Merge branch 'dev' into refactor/backend-cleanup

fix(sysopt): gate shared macOS bypass constant to macOS builds
MACOS_DEFAULT_BYPASS is referenced only from cfg(target_os = "macos") code in sysopt.rs, so clippy on Linux and Windows flagged it as dead code under -D warnings.
2026-10-28 00:42:08 +08:00 · 2026-10-27 23:47:04 +08:00 · 2026-10-27 23:37:39 +08:00 · 2026-10-27 23:26:18 +08:00 · 2026-10-27 23:26:18 +08:00 · 2026-10-27 15:13:58 +00:00
63 changed files with 819 additions and 946 deletions
@@ -0,0 +1,80 @@
+name: Contract Parity
+
+on:
+  pull_request:
+    paths:
+      - "src-tauri/**/*.rs"
+      - "crates/**/*.rs"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "src-tauri/Cargo.toml"
+      - "crates/**/Cargo.toml"
+      - "rust-toolchain.toml"
+      - "src-tauri/tauri.conf*.json"
+      - "src/services/bindings.ts"
+      - "scripts/gen-contract.mjs"
+      - "scripts/check-contract-changes.mjs"
+      - "biome.json"
+      - "biome.jsonc"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "scripts/contract-inputs.json"
+      - ".github/workflows/contract-parity.yml"
+      - ".husky/pre-push"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  HUSKY: 0
+
+jobs:
+  contract-parity:
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust Stable
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          prefix-key: 'v1-rust'
+          key: 'rust-shared-stable-ubuntu-22.04-x86_64-unknown-linux-gnu-contract'
+          workspaces: |
+            . -> target
+          cache-all-crates: true
+          cache-workspace-crates: true
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libxslt1.1 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '24.22.1'
+          cache: 'pnpm'
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Provision sidecar placeholders for tauri-build
+        run: |
+          mkdir -p src-tauri/sidecar src-tauri/resources dist
+          touch dist/index.html
+          for bin in clash-verge-service clash-verge-service-install clash-verge-service-uninstall verge-mihomo verge-mihomo-alpha; do
+            touch "src-tauri/sidecar/${bin}-x86_64-unknown-linux-gnu"
+          done
+
+      - name: Check generated contract without changing the checkout
+        run: pnpm gen:contract --check
@@ -2,11 +2,23 @@ name: Frontend Check

 on:
  pull_request:
+    paths:
+      - "src/**"
+      - "**/*.js"
+      - "**/*.ts"
+      - "**/*.tsx"
+      - "**/*.css"
+      - "**/*.scss"
+      - "**/*.json"
+      - "**/*.md"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "vite.config.*"
+      - ".github/workflows/frontend-check.yml"
  workflow_dispatch:

 permissions:
  contents: read
-  pull-requests: read

 env:
  HUSKY: 0
@@ -17,46 +29,17 @@ jobs:
    steps:
      - uses: actions/checkout@v7

-      - name: Check frontend changes
-        id: check_frontend
-        uses: dorny/paths-filter@v4
-        with:
-          filters: |
-            frontend:
-              - 'src/**'
-              - '**/*.js'
-              - '**/*.ts'
-              - '**/*.tsx'
-              - '**/*.css'
-              - '**/*.scss'
-              - '**/*.json'
-              - '**/*.md'
-              - 'package.json'
-              - 'pnpm-lock.yaml'
-              - 'pnpm-workspace.yaml'
-              - 'knip.json'
-              - 'eslint.config.ts'
-              - 'tsconfig.json'
-              - 'vite.config.*'
-
-      - name: Skip if no frontend changes
-        if: steps.check_frontend.outputs.frontend != 'true'
-        run: echo "No frontend changes, skipping frontend checks."
-
      - name: Install pnpm
-        if: steps.check_frontend.outputs.frontend == 'true'
        uses: pnpm/action-setup@v6
        with:
          run_install: false

      - uses: actions/setup-node@v7
-        if: steps.check_frontend.outputs.frontend == 'true'
        with:
          node-version: '24.22.1'
          cache: 'pnpm'

      - name: Restore pnpm cache
-        if: steps.check_frontend.outputs.frontend == 'true'
        uses: actions/cache@v6
        with:
          path: ~/.pnpm-store
@@ -65,94 +48,21 @@ jobs:
            pnpm-shared-stable-${{ runner.os }}-

      - run: pnpm install --frozen-lockfile
-        if: steps.check_frontend.outputs.frontend == 'true'

      - name: Run Prettier check
-        if: steps.check_frontend.outputs.frontend == 'true'
        run: pnpm format:check

      - name: Run ESLint
-        if: steps.check_frontend.outputs.frontend == 'true'
        run: pnpm lint

      - name: Run TypeScript typecheck
-        if: steps.check_frontend.outputs.frontend == 'true'
        run: pnpm typecheck

      - name: Run tests
-        if: steps.check_frontend.outputs.frontend == 'true'
        run: pnpm test

      - name: Run Knip
-        if: steps.check_frontend.outputs.frontend == 'true'
        run: pnpm knip:check

      - name: Architecture gates (listen/emit only in the event bus, invoke only in services)
-        if: steps.check_frontend.outputs.frontend == 'true'
        run: node scripts/check-architecture.mjs listen emit invoke
-
-  contract-parity:
-    runs-on: ubuntu-26.04
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Check contract inputs
-        id: check_inputs
-        uses: dorny/paths-filter@v4
-        with:
-          filters: scripts/contract-inputs.json
-
-      - name: Skip if contract inputs unchanged
-        if: steps.check_inputs.outputs.contract != 'true'
-        run: echo "No contract inputs changed, skipping parity check."
-
-      - name: Install Rust Stable
-        if: steps.check_inputs.outputs.contract == 'true'
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: stable
-
-      - name: Rust Cache
-        if: steps.check_inputs.outputs.contract == 'true'
-        uses: Swatinem/rust-cache@v2
-        with:
-          prefix-key: 'v1-rust'
-          key: 'rust-shared-stable-ubuntu-22.04-x86_64-unknown-linux-gnu-contract'
-          workspaces: |
-            . -> target
-          cache-all-crates: true
-          cache-workspace-crates: true
-
-      - name: Install dependencies
-        if: steps.check_inputs.outputs.contract == 'true'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libxslt1.1 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
-
-      - name: Install pnpm
-        if: steps.check_inputs.outputs.contract == 'true'
-        uses: pnpm/action-setup@v6
-        with:
-          run_install: false
-
-      - uses: actions/setup-node@v7
-        if: steps.check_inputs.outputs.contract == 'true'
-        with:
-          node-version: '24.22.1'
-          cache: 'pnpm'
-
-      - run: pnpm install --frozen-lockfile
-        if: steps.check_inputs.outputs.contract == 'true'
-
-      - name: Provision sidecar placeholders for tauri-build
-        if: steps.check_inputs.outputs.contract == 'true'
-        run: |
-          mkdir -p src-tauri/sidecar src-tauri/resources dist
-          touch dist/index.html
-          for bin in clash-verge-service clash-verge-service-install clash-verge-service-uninstall verge-mihomo verge-mihomo-alpha; do
-            touch "src-tauri/sidecar/${bin}-x86_64-unknown-linux-gnu"
-          done
-
-      - name: Check generated contract without changing the checkout
-        if: steps.check_inputs.outputs.contract == 'true'
-        run: pnpm gen:contract --check
@@ -2,6 +2,13 @@ name: Clippy Lint

 on:
  pull_request:
+    paths:
+      - "src-tauri/**"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "rust-toolchain.toml"
+      - ".github/workflows/lint-clippy.yml"
  workflow_dispatch:
 env:
  HUSKY: 0
@@ -23,28 +30,6 @@ jobs:

    runs-on: ${{ matrix.os }}
    steps:
-      - name: Check src-tauri changes
-        if: github.event_name != 'workflow_dispatch'
-        id: check_changes
-        uses: dorny/paths-filter@v4
-        with:
-          filters: |
-            rust:
-              - 'src-tauri/**'
-
-      - name: Skip if src-tauri not changed
-        if: github.event_name != 'workflow_dispatch' && steps.check_changes.outputs.rust != 'true'
-        run: echo "No src-tauri changes, skipping clippy lint."
-
-      - name: Continue if src-tauri changed
-        if: github.event_name != 'workflow_dispatch' && steps.check_changes.outputs.rust == 'true'
-        run: echo "src-tauri changed, running clippy lint."
-
-      - name: Manual trigger - always run
-        if: github.event_name == 'workflow_dispatch'
-        run: |
-          echo "Manual trigger detected: skipping changes check and running clippy."
-
      - name: Checkout Repository
        uses: actions/checkout@v7

@@ -79,7 +64,7 @@ jobs:
        run: cargo clippy-all

      - name: Run Windows security tests
-        if: matrix.os == 'windows-latest' && (github.event_name == 'workflow_dispatch' || steps.check_changes.outputs.rust == 'true')
+        if: matrix.os == 'windows-latest'
        working-directory: ./src-tauri
        run: cargo test --all-features --target ${{ matrix.target }}

@@ -6,6 +6,10 @@ name: Check Formatting

 on:
  pull_request:
+    paths:
+      - "src-tauri/**"
+      - "**/*.rs"
+      - ".github/workflows/rustfmt.yml"

 permissions:
  contents: read
@@ -19,25 +23,10 @@ jobs:
    steps:
      - uses: actions/checkout@v7

-      - name: Check Rust changes
-        id: check_rust
-        uses: dorny/paths-filter@v4
-        with:
-          filters: |
-            rust:
-              - 'src-tauri/**'
-              - '**/*.rs'
-
-      - name: Skip if no Rust changes
-        if: steps.check_rust.outputs.rust != 'true'
-        run: echo "No Rust changes, skipping rustfmt."
-
      - name: install Rust stable and rustfmt
-        if: steps.check_rust.outputs.rust == 'true'
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: run cargo fmt
-        if: steps.check_rust.outputs.rust == 'true'
        run: cargo fmt --manifest-path ./src-tauri/Cargo.toml --all -- --check
@@ -63,11 +63,11 @@ tracing = "0.1.44"

 tauri = { version = "2.12.4" }
 tauri-plugin-clipboard-manager = "2.5.0"
-parking_lot = { version = "0.13.0", features = ["hardware-lock-elision"] }
+parking_lot = { version = "0.12.5", features = ["hardware-lock-elision"] }
 anyhow = "1.0.104"
 chrono = "0.4.45"
 criterion = { version = "0.8.2", features = ["async_tokio"] }
-tokio = { version = "1.54.1", features = [
+tokio = { version = "1.53.3", features = [
  "rt-multi-thread",
  "macros",
  "time",
@@ -7,6 +7,10 @@
 - 修复通过 URL 导入订阅时，即使导入的订阅并非当前使用的订阅，也会重新加载当前配置
 - 修复 首页 网站测速失败后卡片一直显示测试中
 - 修复 代理 页展开分组后不显示最新测速结果，需切换节点才刷新
+- 修复 代理 在全局模式下无法展开节点组
+- 修复 自定义 CSS 无法修改编辑器字体和字号的问题
+- 修复恢复备份的同时修改配置，可能导致配置丢失或错乱的问题
+- 修复切换规则模式与配置变更并发时可能丢失或错乱的问题

 **🐧 Linux**

@@ -19,6 +23,7 @@

 - 新增虚拟网卡设置的「DNS 模式」选项，支持配置 mihomo 系统 DNS 行为
 - 新增「IP 信息」自动刷新开关，关闭后仍可手动刷新
+- 新增 Muse AI 解锁检测，针对 Muse AI 特有的 Cloudflare 人机验证增加「Risky」状态标记

 </details>

@@ -4,7 +4,7 @@ version = "0.1.0"
 edition = "2024"

 [dependencies]
-specta = { version = "=2.0.0-rc.27", features = ["derive", "function"] }
+specta = { version = "=2.0.0-rc.25", features = ["derive", "function"] }
 clash-verge-logging = { workspace = true }
 chrono = { workspace = true }
 log = { workspace = true }
@@ -11,6 +11,7 @@ mod chatgpt;
 mod claude;
 mod disney_plus;
 mod gemini;
+mod muse;
 mod netflix;
 mod prime_video;
 mod spotify;
@@ -30,6 +31,7 @@ enum UnlockCheck {
    ChatGptWeb,
    Claude,
    Gemini,
+    MuseAi,
    YouTubePremium,
    BahamutAnime,
    Netflix,
@@ -46,6 +48,7 @@ impl UnlockCheck {
        Self::ChatGptWeb,
        Self::Claude,
        Self::Gemini,
+        Self::MuseAi,
        Self::YouTubePremium,
        Self::BahamutAnime,
        Self::Netflix,
@@ -66,6 +69,7 @@ impl UnlockCheck {
            Self::ChatGptWeb => chatgpt::CHATGPT_WEB_NAME,
            Self::Claude => claude::CLAUDE_NAME,
            Self::Gemini => gemini::GEMINI_NAME,
+            Self::MuseAi => muse::MUSE_AI_NAME,
            Self::YouTubePremium => youtube::YOUTUBE_PREMIUM_NAME,
            Self::BahamutAnime => bahamut::BAHAMUT_ANIME_NAME,
            Self::Netflix => netflix::NETFLIX_NAME,
@@ -83,6 +87,7 @@ impl UnlockCheck {
            Self::ChatGptWeb => chatgpt::check_chatgpt(client).await,
            Self::Claude => claude::check_claude(client).await,
            Self::Gemini => gemini::check_gemini(client).await,
+            Self::MuseAi => muse::check_muse_ai(client).await,
            Self::YouTubePremium => youtube::check_youtube_premium(client).await,
            Self::BahamutAnime => bahamut::check_bahamut_anime(client).await,
            Self::Netflix => netflix::check_netflix(client).await,
@@ -0,0 +1,48 @@
+use reqwest::Client;
+
+use crate::utils::{classify_restricted_status, get_trace_location};
+
+use super::UnlockItem;
+
+pub(crate) const MUSE_AI_NAME: &str = "Muse AI";
+
+const MUSE_URL: &str = "https://muse.ai";
+const CLOUDFLARE_TRACE_URL: &str = "https://www.cloudflare.com/cdn-cgi/trace";
+
+// The aymh ("Are You a Human") gateway answers plain HTTP requests with a
+// generic Meta error page that always contains the Facebook logo asset.
+const AYMH_ERROR_MARKERS: &[&str] = &["Sorry, something went wrong", "static.facebook.com/images/logos"];
+
+pub(super) async fn check_muse_ai(client: &Client) -> UnlockItem {
+    // muse.ai itself is served by Vercel, so resolve the exit region through
+    // the generic Cloudflare trace endpoint instead of a service-specific one.
+    let region = get_trace_location(client, CLOUDFLARE_TRACE_URL)
+        .await
+        .map(|code| code.trim().to_ascii_uppercase())
+        .map(|code| UnlockItem::region_label(&code));
+
+    let Ok(response) = client.get(MUSE_URL).send().await else {
+        return UnlockItem::checked(MUSE_AI_NAME, "Failed (Network Connection)", region);
+    };
+
+    let status = response.status();
+    let landed_on_aymh = response.url().host_str() == Some("auth.muse.ai");
+    let body = response.text().await.unwrap_or_default();
+
+    // Every region is redirected to the aymh anti-bot gateway before the app
+    // loads, and a non-browser HTTP client cannot finish the JavaScript
+    // challenge. It returns the Meta error page, so reaching this point only
+    // proves the exit can connect to Muse's auth infrastructure; availability
+    // cannot be verified over plain HTTP and is reported as `Risky`.
+    let behind_anti_bot = landed_on_aymh || AYMH_ERROR_MARKERS.iter().any(|marker| body.contains(marker));
+
+    let result = if behind_anti_bot {
+        "Risky"
+    } else if status.is_success() {
+        "Yes"
+    } else {
+        classify_restricted_status(status).unwrap_or("Failed")
+    };
+
+    UnlockItem::checked(MUSE_AI_NAME, result, region)
+}
@@ -5,7 +5,7 @@ edition = "2024"
 rust-version = "1.91"

