perf(tray): mutate menu state in place, rebuild only on structure change

Rebuilding the tray menu for every state change re-creates every item even when only checkmarks, delay texts or the selected node moved. Keep handles into the attached menu and, inside the same main-thread dispatch, mutate items in place. A signature over topology inputs (display mode, inline flags, mode, language, hotkeys, profile list) gates a full rebuild, and a proxy-only signature change swaps just the group submenus under the persisted Proxies submenu. State-only updates (mode/system proxy/TUN/lightweight switches, profile selection, node selection, delay texts) no longer reconstruct the menu; structural changes still rebuild exactly as before.
perf(tray): batch menu rebuild into a single dispatch
2026-11-02 21:12:13 +08:00 · 2026-10-21 16:46:44 +08:00 · 2026-10-21 15:44:39 +08:00
85 changed files with 1882 additions and 2387 deletions
@@ -4,8 +4,8 @@

  "features": {
    "ghcr.io/devcontainers/features/node:2": {
-      "version": "26.13.0",
-      "pnpmVersion": "12.16.1"
+      "version": "24.22.0",
+      "pnpmVersion": "12.14.0"
    },
    "ghcr.io/devcontainers/features/rust:1": {
      "version": "1.99.1",
@@ -1,33 +0,0 @@
-# Issue Guidelines / Issue 提交指引
-
-Use these suggestions to make reports easier to assess. State what you observed
-and what you could not verify; unknown details are fine.
-
-以下建议有助于维护者评估问题。请说明实际观察到的现象和无法确认的部分；未知信息可以留空。
-
- Search existing issues by symptom, conditions, and outcome. Add new evidence
-  to an existing report when it describes the same problem.
-  按现象、条件和结果搜索已有 Issue。若描述的是同一问题，请在原 Issue 中补充新证据。
- Keep each issue to one distinct user problem or requested outcome. Split
-  unrelated findings instead of bundling an audit or checklist.
-  每个 Issue 聚焦一个独立的问题或需求结果；无关发现请拆开，不要把审计清单打包成一个 Issue。
- For bugs, include the version, operating system, steps, and actual versus
-  expected behavior when known. A root-cause diagnosis is not required. Share
-  only relevant logs and redact tokens or personal information.
-  反馈 Bug 时，尽可能提供版本、操作系统、复现步骤及实际与预期行为。无需先判断根因；只提供相关日志，并遮盖令牌和个人信息。
- For feature requests, describe the user task, current limitation, desired
-  outcome, and affected platforms. An implementation proposal is optional.
-  提交功能请求时，请描述用户要完成的任务、当前限制、期望结果和适用平台；实现方案不是必填项。
- Separate observations from guesses. An AI or scanner finding is a hypothesis
-  until its affected configuration, concrete impact, and supporting evidence
-  are stated; do not present a list of theoretical risks as confirmed bugs.
-  区分观察结果和推测。AI 或扫描器的发现应先视为假设；请说明受影响的配置、具体影响和支持证据，不要把理论风险清单写成已确认的 Bug。
- Do not post secrets, personal data, or sensitive exploit details in a public
-  issue. Ask maintainers how to share sensitive security information safely.
-  请勿在公开 Issue 中发布密钥、个人信息或敏感利用细节；如涉及安全敏感信息，请先询问维护者如何安全提供。
- AI assistance is welcome; human contributors do not need to disclose it. If
-  an AI agent or automation creates or co-authors an issue, add a final body line
-  such as `Assisted by: GPT-5.6 High`. Omit effort when the runtime does not
-  report it. Disclosure is transparency only, not evidence for or against issue
-  quality.
-  欢迎使用 AI 辅助，人工提交者无需披露。如果 Issue 由 AI Agent 或自动化创建或共同撰写，请在正文末尾添加披露行，例如 `Assisted by: GPT-5.6 High`。运行环境未提供 effort 时可省略。披露仅用于提高透明度，不作为 Issue 质量的正面或负面证据。
@@ -10,8 +10,6 @@ body:
      value: |
        ## 在提交问题之前，请确认以下事项：

-        提交前可参考 [Issue 提交指引](https://github.com/clash-verge-rev/clash-verge-rev/blob/dev/.github/ISSUE_GUIDELINES.md)，说明可观察到的问题和证据；不确定的原因请标为猜测。
-
        1. 请 **确保** 您已经查阅了 [Clash Verge Rev 官方文档](https://clash-verge-rev.github.io/guide/term.html)  以及 [常见问题](https://clash-verge-rev.github.io/faq/windows.html)
        2. 请 **确保** [已有的问题](https://github.com/clash-verge-rev/clash-verge-rev/issues?q=is%3Aissue) 中没有人提交过相似 issue，否则请在已有的 issue 下进行讨论
        3. 请 **务必** 给 issue 填写一个简洁明了的标题，以便他人快速检索
@@ -21,8 +19,6 @@ body:

        ## Before submitting the issue, please make sure of the following checklist:

-        See the [Issue guidelines](https://github.com/clash-verge-rev/clash-verge-rev/blob/dev/.github/ISSUE_GUIDELINES.md) for how to describe observed behavior and evidence; mark uncertain causes as hypotheses.
-
        1. Please make sure you have read the [Clash Verge Rev official documentation](https://clash-verge-rev.github.io/guide/term.html) and [FAQ](https://clash-verge-rev.github.io/faq/windows.html)
        2. Please make sure there is no similar issue in the [existing issues](https://github.com/clash-verge-rev/clash-verge-rev/issues?q=is%3Aissue), otherwise please discuss under the existing issue
        3. Please be sure to fill in a concise and clear title for the issue so that others can quickly search
@@ -9,16 +9,12 @@ body:
    attributes:
      value: |
        ## 在提交问题之前，请确认以下事项：
-        可参考 [Issue 提交指引](https://github.com/clash-verge-rev/clash-verge-rev/blob/dev/.github/ISSUE_GUIDELINES.md)，描述用户任务、当前限制和期望结果。
-
        1. 请 **确保** 您已经查阅了 [Clash Verge Rev 官方文档](https://clash-verge-rev.github.io/guide/term.html) 确认软件不存在类似的功能
        2. 请 **确保** [已有的问题](https://github.com/clash-verge-rev/clash-verge-rev/issues?q=is%3Aissue) 中没有人提交过相似 issue，否则请在已有的 issue 下进行讨论
        3. 请 **务必** 给issue填写一个简洁明了的标题，以便他人快速检索
        4. 请 **务必** 先下载 [AutoBuild](https://github.com/clash-verge-rev/clash-verge-rev/releases/tag/autobuild) 版本测试，确保该功能还未实现
        5. 请 **务必** 按照模板规范详细描述问题，否则 issue 将会被关闭
        ## Before submitting the issue, please make sure of the following checklist:
-        See the [Issue guidelines](https://github.com/clash-verge-rev/clash-verge-rev/blob/dev/.github/ISSUE_GUIDELINES.md) for describing the user task, current limitation, and desired outcome.
-
        1. Please make sure you have read the [Clash Verge Rev official documentation](https://clash-verge-rev.github.io/guide/term.html) to confirm that the software does not have similar functions
        2. Please make sure there is no similar issue in the [existing issues](https://github.com/clash-verge-rev/clash-verge-rev/issues?q=is%3Aissue), otherwise please discuss under the existing issue
        3. Please be sure to fill in a concise and clear title for the issue so that others can quickly search
@@ -1,12 +1,6 @@
 ## Problem

-What breaks or what is missing. Product bug fixes and features require a
-pre-existing issue; link it here (`Fixes #123` only when this PR fully resolves
-it). Maintenance work (such as chore, perf, docs, refactor, test, CI/build,
-dependency, style, routine localization, or release changes) does not require
-an issue link; link one when it defines the scope. For reverts, link the PR or
-commit being reverted. For security-sensitive fixes that cannot be tracked
-publicly, follow maintainer-approved private tracking.
+What breaks or what is missing. Link the issue if one exists (`Fixes #123`).

