
 
+pub async fn resolve_reset_async() -> Result<(), anyhow::Error> {
+    CoreManager::global().stop_core().await?;
+
+    #[cfg(target_os = "macos")]
+    {
+        use dns::restore_public_dns;
+        restore_public_dns().await?;
+    }
+
+    Ok(())
+}
+
 fn init_scheme() {
     logging_error!(Type::Setup, init::init_scheme());
 }

src/components/proxy/proxy-groups.tsx

@@ -608,7 +608,7 @@ function NormalProxyGroups(props: { mode: string }) {
         />
       </DragDropProvider>
 
-      {(mode === 'rule' || mode === 'global') && (
+      {mode === 'rule' && (
         <ProxyGroupNavigator
           proxyGroupNames={proxyGroupNames}
           onGroupLocation={handleGroupLocationByName}

src/components/proxy/use-render-list.ts

@@ -211,7 +211,7 @@ export const useRenderList = (
     if (!proxyView) return []
     if (isChainMode)
       return selectedGroup ? [selectedGroup] : [CHAIN_DELAY_GROUP]
-    return mode === 'rule' || mode === 'global'
+    return mode === 'rule' || mode === 'script'
       ? proxyView.groups.map(({ name }) => name)
       : proxyView.global
         ? [proxyView.global.name]
@@ -257,7 +257,7 @@ export const useRenderList = (
       }))
     }
 
-    const useRule = mode === 'rule' || mode === 'global'
+    const useRule = mode === 'rule' || mode === 'script'
     const renderGroups = useRule
       ? proxyView.groups
       : proxyView.global === null

src/locales/ar/tests.json

@@ -36,7 +36,6 @@
       "yes": "Yes",
       "no": "No",
       "failed": "Failed",
-      "risky": "غير مؤكد",
       "completed": "Completed",
       "disallowedIsp": "Disallowed ISP",
       "originalsOnly": "Originals Only",

src/locales/de/tests.json

@@ -36,7 +36,6 @@
       "yes": "Unterstützt",
       "no": "Nicht unterstützt",
       "failed": "Test fehlgeschlagen",
-      "risky": "Ungewiss",
       "completed": "Prüfung abgeschlossen",
       "disallowedIsp": "Nicht zugelassener Internetdienstanbieter",
       "originalsOnly": "Nur Original",

src/locales/en/tests.json

@@ -36,7 +36,6 @@
       "yes": "Yes",
       "no": "No",
       "failed": "Failed",
-      "risky": "Risky",
       "completed": "Completed",
       "disallowedIsp": "Disallowed ISP",
       "originalsOnly": "Originals Only",

src/locales/es/tests.json

@@ -36,7 +36,6 @@
       "yes": "Soportado",
       "no": "No soportado",
       "failed": "Prueba fallida",
-      "risky": "Dudoso",
       "completed": "Detección completada",
       "disallowedIsp": "Proveedor de servicios de Internet no permitido",
       "originalsOnly": "Solo originales",

src/locales/fa/tests.json

@@ -36,7 +36,6 @@
       "yes": "Yes",
       "no": "No",
       "failed": "Failed",
-      "risky": "نامشخص",
       "completed": "Completed",
       "disallowedIsp": "Disallowed ISP",
       "originalsOnly": "Originals Only",

src/locales/id/tests.json

@@ -36,7 +36,6 @@
       "yes": "Yes",
       "no": "No",
       "failed": "Failed",
-      "risky": "Tidak pasti",
       "completed": "Completed",
       "disallowedIsp": "Disallowed ISP",
       "originalsOnly": "Originals Only",

src/locales/jp/tests.json

@@ -36,7 +36,6 @@
       "yes": "サポートする",
       "no": "サポートしない",
       "failed": "テストに失敗しました。",
-      "risky": "要確認",
       "completed": "検査完了",
       "disallowedIsp": "許可されていないインターネットサービスプロバイダー",
       "originalsOnly": "オリジナルのみ",

src/locales/ko/tests.json

@@ -36,7 +36,6 @@
       "yes": "예",
       "no": "아니오",
       "failed": "실패",
-      "risky": "확인 필요",
       "completed": "완료",
       "disallowedIsp": "허용되지 않는 ISP",
       "originalsOnly": "오리지널만",