 [dependencies]
-specta = { version = "=2.0.0-rc.27", features = ["derive", "function"] }
+specta = { version = "=2.0.0-rc.25", features = ["derive", "function"] }
 tauri = { workspace = true }
 tauri-plugin-clipboard-manager = { workspace = true }
 parking_lot = { workspace = true }
@@ -14,7 +14,7 @@
    "build:fast": "cross-env NODE_OPTIONS='--max-old-space-size=4096' tauri build -- --profile fast-release",
    "tauri": "tauri",
    "web:dev": "vite",
-    "web:build": "tsc --noEmit && vite build",
+    "web:build": "tsrs -p . --noEmit && vite build",
    "web:serve": "vite preview",
    "prebuild": "node scripts/prebuild.mjs",
    "updater": "node scripts/updater.mjs",
@@ -32,7 +32,7 @@
    "i18n:types": "node scripts/generate-i18n-keys.mjs",
    "gen:contract": "node scripts/gen-contract.mjs",
    "arch:check": "node scripts/check-architecture.mjs listen emit invoke",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsrs -p . --noEmit",
    "test": "vitest run",
    "test:watch": "vitest",
    "knip:check": "knip",
@@ -128,6 +128,7 @@
    "sass": "^1.104.1",
    "tar": "^7.5.22",
    "terser": "^5.51.2",
+    "tsrs": "0.20.0-ts7.1.0-beta",
    "typescript": "^6.0.3",
    "typescript-eslint": "^8.70.0",
    "vite": "^8.3.0",
@@ -416,6 +416,9 @@ importers:
      terser:
        specifier: ^5.51.2
        version: 5.51.2
+      tsrs:
+        specifier: 0.20.0-ts7.1.0-beta
+        version: 0.20.0-ts7.1.0-beta
      typescript:
        specifier: ^6.0.3
        version: 6.0.3
@@ -2218,6 +2221,52 @@ packages:
  '@tauri-apps/plugin-updater@2.14.0':
    resolution: {integrity: sha512-gdylJ9tger4hkyOn24QZd6MNOKVo2Eh53iw5th2Qj1vKTR/+u4PIwJWuiis5hohYvobn6iOvlnALfrqIPSzh7Q==}

+  '@tsrs/darwin-arm64@0.20.0-ts7.1.0-beta':
+    resolution: {integrity: sha512-mhHj8QGUmdJDBvJEnMXx5P/jvAKXYU3hy/z3qxrWBo8XHlbLES32PgC0ZpTRbJA960ReTpVqqvCOYaC6EL32/Q==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@tsrs/darwin-x64@0.20.0-ts7.1.0-beta':
+    resolution: {integrity: sha512-CsRUnyYRLrhmChS7ol7LgmdqMXTu+mVlDU+7JgbW8RpkJRGLZ/zgEDEOeD8qrndt8rpP9oW1T1SJ36HSzB3/sg==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@tsrs/linux-arm64-gnu@0.20.0-ts7.1.0-beta':
+    resolution: {integrity: sha512-VNwpdI/iICwQMMlS/MoSZCvKFByEn2+g7D0HREWG+3r3GRayXgbLv8iaNSHKT3QGcu8pXr3lH9170ghJQi2zRg==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@tsrs/linux-arm64-musl@0.20.0-ts7.1.0-beta':
+    resolution: {integrity: sha512-cXnqPpmj5gzeGi4u1OV0ctd5df5t4ivwyeToCa4pBrKtjYodu0EeAo5Y76SHbJwggbiA1gzEJVj1vvuciQm5mQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@tsrs/linux-x64-gnu@0.20.0-ts7.1.0-beta':
+    resolution: {integrity: sha512-jlhJSrO9lxNh0TF5EU1i+Frok5sRWsBvCuQhmdqMZKIN2pSHsDZl3CSmKUsJ4tNr50np9USCPpkkxwby2Eiqhg==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@tsrs/linux-x64-musl@0.20.0-ts7.1.0-beta':
+    resolution: {integrity: sha512-pestGEPplhEPzIERc7zwuQ5zhh9ZwMSvAPNQy5TM0je/QuaizmM1zKoPYJ4NiaPzLh2M25HtP4HcpumTqmF3KQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@tsrs/win32-x64@0.20.0-ts7.1.0-beta':
+    resolution: {integrity: sha512-sstxBfhjjOSYvSHFfSmROau2oGAVNLwAnj+H0h+ywLo7N7ueFKIDk14HAkIYa/F9iVboiICCpHDY/pmBO71sSg==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [win32]
+
  '@tybys/wasm-util@0.10.4':
    resolution: {integrity: sha512-W3c4gRigFS0T/Ma4qIYF3GDAc5AQdHb1yL5znJT1Zv1YaD9Kitx656wBjvr19qbiosmZT8lWDM5BEMynUqX65A==}

@@ -4770,6 +4819,11 @@ packages:
  tslib@2.8.1:
    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}

+  tsrs@0.20.0-ts7.1.0-beta:
+    resolution: {integrity: sha512-8NifAn2tcna3t/nluu1yFvp0fYE28vElDpnD4jiWik69+MDjiHgxdjH8sUYUEFmf/2hl6QIE5ExVGpJzQbBDPw==}
+    engines: {node: '>=16.20.0'}
+    hasBin: true
+
  tunnel@0.0.6:
    resolution: {integrity: sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==}
    engines: {node: '>=0.6.11 <=0.7.0 || >=0.7.3'}
@@ -6882,6 +6936,27 @@ snapshots:
    dependencies:
      '@tauri-apps/api': 2.12.4

+  '@tsrs/darwin-arm64@0.20.0-ts7.1.0-beta':
+    optional: true
+
+  '@tsrs/darwin-x64@0.20.0-ts7.1.0-beta':
+    optional: true
+
+  '@tsrs/linux-arm64-gnu@0.20.0-ts7.1.0-beta':
+    optional: true
+
+  '@tsrs/linux-arm64-musl@0.20.0-ts7.1.0-beta':
+    optional: true
+
+  '@tsrs/linux-x64-gnu@0.20.0-ts7.1.0-beta':
+    optional: true
+
+  '@tsrs/linux-x64-musl@0.20.0-ts7.1.0-beta':
+    optional: true
+
+  '@tsrs/win32-x64@0.20.0-ts7.1.0-beta':
+    optional: true
+
  '@tybys/wasm-util@0.10.4':
    dependencies:
      tslib: 2.8.1
@@ -7222,7 +7297,7 @@ snapshots:

  '@wdio/globals@9.31.3(expect-webdriverio@6.1.0)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0))':
    dependencies:
-      expect-webdriverio: 6.1.0(@wdio/globals@9.31.3)(@wdio/logger@10.1.0)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0))
+      expect-webdriverio: 6.1.0(@wdio/globals@9.31.3)(@wdio/logger@9.29.1)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0))
      webdriverio: 10.1.0(supports-color@7.2.0)(yauzl@2.10.0)

  '@wdio/logger@10.1.0':
@@ -8206,11 +8281,11 @@ snapshots:

  expect-type@1.4.0: {}

-  expect-webdriverio@6.1.0(@wdio/globals@9.31.3)(@wdio/logger@10.1.0)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0)):
+  expect-webdriverio@6.1.0(@wdio/globals@9.31.3)(@wdio/logger@9.29.1)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0)):
    dependencies:
      '@vitest/snapshot': 4.1.11
      '@wdio/globals': 9.31.3(expect-webdriverio@6.1.0)(webdriverio@10.1.0(supports-color@7.2.0)(yauzl@2.10.0))
-      '@wdio/logger': 10.1.0
+      '@wdio/logger': 9.29.1
      deep-eql: 5.0.2
      expect: 30.5.2
      jest-matcher-utils: 30.5.2
@@ -9865,6 +9940,16 @@ snapshots:

  tslib@2.8.1: {}

+  tsrs@0.20.0-ts7.1.0-beta:
+    optionalDependencies:
+      '@tsrs/darwin-arm64': 0.20.0-ts7.1.0-beta
+      '@tsrs/darwin-x64': 0.20.0-ts7.1.0-beta
+      '@tsrs/linux-arm64-gnu': 0.20.0-ts7.1.0-beta
+      '@tsrs/linux-arm64-musl': 0.20.0-ts7.1.0-beta
+      '@tsrs/linux-x64-gnu': 0.20.0-ts7.1.0-beta
+      '@tsrs/linux-x64-musl': 0.20.0-ts7.1.0-beta
+      '@tsrs/win32-x64': 0.20.0-ts7.1.0-beta
+
  tunnel@0.0.6: {}

  type-check@0.4.0:
@@ -10,3 +10,11 @@ allowBuilds:
  unrs-resolver: true
 minimumReleaseAgeExclude:
  - dayjs@1.11.21
+  - "@tsrs/darwin-arm64@0.20.0-ts7.1.0-beta"
+  - "@tsrs/darwin-x64@0.20.0-ts7.1.0-beta"
+  - "@tsrs/linux-arm64-gnu@0.20.0-ts7.1.0-beta"
+  - "@tsrs/linux-arm64-musl@0.20.0-ts7.1.0-beta"
+  - "@tsrs/linux-x64-gnu@0.20.0-ts7.1.0-beta"
+  - "@tsrs/linux-x64-musl@0.20.0-ts7.1.0-beta"
+  - "@tsrs/win32-x64@0.20.0-ts7.1.0-beta"
+  - tsrs@0.20.0-ts7.1.0-beta
@@ -79,6 +79,13 @@
      "matchPackageNames": ["typescript"],
      "allowedVersions": "<7.0.0 || >=7.1.0"
    },
+    {
+      "description": "Review tsrs bumps alone; the version encodes the pinned TypeScript release",
+      "matchPackageNames": ["tsrs", "/^@tsrs//"],
+      "groupName": "tsrs",
+      "rangeStrategy": "pin",
+      "automerge": false
+    },
    {
      "description": "Prevent project from supply chain attack",
      "matchDatasources": ["npm"],
@@ -17,7 +17,7 @@
    "pnpm-lock.yaml",
    "pnpm-workspace.yaml",
    "scripts/contract-inputs.json",
-    ".github/workflows/frontend-check.yml",
+    ".github/workflows/contract-parity.yml",
    ".husky/pre-push"
  ]
 }
@@ -58,8 +58,8 @@ smartstring = { workspace = true, features = ["serde"] }
 bitflags = { workspace = true }
 socket2 = { workspace = true }
 warp = { version = "0.4.3", features = ["server"] }
-open = "5.4.5"
-rfd = { version = "0.17.2", default-features = false, features = ["common-controls-v6"] }
+open = "5.4.4"
+rfd = { version = "0.16.0", default-features = false, features = ["common-controls-v6"] }
 dirs = "7.0.0"
 dunce = "1.0.5"
 nanoid = "0.5"
@@ -79,7 +79,7 @@ tauri-plugin-fs = "2.7.1"
 tauri-plugin-process = "2.4.0"
 tauri-plugin-deep-link = "2.6.2"
 tauri-plugin-window-state = "2.5.0"
-zip = "9.1.2"
+zip = "9.0.4"
 flate2 = "1.1.10"
 reqwest_dav = "0.3.3"
 aes-gcm = { version = "0.11.1" }
@@ -101,16 +101,16 @@ async-trait = "0.1.92"
 clash_verge_service_ipc = { git = "https://github.com/clash-verge-rev/clash-verge-service-ipc.git", tag = "v2.7.6", version = "2.7.6", features = [
  "client",
 ] }
-arc-swap = "1.9.3"
+arc-swap = "1.9.2"
 tokio-rustls = "0.26.6"
 rustls = { version = "0.23.46", features = ["ring"] }
-webpki-roots = "1.0.11"
+webpki-roots = "1.0.9"
 dark-light = "3.0.0"
 bytes = "1.12.1"
 tokio-util = { version = "0.7.20", features = ["time"] }
-specta = { version = "=2.0.0-rc.27", features = ["derive", "function", "serde_json"] }
+specta = { version = "=2.0.0-rc.25", features = ["derive", "function", "serde_json"] }
 tauri-specta = { version = "=2.0.0-rc.25", features = ["derive", "typescript"] }
-specta-typescript = "=0.0.14"
+specta-typescript = "=0.0.12"

 [target.'cfg(unix)'.dependencies]
 libc = "0.2.191"
@@ -184,84 +184,41 @@ impl IClashTemp {
            _ => None,
        })
    }
-    #[cfg(not(target_os = "windows"))]
-    fn guard_redir_port(config: &Mapping) -> u16 {
+    fn guard_port_value(config: &Mapping, key: &str, default: u16) -> u16 {
        let mut port = config
-            .get("redir-port")
+            .get(key)
            .and_then(|value| match value {
                Value::String(val_str) => val_str.parse().ok(),
                Value::Number(val_num) => val_num.as_u64().map(|u| u as u16),
                _ => None,
            })
-            .unwrap_or(7895);
+            .unwrap_or(default);
        if port == 0 {
-            port = 7895;
+            port = default;
        }
        port
    }

+    #[cfg(not(target_os = "windows"))]
+    fn guard_redir_port(config: &Mapping) -> u16 {
+        Self::guard_port_value(config, "redir-port", network::ports::DEFAULT_REDIR)
+    }
+
    #[cfg(target_os = "linux")]
    fn guard_tproxy_port(config: &Mapping) -> u16 {
-        let mut port = config
-            .get("tproxy-port")
-            .and_then(|value| match value {
-                Value::String(val_str) => val_str.parse().ok(),
-                Value::Number(val_num) => val_num.as_u64().map(|u| u as u16),
-                _ => None,
-            })
-            .unwrap_or(network::ports::DEFAULT_TPROXY);
-        if port == 0 {
-            port = network::ports::DEFAULT_TPROXY;
-        }
-        port
+        Self::guard_port_value(config, "tproxy-port", network::ports::DEFAULT_TPROXY)
    }

    fn guard_mixed_port(config: &Mapping) -> u16 {
-        let raw_value = config.get("mixed-port");
-
-        let mut port = raw_value
-            .and_then(|value| match value {
-                Value::String(val_str) => val_str.parse().ok(),
-                Value::Number(val_num) => val_num.as_u64().map(|u| u as u16),
-                _ => None,
-            })
-            .unwrap_or(network::ports::DEFAULT_MIXED);
-
-        if port == 0 {
-            port = network::ports::DEFAULT_MIXED;
-        }
-
-        port
+        Self::guard_port_value(config, "mixed-port", network::ports::DEFAULT_MIXED)
    }

    fn guard_socks_port(config: &Mapping) -> u16 {
-        let mut port = config
-            .get("socks-port")
-            .and_then(|value| match value {
-                Value::String(val_str) => val_str.parse().ok(),
-                Value::Number(val_num) => val_num.as_u64().map(|u| u as u16),
-                _ => None,
-            })
-            .unwrap_or(7898);
-        if port == 0 {
-            port = 7898;
-        }
-        port
+        Self::guard_port_value(config, "socks-port", network::ports::DEFAULT_SOCKS)
    }

    fn guard_port(config: &Mapping) -> u16 {
-        let mut port = config
-            .get("port")
-            .and_then(|value| match value {
-                Value::String(val_str) => val_str.parse().ok(),
-                Value::Number(val_num) => val_num.as_u64().map(|u| u as u16),
-                _ => None,
-            })
-            .unwrap_or(7899);
-        if port == 0 {
-            port = 7899;
-        }
-        port
+        Self::guard_port_value(config, "port", network::ports::DEFAULT_HTTP)
    }

    pub(super) fn guard_server_ctrl(config: &Mapping) -> String {
@@ -14,6 +14,15 @@ mod verge;
 pub(crate) use self::config::Config;
 pub use self::{clash::*, encrypt::*, mixed_port::*, prfitem::*, profiles::*, verge::*};