 ## Approach

@@ -51,7 +51,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile
@@ -185,7 +185,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'
          cache: 'pnpm'

      - name: Pnpm Cache
@@ -282,7 +282,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'
          cache: 'pnpm'

      - name: Pnpm Cache
@@ -426,7 +426,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'
          cache: 'pnpm'

      - name: Pnpm Cache
@@ -524,7 +524,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - uses: pnpm/action-setup@v6.1.0
        name: Install pnpm
@@ -1,80 +0,0 @@
-name: Contract Parity
-
-on:
-  pull_request:
-    paths:
-      - "src-tauri/**/*.rs"
-      - "crates/**/*.rs"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "src-tauri/Cargo.toml"
-      - "crates/**/Cargo.toml"
-      - "rust-toolchain.toml"
-      - "src-tauri/tauri.conf*.json"
-      - "src/services/bindings.ts"
-      - "scripts/gen-contract.mjs"
-      - "scripts/check-contract-changes.mjs"
-      - "biome.json"
-      - "biome.jsonc"
-      - "package.json"
-      - "pnpm-lock.yaml"
-      - "pnpm-workspace.yaml"
-      - "scripts/contract-inputs.json"
-      - ".github/workflows/contract-parity.yml"
-      - ".husky/pre-push"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  HUSKY: 0
-
-jobs:
-  contract-parity:
-    runs-on: ubuntu-26.04
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Install Rust Stable
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: stable
-
-      - name: Rust Cache
-        uses: Swatinem/rust-cache@v2
-        with:
-          prefix-key: 'v1-rust'
-          key: 'rust-shared-stable-ubuntu-22.04-x86_64-unknown-linux-gnu-contract'
-          workspaces: |
-            . -> target
-          cache-all-crates: true
-          cache-workspace-crates: true
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libxslt1.1 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v6
-        with:
-          run_install: false
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: '26.13.0'
-          cache: 'pnpm'
-
-      - run: pnpm install --frozen-lockfile
-
-      - name: Provision sidecar placeholders for tauri-build
-        run: |
-          mkdir -p src-tauri/sidecar src-tauri/resources dist
-          touch dist/index.html
-          for bin in clash-verge-service clash-verge-service-install clash-verge-service-uninstall verge-mihomo verge-mihomo-alpha; do
-            touch "src-tauri/sidecar/${bin}-x86_64-unknown-linux-gnu"
-          done
-
-      - name: Check generated contract without changing the checkout
-        run: pnpm gen:contract --check
@@ -43,7 +43,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
@@ -103,7 +103,7 @@ jobs:
        if: github.event.inputs[matrix.input] == 'true'
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'
          cache: 'pnpm'

      - name: Pnpm Cache
@@ -2,23 +2,11 @@ name: Frontend Check

 on:
  pull_request:
-    paths:
-      - "src/**"
-      - "**/*.js"
-      - "**/*.ts"
-      - "**/*.tsx"
-      - "**/*.css"
-      - "**/*.scss"
-      - "**/*.json"
-      - "**/*.md"
-      - "pnpm-lock.yaml"
-      - "pnpm-workspace.yaml"
-      - "vite.config.*"
-      - ".github/workflows/frontend-check.yml"
  workflow_dispatch:

 permissions:
  contents: read
+  pull-requests: read

 env:
  HUSKY: 0
@@ -29,17 +17,46 @@ jobs:
    steps:
      - uses: actions/checkout@v7

+      - name: Check frontend changes
+        id: check_frontend
+        uses: dorny/paths-filter@v4
+        with:
+          filters: |
+            frontend:
+              - 'src/**'
+              - '**/*.js'
+              - '**/*.ts'
+              - '**/*.tsx'
+              - '**/*.css'
+              - '**/*.scss'
+              - '**/*.json'
+              - '**/*.md'
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
+              - 'knip.json'
+              - 'eslint.config.ts'
+              - 'tsconfig.json'
+              - 'vite.config.*'
+
+      - name: Skip if no frontend changes
+        if: steps.check_frontend.outputs.frontend != 'true'
+        run: echo "No frontend changes, skipping frontend checks."
+
      - name: Install pnpm
+        if: steps.check_frontend.outputs.frontend == 'true'
        uses: pnpm/action-setup@v6
        with:
          run_install: false

      - uses: actions/setup-node@v7
+        if: steps.check_frontend.outputs.frontend == 'true'
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'
          cache: 'pnpm'

      - name: Restore pnpm cache
+        if: steps.check_frontend.outputs.frontend == 'true'
        uses: actions/cache@v6
        with:
          path: ~/.pnpm-store
@@ -48,21 +65,94 @@ jobs:
            pnpm-shared-stable-${{ runner.os }}-

      - run: pnpm install --frozen-lockfile
+        if: steps.check_frontend.outputs.frontend == 'true'

      - name: Run Prettier check
+        if: steps.check_frontend.outputs.frontend == 'true'
        run: pnpm format:check

      - name: Run ESLint
+        if: steps.check_frontend.outputs.frontend == 'true'
        run: pnpm lint

      - name: Run TypeScript typecheck
+        if: steps.check_frontend.outputs.frontend == 'true'
        run: pnpm typecheck

      - name: Run tests
+        if: steps.check_frontend.outputs.frontend == 'true'
        run: pnpm test

      - name: Run Knip
+        if: steps.check_frontend.outputs.frontend == 'true'
        run: pnpm knip:check