src/locales/pt/tests.json

@@ -36,7 +36,6 @@
       "yes": "Sim",
       "no": "Não",
       "failed": "Falhou",
-      "risky": "Incerto",
       "completed": "Concluído",
       "disallowedIsp": "ISP não permitido",
       "originalsOnly": "Somente originais",

src/locales/ru/tests.json

@@ -36,7 +36,6 @@
       "yes": "Да",
       "no": "Нет",
       "failed": "Ошибка",
-      "risky": "Неясно",
       "completed": "Завершено",
       "disallowedIsp": "Провайдер заблокирован",
       "originalsOnly": "Только Originals",

src/locales/tr/tests.json

@@ -36,7 +36,6 @@
       "yes": "Evet",
       "no": "Hayır",
       "failed": "Başarısız",
-      "risky": "Belirsiz",
       "completed": "Tamamlandı",
       "disallowedIsp": "İzin Verilmeyen ISP",
       "originalsOnly": "Yalnızca Orijinaller",

src/locales/tt/tests.json

@@ -36,7 +36,6 @@
       "yes": "Yes",
       "no": "No",
       "failed": "Failed",
-      "risky": "Билгесез",
       "completed": "Completed",
       "disallowedIsp": "Disallowed ISP",
       "originalsOnly": "Originals Only",

src/locales/zh/tests.json

@@ -36,7 +36,6 @@
       "yes": "支持",
       "no": "不支持",
       "failed": "测试失败",
-      "risky": "存疑",
       "completed": "检测完成",
       "disallowedIsp": "不允许的 ISP",
       "originalsOnly": "仅限原创",

src/locales/zhtw/tests.json

@@ -36,7 +36,6 @@
       "yes": "支援",
       "no": "不支援",
       "failed": "測試失敗",
-      "risky": "存疑",
       "completed": "檢測完成",
       "disallowedIsp": "不允許的網際網路服務供應商",
       "originalsOnly": "僅限原創",

src/pages/_layout/hooks/use-custom-theme.ts

@@ -55,7 +55,7 @@ const wrapCssInjectionWithScope = (css?: string) => {
     return null
   }
   const scopeRoot = CSS_INJECTION_SCOPE_ROOT
-  const scopeLimit = `${CSS_INJECTION_SCOPE_LIMIT} > *`
+  const scopeLimit = CSS_INJECTION_SCOPE_LIMIT
   const scopedBlock = `@scope (${scopeRoot}) to (${scopeLimit}) {
 ${css}
 }`

src/pages/unlock.tsx

@@ -40,7 +40,6 @@ const STATUS_LABEL_KEYS: Record<string, string> = {
   Yes: 'tests.statuses.test.yes',
   No: 'tests.statuses.test.no',
   Failed: 'tests.statuses.test.failed',
-  Risky: 'tests.statuses.test.risky',
   Completed: 'tests.statuses.test.completed',
   'Disallowed ISP': 'tests.statuses.test.disallowedIsp',
   'Originals Only': 'tests.statuses.test.originalsOnly',
@@ -197,7 +196,7 @@ const UnlockPage = () => {
     if (status === 'Pending') return 'default'
     if (status === 'Yes') return 'success'
     if (status === 'No') return 'error'
-    if (status === 'Soon' || status === 'Risky') return 'warning'
+    if (status === 'Soon') return 'warning'
     if (status.includes('Failed')) return 'error'
     if (status === 'Completed') return 'info'
     if (
@@ -223,8 +222,7 @@ const UnlockPage = () => {
   const getStatusBorderColor = (status: string) => {
     if (status === 'Yes') return theme.palette.success.main
     if (status === 'No') return theme.palette.error.main
-    if (status === 'Soon' || status === 'Risky')
-      return theme.palette.warning.main
+    if (status === 'Soon') return theme.palette.warning.main
     if (status.includes('Failed')) return theme.palette.error.main
     if (status === 'Completed') return theme.palette.info.main
     return theme.palette.divider