+macro_rules! patch_opt_field {
+    ($lv:expr, $rv:expr, $key:tt) => {
+        if ($rv.$key).is_some() {
+            $lv.$key = $rv.$key.clone();
+        }
+    };
+}
+pub(crate) use patch_opt_field;
+
 pub const DEFAULT_PAC: &str = r#"function FindProxyForURL(url, host) {
  return "PROXY 127.0.0.1:%mixed-port%; SOCKS5 127.0.0.1:%mixed-port%; DIRECT;";
 }
@@ -1,3 +1,5 @@
+use super::patch_opt_field;
+
 use crate::{
    config::profiles,
    utils::{
@@ -131,19 +133,18 @@ impl PrfOption {
        match (one, other) {
            (Some(a_ref), Some(b_ref)) => {
                let mut result = a_ref.clone();
-                result.user_agent = b_ref.user_agent.clone().or(result.user_agent);
-                result.with_proxy = b_ref.with_proxy.or(result.with_proxy);
-                result.self_proxy = b_ref.self_proxy.or(result.self_proxy);
-                result.danger_accept_invalid_certs =
-                    b_ref.danger_accept_invalid_certs.or(result.danger_accept_invalid_certs);
-                result.allow_auto_update = b_ref.allow_auto_update.or(result.allow_auto_update);
-                result.update_interval = b_ref.update_interval.or(result.update_interval);
-                result.merge = b_ref.merge.clone().or(result.merge);
-                result.script = b_ref.script.clone().or(result.script);
-                result.rules = b_ref.rules.clone().or(result.rules);
-                result.proxies = b_ref.proxies.clone().or(result.proxies);
-                result.groups = b_ref.groups.clone().or(result.groups);
-                result.timeout_seconds = b_ref.timeout_seconds.or(result.timeout_seconds);
+                patch_opt_field!(result, b_ref, user_agent);
+                patch_opt_field!(result, b_ref, with_proxy);
+                patch_opt_field!(result, b_ref, self_proxy);
+                patch_opt_field!(result, b_ref, danger_accept_invalid_certs);
+                patch_opt_field!(result, b_ref, allow_auto_update);
+                patch_opt_field!(result, b_ref, update_interval);
+                patch_opt_field!(result, b_ref, merge);
+                patch_opt_field!(result, b_ref, script);
+                patch_opt_field!(result, b_ref, rules);
+                patch_opt_field!(result, b_ref, proxies);
+                patch_opt_field!(result, b_ref, groups);
+                patch_opt_field!(result, b_ref, timeout_seconds);
                Some(result)
            }
            (Some(a_ref), None) => Some(a_ref.clone()),
@@ -181,6 +182,36 @@ impl PrfItem {
        }
    }

+    async fn append_companion_item(item: &mut Self) -> Result<Option<String>> {
+        profiles::profiles_append_item_safe(item).await?;
+        Ok(item.uid.clone())
+    }
+
+    async fn ensure_companion_items(
+        merge: &mut Option<String>,
+        script: &mut Option<String>,
+        rules: &mut Option<String>,
+        proxies: &mut Option<String>,
+        groups: &mut Option<String>,
+    ) -> Result<()> {
+        if merge.is_none() {
+            *merge = Self::append_companion_item(&mut Self::from_merge(None)).await?;
+        }
+        if script.is_none() {
+            *script = Self::append_companion_item(&mut Self::from_script(None)).await?;
+        }
+        if rules.is_none() {
+            *rules = Self::append_companion_item(&mut Self::from_rules()).await?;
+        }
+        if proxies.is_none() {
+            *proxies = Self::append_companion_item(&mut Self::from_proxies()).await?;
+        }
+        if groups.is_none() {
+            *groups = Self::append_companion_item(&mut Self::from_groups()).await?;
+        }
+        Ok(())
+    }
+
    async fn from_local(
        name: String,
        desc: String,
@@ -197,31 +228,7 @@ impl PrfItem {
        let mut proxies = opt_ref.and_then(|o| o.proxies.clone());
        let mut groups = opt_ref.and_then(|o| o.groups.clone());

-        if merge.is_none() {
-            let merge_item = &mut Self::from_merge(None);
-            profiles::profiles_append_item_safe(merge_item).await?;
-            merge = merge_item.uid.clone();
-        }
-        if script.is_none() {
-            let script_item = &mut Self::from_script(None);
-            profiles::profiles_append_item_safe(script_item).await?;
-            script = script_item.uid.clone();
-        }
-        if rules.is_none() {
-            let rules_item = &mut Self::from_rules();
-            profiles::profiles_append_item_safe(rules_item).await?;
-            rules = rules_item.uid.clone();
-        }
-        if proxies.is_none() {
-            let proxies_item = &mut Self::from_proxies();
-            profiles::profiles_append_item_safe(proxies_item).await?;
-            proxies = proxies_item.uid.clone();
-        }
-        if groups.is_none() {
-            let groups_item = &mut Self::from_groups();
-            profiles::profiles_append_item_safe(groups_item).await?;
-            groups = groups_item.uid.clone();
-        }
+        Self::ensure_companion_items(&mut merge, &mut script, &mut rules, &mut proxies, &mut groups).await?;
        Ok(Self {
            uid: Some(uid),
            itype: Some("local".into()),
@@ -375,31 +382,7 @@ impl PrfItem {
            bail!("profile does not contain `proxies` or `proxy-providers`");
        }

-        if merge.is_none() {
-            let merge_item = &mut Self::from_merge(None);
-            profiles::profiles_append_item_safe(merge_item).await?;
-            merge = merge_item.uid.clone();
-        }
-        if script.is_none() {
-            let script_item = &mut Self::from_script(None);
-            profiles::profiles_append_item_safe(script_item).await?;
-            script = script_item.uid.clone();
-        }
-        if rules.is_none() {
-            let rules_item = &mut Self::from_rules();
-            profiles::profiles_append_item_safe(rules_item).await?;
-            rules = rules_item.uid.clone();
-        }
-        if proxies.is_none() {
-            let proxies_item = &mut Self::from_proxies();
-            profiles::profiles_append_item_safe(proxies_item).await?;
-            proxies = proxies_item.uid.clone();
-        }
-        if groups.is_none() {
-            let groups_item = &mut Self::from_groups();
-            profiles::profiles_append_item_safe(groups_item).await?;
-            groups = groups_item.uid.clone();
-        }
+        Self::ensure_companion_items(&mut merge, &mut script, &mut rules, &mut proxies, &mut groups).await?;

        Ok(Self {
            uid: Some(uid),
@@ -461,46 +444,30 @@ impl PrfItem {
        }
    }

-    fn from_rules() -> Self {
-        let uid = help::get_uid("r").into();
+    fn from_seq_item(prefix: &str, itype: &str, template: &str) -> Self {
+        let uid = help::get_uid(prefix).into();
        let file = format!("{uid}.yaml").into(); // yaml ext

        Self {
            uid: Some(uid),
-            itype: Some("rules".into()),
+            itype: Some(itype.into()),
            file: Some(file),
            updated: Some(chrono::Local::now().timestamp() as usize),
-            file_data: Some(tmpl::ITEM_RULES.into()),
+            file_data: Some(template.into()),
            ..Default::default()
        }
    }

+    fn from_rules() -> Self {
+        Self::from_seq_item("r", "rules", tmpl::ITEM_RULES)
+    }
+
    fn from_proxies() -> Self {
-        let uid = help::get_uid("p").into();
-        let file = format!("{uid}.yaml").into(); // yaml ext
-
-        Self {
-            uid: Some(uid),
-            itype: Some("proxies".into()),
-            file: Some(file),
-            updated: Some(chrono::Local::now().timestamp() as usize),
-            file_data: Some(tmpl::ITEM_PROXIES.into()),
-            ..Default::default()
-        }
+        Self::from_seq_item("p", "proxies", tmpl::ITEM_PROXIES)
    }

    fn from_groups() -> Self {
-        let uid = help::get_uid("g").into();
-        let file = format!("{uid}.yaml").into(); // yaml ext
-
-        Self {
-            uid: Some(uid),
-            itype: Some("groups".into()),
-            file: Some(file),
-            updated: Some(chrono::Local::now().timestamp() as usize),
-            file_data: Some(tmpl::ITEM_GROUPS.into()),
-            ..Default::default()
-        }
+        Self::from_seq_item("g", "groups", tmpl::ITEM_GROUPS)
    }

    pub(crate) async fn read_file(&self) -> Result<String> {
@@ -516,26 +483,20 @@ impl PrfItem {
    }
 }

+macro_rules! current_field {
+    ($name:ident, $field:ident) => {
+        pub(crate) fn $name(&self) -> Option<&String> {
+            self.option.as_ref().and_then(|o| o.$field.as_ref())
+        }
+    };
+}
+
 impl PrfItem {
-    pub(crate) fn current_merge(&self) -> Option<&String> {
-        self.option.as_ref().and_then(|o| o.merge.as_ref())
-    }
-
-    pub(crate) fn current_script(&self) -> Option<&String> {
-        self.option.as_ref().and_then(|o| o.script.as_ref())
-    }
-
-    pub(crate) fn current_rules(&self) -> Option<&String> {
-        self.option.as_ref().and_then(|o| o.rules.as_ref())
-    }
-
-    pub(crate) fn current_proxies(&self) -> Option<&String> {
-        self.option.as_ref().and_then(|o| o.proxies.as_ref())
-    }
-
-    pub(crate) fn current_groups(&self) -> Option<&String> {
-        self.option.as_ref().and_then(|o| o.groups.as_ref())
-    }
+    current_field!(current_merge, merge);
+    current_field!(current_script, script);
+    current_field!(current_rules, rules);
+    current_field!(current_proxies, proxies);
+    current_field!(current_groups, groups);
 }

 fn allow_auto_update_enabled(option: Option<&PrfOption>) -> bool {
@@ -1,5 +1,5 @@
 use super::{
-    PrfOption,
+    PrfOption, patch_opt_field,
    prfitem::{PrfItem, PrfSelected, normalize_profile_home_url},
 };
 use crate::core::notify::{Refresh, announce};
@@ -86,14 +86,6 @@ impl ProfileDeletePlan {
    }
 }

-macro_rules! patch {
-    ($lv: expr, $rv: expr, $key: tt) => {
-        if ($rv.$key).is_some() {
-            $lv.$key = $rv.$key.to_owned();
-        }
-    };
-}
-
 impl IProfiles {
    fn take_item_file_by_uid(items: &mut Vec<PrfItem>, target_uid: Option<&str>) -> Option<String> {
        let index = items.iter().position(|item| item.uid.as_deref() == target_uid)?;
@@ -244,15 +236,15 @@ impl IProfiles {

        for each in items.iter_mut() {
            if each.uid.as_deref() == Some(uid) {
-                patch!(each, item, itype);
-                patch!(each, item, name);
-                patch!(each, item, desc);
-                patch!(each, item, file);
-                patch!(each, item, url);
-                patch!(each, item, selected);
-                patch!(each, item, extra);
-                patch!(each, item, updated);
-                patch!(each, item, option);
+                patch_opt_field!(each, item, itype);
+                patch_opt_field!(each, item, name);
+                patch_opt_field!(each, item, desc);
+                patch_opt_field!(each, item, file);
+                patch_opt_field!(each, item, url);
+                patch_opt_field!(each, item, selected);
+                patch_opt_field!(each, item, extra);
+                patch_opt_field!(each, item, updated);
+                patch_opt_field!(each, item, option);

                self.items = Some(items);
                return self.save_file().await;
@@ -420,6 +412,21 @@ pub(crate) async fn profiles_append_item_with_filedata_safe(item: &PrfItem, file
    profiles_append_item_safe(item).await
 }

+/// Applies `edit` to the committed profiles; commits only when the edit succeeds.
+async fn with_profiles_edit<F, Fut>(edit: F) -> Result<()>
+where
+    F: FnOnce(IProfiles) -> Fut + Send,
+    Fut: std::future::Future<Output = Result<IProfiles>> + Send,
+{
+    Config::profiles()
+        .await
+        .with_data_modify(|profiles| async move {
+            let profiles = edit(profiles).await?;
+            Ok((profiles, ()))
+        })
+        .await
+}
+
 pub(crate) async fn profiles_append_item_safe(item: &mut PrfItem) -> Result<()> {
    let profiles = Config::profiles().await;
    profiles_append_item_to_safe(&profiles, item).await
@@ -435,43 +442,19 @@ pub(super) async fn profiles_append_item_to_safe(profiles: &Draft<IProfiles>, it
 }

 pub(crate) async fn profiles_patch_item_safe(index: &str, item: &PrfItem) -> Result<()> {
-    Config::profiles()
-        .await
-        .with_data_modify(|mut profiles| async move {
-            profiles.patch_item(index, item).await?;
-            Ok((profiles, ()))
-        })
-        .await
+    with_profiles_edit(|mut profiles| async move { profiles.patch_item(index, item).await.map(|_| profiles) }).await
 }

 pub(crate) async fn profiles_reorder_safe(active_id: &str, over_id: &str) -> Result<()> {
-    Config::profiles()
-        .await
-        .with_data_modify(|mut profiles| async move {
-            profiles.reorder(active_id, over_id).await?;
-            Ok((profiles, ()))
-        })
-        .await
+    with_profiles_edit(|mut profiles| async move { profiles.reorder(active_id, over_id).await.map(|_| profiles) }).await
 }

 pub(crate) async fn profiles_save_file_safe() -> Result<()> {
-    Config::profiles()
-        .await
-        .with_data_modify(|profiles| async move {
-            profiles.save_file().await?;
-            Ok((profiles, ()))
-        })
-        .await
+    with_profiles_edit(|profiles| async move { profiles.save_file().await.map(|_| profiles) }).await
 }

 pub(crate) async fn profiles_update_item_safe(index: &str, item: &mut PrfItem) -> Result<()> {
-    Config::profiles()
-        .await
-        .with_data_modify(|mut profiles| async move {
-            profiles.update_item(index, item).await?;
-            Ok((profiles, ()))
-        })
-        .await
+    with_profiles_edit(|mut profiles| async move { profiles.update_item(index, item).await.map(|_| profiles) }).await
 }

 #[derive(Debug, PartialEq, Eq)]
@@ -713,19 +696,21 @@ where
    Ok(())
 }

+fn current_item_mut(profiles: &mut IProfiles) -> Option<&mut PrfItem> {
+    let current = profiles.current.clone()?;
+    profiles
+        .items
+        .as_mut()?
+        .iter_mut()
+        .find(|item| item.uid.as_ref() == Some(&current))
+}
+
 /// Records a backend-made selection so the next core start restores it.
 pub(crate) async fn record_selected_node(group_name: &str, node: &str) -> Result<()> {
    let group_name = String::from(group_name);
    let node = String::from(node);
    persist_selected_update(true, move |mut profiles| async move {
-        let Some(current) = profiles.current.clone() else {
-            return Ok((profiles, false));
-        };
-        let Some(item) = profiles
-            .items
-            .as_mut()
-            .and_then(|items| items.iter_mut().find(|item| item.uid.as_ref() == Some(&current)))
-        else {
+        let Some(item) = current_item_mut(&mut profiles) else {
            return Ok((profiles, false));
        };

@@ -760,14 +745,7 @@ fn remove_selected_node(selected: &mut Vec<PrfSelected>, group_name: &str) -> bo

 pub(crate) async fn forget_selected_node(group_name: &str) -> Result<()> {
    persist_selected_update(true, move |mut profiles| async move {
-        let Some(current) = profiles.current.clone() else {
-            return Ok((profiles, false));
-        };
-        let Some(item) = profiles
-            .items
-            .as_mut()
-            .and_then(|items| items.iter_mut().find(|item| item.uid.as_ref() == Some(&current)))
-        else {
+        let Some(item) = current_item_mut(&mut profiles) else {
            return Ok((profiles, false));
        };

@@ -1,6 +1,6 @@
 use crate::config::Config;
 use crate::{
-    config::{DEFAULT_PAC, deserialize_encrypted, serialize_encrypted},
+    config::{DEFAULT_PAC, deserialize_encrypted, patch_opt_field, serialize_encrypted},
    constants::network,
    utils::{dirs, help},
 };
@@ -432,98 +432,90 @@ impl IVerge {

    #[allow(clippy::cognitive_complexity)]
    pub fn patch_config(&mut self, patch: &Self) {
-        macro_rules! patch {
-            ($key: tt) => {
-                if patch.$key.is_some() {
-                    self.$key = patch.$key.clone();
-                }
-            };
-        }
+        patch_opt_field!(self, patch, app_log_level);
+        patch_opt_field!(self, patch, app_log_max_size);
+        patch_opt_field!(self, patch, app_log_max_count);