      - name: Architecture gates (listen/emit only in the event bus, invoke only in services)
+        if: steps.check_frontend.outputs.frontend == 'true'
        run: node scripts/check-architecture.mjs listen emit invoke
+
+  contract-parity:
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Check contract inputs
+        id: check_inputs
+        uses: dorny/paths-filter@v4
+        with:
+          filters: scripts/contract-inputs.json
+
+      - name: Skip if contract inputs unchanged
+        if: steps.check_inputs.outputs.contract != 'true'
+        run: echo "No contract inputs changed, skipping parity check."
+
+      - name: Install Rust Stable
+        if: steps.check_inputs.outputs.contract == 'true'
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+
+      - name: Rust Cache
+        if: steps.check_inputs.outputs.contract == 'true'
+        uses: Swatinem/rust-cache@v2
+        with:
+          prefix-key: 'v1-rust'
+          key: 'rust-shared-stable-ubuntu-22.04-x86_64-unknown-linux-gnu-contract'
+          workspaces: |
+            . -> target
+          cache-all-crates: true
+          cache-workspace-crates: true
+
+      - name: Install dependencies
+        if: steps.check_inputs.outputs.contract == 'true'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libxslt1.1 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
+
+      - name: Install pnpm
+        if: steps.check_inputs.outputs.contract == 'true'
+        uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+
+      - uses: actions/setup-node@v7
+        if: steps.check_inputs.outputs.contract == 'true'
+        with:
+          node-version: '24.22.0'
+          cache: 'pnpm'
+
+      - run: pnpm install --frozen-lockfile
+        if: steps.check_inputs.outputs.contract == 'true'
+
+      - name: Provision sidecar placeholders for tauri-build
+        if: steps.check_inputs.outputs.contract == 'true'
+        run: |
+          mkdir -p src-tauri/sidecar src-tauri/resources dist
+          touch dist/index.html
+          for bin in clash-verge-service clash-verge-service-install clash-verge-service-uninstall verge-mihomo verge-mihomo-alpha; do
+            touch "src-tauri/sidecar/${bin}-x86_64-unknown-linux-gnu"
+          done
+
+      - name: Check generated contract without changing the checkout
+        if: steps.check_inputs.outputs.contract == 'true'
+        run: pnpm gen:contract --check
@@ -2,14 +2,6 @@ name: Clippy Lint

 on:
  pull_request:
-    paths:
-      - "src-tauri/**"
-      - "crates/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "rust-toolchain.toml"
-      - ".cargo/config.toml"
-      - ".github/workflows/lint-clippy.yml"
  workflow_dispatch:
 env:
  HUSKY: 0
@@ -31,6 +23,28 @@ jobs:

    runs-on: ${{ matrix.os }}
    steps:
+      - name: Check src-tauri changes
+        if: github.event_name != 'workflow_dispatch'
+        id: check_changes
+        uses: dorny/paths-filter@v4
+        with:
+          filters: |
+            rust:
+              - 'src-tauri/**'
+
+      - name: Skip if src-tauri not changed
+        if: github.event_name != 'workflow_dispatch' && steps.check_changes.outputs.rust != 'true'
+        run: echo "No src-tauri changes, skipping clippy lint."
+
+      - name: Continue if src-tauri changed
+        if: github.event_name != 'workflow_dispatch' && steps.check_changes.outputs.rust == 'true'
+        run: echo "src-tauri changed, running clippy lint."
+
+      - name: Manual trigger - always run
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          echo "Manual trigger detected: skipping changes check and running clippy."
+
      - name: Checkout Repository
        uses: actions/checkout@v7

@@ -65,7 +79,7 @@ jobs:
        run: cargo clippy-all

      - name: Run Windows security tests
-        if: matrix.os == 'windows-latest'
+        if: matrix.os == 'windows-latest' && (github.event_name == 'workflow_dispatch' || steps.check_changes.outputs.rust == 'true')
        working-directory: ./src-tauri
        run: cargo test --all-features --target ${{ matrix.target }}

@@ -1,79 +0,0 @@
-name: Prepare Release
-
-on:
-  pull_request_target:
-    types: [edited, closed]
-    branches: [dev]
-  workflow_dispatch:
-    inputs:
-      channel:
-        description: Release channel
-        required: true
-        type: choice
-        options: [rc, stable]
-        default: rc
-      release_tag:
-        description: 'Optional tag: vX.Y.Z-rc[.N] for RC, vX.Y.Z for stable'
-        required: false
-        type: string
-
-permissions:
-  contents: write
-  pull-requests: write
-
-concurrency:
-  group: prepare-release
-  cancel-in-progress: false
-
-jobs:
-  prepare:
-    if: >-
-      ${{ github.event_name == 'workflow_dispatch' ||
-          (github.event.pull_request.head.repo.full_name == github.repository &&
-           github.event.pull_request.user.login == 'github-actions[bot]' &&
-           ((startsWith(github.event.pull_request.head.ref, 'release/v') &&
-             ((github.event.action == 'closed' && github.event.pull_request.merged == true) ||
-              (github.event.changes.body && github.event.pull_request.state == 'open' &&
-               contains(github.event.pull_request.body, '[x] Refresh this PR from latest dev')))) ||
-            (startsWith(github.event.pull_request.head.ref, 'next-dev/v') &&
-             github.event.changes.body && github.event.pull_request.state == 'open' &&
-             (contains(github.event.pull_request.body, '[x] Refresh this PR from latest dev') ||
-              contains(github.event.pull_request.body, '[x] Use the next minor version') !=
-              contains(github.event.changes.body.from, '[x] Use the next minor version'))))) }}
-    runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - name: Require the dev branch
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          SOURCE_REF: ${{ github.ref }}
-        run: |
-          if [[ "$SOURCE_REF" != 'refs/heads/dev' ]]; then
-            echo '::error::Run Prepare Release from the dev branch.'
-            exit 1
-          fi
-
-      - uses: actions/checkout@v7
-        with:
-          ref: refs/heads/dev
-          fetch-depth: 0
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: '26.13.0'
-
-      - uses: pnpm/action-setup@v6
-        if: github.event.action != 'closed'
-        with:
-          run_install: false
-
-      - run: pnpm install --frozen-lockfile --ignore-scripts
-        if: github.event.action != 'closed'
-
-      - name: Create or refresh version or publication PR
-        env:
-          RELEASE_TAG: ${{ inputs.release_tag }}
-          RELEASE_CHANNEL: ${{ inputs.channel }}
-          RELEASE_COMMAND: ${{ github.event.action == 'closed' && 'publish-pr' || startsWith(github.event.pull_request.head.ref, 'next-dev/') && 'next-dev' || 'prepare' }}
-        run: node scripts-workflow/release.mjs "$RELEASE_COMMAND"
@@ -1,9 +1,6 @@
 name: Release Build

 on:
-  pull_request:
-    types: [edited]
-    branches: [main]
  push:
    # -rc tag 时预览发布, 跳过 telegram 通知、跳过 winget 提交、跳过 latest.json 文件更新
    tags:
@@ -14,59 +11,75 @@ env:
  RUST_BACKTRACE: short
  HUSKY: 0
 concurrency:
-  group: release-publication
-  cancel-in-progress: false
+  group: '${{ github.workflow }} - ${{ github.head_ref || github.ref }}'
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

 jobs:
-  prepare_release:
-    name: Approve Snapshot and Prepare Draft Release
-    if: >-
-      ${{ github.event_name == 'push' ||
-          (github.event.changes.body &&
-           github.event.pull_request.head.repo.full_name == github.repository &&
-           github.event.pull_request.user.login == 'github-actions[bot]' &&
-           startsWith(github.event.pull_request.head.ref, 'publish/v') &&
-           contains(github.event.pull_request.body, '[x] Publish this approved release')) }}
+  check_tag_version:
+    name: Check Release Tag and package.json Version Consistency
    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: read
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    outputs:
-      release_tag: ${{ steps.source.outputs.release_tag }}
-      source_sha: ${{ steps.source.outputs.source_sha }}
-      channel: ${{ steps.source.outputs.channel }}
-      release_id: ${{ steps.draft.outputs.id }}
    steps:
-      - name: Checkout trusted release tooling
+      - name: Checkout repository
        uses: actions/checkout@v7
        with:
-          ref: refs/heads/dev
          fetch-depth: 0
-      - uses: actions/setup-node@v7
-        with:
-          node-version: '26.13.0'
-      - name: Validate source and publish the approved snapshot
-        id: source
-        env:
-          RELEASE_COMMAND: ${{ github.event_name == 'push' && 'validate-tag' || 'publish' }}
-        run: node scripts-workflow/release.mjs "$RELEASE_COMMAND"