-        patch!(app_log_level);
-        patch!(app_log_max_size);
-        patch!(app_log_max_count);
-
-        patch!(language);
-        patch!(theme_mode);
-        patch!(tray_event);
-        patch!(env_type);
-        patch!(start_page);
-        patch!(startup_script);
-        patch!(traffic_graph);
-        patch!(enable_memory_usage);
-        patch!(enable_group_icon);
-        patch!(pause_render_traffic_stats_on_blur);
+        patch_opt_field!(self, patch, language);
+        patch_opt_field!(self, patch, theme_mode);
+        patch_opt_field!(self, patch, tray_event);
+        patch_opt_field!(self, patch, env_type);
+        patch_opt_field!(self, patch, start_page);
+        patch_opt_field!(self, patch, startup_script);
+        patch_opt_field!(self, patch, traffic_graph);
+        patch_opt_field!(self, patch, enable_memory_usage);
+        patch_opt_field!(self, patch, enable_group_icon);
+        patch_opt_field!(self, patch, pause_render_traffic_stats_on_blur);
        #[cfg(target_os = "macos")]
-        patch!(tray_icon);
-        patch!(menu_icon);
-        patch!(menu_order);
-        patch!(proxy_group_tools_position);
-        patch!(notice_position);
-        patch!(collapse_navbar);
-        patch!(common_tray_icon);
-        patch!(sysproxy_tray_icon);
-        patch!(tun_tray_icon);
+        patch_opt_field!(self, patch, tray_icon);
+        patch_opt_field!(self, patch, menu_icon);
+        patch_opt_field!(self, patch, menu_order);
+        patch_opt_field!(self, patch, proxy_group_tools_position);
+        patch_opt_field!(self, patch, notice_position);
+        patch_opt_field!(self, patch, collapse_navbar);
+        patch_opt_field!(self, patch, common_tray_icon);
+        patch_opt_field!(self, patch, sysproxy_tray_icon);
+        patch_opt_field!(self, patch, tun_tray_icon);

-        patch!(enable_tun_mode);
-        patch!(enable_auto_launch);
-        patch!(enable_silent_start);
-        patch!(enable_hover_jump_navigator);
-        patch!(hover_jump_navigator_delay);
+        patch_opt_field!(self, patch, enable_tun_mode);
+        patch_opt_field!(self, patch, enable_auto_launch);
+        patch_opt_field!(self, patch, enable_silent_start);
+        patch_opt_field!(self, patch, enable_hover_jump_navigator);
+        patch_opt_field!(self, patch, hover_jump_navigator_delay);
        #[cfg(not(target_os = "windows"))]
-        patch!(verge_redir_port);
+        patch_opt_field!(self, patch, verge_redir_port);
        #[cfg(not(target_os = "windows"))]
-        patch!(verge_redir_enabled);
+        patch_opt_field!(self, patch, verge_redir_enabled);
        #[cfg(target_os = "linux")]
-        patch!(verge_tproxy_port);
+        patch_opt_field!(self, patch, verge_tproxy_port);
        #[cfg(target_os = "linux")]
-        patch!(verge_tproxy_enabled);
-        patch!(verge_mixed_port);
-        patch!(verge_socks_port);
-        patch!(verge_socks_enabled);
-        patch!(verge_port);
-        patch!(verge_http_enabled);
-        patch!(enable_system_proxy);
-        patch!(enable_proxy_guard);
-        patch!(enable_bypass_check);
-        patch!(use_default_bypass);
-        patch!(system_proxy_bypass);
-        patch!(proxy_guard_duration);
-        patch!(proxy_auto_config);
-        patch!(pac_file_content);
-        patch!(proxy_host);
-        patch!(theme_setting);
-        patch!(web_ui_list);
-        patch!(clash_core);
-        patch!(hotkeys);
-        patch!(enable_global_hotkey);
+        patch_opt_field!(self, patch, verge_tproxy_enabled);
+        patch_opt_field!(self, patch, verge_mixed_port);
+        patch_opt_field!(self, patch, verge_socks_port);
+        patch_opt_field!(self, patch, verge_socks_enabled);
+        patch_opt_field!(self, patch, verge_port);
+        patch_opt_field!(self, patch, verge_http_enabled);
+        patch_opt_field!(self, patch, enable_system_proxy);
+        patch_opt_field!(self, patch, enable_proxy_guard);
+        patch_opt_field!(self, patch, enable_bypass_check);
+        patch_opt_field!(self, patch, use_default_bypass);
+        patch_opt_field!(self, patch, system_proxy_bypass);
+        patch_opt_field!(self, patch, proxy_guard_duration);
+        patch_opt_field!(self, patch, proxy_auto_config);
+        patch_opt_field!(self, patch, pac_file_content);
+        patch_opt_field!(self, patch, proxy_host);
+        patch_opt_field!(self, patch, theme_setting);
+        patch_opt_field!(self, patch, web_ui_list);
+        patch_opt_field!(self, patch, clash_core);
+        patch_opt_field!(self, patch, hotkeys);
+        patch_opt_field!(self, patch, enable_global_hotkey);

-        patch!(auto_close_connection);
-        patch!(auto_check_update);
-        patch!(default_latency_test);
-        patch!(default_latency_timeout);
-        patch!(enable_auto_delay_detection);
-        patch!(auto_delay_detection_interval_minutes);
-        patch!(enable_builtin_enhanced);
-        patch!(proxy_layout_column);
-        patch!(test_list);
-        patch!(auto_log_clean);
-        patch!(enable_auto_backup_schedule);
-        patch!(auto_backup_interval_hours);
-        patch!(auto_backup_on_change);
+        patch_opt_field!(self, patch, auto_close_connection);
+        patch_opt_field!(self, patch, auto_check_update);
+        patch_opt_field!(self, patch, default_latency_test);
+        patch_opt_field!(self, patch, default_latency_timeout);
+        patch_opt_field!(self, patch, enable_auto_delay_detection);
+        patch_opt_field!(self, patch, auto_delay_detection_interval_minutes);
+        patch_opt_field!(self, patch, enable_builtin_enhanced);
+        patch_opt_field!(self, patch, proxy_layout_column);
+        patch_opt_field!(self, patch, test_list);
+        patch_opt_field!(self, patch, auto_log_clean);
+        patch_opt_field!(self, patch, enable_auto_backup_schedule);
+        patch_opt_field!(self, patch, auto_backup_interval_hours);
+        patch_opt_field!(self, patch, auto_backup_on_change);

-        patch!(webdav_url);
-        patch!(webdav_username);
-        patch!(webdav_password);
+        patch_opt_field!(self, patch, webdav_url);
+        patch_opt_field!(self, patch, webdav_username);
+        patch_opt_field!(self, patch, webdav_password);
        #[cfg(target_os = "macos")]
-        patch!(enable_tray_speed);
-        patch!(tray_proxy_groups_display_mode);
-        patch!(tray_inline_outbound_modes);
-        patch!(enable_auto_light_weight_mode);
-        patch!(auto_light_weight_minutes);
-        patch!(enable_dns_settings);
-        patch!(home_cards);
-        patch!(enable_external_controller);
+        patch_opt_field!(self, patch, enable_tray_speed);
+        patch_opt_field!(self, patch, tray_proxy_groups_display_mode);
+        patch_opt_field!(self, patch, tray_inline_outbound_modes);
+        patch_opt_field!(self, patch, enable_auto_light_weight_mode);
+        patch_opt_field!(self, patch, auto_light_weight_minutes);
+        patch_opt_field!(self, patch, enable_dns_settings);
+        patch_opt_field!(self, patch, home_cards);
+        patch_opt_field!(self, patch, enable_external_controller);
    }

    pub fn get_log_level(&self) -> LevelFilter {
@@ -14,6 +14,13 @@ pub mod network {
    }
 }

+pub mod proxy {
+    /// Single source of the macOS default bypass list; both proxy backends compose from it.
+    #[cfg(target_os = "macos")]
+    pub const MACOS_DEFAULT_BYPASS: &str =
+        "127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,localhost,*.local,*.crashlytics.com,<local>";
+}
+
 pub mod timing {
    use super::Duration;

@@ -7,11 +7,10 @@ use crate::{
 use anyhow::Result;
 use chrono::Local;
 use clash_verge_logging::{Type, logging};
-use parking_lot::RwLock;
 use std::{
    path::PathBuf,
    sync::{
-        Arc, OnceLock,
+        OnceLock,
        atomic::{AtomicBool, AtomicI64, Ordering},
    },
    time::{Duration, UNIX_EPOCH},
@@ -82,8 +81,9 @@ impl Default for AutoBackupSettings {
 }

 pub struct AutoBackupManager {
-    settings: Arc<RwLock<AutoBackupSettings>>,
    settings_tx: watch::Sender<AutoBackupSettings>,
+    // The watch channel is the single settings store; no duplicate copies.
+    settings_rx: watch::Receiver<AutoBackupSettings>,
    runner_started: AtomicBool,
    exec_lock: Mutex<()>,
    last_backup: AtomicI64,
@@ -93,10 +93,10 @@ impl AutoBackupManager {
    pub fn global() -> &'static Self {
        static INSTANCE: OnceLock<AutoBackupManager> = OnceLock::new();
        INSTANCE.get_or_init(|| {
-            let (tx, _rx) = watch::channel(AutoBackupSettings::default());
+            let (settings_tx, settings_rx) = watch::channel(AutoBackupSettings::default());
            Self {
-                settings: Arc::new(RwLock::new(AutoBackupSettings::default())),
-                settings_tx: tx,
+                settings_tx,
+                settings_rx,
                runner_started: AtomicBool::new(false),
                exec_lock: Mutex::new(()),
                last_backup: AtomicI64::new(0),
@@ -106,9 +106,6 @@ impl AutoBackupManager {

    pub async fn init(&self) -> Result<()> {
        let settings = Self::load_settings().await;
-        {
-            *self.settings.write() = settings;
-        }
        let _ = self.settings_tx.send(settings);
        self.maybe_start_runner(settings);
        Ok(())
@@ -116,9 +113,6 @@ impl AutoBackupManager {

    pub async fn refresh_settings(&self) -> Result<()> {
        let settings = Self::load_settings().await;
-        {
-            *self.settings.write() = settings;
-        }
        let _ = self.settings_tx.send(settings);
        self.maybe_start_runner(settings);
        Ok(())
@@ -193,7 +187,7 @@ impl AutoBackupManager {
    }

    async fn execute_trigger(&self, trigger: AutoBackupTrigger) -> Result<()> {
-        let snapshot = *self.settings.read();
+        let snapshot = *self.settings_rx.borrow();

        if trigger.is_schedule() && !snapshot.schedule_enabled {
            return Ok(());
@@ -466,12 +466,3 @@ impl Hotkey {
        (del_list, add_list)
    }
 }
-
-impl Drop for Hotkey {
-    fn drop(&mut self) {
-        let app_handle = handle::Handle::app_handle();
-        if let Err(e) = app_handle.global_shortcut().unregister_all() {
-            logging!(error, Type::Hotkey, "Error unregistering all hotkeys: {:?}", e);
-        }
-    }
-}
@@ -40,8 +40,47 @@ impl LightweightState {

 static LIGHTWEIGHT_STATE: AtomicU8 = AtomicU8::new(LightweightState::Normal as u8);

-static WINDOW_CLOSE_HANDLER_ID: AtomicU32 = AtomicU32::new(0);
-static WEBVIEW_FOCUS_HANDLER_ID: AtomicU32 = AtomicU32::new(0);
+struct WindowListener {
+    handler_id: AtomicU32,
+    event: &'static str,
+    label: &'static str,
+}
+
+impl WindowListener {
+    fn setup(&self, on_event: impl Fn() + Send + 'static) {
+        if let Some(window) = WindowManager::get_main_window() {
+            let previous_handler_id = self.handler_id.swap(0, Ordering::AcqRel);
+            if previous_handler_id != 0 {
+                window.unlisten(previous_handler_id);
+                logging!(debug, Type::Lightweight, "覆盖旧的{}监听", self.label);
+            }
+            let handler_id = window.listen(self.event, move |_event| on_event());
+            self.handler_id.store(handler_id, Ordering::Release);
+        }
+    }
+
+    fn cancel(&self) {
+        let id = self.handler_id.swap(0, Ordering::AcqRel);
+        if id != 0 {
+            if let Some(window) = WindowManager::get_main_window() {
+                window.unlisten(id);
+            }
+            logging!(debug, Type::Lightweight, "取消了{}监听", self.label);
+        }
+    }
+}
+
+static WINDOW_CLOSE_LISTENER: WindowListener = WindowListener {
+    handler_id: AtomicU32::new(0),
+    event: "tauri://close-requested",
+    label: "窗口关闭",
+};
+
+static WEBVIEW_FOCUS_LISTENER: WindowListener = WindowListener {
+    handler_id: AtomicU32::new(0),
+    event: "tauri://focus",
+    label: "窗口焦点",
+};

 static CANCEL_TX: Mutex<Option<oneshot::Sender<()>>> = Mutex::new(None);

@@ -154,55 +193,27 @@ pub async fn add_light_weight_timer() {
 }

 fn setup_window_close_listener() {
-    if let Some(window) = WindowManager::get_main_window() {
-        let previous_handler_id = WINDOW_CLOSE_HANDLER_ID.swap(0, Ordering::AcqRel);
-        if previous_handler_id != 0 {
-            window.unlisten(previous_handler_id);
-            logging!(debug, Type::Lightweight, "覆盖旧的窗口关闭监听");
-        }
-        let handler_id = window.listen("tauri://close-requested", move |_event| {
-            std::mem::drop(AsyncHandler::spawn(|| async {
-                setup_light_weight_timer().await;
-            }));
-            logging!(info, Type::Lightweight, "监听到关闭请求，开始轻量模式计时");
-        });
-        WINDOW_CLOSE_HANDLER_ID.store(handler_id, Ordering::Release);
-    }
+    WINDOW_CLOSE_LISTENER.setup(|| {
+        std::mem::drop(AsyncHandler::spawn(|| async {
+            setup_light_weight_timer().await;
+        }));
+        logging!(info, Type::Lightweight, "监听到关闭请求，开始轻量模式计时");
+    });
 }

 fn cancel_window_close_listener() {
-    let id = WINDOW_CLOSE_HANDLER_ID.swap(0, Ordering::AcqRel);
-    if id != 0 {
-        if let Some(window) = WindowManager::get_main_window() {
-            window.unlisten(id);
-        }
-        logging!(debug, Type::Lightweight, "取消了窗口关闭监听");
-    }
+    WINDOW_CLOSE_LISTENER.cancel();
 }

 fn setup_webview_focus_listener() {
-    if let Some(window) = WindowManager::get_main_window() {
-        let previous_handler_id = WEBVIEW_FOCUS_HANDLER_ID.swap(0, Ordering::AcqRel);
-        if previous_handler_id != 0 {
-            window.unlisten(previous_handler_id);
-            logging!(debug, Type::Lightweight, "覆盖旧的窗口焦点监听");
-        }
-        let handler_id = window.listen("tauri://focus", move |_event| {
-            cancel_light_weight_timer();
-            logging!(debug, Type::Lightweight, "监听到窗口获得焦点，取消轻量模式计时");
-        });
-        WEBVIEW_FOCUS_HANDLER_ID.store(handler_id, Ordering::Release);
-    }
+    WEBVIEW_FOCUS_LISTENER.setup(|| {
+        cancel_light_weight_timer();
+        logging!(debug, Type::Lightweight, "监听到窗口获得焦点，取消轻量模式计时");
+    });
 }

 fn cancel_webview_focus_listener() {
-    let id = WEBVIEW_FOCUS_HANDLER_ID.swap(0, Ordering::AcqRel);
-    if id != 0 {
-        if let Some(window) = WindowManager::get_main_window() {
-            window.unlisten(id);
-        }
-        logging!(debug, Type::Lightweight, "取消了窗口焦点监听");
-    }
+    WEBVIEW_FOCUS_LISTENER.cancel();
 }

 async fn setup_light_weight_timer() {
@@ -6,7 +6,7 @@ use crate::{
        notification::{self, FailedOperation},
        runstate::RUN_STATE,
        service,
-        sysopt::Sysopt,
+        sysopt::{Sysopt, format_bypass},
    },
    process::AsyncHandler,
    utils::{
@@ -204,8 +204,6 @@ const fn refusal_classification(service_usable: Option<bool>) -> SysproxyFailure
 }

 const LOOPBACK_HOST: &str = "127.0.0.1";
-const MACOS_DEFAULT_BYPASS: &str =
-    "127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,localhost,*.local,*.crashlytics.com,<local>";
 const MAX_SERVICE_BYPASS_LEN: usize = 8192;

 static SERVICE_PROXY_OPERATIONS: ServiceProxyOperations = ServiceProxyOperations::new();
@@ -327,13 +325,7 @@ fn service_bypass(verge: &IVerge) -> Result<String> {
    let custom = verge.system_proxy_bypass.as_deref().unwrap_or("");
    ensure!(!custom.contains('\0'), "system proxy bypass contains NUL");