-      - name: Create or reuse draft release
-        id: draft
-        env:
-          RELEASE_TAG: ${{ steps.source.outputs.release_tag }}
-          SOURCE_SHA: ${{ steps.source.outputs.source_sha }}
-        run: node scripts-workflow/release.mjs prepare-draft
+      - name: Check if tag is from main branch
+        run: |
+          TAG_REF="${GITHUB_REF##*/}"
+          echo "Checking if tag $TAG_REF is from main branch..."
+
+          TAG_COMMIT=$(git rev-list -n 1 $TAG_REF)
+          MAIN_COMMITS=$(git rev-list origin/main)
+
+          if echo "$MAIN_COMMITS" | grep -q "$TAG_COMMIT"; then
+            echo "✅ Tag $TAG_REF is from main branch"
+          else
+            echo "❌ Tag $TAG_REF is not from main branch"
+            echo "This release workflow only accepts tags from main branch."
+            exit 1
+          fi
+
+      - name: Check tag and package.json version
+        run: |
+          TAG_REF="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
+          echo "Current tag: $TAG_REF"
+
+          PKG_VERSION=$(jq -r .version package.json)
+          echo "package.json version: $PKG_VERSION"
+
+          EXPECTED_TAG="v$PKG_VERSION"
+
+          if [[ "$TAG_REF" != "$EXPECTED_TAG" ]]; then
+            echo "❌ Version mismatch:"
+            echo "   Git tag       : $TAG_REF"
+            echo "   package.json  : $EXPECTED_TAG"
+            exit 1
+          fi
+
+          echo "✅ Tag and package.json version are consistent."
+
+  prepare_release:
+    name: Prepare Draft Release
+    runs-on: ubuntu-latest
+    needs: [check_tag_version]
+    outputs:
+      release_id: ${{ steps.prepare_release.outputs.id }}
+    steps:
+      - name: Create or update draft release
+        id: prepare_release
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: ${{ github.ref_name }}
+          target_commitish: ${{ github.sha }}
+          name: 'Clash Verge Rev ${{ github.ref_name }}'
+          body: 'Draft release, will be updated later.'
+          token: ${{ secrets.GITHUB_TOKEN }}
+          draft: true
+          prerelease: ${{ contains(github.ref_name, '-rc') }}

  update_tag:
-    name: Publish Completed Release
-    env:
-      RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
-    outputs:
-      source_sha: ${{ needs.prepare_release.outputs.source_sha }}
-      channel: ${{ needs.prepare_release.outputs.channel }}
+    name: Update tag
    runs-on: ubuntu-latest
    needs:
      [
@@ -78,8 +91,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.prepare_release.outputs.source_sha }}

      - name: Group changelog platforms
        run: bash ./scripts-workflow/group_platforms.sh
@@ -92,7 +103,7 @@ jobs:
      - name: Set Env
        run: |
          echo "BUILDTIME=$(TZ=Asia/Shanghai date)" >> $GITHUB_ENV
-          TAG_REF="$RELEASE_TAG"
+          TAG_REF="${GITHUB_REF##*/}"
          echo "TAG_NAME=$TAG_REF" >> $GITHUB_ENV
          VERSION=$(echo "$TAG_REF" | sed 's/^v//')
          echo "VERSION=$VERSION" >> $GITHUB_ENV
@@ -138,16 +149,10 @@ jobs:
          Created at ${{ env.BUILDTIME }}.
          EOF

-      - name: Verify release tag still points to the approved source
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SOURCE_SHA: ${{ needs.prepare_release.outputs.source_sha }}
-        run: node scripts-workflow/release.mjs verify-target
-
      - name: Publish Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PRERELEASE: ${{ contains(env.RELEASE_TAG, '-rc') }}
+          PRERELEASE: ${{ contains(github.ref_name, '-rc') }}
        run: |
          release_id="${{ needs.prepare_release.outputs.release_id }}"

@@ -176,8 +181,6 @@ jobs:
  release:
    name: Release Build
    needs: [prepare_release]
-    env:
-      RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
    strategy:
      fail-fast: false
      matrix:
@@ -197,8 +200,6 @@ jobs:
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.prepare_release.outputs.source_sha }}

      - name: Install Rust Stable
        uses: dtolnay/rust-toolchain@master
@@ -229,7 +230,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
@@ -248,6 +249,7 @@ jobs:
          echo "Rust target ${{ matrix.target }} installed."

      - name: Tauri build
+        # 上游 5.24 修改了 latest.json 的生成逻辑，且依赖 tauri-plugin-update 2.10.0 暂未发布，故锁定在 0.5.23 版本
        uses: tauri-apps/tauri-action@v1.0.0
        env:
          NODE_OPTIONS: '--max_old_space_size=4096'
@@ -262,14 +264,11 @@ jobs:
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        with:
          releaseId: ${{ needs.prepare_release.outputs.release_id }}
-          tagName: ${{ env.RELEASE_TAG }}
+          tagName: ${{ github.ref_name }}
          releaseBody: 'Draft release, will be updated later.'
-          releaseDraft: true
-          prerelease: ${{ needs.prepare_release.outputs.channel == 'rc' }}
-          releaseCommitish: ${{ needs.prepare_release.outputs.source_sha }}
          tauriScript: pnpm
          args: --target ${{ matrix.target }}
-          uploadUpdaterJson: ${{ needs.prepare_release.outputs.channel == 'stable' }}
+          includeUpdaterJson: true

      - name: Attest Windows bundles
        if: matrix.os == 'windows-latest'
@@ -294,8 +293,6 @@ jobs:
  release-for-linux-arm:
    name: Release Build for Linux ARM
    needs: [prepare_release]
-    env:
-      RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
    strategy:
      fail-fast: false
      matrix:
@@ -310,8 +307,6 @@ jobs:
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.prepare_release.outputs.source_sha }}

      - name: Install Rust Stable
        uses: dtolnay/rust-toolchain@master
@@ -336,7 +331,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - name: Install pnpm
        uses: pnpm/action-setup@v6
@@ -425,7 +420,7 @@ jobs:
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
-          gh release upload "$RELEASE_TAG" \
+          gh release upload "${{ github.ref_name }}" \
            target/${{ matrix.target }}/release/bundle/deb/*.deb \
            target/${{ matrix.target }}/release/bundle/rpm/*.rpm \
            --clobber
@@ -433,8 +428,6 @@ jobs:
  release-for-fixed-webview2:
    name: Release Build for Fixed WebView2
    needs: [prepare_release]
-    env:
-      RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
    strategy:
      fail-fast: false
      matrix:
@@ -449,8 +442,6 @@ jobs:
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.prepare_release.outputs.source_sha }}

      - name: Install Rust Stable
        uses: dtolnay/rust-toolchain@master
@@ -475,7 +466,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
@@ -541,55 +532,22 @@ jobs:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $files = Get-ChildItem "target\${{ matrix.target }}\release\bundle\nsis\*setup*" | Select-Object -ExpandProperty FullName
-          gh release upload "$env:RELEASE_TAG" $files --clobber
+          gh release upload "${{ github.ref_name }}" $files --clobber
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

-  prepare-next-dev:
-    name: Prepare Next Dev Version
-    if: ${{ needs.update_tag.outputs.channel == 'stable' }}
-    needs: [prepare_release, update_tag]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    concurrency:
-      group: prepare-release
-      cancel-in-progress: false
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
-      SOURCE_SHA: ${{ needs.prepare_release.outputs.source_sha }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: refs/heads/dev
-          fetch-depth: 0
-      - uses: actions/setup-node@v7
-        with:
-          node-version: '26.13.0'
-      - uses: pnpm/action-setup@v6
-        with:
-          run_install: false
-      - name: Prepare version and changelog PR
-        run: |
-          pnpm install --frozen-lockfile --ignore-scripts
-          node scripts-workflow/release.mjs next-dev
-
  release-update:
-    if: ${{ needs.update_tag.outputs.channel == 'stable' }}
+    if: ${{ !contains(github.ref_name, '-rc') }}
    name: Release Update
    runs-on: ubuntu-latest
    needs: [update_tag]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.update_tag.outputs.source_sha }}

      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
@@ -605,19 +563,17 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release-update-for-fixed-webview2:
-    if: ${{ needs.update_tag.outputs.channel == 'stable' }}
+    if: ${{ !contains(github.ref_name, '-rc') }}
    runs-on: ubuntu-latest
    needs: [update_tag]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.update_tag.outputs.source_sha }}

      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
@@ -633,7 +589,7 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  submit-to-winget:
-    if: ${{ needs.update_tag.outputs.channel == 'stable' }}
+    if: ${{ !contains(github.ref_name, '-rc') }}
    name: Submit to Winget
    runs-on: ubuntu-latest
    needs: [update_tag, release-update]
@@ -641,7 +597,6 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
-          ref: ${{ needs.update_tag.outputs.source_sha }}
          fetch-depth: 0
      - name: Get Version
        run: |
@@ -658,7 +613,7 @@ jobs:
          token: ${{ secrets.WINGET_TOKEN  }}

  notify-telegram:
-    if: ${{ needs.update_tag.outputs.channel == 'stable' }}
+    if: ${{ !contains(github.ref_name, '-rc') }}
    name: Notify Telegram
    runs-on: ubuntu-latest
    needs:
@@ -671,8 +626,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.update_tag.outputs.source_sha }}

      - name: Group changelog platforms
        run: bash ./scripts-workflow/group_platforms.sh
@@ -685,7 +638,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
@@ -6,12 +6,6 @@ name: Check Formatting

 on:
  pull_request:
-    paths:
-      - "src-tauri/**"
-      - "**/*.rs"
-      - "rustfmt.toml"
-      - "rust-toolchain.toml"
-      - ".github/workflows/rustfmt.yml"

 permissions:
  contents: read
@@ -25,10 +19,25 @@ jobs:
    steps:
      - uses: actions/checkout@v7

+      - name: Check Rust changes
+        id: check_rust
+        uses: dorny/paths-filter@v4
+        with:
+          filters: |
+            rust:
+              - 'src-tauri/**'
+              - '**/*.rs'
+
+      - name: Skip if no Rust changes
+        if: steps.check_rust.outputs.rust != 'true'
+        run: echo "No Rust changes, skipping rustfmt."
+
      - name: install Rust stable and rustfmt
+        if: steps.check_rust.outputs.rust == 'true'
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: run cargo fmt
+        if: steps.check_rust.outputs.rust == 'true'
        run: cargo fmt --manifest-path ./src-tauri/Cargo.toml --all -- --check
@@ -28,7 +28,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - name: Install pnpm
        uses: pnpm/action-setup@v6
@@ -34,7 +34,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
@@ -15,7 +15,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
@@ -39,7 +39,7 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@v7
        with:
-          node-version: '26.13.0'
+          node-version: '24.22.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
@@ -1,3 +1,3 @@
-nodejs 26.13.0
-pnpm 12.16.1
+nodejs 24.22.0
+pnpm 12.14.0
 rust 1.99.1
@@ -18,25 +18,22 @@ These rules apply to every change, whether human- or agent-authored. They match
 the ownership evidence the AI-slop review evaluates (see
 [`pr-ai-slop-review.md`](.github/workflows/pr-ai-slop-review.md)).

-1. **Issue first.** Product bug fixes and features require a pre-existing issue;
-   self-scoped maintenance work does not. Follow the PR template for linkage and
-   revert references. If a required issue is missing, ask maintainers to open or
-   approve one before implementing. For security-sensitive fixes that cannot be
-   tracked publicly, follow maintainer-approved private tracking.
+1. **Issue first.** Non-trivial changes require a pre-existing issue describing
+   the problem. If none exists, ask the maintainers to open or approve one
+   before implementing.
 2. **Scope discipline.** Every changed file must be justifiable from the linked
-   issue or the stated PR scope. No drive-by refactors, renames, formatting
-   churn, or dependency bumps unrelated to the work.
+   issue. No drive-by refactors, renames, formatting churn, or dependency bumps
+   unrelated to the problem being fixed.
 3. **Author accountability.** AI assistance is welcome, but the contributor owns
   the result: understand the change, describe the problem and approach in your
   own words, and verify the change against the reported behavior before
   submitting.
 4. **Tests are justified, not default.** Do not add tests, test scaffolding, or
-   speculative defensive code unless the linked issue or stated task demands
-   them. When a test is genuinely necessary — it reproduces the reported
-   regression or guards behavior whose breakage would otherwise go unnoticed —
-   keep it minimal and state in the PR body why it is needed. Bulk test files
-   and defensive programming for hypothetical failure modes are PR bloat, not
-   rigor.
+   speculative defensive code unless the linked issue demands them. When a test
+   is genuinely necessary — it reproduces the reported regression or guards
+   behavior whose breakage would otherwise go unnoticed — keep it minimal and
+   state in the PR body why it is needed. Bulk test files and defensive
+   programming for hypothetical failure modes are PR bloat, not rigor.
 5. **Comments state constraints, not narration.** Write a comment only for a
   non-obvious constraint the code cannot express; never restate what the code
   does.
@@ -47,12 +44,13 @@ the ownership evidence the AI-slop review evaluates (see
   real evidence instead: reproduction steps, failure output, targeted tests.
 8. **Minimal diffs.** Match the surrounding code's style, naming, and comment
   density. Do not introduce new dependencies or restructure working code unless
-   the linked issue or stated task demands it.
-9. **Disclose AI automation.** When an agent creates or co-creates a PR or Issue,
-   append a final body line with the model and effort used (e.g.
-   `Assisted by: GPT-5.6 High`). Effort may be omitted when the runtime does not
-   report it. Human contributors are not asked to disclose AI assistance.
-   Disclosure is transparency only and carries no positive or negative weight.
+   the issue demands it.
+9. **Disclose AI automation.** When an agent produces or co-produces a change,
+   append a footer line to the PR body with the model and effort used (e.g.
+   `Assisted by: GPT-5.6 High`). The PR template intentionally omits this line —
+   the agent adds it itself, humans are not asked to declare anything. Effort may
+   be omitted when the runtime does not report it. Disclosure is transparency
+   only; it does not substitute for any rule above.
 10. **Compiled workflows.** The AI-slop review policy in
    [pr-ai-slop-review.md](.github/workflows/pr-ai-slop-review.md) is compiled:
    after editing it, run `gh aw compile` and commit the regenerated
@@ -61,10 +59,8 @@ the ownership evidence the AI-slop review evaluates (see
    [`template/Changelog.md`](template/Changelog.md): one line per
    user-visible change, no internals.