-    let mut bypass = if custom.is_empty() {
-        MACOS_DEFAULT_BYPASS.to_owned()
-    } else if verge.use_default_bypass.unwrap_or(true) {
-        format!("{MACOS_DEFAULT_BYPASS},{custom}")
-    } else {
-        custom.to_owned()
-    };
+    let mut bypass: String = format_bypass(verge.use_default_bypass.unwrap_or(true), custom).into();
    truncate_utf8(&mut bypass, MAX_SERVICE_BYPASS_LEN);
    Ok(bypass)
 }
@@ -593,50 +593,71 @@ fn packaged_service_tool_path(file_name: &str, packaged_path: impl FnOnce() -> R
 }

 #[cfg(target_os = "windows")]
-fn uninstall_service() -> Result<()> {
-    logging!(info, Type::Service, "uninstall service");
-
+pub(super) fn run_maybe_elevated(program: &Path, hide_window: bool) -> Result<std::process::ExitStatus> {
    use deelevate::{PrivilegeLevel, Token};
    use runas::Command as RunasCommand;
    use std::os::windows::process::CommandExt as _;

-    let uninstall_path = packaged_service_tool_path("clash-verge-service-uninstall.exe", || {
-        Ok(dirs::service_path()?.with_file_name("clash-verge-service-uninstall.exe"))
-    })?;
-
-    if !uninstall_path.exists() {
-        bail!(format!("uninstaller not found: {uninstall_path:?}"));
-    }
-
    let token = Token::with_current_process()?;
    let level = token.privilege_level()?;
    let status = match level {
-        PrivilegeLevel::NotPrivileged => RunasCommand::new(uninstall_path).show(false).status()?,
-        _ => StdCommand::new(uninstall_path).creation_flags(0x08000000).status()?,
+        PrivilegeLevel::NotPrivileged => {
+            let mut command = RunasCommand::new(program);
+            if hide_window {
+                command.show(false);
+            }
+            command.status()?
+        }
+        _ => {
+            let mut command = StdCommand::new(program);
+            if hide_window {
+                // 0x08000000 is CREATE_NO_WINDOW, the direct counterpart of runas's show(false).
+                command.creation_flags(0x08000000);
+            }
+            command.status()?
+        }
    };
+    Ok(status)
+}

+fn uninstaller_tool_path(file_name: &str, packaged_path: impl FnOnce() -> Result<PathBuf>) -> Result<PathBuf> {
+    let uninstall_path = packaged_service_tool_path(file_name, packaged_path)?;
+    if !uninstall_path.exists() {
+        bail!(format!("uninstaller not found: {uninstall_path:?}"));
+    }
+    Ok(uninstall_path)
+}
+
+fn ensure_uninstall_success(status: &std::process::ExitStatus) -> Result<()> {
    if !status.success() {
        bail!(
            "failed to uninstall service with status {}",
            status.code().unwrap_or(-1)
        );
    }
-
    Ok(())
 }

+#[cfg(target_os = "windows")]
+fn uninstall_service() -> Result<()> {
+    logging!(info, Type::Service, "uninstall service");
+
+    let uninstall_path = uninstaller_tool_path("clash-verge-service-uninstall.exe", || {
+        Ok(dirs::service_path()?.with_file_name("clash-verge-service-uninstall.exe"))
+    })?;
+
+    let status = run_maybe_elevated(&uninstall_path, true)?;
+    ensure_uninstall_success(&status)
+}
+
 #[cfg(target_os = "linux")]
 fn uninstall_service() -> Result<()> {
    logging!(info, Type::Service, "uninstall service");

-    let uninstall_path = packaged_service_tool_path("clash-verge-service-uninstall", || {
+    let uninstall_path = uninstaller_tool_path("clash-verge-service-uninstall", || {
        Ok(tauri::utils::platform::current_exe()?.with_file_name("clash-verge-service-uninstall"))
    })?;

-    if !uninstall_path.exists() {
-        bail!(format!("uninstaller not found: {uninstall_path:?}"));
-    }
-
    let elevator = crate::utils::help::linux_elevator();
    let status = if linux_running_as_root() {
        StdCommand::new(&uninstall_path).status()?
@@ -666,14 +687,7 @@ fn uninstall_service() -> Result<()> {
        status.code().unwrap_or(-1)
    );

-    if !status.success() {
-        bail!(
-            "failed to uninstall service with status {}",
-            status.code().unwrap_or(-1)
-        );
-    }
-
-    Ok(())
+    ensure_uninstall_success(&status)
 }

 #[cfg(target_os = "linux")]
@@ -688,14 +702,10 @@ fn linux_running_as_root() -> bool {
 fn uninstall_service() -> Result<()> {
    logging!(info, Type::Service, "uninstall service");

-    let uninstall_path = packaged_service_tool_path("clash-verge-service-uninstall", || {
+    let uninstall_path = uninstaller_tool_path("clash-verge-service-uninstall", || {
        Ok(dirs::service_path()?.with_file_name("clash-verge-service-uninstall"))
    })?;

-    if !uninstall_path.exists() {
-        bail!(format!("uninstaller not found: {uninstall_path:?}"));
-    }
-
    let uninstall_path = macos_service_tool_path(&uninstall_path)?;
    let uninstall_shell: String = uninstall_path.to_string_lossy().into_owned();

@@ -711,14 +721,7 @@ fn uninstall_service() -> Result<()> {

    let status = StdCommand::new("osascript").args(vec!["-e", &command]).status()?;

-    if !status.success() {
-        bail!(
-            "failed to uninstall service with status {}",
-            status.code().unwrap_or(-1)
-        );
-    }
-
-    Ok(())
+    ensure_uninstall_success(&status)
 }

 fn install_service() -> Result<()> {
@@ -241,20 +241,19 @@ async fn current_os_proxy_state(sys: Sysproxy, auto: Autoproxy) -> OsProxyState
 }

 pub(crate) struct Sysopt {
-    update_lock: TokioMutex<()>,
+    // Owns the proxy target pair; every reader and writer goes through this lock.
+    update_lock: TokioMutex<(Sysproxy, Autoproxy)>,
    guard_operation_lock: TokioMutex<()>,
    reset_sysproxy: AtomicBool,
-    inner_proxy: Arc<RwLock<(Sysproxy, Autoproxy)>>,
    guard: Arc<RwLock<GuardMonitor>>,
 }

 impl Default for Sysopt {
    fn default() -> Self {
        Self {
-            update_lock: TokioMutex::new(()),
+            update_lock: TokioMutex::new((Sysproxy::default(), Autoproxy::default())),
            guard_operation_lock: TokioMutex::new(()),
            reset_sysproxy: AtomicBool::new(false),
-            inner_proxy: Arc::new(RwLock::new((Sysproxy::default(), Autoproxy::default()))),
            guard: Arc::new(RwLock::new(GuardMonitor::new(GuardType::None, Duration::from_secs(30)))),
        }
    }
@@ -269,10 +268,9 @@ static DEFAULT_BYPASS: &str = "localhost,127.0.0.1,192.168.0.0/16,10.0.0.0/8,172
 #[cfg(any(target_os = "linux", target_os = "macos"))]
 static BYPASS_SEPARATOR: &str = ",";
 #[cfg(target_os = "macos")]
-static DEFAULT_BYPASS: &str =
-    "127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,localhost,*.local,*.crashlytics.com,<local>";
+static DEFAULT_BYPASS: &str = crate::constants::proxy::MACOS_DEFAULT_BYPASS;

-fn format_bypass(use_default: bool, custom_bypass: &str) -> String {
+pub(super) fn format_bypass(use_default: bool, custom_bypass: &str) -> String {
    if custom_bypass.is_empty() {
        DEFAULT_BYPASS.into()
    } else if use_default {
@@ -361,7 +359,7 @@ impl Sysopt {
            }
        }
        while self.access_guard().read().get_state().is_pendding() {
-            tokio::task::yield_now().await;
+            tokio::time::sleep(Duration::from_millis(10)).await;
        }
        // `start()` false may also mean a guard was already running.
        !self.access_guard().read().get_state().is_stopped()
@@ -413,14 +411,17 @@ impl Sysopt {
    }

    /// init the sysproxy
+    #[allow(
+        clippy::significant_drop_tightening,
+        reason = "the update lock must stay held until the OS write finishes; wait_idle relies on it"
+    )]
    pub(super) async fn update_sysproxy(&self) -> Result<()> {
-        let _lock = self.update_lock.lock().await;
+        let mut inner_proxy = self.update_lock.lock().await;
        let verge = Config::verge().await.latest_arc();
        // Configured, not live: this runs while the Core is being started or restarted, and
        // asking a Core that is not up yet would only fall back here anyway.
        let port = MixedPort::desired().await;
        let pac_port = server::embedded_server_port()?;
-        // 先 await, 避免持有锁导致的 Send 问题
        let bypass = get_bypass().await;

        let (sys_enable, pac_enable, proxy_host, proxy_guard) = (
@@ -431,7 +432,7 @@ impl Sysopt {
        );

        let (sys, auto, guard_type) = {
-            let (sys, auto) = &mut *self.inner_proxy.write();
+            let (sys, auto) = &mut *inner_proxy;
            sys.host = proxy_host.into();
            sys.port = port;
            sys.bypass = bypass.into();
@@ -528,6 +529,10 @@ impl Sysopt {
    }

    /// reset the sysproxy
+    #[allow(
+        clippy::significant_drop_tightening,
+        reason = "the update lock must stay held until the disable finishes; wait_idle relies on it"
+    )]
    pub(super) async fn reset_sysproxy(&self) -> Result<()> {
        if self
            .reset_sysproxy
@@ -539,13 +544,13 @@ impl Sysopt {
        defer! {
            self.reset_sysproxy.store(false, Ordering::SeqCst);
        }
-        let _lock = self.update_lock.lock().await;
+        let mut inner_proxy = self.update_lock.lock().await;
        let _guard_operation = self.guard_operation_lock.lock().await;
        let drained = self.stop_proxy_guard_locked().await;

        // 直接关闭所有代理
        let (sys, auto) = {
-            let (sys, auto) = &mut *self.inner_proxy.write();
+            let (sys, auto) = &mut *inner_proxy;
            sys.enable = false;
            auto.enable = false;
            (sys.clone(), auto.clone())
@@ -636,7 +636,8 @@ async fn create_tray_menu(
        .tray_proxy_groups_display_mode
        .as_deref()
        .unwrap_or("default");
-    let include_proxy_groups = options.include_proxy_groups && tray_proxy_groups_display_mode != "disable";
+    let include_proxy_groups =
+        options.include_proxy_groups && verge_settings.tray_proxy_groups_display_mode.as_deref() != Some("disable");

    let proxy_group_order_map = runtime_proxy_groups_order;

@@ -1,10 +1,7 @@
 #![cfg(target_os = "windows")]

-use crate::utils::dirs;
+use crate::{core::service, utils::dirs};
 use anyhow::{Result, bail};
-use deelevate::{PrivilegeLevel, Token};
-use runas::Command as RunasCommand;
-use std::process::Command as StdCommand;

 pub fn invoke_uwptools() -> Result<()> {
    let resource_dir = dirs::app_resources_dir()?;
@@ -14,13 +11,7 @@ pub fn invoke_uwptools() -> Result<()> {
        bail!("enableLoopback exe not found");
    }

-    let token = Token::with_current_process()?;
-    let level = token.privilege_level()?;
-
-    match level {
-        PrivilegeLevel::NotPrivileged => RunasCommand::new(tool_path).status()?,
-        _ => StdCommand::new(tool_path).status()?,
-    };
+    service::run_maybe_elevated(&tool_path, false)?;

    Ok(())
 }
@@ -1,8 +0,0 @@
-// This function is exported for use by the Clash core
-// eslint-disable-next-line unused-imports/no-unused-vars
-function main(config, _name) {
-  if (config.mode === 'script') {
-    config.mode = 'rule'
-  }
-  return config
-}
@@ -1,12 +0,0 @@
-// This function is exported for use by the Clash core
-// eslint-disable-next-line unused-imports/no-unused-vars
-function main(config, _name) {
-  if (Array.isArray(config.proxies)) {
-    config.proxies.forEach((p, i) => {
-      if (p.type === 'hysteria' && typeof p.alpn === 'string') {
-        config.proxies[i].alpn = [p.alpn]
-      }
-    })
-  }
-  return config
-}
@@ -24,8 +24,8 @@ pub enum ChainType {

 #[derive(Debug, Clone)]
 pub enum ChainSupport {
-    ClashMeta,
-    ClashMetaAlpha,
+    Mihomo,
+    MihomoAlpha,
 }

 // Helper trait to allow async conversion
@@ -53,26 +53,14 @@ impl AsyncChainItemFrom for Option<ChainItem> {
                uid,
                data: ChainType::Merge(help::read_mapping(&path).await.ok()?),
            }),
-            "rules" => {
+            "rules" | "proxies" | "groups" => {
                let seq_map = help::read_yaml::<SeqMap>(&path).await.ok()?;
-                Some(ChainItem {
-                    uid,
-                    data: ChainType::Rules(seq_map),
-                })
-            }
-            "proxies" => {
-                let seq_map = help::read_yaml::<SeqMap>(&path).await.ok()?;
-                Some(ChainItem {
-                    uid,
-                    data: ChainType::Proxies(seq_map),
-                })
-            }
-            "groups" => {
-                let seq_map = help::read_yaml::<SeqMap>(&path).await.ok()?;
-                Some(ChainItem {
-                    uid,
-                    data: ChainType::Groups(seq_map),
-                })
+                let data = match itype {
+                    "rules" => ChainType::Rules(seq_map),
+                    "proxies" => ChainType::Proxies(seq_map),
+                    _ => ChainType::Groups(seq_map),
+                };
+                Some(ChainItem { uid, data })
            }
            _ => None,
        }
@@ -81,23 +69,15 @@ impl AsyncChainItemFrom for Option<ChainItem> {
 impl ChainItem {
    /// 内建支持一些脚本
    pub fn builtin() -> Vec<(ChainSupport, Self)> {
-        // meta 的一些处理
-        let meta_guard = Self::to_script("verge_meta_guard", include_str!("./builtin/meta_guard.js"));
-
-        // meta 1.13.2 alpn string 转 数组
-        let hy_alpn = Self::to_script("verge_hy_alpn", include_str!("./builtin/meta_hy_alpn.js"));
-
-        // meta 的一些处理
-        let meta_guard_alpha = Self::to_script("verge_meta_guard", include_str!("./builtin/meta_guard.js"));
-
-        // meta 1.13.2 alpn string 转 数组
-        let hy_alpn_alpha = Self::to_script("verge_hy_alpn", include_str!("./builtin/meta_hy_alpn.js"));
+        // data intentionally empty: the enhance loop dispatches on uid to native implementations
+        let hy_alpn = Self::to_script("verge_hy_alpn", "");
+        let meta_guard = Self::to_script("verge_meta_guard", "");

        vec![
-            (ChainSupport::ClashMeta, hy_alpn),
-            (ChainSupport::ClashMeta, meta_guard),
-            (ChainSupport::ClashMetaAlpha, hy_alpn_alpha),
-            (ChainSupport::ClashMetaAlpha, meta_guard_alpha),
+            (ChainSupport::Mihomo, hy_alpn.clone()),
+            (ChainSupport::Mihomo, meta_guard.clone()),
+            (ChainSupport::MihomoAlpha, hy_alpn),
+            (ChainSupport::MihomoAlpha, meta_guard),
        ]
    }

@@ -114,7 +94,7 @@ impl ChainSupport {
        match core {
            Some(core) => matches!(
                (self, core.as_str()),
-                (Self::ClashMeta, "verge-mihomo") | (Self::ClashMetaAlpha, "verge-mihomo-alpha")
+                (Self::Mihomo, "verge-mihomo") | (Self::MihomoAlpha, "verge-mihomo-alpha")
            ),
            None => true,
        }
@@ -24,18 +24,7 @@ fn lowercase_key(key: &str) -> Value {
    Value::from(key.as_str())
 }