-## Issue and PR Workflows
+## Pull Request Shape

-When drafting, triaging, splitting, or implementing from a community issue, use
-the conditional checklist in [`.github/ISSUE_GUIDELINES.md`](.github/ISSUE_GUIDELINES.md).
-Do not make GitHub issue changes without explicit authorization. For PRs, follow
-the directly loaded [PR template](.github/PULL_REQUEST_TEMPLATE.md); do not
-duplicate its prompts here.
+Describe three things, briefly: the problem (with issue link), why this approach
+solves it, and what changed. See
+[`PULL_REQUEST_TEMPLATE.md`](.github/PULL_REQUEST_TEMPLATE.md).
@@ -28,7 +28,7 @@ Before contributing, you need to set up your development environment. Follow the
 ### Prerequisites

 1. **Install Rust and Node.js**  
-   Follow the [Tauri prerequisites](https://tauri.app/start/prerequisites/) for your operating system. Use the Node.js version in [`.tool-versions`](.tool-versions); [`rust-toolchain.toml`](rust-toolchain.toml) selects the Rust version and required components when you run Cargo from this repository.
+   Our project requires both Rust and Node.js. Follow the official installation instructions [here](https://tauri.app/start/prerequisites/).

 ### Windows Users

@@ -51,21 +51,18 @@ rustup set default-host x86_64-pc-windows-msvc

 ### Install Node.js Package Manager

-[Corepack is no longer bundled with Node.js starting with Node.js 25](https://nodejs.org/api/corepack.html). Install it globally if it is not already available, then enable it:
+Enable `corepack`:

 ```bash
-npm install --global corepack
 corepack enable
 ```

-Run pnpm from this repository so Corepack selects the version pinned by `packageManager` in [`package.json`](package.json).
-
 ### Install Project Dependencies

 Node.js dependencies:

 ```bash
-pnpm install --frozen-lockfile
+pnpm install
 ```

 Ubuntu-only system packages:
@@ -81,24 +78,14 @@ pnpm run prebuild
 pnpm run prebuild --force  # Re-download and overwrite Mihomo core and service binaries
 ```

-### Prepare the Development Service Source
-
-`pnpm dev` builds the development service from a sibling checkout of [`clash-verge-service-ipc`](https://github.com/clash-verge-rev/clash-verge-service-ipc). The binaries downloaded by `pnpm prebuild` do not replace this source checkout.
-
-Check the `clash_verge_service_ipc` dependency in [`src-tauri/Cargo.toml`](src-tauri/Cargo.toml), then clone the service repository alongside `clash-verge-rev` and check out the matching tag. If the sibling directory already exists, reuse it and check its version rather than overwriting it. Without this checkout, `pnpm dev` fails when it tries to access `../clash-verge-service-ipc/Cargo.toml`.
-
 ### Run the Development Server

-Run these commands from the root of `clash-verge-rev`:
-
 ```bash
-pnpm dev           # Build the development service and start the desktop app
-pnpm dev:diff      # Alias of pnpm dev
-pnpm dev:tauri     # Run Tauri directly with the tauri-dev feature
+pnpm dev           # Standard
+pnpm dev:diff      # If an app instance already exists
+pnpm dev:tauri     # Run Tauri development mode
 ```

-For frontend-only development, use `pnpm web:dev`. It does not start the Rust backend or build the development service.
-
 ### Build the Project

 Standard build:
@@ -33,7 +33,6 @@ dependencies = [
 "cipher",
 "cpubits",
 "cpufeatures 0.3.0",
- "zeroize",
 ]

 [[package]]
@@ -136,6 +135,15 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"

+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+dependencies = [
+ "derive_arbitrary",
+]
+
 [[package]]
 name = "arboard"
 version = "3.6.1"
@@ -1111,7 +1119,7 @@ dependencies = [
 "getrandom 0.4.3",
 "libc",
 "log",
- "minisign-verify",
+ "minisign-verify 0.3.0",
 "nanoid",
 "network-interface",
 "objc2",
@@ -1167,7 +1175,7 @@ dependencies = [
 "windows-service",
 "windows-sys 0.61.2",
 "winreg 0.56.0",
- "zip",
+ "zip 9.0.4",
 ]

 [[package]]
@@ -1334,7 +1342,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "117725a109d387c937a1533ce01b450cbde6b88abceea8473c4d7a85853cda3c"
 dependencies = [
 "lazy_static",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -1862,6 +1870,17 @@ dependencies = [
 "serde_core",
 ]

+[[package]]
+name = "derive_arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "derive_more"
 version = "2.1.1"
@@ -2015,7 +2034,7 @@ dependencies = [
 "libc",
 "option-ext",
 "redox_users 0.5.2",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -2274,7 +2293,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -2790,7 +2809,7 @@ dependencies = [
 "gobject-sys 0.21.5",
 "libc",
 "system-deps 7.0.8",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3344,7 +3363,7 @@ dependencies = [
 "js-sys",
 "log",
 "wasm-bindgen",
- "windows-core 0.61.2",
+ "windows-core 0.62.2",
 ]

 [[package]]
@@ -4032,9 +4051,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"

 [[package]]
 name = "lzma-rust2"
-version = "0.23.0"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1c46f3fcd2e888afdb01a07efc071cb21300e07c68d32c3e8b01b5c8cb1fcaa"
+checksum = "7277c9742229dc25243236d578b6471a798c554512c6f6a04365ec2e87c2a3bb"
 dependencies = [
 "sha2 0.11.1",
 ]
@@ -4151,6 +4170,12 @@ dependencies = [
 "unicase",
 ]

+[[package]]
+name = "minisign-verify"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e"
+
 [[package]]
 name = "minisign-verify"
 version = "0.3.0"
@@ -4215,7 +4240,7 @@ dependencies = [
 "png 0.18.1",
 "serde",
 "thiserror 2.0.20",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4382,7 +4407,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4859,7 +4884,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5524,7 +5549,7 @@ dependencies = [
 "once_cell",
 "socket2",
 "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5974,13 +5999,12 @@ dependencies = [

 [[package]]
 name = "rust-ini"
-version = "0.21.1"
+version = "0.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e310ef0e1b6eeb79169a1171daf9abcb87a2e17c03bee2c4bb100b55c75409f"
+checksum = "796e8d2b6696392a43bea58116b667fb4c29727dc5abd27d6acf338bb4f688c7"
 dependencies = [
 "cfg-if",
 "ordered-multimap",
- "trim-in-place",
 ]

 [[package]]
@@ -6028,7 +6052,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.4.15",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -6041,7 +6065,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6100,7 +6124,7 @@ dependencies = [
 "security-framework",
 "security-framework-sys",
 "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6601,6 +6625,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e362d9935bc50f019969e2f9ecd66786612daae13e8f277be7bfb66e8bed3f7"
 dependencies = [
 "libc",
+ "sigchld",
 "windows-sys 0.60.2",
 ]

@@ -6620,6 +6645,17 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"

+[[package]]
+name = "sigchld"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47106eded3c154e70176fc83df9737335c94ce22f821c32d17ed1db1f83badb1"
+dependencies = [
+ "libc",
+ "os_pipe",
+ "signal-hook 0.3.18",
+]
+
 [[package]]
 name = "signal-hook"
 version = "0.1.17"
@@ -6630,6 +6666,16 @@ dependencies = [
 "signal-hook-registry",
 ]

+[[package]]
+name = "signal-hook"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
@@ -6720,7 +6766,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
 "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6835,12 +6881,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"

-[[package]]
-name = "static_vcruntime"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff7589a1859b09232522bb9edf076ca7fcf14ded96685d3fa629db73023ffbb7"
-
 [[package]]
 name = "string_cache"
 version = "0.9.0"
@@ -6900,9 +6940,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

 [[package]]
 name = "swift-rs"
-version = "1.0.9"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cefd87076fd385308ee4aff597256c902f1fbb4d031de1558efc12f8ffefadd9"
+checksum = "e45c444e496845d3f2a351146bff59aae4975b2280238df1dfaa0c7d1846f38e"
 dependencies = [
 "base64 0.21.7",
 "serde",
@@ -7069,9 +7109,9 @@ checksum = "c0e973b34477b7823833469eb0f5a3a60370fef7a453e02d751b59180d0a5a05"

 [[package]]
 name = "tao"
-version = "0.37.2"
+version = "0.37.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5777b06fe6435126ae8d816eba269e050e1e10d302cf5461e9c49eccabc3548"
+checksum = "f37f381f4e048e6cdf038b5705f8cf14ad108279d46eb968140a7b291aba9400"
 dependencies = [
 "bitflags 2.13.2",
 "block2",
@@ -7149,9 +7189,9 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"

 [[package]]
 name = "tauri"
-version = "2.12.4"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f316751027fc2644221d1a448564d519efb07067fda584879d9cda966391d212"
+checksum = "ed99ee9694a2deb776d91cae48ac7411ddfc89ecae2f9b5041111d8c88f2ace9"
 dependencies = [
 "anyhow",
 "bytes",
@@ -7197,16 +7237,16 @@ dependencies = [
 "tray-icon",
 "url",
 "webkit2gtk",
- "webview2-com",
+ "webview2-com 0.39.1",
 "window-vibrancy",
 "windows 0.62.2",
 ]

 [[package]]
 name = "tauri-build"
-version = "2.7.3"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "641dd5fd297c99ab92717b0428cca5b9c6f960b2ac96ca131b3eebc9d70b8ddc"
+checksum = "59563ca5b331fd97f27ee9672ec8d36d33bb3c9e2c9f6710a1a5687256052e45"