-pub fn use_lowercase(config: &Mapping) -> Mapping {
-    let mut lowercased = Mapping::new();
-
-    for (key, value) in config.into_iter() {
-        if let Some(key_str) = key.as_str() {
-            lowercased.insert(lowercase_key(key_str), value.clone());
-        }
-    }
-    lowercased
-}
-
-pub fn use_lowercase_owned(config: Mapping) -> Mapping {
+pub fn use_lowercase(config: Mapping) -> Mapping {
    let mut lowercased = Mapping::new();

    for (key, value) in config {
@@ -17,7 +17,7 @@ fn deep_merge(a: &mut Value, b: Value) {
 }

 pub fn use_merge(merge: &Mapping, mut config: Mapping) -> Mapping {
-    for (key, value) in use_lowercase(merge) {
+    for (key, value) in use_lowercase(merge.clone()) {
        match (config.get_mut(&key), value) {
            (Some(Value::Mapping(existing)), Value::Mapping(overlay)) if key.as_str() == Some("dns") => {
                existing.extend(overlay);
@@ -8,7 +8,7 @@ mod tun;

 use self::{
    chain::{AsyncChainItemFrom as _, ChainItem, ChainType},
-    field::{use_keys, use_lowercase_owned, use_sort},
+    field::{use_keys, use_lowercase, use_sort},
    merge::use_merge,
    script::use_script,
    seq::{SeqMap, use_seq},
@@ -199,35 +199,25 @@ async fn collect_profile_items(profiles: &IProfiles) -> Result<ProfileItems> {

    let name = current_item.name.clone().unwrap_or_default();

+    let ProfileItems {
+        merge_item: default_merge,
+        script_item: default_script,
+        rules_item: default_rules,
+        proxies_item: default_proxies,
+        groups_item: default_groups,
+        global_merge: default_global_merge,
+        global_script: default_global_script,
+        ..
+    } = ProfileItems::default();
+
    let (merge_item, script_item, rules_item, proxies_item, groups_item, global_merge, global_script) = tokio::join!(
-        chain_item_or_default(profiles.get_item(&merge_uid).ok(), || ChainItem {
-            uid: "".into(),
-            data: ChainType::Merge(Mapping::new()),
-        },),
-        chain_item_or_default(profiles.get_item(&script_uid).ok(), || ChainItem {
-            uid: "".into(),
-            data: ChainType::Script(tmpl::ITEM_SCRIPT.into()),
-        },),
-        chain_item_or_default(profiles.get_item(&rules_uid).ok(), || ChainItem {
-            uid: "".into(),
-            data: ChainType::Rules(SeqMap::default()),
-        },),
-        chain_item_or_default(profiles.get_item(&proxies_uid).ok(), || ChainItem {
-            uid: "".into(),
-            data: ChainType::Proxies(SeqMap::default()),
-        },),
-        chain_item_or_default(profiles.get_item(&groups_uid).ok(), || ChainItem {
-            uid: "".into(),
-            data: ChainType::Groups(SeqMap::default()),
-        },),
-        chain_item_or_default(profiles.get_item("Merge").ok(), || ChainItem {
-            uid: "Merge".into(),
-            data: ChainType::Merge(Mapping::new()),
-        },),
-        chain_item_or_default(profiles.get_item("Script").ok(), || ChainItem {
-            uid: "Script".into(),
-            data: ChainType::Script(tmpl::ITEM_SCRIPT.into()),
-        },),
+        chain_item_or_default(profiles.get_item(&merge_uid).ok(), || default_merge,),
+        chain_item_or_default(profiles.get_item(&script_uid).ok(), || default_script,),
+        chain_item_or_default(profiles.get_item(&rules_uid).ok(), || default_rules,),
+        chain_item_or_default(profiles.get_item(&proxies_uid).ok(), || default_proxies,),
+        chain_item_or_default(profiles.get_item(&groups_uid).ok(), || default_groups,),
+        chain_item_or_default(profiles.get_item("Merge").ok(), || default_global_merge,),
+        chain_item_or_default(profiles.get_item("Script").ok(), || default_global_script,),
    );

    Ok(ProfileItems {
@@ -243,16 +233,16 @@ async fn collect_profile_items(profiles: &IProfiles) -> Result<ProfileItems> {
    })
 }

-async fn process_global_items(
+async fn process_override_items(
    mut config: Mapping,
    mut exists_keys: Vec<String>,
    mut result_map: HashMap<String, ResultLog>,
-    global_merge: ChainItem,
-    global_script: ChainItem,
+    merge_item: ChainItem,
+    script_item: ChainItem,
    profile_name: &String,
    authoritative: &AuthoritativeFields,
 ) -> (Mapping, Vec<String>, HashMap<String, ResultLog>) {
-    if let ChainType::Merge(merge) = global_merge.data {
+    if let ChainType::Merge(merge) = merge_item.data {
        exists_keys.extend(use_keys(&merge));
        let before = authoritative.current(&config);
        config = use_merge(&merge, config);
@@ -262,11 +252,11 @@ async fn process_global_items(
            .map(discarded_note)
            .collect();
        if !notes.is_empty() {
-            result_map.entry(global_merge.uid).or_default().extend(notes);
+            result_map.entry(merge_item.uid).or_default().extend(notes);
        }
    }

-    if let ChainType::Script(script) = global_script.data {
+    if let ChainType::Script(script) = script_item.data {
        let before = authoritative.current(&config);
        let (res_config, changed_keys, mut logs) = use_script(script, config, profile_name.clone()).await;
        exists_keys.extend(changed_keys);
@@ -277,7 +267,7 @@ async fn process_global_items(
                .into_iter()
                .map(discarded_note),
        );
-        result_map.insert(global_script.uid, logs);
+        result_map.insert(script_item.uid, logs);
    }

    (config, exists_keys, result_map)
@@ -544,46 +534,6 @@ fn ensure_lan_bind_address(mut config: Mapping) -> Mapping {
    config
 }

-async fn process_profile_items(
-    mut config: Mapping,
-    mut exists_keys: Vec<String>,
-    mut result_map: HashMap<String, ResultLog>,
-    merge_item: ChainItem,
-    script_item: ChainItem,
-    profile_name: &String,
-    authoritative: &AuthoritativeFields,
-) -> (Mapping, Vec<String>, HashMap<String, ResultLog>) {
-    if let ChainType::Merge(merge) = merge_item.data {
-        exists_keys.extend(use_keys(&merge));
-        let before = authoritative.current(&config);
-        config = use_merge(&merge, config);
-        let notes: ResultLog = authoritative
-            .overridden(&before, &authoritative.current(&config))
-            .into_iter()
-            .map(discarded_note)
-            .collect();
-        if !notes.is_empty() {
-            result_map.entry(merge_item.uid).or_default().extend(notes);
-        }
-    }
-
-    if let ChainType::Script(script) = script_item.data {
-        let before = authoritative.current(&config);
-        let (res_config, changed_keys, mut logs) = use_script(script, config, profile_name.clone()).await;
-        exists_keys.extend(changed_keys);
-        config = res_config;
-        logs.extend(
-            authoritative
-                .overridden(&before, &authoritative.current(&config))
-                .into_iter()
-                .map(discarded_note),
-        );
-        result_map.insert(script_item.uid, logs);
-    }
-
-    (config, exists_keys, result_map)
-}
-
 /// Merges the app's clash config over the profile; switches are parameters to keep it pure.
 fn merge_default_config(
    mut config: Mapping,
@@ -664,7 +614,7 @@ fn apply_builtin_scripts(mut config: Mapping, clash_core: Option<String>, enable
            .collect();
        if !items.is_empty() {
            // The JS path saw a lowercased view; lowercase once, only when a builtin runs.
-            config = use_lowercase_owned(config);
+            config = use_lowercase(config);
            for item in items {
                logging!(debug, Type::Core, "run builtin script {}", item.uid);
                config = match item.uid.as_str() {
@@ -935,7 +885,7 @@ pub async fn enhance(

    let authoritative = AuthoritativeFields::capture(&config, &gui_tun_keys, dns_settings);

-    let (config, exists_keys, result_map) = process_global_items(
+    let (config, exists_keys, result_map) = process_override_items(
        config,
        exists_keys,
        result_map,
@@ -946,7 +896,7 @@ pub async fn enhance(
    )
    .await;

-    let (config, exists_keys, result_map) = process_profile_items(
+    let (config, exists_keys, result_map) = process_override_items(
        config,
        exists_keys,
        result_map,
@@ -1428,7 +1378,7 @@ mod authoritative_field_tests {
 mod tests {
    use super::{
        AuthoritativeFields, ChainItem, ChainType, Mapping, cleanup_proxy_groups, ensure_lan_bind_address,
-        process_global_items, process_profile_items, use_keys,
+        process_override_items, use_keys,
    };
    use std::collections::HashMap;

@@ -1476,7 +1426,7 @@ mod tests {
                data: ChainType::Merge(merge.clone()),
            };
            let profile_name = "test-profile".into();
-            let (config, keys, logs) = process_global_items(
+            let (config, keys, logs) = process_override_items(
                config,
                vec![],
                HashMap::new(),
@@ -1486,7 +1436,7 @@ mod tests {
                &authoritative,
            )
            .await;
-            let (config, _, logs) = process_profile_items(
+            let (config, _, logs) = process_override_items(
                config,
                keys,
                logs,
@@ -1564,7 +1514,7 @@ mod tests {

        let profile_name = "test-profile".into();
        let authoritative = AuthoritativeFields::capture(&config, &[], Mapping::new());
-        let (config, exists_keys, result_map) = process_global_items(
+        let (config, exists_keys, result_map) = process_override_items(
            config,
            exists_keys,
            HashMap::new(),
@@ -1574,7 +1524,7 @@ mod tests {
            &authoritative,
        )
        .await;
-        let (config, exists_keys, _) = process_profile_items(
+        let (config, exists_keys, _) = process_override_items(
            config,
            exists_keys,
            result_map,
@@ -1,6 +1,6 @@
 use crate::{process::AsyncHandler, utils::tmpl};

-use super::field::{use_lowercase, use_lowercase_owned};
+use super::field::use_lowercase;
 use anyhow::{Error, Result};
 use boa_engine::{Context, JsString, JsValue, Source, js_string, native_function::NativeFunction, property::Attribute};
 use clash_verge_logging::{Type, logging};
@@ -22,10 +22,10 @@ type EvalOutcome = (Result<Mapping, std::string::String>, Vec<(String, String)>)
 pub(super) async fn use_script(script: String, config: Mapping, name: String) -> ScriptResult {
    // The template is identity-plus-lowercasing; skip the Boa round-trip.
    if script == tmpl::ITEM_SCRIPT {
-        return (use_lowercase_owned(config), vec![], vec![]);
+        return (use_lowercase(config), vec![], vec![]);
    }

-    let json = match serde_json::to_string(&use_lowercase(&config)) {
+    let json = match serde_json::to_string(&use_lowercase(config.clone())) {
        Ok(json) if json.len() <= MAX_JSON_SIZE => json,
        Ok(_) => {
            let message = "Configuration size exceeds maximum allowed size";
@@ -173,7 +173,7 @@ fn eval_script(script: &str, config_json: &str, name: &String) -> EvalOutcome {
    }

    match parse_json_safely(&result) {
-        Ok(config) => (Ok(use_lowercase_owned(config)), outputs.lock().to_vec()),
+        Ok(config) => (Ok(use_lowercase(config)), outputs.lock().to_vec()),
        Err(err) => {
            logging!(
                error,
@@ -28,7 +28,7 @@ pub fn use_tun(mut config: Mapping, enable: bool) -> Mapping {
            .and_then(|v| v.as_str())
            .unwrap_or("fake-ip");

-        if current_mode == "fake-ip" || !dns_val.contains_key(Value::from("enhanced-mode")) {
+        if current_mode == "fake-ip" {
            revise!(dns_val, "enable", true);
            revise!(dns_val, "ipv6", ipv6_val);

@@ -33,6 +33,9 @@ async fn finalize_restored_verge_config(
    webdav_username: Option<String>,
    webdav_password: Option<String>,
 ) -> Result<()> {
+    // The lock must cover every restored layer; an unlocked apply races a concurrently staged draft.
+    let config_write = Config::lock_config_write().await;
+
    // A broken restored `verge.yaml` is a restore failure, not a reason to load defaults.
    let mut restored = help::read_yaml::<IVerge>(&verge_path()?).await?;
    restored.webdav_url = webdav_url;
@@ -43,43 +46,42 @@ async fn finalize_restored_verge_config(
    let restored_clash = IClashTemp::new().await;
    let clash_draft = Config::clash().await;
    clash_draft.edit_draft(|d| {
-        *d = restored_clash.clone();
+        *d = restored_clash;
    });
    clash_draft.apply();

    let restored_profiles = IProfiles::new().await;
    let profiles_draft = Config::profiles().await;
    profiles_draft.edit_draft(|d| {
-        *d = restored_profiles.clone();
+        *d = restored_profiles;
    });
    profiles_draft.apply();

    let verge_draft = Config::verge().await;
-    {
-        // Hold the write lock so a concurrent patch cannot stage a draft the proxy write reads.
-        let _config_write = Config::lock_config_write().await;
-        verge_draft.edit_draft(|d| {
-            *d = restored.clone();
-        });
-        verge_draft.apply();
+    verge_draft.edit_draft(|d| {
+        *d = restored.clone();
+    });
+    verge_draft.apply();

-        // Turn it off here; a failing core side effect below would otherwise skip this step.
-        if !restored.enable_system_proxy.unwrap_or_default() {
-            let result = async {
-                let _lifecycle = CoreManager::global().lifecycle_lock.lock().await;
-                proxy_control::apply().await?;
-                proxy_control::refresh_guard().await
-            }
-            .await;
-            if let Err(err) = result {
-                logging!(error, Type::Backup, "Failed to turn the system proxy off: {err:#}");
-                if SystemProxyStateUnknown::is_in(&err) {
-                    return Err(err);
-                }
+    // Turn it off here; a failing core side effect below would otherwise skip this step.
+    if !restored.enable_system_proxy.unwrap_or_default() {
+        let result = async {
+            let _lifecycle = CoreManager::global().lifecycle_lock.lock().await;
+            proxy_control::apply().await?;
+            proxy_control::refresh_guard().await
+        }
+        .await;
+        if let Err(err) = result {
+            logging!(error, Type::Backup, "Failed to turn the system proxy off: {err:#}");
+            if SystemProxyStateUnknown::is_in(&err) {
+                return Err(err);
            }
        }
    }

+    // `patch_verge` re-acquires the lock through `try_lock_config_write`.
+    drop(config_write);
+
    // Run configuration side effects without rewriting the already-restored file.
    if let Err(err) = super::patch_verge(&restored, true).await {
        logging!(error, Type::Backup, "Failed to apply restored verge config: {err:#}");
@@ -134,14 +136,35 @@ pub async fn delete_webdav_backup(filename: String) -> Result<()> {
    })
 }

+/// Backup creation strips the WebDAV credentials, so the live ones are kept.
+async fn restore_backup_archive(path: PathBuf) -> Result<()> {
+    let (webdav_url, webdav_username, webdav_password) = {
+        let verge = Config::verge().await;
+        let verge = verge.latest_arc();
+        (
+            verge.webdav_url.clone(),
+            verge.webdav_username.clone(),
+            verge.webdav_password.clone(),
+        )
+    };
+
+    let home_dir = app_home_dir()?;
+    AsyncHandler::spawn_blocking(move || -> Result<()> {
+        let file = std::fs::File::open(&path)?;
+        let mut zip = zip::ZipArchive::new(file)?;
+        zip.extract(&home_dir)?;
+        Ok(())
+    })
+    .await
+    .map_err(|join| anyhow!("backup extraction task failed: {join}"))??;
+
+    // Held for the config-data transition only; extraction is plain filesystem work.
+    let _profile_write = crate::config::profiles::PROFILE_WRITE_LOCK.lock().await;
+    finalize_restored_verge_config(webdav_url, webdav_username, webdav_password).await
+}
+
 #[tracing::instrument(skip_all, level = "info", fields(filename = %filename))]
 pub async fn restore_webdav_backup(filename: String) -> Result<()> {
-    let verge = Config::verge().await;
-    let verge_data = verge.latest_arc();
-    let webdav_url = verge_data.webdav_url.clone();
-    let webdav_username = verge_data.webdav_username.clone();
-    let webdav_password = verge_data.webdav_password.clone();
-
    let backup_storage_path = app_home_dir()
        .map_err(|e| anyhow::anyhow!("Failed to get app home dir: {e}"))?
        .join(filename.as_str());
@@ -158,12 +181,7 @@ pub async fn restore_webdav_backup(filename: String) -> Result<()> {
            err
        })?;

-    let value = backup_storage_path.clone();
-    let file = AsyncHandler::spawn_blocking(move || std::fs::File::open(&value)).await??;
-    let mut zip = zip::ZipArchive::new(file)?;
-    let _profile_write = crate::config::profiles::PROFILE_WRITE_LOCK.lock().await;
-    zip.extract(app_home_dir()?)?;
-    let res = finalize_restored_verge_config(webdav_url, webdav_username, webdav_password).await;
+    let res = restore_backup_archive(backup_storage_path.clone()).await;
    let _ = backup_storage_path.remove_if_exists().await;
    res
 }
@@ -332,22 +350,7 @@ pub async fn restore_local_backup(filename: String) -> Result<()> {
        return Err(anyhow!("Backup file not found: {}", filename));
    }

-    let (webdav_url, webdav_username, webdav_password) = {
-        let verge = Config::verge().await;
-        let verge = verge.latest_arc();
-        (
-            verge.webdav_url.clone(),
-            verge.webdav_username.clone(),
-            verge.webdav_password.clone(),
-        )
-    };
-
-    let file = AsyncHandler::spawn_blocking(move || std::fs::File::open(&target_path)).await??;
-    let mut zip = zip::ZipArchive::new(file)?;
-    let _profile_write = crate::config::profiles::PROFILE_WRITE_LOCK.lock().await;
-    zip.extract(app_home_dir()?)?;
-    finalize_restored_verge_config(webdav_url, webdav_username, webdav_password).await?;
-    Ok(())
+    restore_backup_archive(target_path).await
 }

 #[tracing::instrument(skip_all, level = "info", fields(filename = %filename, destination = %destination))]
@@ -3,7 +3,7 @@ use crate::core::notify::{Refresh, announce};
 use crate::{
    config::{Config, MixedPort},
    core::{CoreManager, handle, tray},
-    feat::clean_async,
+    feat::run_exit_cleanup_flow,
    process::AsyncHandler,
    utils,
 };
@@ -14,15 +14,8 @@ use smartstring::alias::String;
 use std::sync::{Arc, LazyLock};

 #[allow(clippy::expect_used)]
-static TLS_CONFIG: LazyLock<Arc<rustls::ClientConfig>> = LazyLock::new(|| {
-    let root_store = rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
-    let config = rustls::ClientConfig::builder_with_provider(Arc::new(rustls::crypto::ring::default_provider()))
-        .with_safe_default_protocol_versions()
-        .expect("Failed to set TLS versions")
-        .with_root_certificates(root_store)
-        .with_no_client_auth();
-    Arc::new(config)
-});
+static TLS_CONFIG: LazyLock<Arc<rustls::ClientConfig>> =
+    LazyLock::new(|| Arc::new(utils::network::build_webpki_rooted_tls_config().expect("Failed to set TLS versions")));

 pub async fn restart_clash_core() {
    match CoreManager::global().restart_core().await {
@@ -38,38 +31,9 @@ pub async fn restart_clash_core() {

 pub async fn restart_app() {
    logging!(debug, Type::System, "启动重启应用流程");
-    handle::Handle::global().set_is_exiting();
-
-    Config::apply_all_and_save_file().await;
-
-    let cleanup_result = clean_async().await;
-
-    logging!(
-        info,
-        Type::System,
-        "资源清理完成，退出代码: {}",
-        if cleanup_result.all_success { 0 } else { 1 }
-    );
+    let cleanup_result = run_exit_cleanup_flow(NoticeStatus::AppRestartCoreStopFailed).await;

    if !cleanup_result.core_stopped {
-        handle::Handle::global().clear_is_exiting();
-        // A failed stop may still have marked the core stopped, and exit cleanup skipped the DNS restore.
-        // A core that kept running keeps its DNS, whatever an unapplied config draft says.
-        #[cfg(target_os = "macos")]
-        {
-            let manager = CoreManager::global();
-            let _lifecycle = manager.lifecycle_lock.lock().await;
-            if matches!(
-                *manager.get_running_mode(),
-                crate::core::manager::RunningMode::NotRunning
-            ) {
-                crate::utils::resolve::dns::sync_public_dns().await;
-            }
-        }
-        handle::Handle::notice(
-            NoticeStatus::AppRestartCoreStopFailed,
-            cleanup_result.stop_error.unwrap_or_default(),
-        );
        return;
    }

@@ -103,11 +67,14 @@ pub async fn change_clash_mode(mode: String) -> Result<(), String> {
    }

    let clash = Config::clash().await;
-    clash.edit_draft(|d| d.patch_config(&mapping));
-    clash.apply();
-
-    let clash_data = clash.data_arc();
-    if clash_data.save_config().await.is_ok() {
+    // Serialize with patch transactions: an unlocked commit can flush a staged draft mid-rollback.
+    let save_result = {
+        let _config_write = Config::lock_config_write().await;
+        clash.edit_draft(|d| d.patch_config(&mapping));
+        clash.apply();
+        clash.data_arc().save_config().await
+    };
+    if save_result.is_ok() {
        announce(Refresh::Clash);
        tray::Tray::global().update_menu_and_icon().await;
    }
@@ -47,26 +47,11 @@ pub async fn switch_proxy_node(group_name: &str, proxy_name: &str) {
            record_switched_node(group_name, proxy_name).await;
            announce(Refresh::Proxies);
            let _ = tray::Tray::global().update_menu().await;
-            return;
        }
        Err(err) => {
            logging!(error, Type::Tray, "切换代理失败: {err:?}");
        }
    }
-
-    match handle::Handle::mihomo()
-        .select_node_for_group(group_name, proxy_name)
-        .await
-    {
-        Ok(_) => {
-            logging!(info, Type::Tray, "代理切换回退成功: {} -> {}", group_name, proxy_name);
-            record_switched_node(group_name, proxy_name).await;
-            let _ = tray::Tray::global().update_menu().await;
-        }
-        Err(err) => {
-            logging!(error, Type::Tray, "代理切换最终失败: {err:?}");
-        }
-    }
 }

 async fn should_update_profile(uid: &String, ignore_auto_update: bool) -> Result<Option<(String, Option<PrfOption>)>> {
@@ -130,9 +130,7 @@ pub async fn open_or_close_dashboard() {
    logging!(info, Type::Window, "Window toggle result: {result:?}");
 }

-pub async fn quit() {
-    logging!(debug, Type::System, "启动退出流程");
-    // 设置退出标志
+pub(crate) async fn run_exit_cleanup_flow(stop_failed_notice: NoticeStatus) -> CleanupResult {
    handle::Handle::global().set_is_exiting();

    Config::apply_all_and_save_file().await;
@@ -162,11 +160,18 @@ pub async fn quit() {
            }
        }
        handle::Handle::notice(
-            NoticeStatus::AppQuitCoreStopFailed,
-            cleanup_result.stop_error.unwrap_or_default(),
+            stop_failed_notice,
+            cleanup_result.stop_error.clone().unwrap_or_default(),
        );
    }

+    cleanup_result
+}
+
+pub async fn quit() {
+    logging!(debug, Type::System, "启动退出流程");
+    let cleanup_result = run_exit_cleanup_flow(NoticeStatus::AppQuitCoreStopFailed).await;
+
    utils::server::shutdown_embedded_server();
    let app_handle = handle::Handle::app_handle();
    app_handle.exit(if cleanup_result.all_success { 0 } else { 1 });
@@ -354,7 +354,6 @@ pub(super) async fn init_dns_config() -> Result<()> {
                Value::String("*.arpa".into()),
                Value::String("time.*.com".into()),
                Value::String("ntp.*.com".into()),
-                Value::String("time.*.com".into()),
                Value::String("+.market.xiaomi.com".into()),
                Value::String("localhost.ptlogin2.qq.com".into()),
                Value::String("*.msftncsi.com".into()),
@@ -509,11 +508,9 @@ pub async fn init_resources() -> Result<()> {
    let app_dir = dirs::app_home_dir()?;
    let res_dir = dirs::app_resources_dir()?;

-    if !app_dir.exists() {
-        std::mem::drop(fs::create_dir_all(&app_dir).await);
-    }
+    // app_home is created by `ensure_directories` in `init_config`, which always runs first.
    if !res_dir.exists() {
-        std::mem::drop(fs::create_dir_all(&res_dir).await);
+        fs::create_dir_all(&res_dir).await?;
    }

    let file_list = ["Country.mmdb", "ASN.mmdb", "geoip.dat", "geosite.dat"];
@@ -48,6 +48,17 @@ enum TlsRootMode {
    StaticWebpkiRoots,
 }

+/// ALPN stays unset: raw TLS connectors offer none, while reqwest needs the h2 offer.
+pub(crate) fn build_webpki_rooted_tls_config() -> Result<rustls::ClientConfig> {
+    let root_store = rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
+    let config = rustls::ClientConfig::builder_with_provider(Arc::new(rustls::crypto::ring::default_provider()))
+        .with_safe_default_protocol_versions()?
+        .with_root_certificates(root_store)
+        .with_no_client_auth();
+
+    Ok(config)
+}
+
 pub struct NetworkManager;

 impl NetworkManager {
@@ -102,13 +113,7 @@ impl NetworkManager {
    }

    fn build_static_webpki_tls_config() -> Result<rustls::ClientConfig> {
-        let root_store = rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
-        let mut config =
-            rustls::ClientConfig::builder_with_provider(Arc::new(rustls::crypto::ring::default_provider()))
-                .with_safe_default_protocol_versions()?
-                .with_root_certificates(root_store)
-                .with_no_client_auth();
-
+        let mut config = build_webpki_rooted_tls_config()?;
        config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];

        Ok(config)
@@ -155,6 +160,23 @@ impl NetworkManager {
        detail.contains("protocolversion") || detail.contains("protocol version")
    }

+    /// `allow_fallback` stays false when the caller already disabled certificate verification.
+    async fn request_with_static_webpki_fallback<T, F, Fut>(allow_fallback: bool, mut request: F) -> Result<T>
+    where
+        F: FnMut(TlsRootMode) -> Fut,
+        Fut: std::future::Future<Output = Result<T>>,
+    {
+        match request(TlsRootMode::PlatformVerifier).await {
+            Ok(value) => Ok(value),
+            Err(err) if allow_fallback && Self::should_retry_with_static_webpki_roots(&err) => {
+                request(TlsRootMode::StaticWebpkiRoots).await.map_err(|fallback_err| {
+                    fallback_err.context("static webpki roots fallback failed after platform TLS verifier failed")
+                })
+            }
+            Err(err) => Err(err),
+        }
+    }
+
    async fn get_with_tls_mode(
        &self,
        url: &str,
@@ -264,34 +286,21 @@ impl NetworkManager {
        user_agent: Option<String>,
        accept_invalid_certs: bool,
    ) -> Result<HttpResponse> {
-        let platform_result = self
-            .get_with_tls_mode(
-                url,
-                proxy_type,
-                timeout_secs,
-                user_agent.clone(),
-                accept_invalid_certs,
-                TlsRootMode::PlatformVerifier,
-            )
-            .await;
-
-        match platform_result {
-            Ok(response) => Ok(response),
-            Err(err) if !accept_invalid_certs && Self::should_retry_with_static_webpki_roots(&err) => self
-                .get_with_tls_mode(
+        Self::request_with_static_webpki_fallback(!accept_invalid_certs, |tls_root_mode| {
+            let user_agent = user_agent.clone();
+            async move {
+                self.get_with_tls_mode(
                    url,
                    proxy_type,
                    timeout_secs,
                    user_agent,
                    accept_invalid_certs,
-                    TlsRootMode::StaticWebpkiRoots,
+                    tls_root_mode,
                )
                .await
-                .map_err(|fallback_err| {
-                    fallback_err.context("static webpki roots fallback failed after platform TLS verifier failed")
-                }),
-            Err(err) => Err(err),
-        }
+            }
+        })
+        .await
    }

    async fn get_bytes_with_tls_mode(
@@ -340,19 +349,10 @@ impl NetworkManager {
        timeout_secs: Option<u64>,
        max_bytes: usize,
    ) -> Result<Vec<u8>> {
-        let platform_result = self
-            .get_bytes_with_tls_mode(url, proxy_type, timeout_secs, max_bytes, TlsRootMode::PlatformVerifier)
-            .await;
-
-        match platform_result {
-            Ok(body) => Ok(body),
-            Err(err) if Self::should_retry_with_static_webpki_roots(&err) => self
-                .get_bytes_with_tls_mode(url, proxy_type, timeout_secs, max_bytes, TlsRootMode::StaticWebpkiRoots)
+        Self::request_with_static_webpki_fallback(true, |tls_root_mode| async move {
+            self.get_bytes_with_tls_mode(url, proxy_type, timeout_secs, max_bytes, tls_root_mode)
                .await
-                .map_err(|fallback_err| {
-                    fallback_err.context("static webpki roots fallback failed after platform TLS verifier failed")
-                }),
-            Err(err) => Err(err),
-        }
+        })
+        .await
    }
 }
@@ -1,8 +1,6 @@
 use crate::core::notify::NoticeStatus;
 use std::sync::atomic::{AtomicBool, Ordering};

-use anyhow::Result;
-
 use crate::{
    config::Config,
    core::{
@@ -97,18 +95,6 @@ async fn resolve_setup() {
    resolve_done();
 }

-pub async fn resolve_reset_async() -> Result<(), anyhow::Error> {
-    CoreManager::global().stop_core().await?;
-
-    #[cfg(target_os = "macos")]
-    {
-        use dns::restore_public_dns;
-        restore_public_dns().await?;
-    }
-
-    Ok(())
-}
-
 fn init_scheme() {
    logging_error!(Type::Setup, init::init_scheme());
 }
@@ -608,7 +608,7 @@ function NormalProxyGroups(props: { mode: string }) {
        />
      </DragDropProvider>

-      {mode === 'rule' && (
+      {(mode === 'rule' || mode === 'global') && (
        <ProxyGroupNavigator
          proxyGroupNames={proxyGroupNames}
          onGroupLocation={handleGroupLocationByName}
@@ -211,7 +211,7 @@ export const useRenderList = (
    if (!proxyView) return []
    if (isChainMode)
      return selectedGroup ? [selectedGroup] : [CHAIN_DELAY_GROUP]
-    return mode === 'rule' || mode === 'script'
+    return mode === 'rule' || mode === 'global'
      ? proxyView.groups.map(({ name }) => name)
      : proxyView.global
        ? [proxyView.global.name]
@@ -257,7 +257,7 @@ export const useRenderList = (
      }))
    }

-    const useRule = mode === 'rule' || mode === 'script'
+    const useRule = mode === 'rule' || mode === 'global'
    const renderGroups = useRule
      ? proxyView.groups
      : proxyView.global === null
@@ -36,6 +36,7 @@
      "yes": "Yes",
      "no": "No",
      "failed": "Failed",
+      "risky": "غير مؤكد",
      "completed": "Completed",
      "disallowedIsp": "Disallowed ISP",
      "originalsOnly": "Originals Only",
@@ -36,6 +36,7 @@
      "yes": "Unterstützt",
      "no": "Nicht unterstützt",
      "failed": "Test fehlgeschlagen",
+      "risky": "Ungewiss",
      "completed": "Prüfung abgeschlossen",
      "disallowedIsp": "Nicht zugelassener Internetdienstanbieter",
      "originalsOnly": "Nur Original",
@@ -36,6 +36,7 @@
      "yes": "Yes",
      "no": "No",
      "failed": "Failed",
+      "risky": "Risky",
      "completed": "Completed",
      "disallowedIsp": "Disallowed ISP",
      "originalsOnly": "Originals Only",
@@ -36,6 +36,7 @@
      "yes": "Soportado",
      "no": "No soportado",
      "failed": "Prueba fallida",
+      "risky": "Dudoso",
      "completed": "Detección completada",
      "disallowedIsp": "Proveedor de servicios de Internet no permitido",
      "originalsOnly": "Solo originales",
@@ -36,6 +36,7 @@
      "yes": "Yes",
      "no": "No",
      "failed": "Failed",
+      "risky": "نامشخص",
      "completed": "Completed",
      "disallowedIsp": "Disallowed ISP",
      "originalsOnly": "Originals Only",
@@ -36,6 +36,7 @@
      "yes": "Yes",
      "no": "No",
      "failed": "Failed",
+      "risky": "Tidak pasti",
      "completed": "Completed",
      "disallowedIsp": "Disallowed ISP",
      "originalsOnly": "Originals Only",
@@ -36,6 +36,7 @@
      "yes": "サポートする",
      "no": "サポートしない",
      "failed": "テストに失敗しました。",
+      "risky": "要確認",
      "completed": "検査完了",
      "disallowedIsp": "許可されていないインターネットサービスプロバイダー",
      "originalsOnly": "オリジナルのみ",
@@ -36,6 +36,7 @@
      "yes": "예",
      "no": "아니오",
      "failed": "실패",
+      "risky": "확인 필요",
      "completed": "완료",
      "disallowedIsp": "허용되지 않는 ISP",
      "originalsOnly": "오리지널만",
@@ -36,6 +36,7 @@
      "yes": "Sim",
      "no": "Não",
      "failed": "Falhou",
+      "risky": "Incerto",
      "completed": "Concluído",
      "disallowedIsp": "ISP não permitido",
      "originalsOnly": "Somente originais",
@@ -36,6 +36,7 @@
      "yes": "Да",
      "no": "Нет",
      "failed": "Ошибка",
+      "risky": "Неясно",
      "completed": "Завершено",
      "disallowedIsp": "Провайдер заблокирован",
      "originalsOnly": "Только Originals",
@@ -36,6 +36,7 @@
      "yes": "Evet",
      "no": "Hayır",
      "failed": "Başarısız",
+      "risky": "Belirsiz",
      "completed": "Tamamlandı",
      "disallowedIsp": "İzin Verilmeyen ISP",
      "originalsOnly": "Yalnızca Orijinaller",
@@ -36,6 +36,7 @@
      "yes": "Yes",
      "no": "No",
      "failed": "Failed",
+      "risky": "Билгесез",
      "completed": "Completed",
      "disallowedIsp": "Disallowed ISP",
      "originalsOnly": "Originals Only",
@@ -36,6 +36,7 @@
      "yes": "支持",
      "no": "不支持",
      "failed": "测试失败",
+      "risky": "存疑",
      "completed": "检测完成",
      "disallowedIsp": "不允许的 ISP",
      "originalsOnly": "仅限原创",
@@ -36,6 +36,7 @@
      "yes": "支援",
      "no": "不支援",
      "failed": "測試失敗",
+      "risky": "存疑",
      "completed": "檢測完成",
      "disallowedIsp": "不允許的網際網路服務供應商",
      "originalsOnly": "僅限原創",
@@ -55,7 +55,7 @@ const wrapCssInjectionWithScope = (css?: string) => {
    return null
  }
  const scopeRoot = CSS_INJECTION_SCOPE_ROOT
-  const scopeLimit = CSS_INJECTION_SCOPE_LIMIT
+  const scopeLimit = `${CSS_INJECTION_SCOPE_LIMIT} > *`
  const scopedBlock = `@scope (${scopeRoot}) to (${scopeLimit}) {
 ${css}
 }`
@@ -40,6 +40,7 @@ const STATUS_LABEL_KEYS: Record<string, string> = {
  Yes: 'tests.statuses.test.yes',
  No: 'tests.statuses.test.no',
  Failed: 'tests.statuses.test.failed',
+  Risky: 'tests.statuses.test.risky',
  Completed: 'tests.statuses.test.completed',
  'Disallowed ISP': 'tests.statuses.test.disallowedIsp',
  'Originals Only': 'tests.statuses.test.originalsOnly',
@@ -196,7 +197,7 @@ const UnlockPage = () => {
    if (status === 'Pending') return 'default'
    if (status === 'Yes') return 'success'
    if (status === 'No') return 'error'
-    if (status === 'Soon') return 'warning'
+    if (status === 'Soon' || status === 'Risky') return 'warning'
    if (status.includes('Failed')) return 'error'
    if (status === 'Completed') return 'info'
    if (
@@ -222,7 +223,8 @@ const UnlockPage = () => {
  const getStatusBorderColor = (status: string) => {
    if (status === 'Yes') return theme.palette.success.main
    if (status === 'No') return theme.palette.error.main
-    if (status === 'Soon') return theme.palette.warning.main
+    if (status === 'Soon' || status === 'Risky')
+      return theme.palette.warning.main
    if (status.includes('Failed')) return theme.palette.error.main
    if (status === 'Completed') return theme.palette.info.main
    return theme.palette.divider
Author	SHA1	Message	Date
Tunglies	5780915d16	Merge branch 'dev' into refactor/backend-cleanup	2026-10-27 23:47:04 +08:00
Tunglies	eba4818e99	fix(sysopt): gate shared macOS bypass constant to macOS builds MACOS_DEFAULT_BYPASS is referenced only from cfg(target_os = "macos") code in sysopt.rs, so clippy on Linux and Windows flagged it as dead code under -D warnings.	2026-10-27 23:37:39 +08:00
Tunglies	abdf8cafcb	refactor(enhance): rename ChainSupport variants to Mihomo names Clash is a legacy name; the variants match the verge-mihomo and verge-mihomo-alpha cores they gate.	2026-10-27 23:26:18 +08:00
Tunglies	a91a7692f1	refactor(enhance): fold lowercase helpers into single owned function use_lowercase_owned disappears; the surviving use_lowercase takes the owned Mapping and borrowed callers clone at the call site.	2026-10-27 23:26:18 +08:00
nrenvo	cbd5ed73a5	fix(theme): allow injected CSS to style Monaco view containers (#8385 ) `@scope`'s `to` bound excludes the boundary elements themselves, so rules targeting `.view-lines` never matched. Move the bound to its children with `> *`: the container becomes styleable, its internals stay excluded.	2026-10-27 15:13:58 +00:00
Tunglies	635d345b1a	refactor(core): dedupe window listeners, elevated runners, backup settings - Collapse the close/focus window listener pairs in lightweight.rs onto a shared WindowListener with per-listener event and log label. - Extract the windows runas-or-direct execution into service::run_maybe_elevated, shared by win_uwp and the service uninstaller, and factor the common uninstaller path resolution and status check shared across platforms. - Make the auto-backup watch channel the single settings source, replacing the duplicate Arc<RwLock> copy with a stored receiver.	2026-10-27 22:40:33 +08:00
Tunglies	88153a65eb	refactor(sysopt): share macos bypass formatting The macOS default bypass list and its three-way composition (empty -> default, default + custom, custom only) were maintained twice: in sysopt's format_bypass and inline in proxy_control's service_bypass. Keep the literal once in constants and compose both paths through format_bypass; service_bypass keeps its NUL check and UTF-8 truncation.	2026-10-27 22:40:33 +08:00
Tunglies	71aef2e83c	refactor(sysopt): drop redundant lock and busy-wait The proxy target pair sat behind an Arc<RwLock> with no readers and an Arc that was never cloned; both writers already serialize on update_lock, so store the pair inside that mutex and delete the RwLock. refresh_guard waited for the guard to become ready with a yield_now spin at full CPU while holding guard_operation_lock; a 10 ms sleep keeps the same wait condition and lock scope without the spin.	2026-10-27 22:40:33 +08:00
Tunglies	c5dcef6f1e	fix(clash): take config write lock when changing mode change_clash_mode committed the clash draft and saved config.yaml without claiming CONFIG_WRITE_LOCK, so a concurrent patch_clash transaction could have its staged draft committed here or its file-snapshot rollback swallow the mode change. Take lock_config_write (waiting) rather than try_lock_config_write: two of the three callers (hotkey, tray) discard the result, so fail-fast would silently drop the switch, and the lock is only attempted after the mihomo patch already applied, where an Err would roll the frontend back while the core runs the new mode.	2026-10-27 22:40:33 +08:00
Tunglies	3a892043c4	refactor(backup): share restore finalize path restore_webdav_backup and restore_local_backup duplicated the credential extraction (backup creation strips the WebDAV credentials, so both re-inject the live ones), the archive extraction and the finalize tail. Move that tail into a private restore_backup_archive helper so the two entries keep only their download/locate logic; the config-write lock scope and the off-runtime extraction land in one place. The webdav entry keeps its downloaded-file cleanup.	2026-10-27 22:40:33 +08:00
Tunglies	5d0961943c	perf(backup): extract archive off the runtime Run File::open, ZipArchive::new and the extraction of the backup archive inside spawn_blocking. Extracting a multi-file backup blocked a tokio worker for hundreds of milliseconds to seconds while the runtime kept serving other work on the remaining workers. Move the PROFILE_WRITE_LOCK acquisition after the extraction, right before finalize_restored_verge_config: the lock protects the config-data transition (extracted files reloaded into drafts), not the plain filesystem writes, so profile operations no longer queue behind the blocking unzip.	2026-10-27 22:40:33 +08:00
Tunglies	70ae63c534	fix(backup): serialize restore with config write lock Acquire the configuration write lock at the entry of finalize_restored_verge_config so the clash, profiles and verge draft applies all happen under it, instead of only the verge layer. A concurrent patch (patch_clash / patch_verge via try_lock_config_write) could otherwise stage a draft that the unlocked restore applies overwrite, or interleave its persistence with the restore. Also drop the pointless clones in the clash and profiles edit_draft closures; edit_draft takes FnOnce so the restored values can be moved in. The lock is released before patch_verge, which re-acquires it via try_lock_config_write.	2026-10-27 22:40:33 +08:00
Tunglies	096a9f0d32	refactor(app): extract common exit cleanup restart_app and quit duplicate the whole exit preparation: set the exiting flag, persist configs, run interactive cleanup, and on a failed core stop clear the flag, restore public DNS under the lifecycle lock on macOS, and send the stop-failed notice. Move that flow into run_exit_cleanup_flow next to clean_async, taking the notice variant as a parameter and returning the CleanupResult so each caller keeps its own tail: restart aborts before shutdown, quit always shuts down and exits with the cleanup code.	2026-10-27 22:40:33 +08:00
Tunglies	4a4b72a5d6	refactor(net): reuse webpki tls config and fallback Extract build_webpki_rooted_tls_config so the delay-test TLS connector and the reqwest clients share one static-webpki-roots builder; ALPN stays caller-specific (only reqwest offers h2). Collapse the duplicated platform-verifier -> static-webpki-roots retry in get/get_bytes into request_with_static_webpki_fallback, gated by the caller's certificate-verification setting.	2026-10-27 22:40:33 +08:00
Tunglies	5363a4affb	refactor(enhance): merge chain processing and drop unused builtin js payload - collapse the identical process_global_items/process_profile_items into one parameterized process_override_items (entry uid sources unchanged) - fold the identical rules/proxies/groups arms of ChainItem::from_async into a single arm with an inner dispatch - stop embedding builtin JS payloads never executed by any path: the enhance loop dispatches builtin items by uid to native implementations, so ChainItem::builtin now carries empty script data (uids unchanged) - source ProfileItems fallback literals from Default instead of a second hand-written copy in collect_profile_items	2026-10-27 22:40:33 +08:00
Tunglies	6b883346d2	refactor(config): share patch macro and profiles helpers IVerge::patch_config, IProfiles::patch_item and PrfOption::merge each hand-rolled the same copy-Some-overwrite pattern; they now share one patch_opt_field macro (the or-else merge form is field-for-field equivalent for Option fields). The four profiles *_safe wrappers that inlined Config::profiles().with_data_modify boilerplate delegate to a with_profiles_edit helper, and record/forget_selected_node share the current-item lookup prelude via current_item_mut.	2026-10-27 22:40:33 +08:00
Tunglies	e3ad94c056	refactor(config): dedupe prfitem factories and companion seeding from_rules/from_proxies/from_groups differed only in uid prefix, type string and template, so they now delegate to a shared from_seq_item. The five current_* accessors collapse into a local macro. The identical five-block companion seeding in from_local and from_url moves into ensure_companion_items, preserving seeding order and error propagation.	2026-10-27 22:40:33 +08:00
Tunglies	a23b0ddc6b	refactor(config): fold port guards into single helper The five IClashTemp port guards duplicated the same read/parse/default logic with drifting defaults: some hardcoded 7895/7898/7899 while others referenced network::ports constants. Route them all through one guard_port_value helper and use the constants everywhere, keeping each guard's name, key and cfg attributes.	2026-10-27 22:40:32 +08:00
Tunglies	fbf94c3a41	refactor(core): drop unreachable hotkey dtor and dedupe tray predicate Remove impl Drop for Hotkey: the instance lives in a OnceLock static via the singleton! macro and is never dropped; exit-time unregistration is already handled by Hotkey::reset(). Spell the include_proxy_groups/display-mode predicate identically at both evaluation sites in tray menu building; behavior is unchanged (Option != Some("disable") is equivalent to unwrap_or("default") != "disable").	2026-10-27 22:40:32 +08:00
Tunglies	2d3619d2ec	refactor(enhance): simplify tun mode check and lowercase helpers - Drop the always-true second clause in use_tun's enhanced-mode check: the key is absent only when the unwrap_or default already makes current_mode == "fake-ip" true. - Collapse use_lowercase into a delegation to use_lowercase_owned.	2026-10-27 22:40:32 +08:00
Tunglies	16ee4aa135	refactor(profile): remove identical blind retry when switching node The second select_node_for_group call in switch_proxy_node was a zero-interval retry with identical arguments. Its success path was a degraded copy of the first (missing the Refresh::Proxies announcement ever since the old force-refresh emit was removed), and its distinct "回退/最终失败" log wording misled maintainers. Keep a single call, the primary success aftermath, and one error log.	2026-10-27 22:40:32 +08:00
Tunglies	ddfb476fc5	refactor(utils): drop dead reset helper and tidy init_resources - remove resolve_reset_async, which had no callers - drop the duplicated time.*.com entry from the default fake-ip-filter - init_resources no longer recreates app_home (ensure_directories during init_config already created it) and now propagates res_dir creation errors	2026-10-27 22:40:32 +08:00
Tunglies	02e5e0e4a6	ci: gate frontend and rust checks by changed paths (#8433 ) The paths-filter output in lint-clippy.yml only gated two echo steps; checkout, toolchain setup and clippy itself ran unconditionally, so frontend-only PRs still burned a 3-runner matrix on a full clippy build plus the logging-check tool install. - lint-clippy/rustfmt/frontend-check: move path filters to workflow level so irrelevant PRs spawn no runner at all - split contract-parity into its own workflow; its trigger set spans both sides and workflow paths cannot vary per job - clippy paths now cover crates/ and workspace Cargo files, which the old src-tauri/ filter missed dev has no required status checks, so path-filtered workflows cannot get stuck in "Expected".	2026-10-27 16:36:49 +08:00
susu-Sugar susu-Sugar Tunglies	0498ba3e4f	fix(proxies): render configured groups in global mode (#8402 ) * fix(proxies): render configured groups in global mode Global mode previously only rendered the synthetic GLOBAL group and sliced off its header, which flattened every user-defined group into a non-expandable proxy row. Configured groups could no longer be opened or inspected. Render the same group list as rule/script mode so every group keeps its own header and expand toggle. Fixes #8376 * style: keep useRule assignment on one line * fix & changelog * fix: hover when global proxy --------- Co-authored-by: susu-Sugar <214122492+susu-Sugar@users.noreply.github.com> Co-authored-by: Tunglies <77394545+Tunglies@users.noreply.github.com>	2026-10-27 01:41:19 +00:00
Tunglies	f39644ee6b	chore(typecheck): replace tsc with tsrs as the typecheck gate (#8428 ) tsrs (Rust port of the TypeScript 7 checker) replaces tsc --noEmit in the typecheck script, web:build, and CI. Measured on this repository: ~0.4s vs ~3.5s wall time and ~280 MB vs ~750 MB peak RSS, with identical zero-diagnostic results on the current tree. The typescript package stays installed: typescript-eslint projectService and scripts/cleanup-unused-i18n.mjs consume its compiler API.	2026-10-27 01:34:29 +00:00
susu-Sugar susu-Sugar ❤是纱雾酱哟～	488f022c05	feat(media-unlock): add Muse AI (muse.ai) detection (#8411 ) * feat(media-unlock): add Muse AI detection muse.ai redirects every region to Meta's aymh anti-bot gateway before the app loads, and a plain HTTP client cannot finish the JavaScript challenge. Report the result as a new Risky status (exit reachable, availability unverifiable) together with the exit region instead of a misleading Yes/No. Signed-off-by: ❤是纱雾酱哟～ <49941141+Dragon1573@users.noreply.github.com> * style(media-unlock): apply rustfmt and biome formatting Signed-off-by: ❤是纱雾酱哟～ <49941141+Dragon1573@users.noreply.github.com> * docs(changelog): Update changelog Signed-off-by: ❤是纱雾酱哟～ <49941141+Dragon1573@users.noreply.github.com> --------- Signed-off-by: ❤是纱雾酱哟～ <49941141+Dragon1573@users.noreply.github.com> Co-authored-by: susu-Sugar <214122492+susu-Sugar@users.noreply.github.com> Co-authored-by: ❤是纱雾酱哟～ <49941141+Dragon1573@users.noreply.github.com>	2026-10-26 17:17:09 +00:00