 dependencies = [
 "anyhow",
 "cargo_toml",
@@ -7218,8 +7258,6 @@ dependencies = [
 "semver 1.0.28",
 "serde",
 "serde_json",
- "static_vcruntime",
- "strsim",
 "tauri-utils",
 "tauri-winres",
 "walkdir",
@@ -7227,11 +7265,11 @@ dependencies = [

 [[package]]
 name = "tauri-codegen"
-version = "2.7.3"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6585c5b536c00f039d12ce70a9755172d5423bbcfd3969863baa70314c3e02f"
+checksum = "e50213e463086ecc283d7e9f51c30cc0fd304ad457425158018be26dbf0d0a80"
 dependencies = [
- "base64 0.23.1",
+ "base64 0.22.1",
 "brotli",
 "ico",
 "json-patch",
@@ -7254,9 +7292,9 @@ dependencies = [

 [[package]]
 name = "tauri-macros"
-version = "2.7.3"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e83a0cfa1bae376e8fbbdc0b1692707aed50cd6072ce85cae4789af5d6c19f"
+checksum = "8129fb43bb6e0d6b73ad3315cd172beaab17cd28899c594b1b32c80edbbfd99c"
 dependencies = [
 "heck 0.5.0",
 "proc-macro2",
@@ -7312,9 +7350,9 @@ dependencies = [

 [[package]]
 name = "tauri-plugin-clipboard-manager"
-version = "2.5.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9be5ed8d94c33afe8377e885119069f6508780659271d0a25cfc54d441f2bc81"
+checksum = "333d3b6beeb1c2c7fc040233d4ea7b6c03a9f8f039592b7400833c43fb5b568a"
 dependencies = [
 "arboard",
 "log",
@@ -7327,9 +7365,9 @@ dependencies = [

 [[package]]
 name = "tauri-plugin-deep-link"
-version = "2.6.2"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b3c64e24ebcbc63aaa2d88a9c51e2507084b46620baf39ecb0baa0738a08bb4"
+checksum = "4ac7a92a46ab5c88f44532ca50906d6e448a948d4ddf8c5376ab125e3260f736"
 dependencies = [
 "dunce",
 "plist",
@@ -7375,9 +7413,9 @@ dependencies = [

 [[package]]
 name = "tauri-plugin-dialog"
-version = "2.8.3"
+version = "2.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7461aaacf1901915ea7b9f5cd74f8224a351ed96af0a62c07fce934003cb34b"
+checksum = "daf9a5c92e39bdd84f22f6be9230e39d0c4e140345f71ffe6058dca4f71127cf"
 dependencies = [
 "log",
 "raw-window-handle",
@@ -7393,9 +7431,9 @@ dependencies = [

 [[package]]
 name = "tauri-plugin-fs"
-version = "2.7.1"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d58eb1d4984e535f47a642ffec09a2da6f5c18a12b5902d12126cb7626d628b"
+checksum = "466eb32466fe5021b6728b06862f9ff14a9f7e1af890047654e03a96d7c0e1bb"
 dependencies = [
 "anyhow",
 "dunce",
@@ -7417,9 +7455,9 @@ dependencies = [

 [[package]]
 name = "tauri-plugin-global-shortcut"
-version = "2.4.1"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93ff17919fe09852d269bd37b1d3d2e993b9dbb514afe7acbf3346c1d3627e2d"
+checksum = "0bd2e1f725891a1613af8f25bf918ba3357654b0fd3f2d794c0ce76cbdd92ed2"
 dependencies = [
 "global-hotkey",
 "log",
@@ -7432,9 +7470,9 @@ dependencies = [

 [[package]]
 name = "tauri-plugin-http"
-version = "2.8.3"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c57e3451553f95a1db3bfed6a358a77ce5080b6399a242c6eadac113f97abd2"
+checksum = "93e9d6b3319e101bc1be27cfa0fb4054d7784a12509c67ead0033b82180e5ed1"
 dependencies = [
 "bytes",
 "cookie_store",
@@ -7451,7 +7489,7 @@ dependencies = [
 "thiserror 2.0.20",
 "tokio",
 "url",
- "urlpattern",
+ "urlpattern 0.3.0",
 ]

 [[package]]
@@ -7481,9 +7519,9 @@ dependencies = [

 [[package]]
 name = "tauri-plugin-notification"
-version = "2.7.0"
+version = "2.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b939d7b19c8af1381a72ef8474b3aba2b56c1ddac2c23f0c8e96abbcf86b198b"
+checksum = "533770889abb60a0407d5a32096182f0e6463f5a3dfaa675be94580aa14070e1"
 dependencies = [
 "log",
 "notify-rust",
@@ -7496,14 +7534,13 @@ dependencies = [
 "thiserror 2.0.20",
 "time",
 "url",
- "zbus",
 ]

 [[package]]
 name = "tauri-plugin-opener"
-version = "2.7.2"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53810be1b4fed22bb6ac3f4cab5a2b80d9391d1af436bda145607532bc0bb219"
+checksum = "d39404b2572927e0d3ed30a7ca226037f7508d22e79c96ee6ef0d42b6a4b3345"
 dependencies = [
 "dunce",
 "glob",
@@ -7533,12 +7570,11 @@ dependencies = [

 [[package]]
 name = "tauri-plugin-shell"
-version = "2.5.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8567d42b2c7264355daa1df415ec77f52aa42e885924c86a969be2e920e05521"
+checksum = "094bdbc47e5efe36544ba21b3a53ab5c724150236cf55e6c9be46191deb6eab6"
 dependencies = [
 "encoding_rs",
- "libc",
 "log",
 "open",
 "os_pipe",
@@ -7551,24 +7587,22 @@ dependencies = [
 "tauri-plugin",
 "thiserror 2.0.20",
 "tokio",
- "windows-sys 0.60.2",
 ]

 [[package]]
 name = "tauri-plugin-updater"
-version = "2.14.1"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d957abbcb3f9f6c76d22a3a0f012f30880640d0bccb5634d2b12a9937e4c872b"
+checksum = "3cb0b2ea3e85ca287990d3859a29cc5cb18024240fd78f62e027fb7963670f18"
 dependencies = [
- "base64 0.23.1",
+ "base64 0.22.1",
 "dirs 7.0.0",
 "flate2",
 "futures-util",
 "http",
 "infer",
- "libc",
 "log",
- "minisign-verify",
+ "minisign-verify 0.2.5",
 "osakit",
 "percent-encoding",
 "reqwest 0.13.5",
@@ -7585,14 +7619,14 @@ dependencies = [
 "tokio",
 "url",
 "windows-sys 0.61.2",
- "zip",
+ "zip 4.6.1",
 ]

 [[package]]
 name = "tauri-plugin-wdio-webdriver"
-version = "1.5.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f76676d510d271d80abcf8b0552987b5b4f0eae5e3f906e9b5660d43c97c62e"
+checksum = "52c5e97428174a52b7f4357bbc4535fcce52c6a06c8ee7a379502f7cda1b6045"
 dependencies = [
 "async-trait",
 "axum",
@@ -7616,9 +7650,9 @@ dependencies = [
 "tracing",
 "uuid",
 "webkit2gtk",
- "webview2-com",
- "windows 0.62.2",
- "windows-core 0.62.2",
+ "webview2-com 0.38.2",
+ "windows 0.61.3",
+ "windows-core 0.61.2",
 ]

 [[package]]
@@ -7638,9 +7672,9 @@ dependencies = [

 [[package]]
 name = "tauri-runtime"
-version = "2.12.2"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c55766d99cea69055904d1735b93c2049302b2e09effd462120deb5581d78e9"
+checksum = "c2a57a2a9b8c8b7fc00d35b510fe808ded7f9f1b44fc1cdda6aee38632ea5413"
 dependencies = [
 "cookie",
 "dpi",
@@ -7657,15 +7691,15 @@ dependencies = [
 "thiserror 2.0.20",
 "url",
 "webkit2gtk",
- "webview2-com",
+ "webview2-com 0.39.1",
 "windows 0.62.2",
 ]

 [[package]]
 name = "tauri-runtime-wry"
-version = "2.12.2"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d61892587aea2a85245bcaec98c6fe46268874c0a0deae5535fb71ca7b93eae"
+checksum = "7f9e7e0c9f80a5130773cfabb6df4dc924518fb1b2c923726966804634b57d22"
 dependencies = [
 "gtk",
 "http",
@@ -7683,7 +7717,7 @@ dependencies = [
 "tracing",
 "url",
 "webkit2gtk",
- "webview2-com",
+ "webview2-com 0.39.1",
 "windows 0.62.2",
 "wry",
 ]
@@ -7721,9 +7755,9 @@ dependencies = [

 [[package]]
 name = "tauri-utils"
-version = "2.10.2"
+version = "2.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "362ab21cd4cc713f2a02b1a9b5688198b1541cfb6907c4281e9190e0f0ef4aa3"
+checksum = "2ff55a614843b9a3f010f211df637c94df2607175b8d0f6e0f4a7c19e18621ee"
 dependencies = [
 "anyhow",
 "brotli",
@@ -7752,7 +7786,7 @@ dependencies = [
 "thiserror 2.0.20",
 "toml 1.1.6+spec-1.1.0",
 "url",
- "urlpattern",
+ "urlpattern 0.6.0",
 "uuid",
 "walkdir",
 ]
@@ -7786,10 +7820,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
 "once_cell",
 "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -7871,7 +7905,7 @@ dependencies = [
 "regex",
 "semver 0.11.0",
 "sha2 0.9.9",
- "signal-hook",
+ "signal-hook 0.1.17",
 "terminfo",
 "termios",
 "thiserror 1.0.69",
@@ -8455,7 +8489,7 @@ dependencies = [
 "png 0.18.1",
 "serde",
 "thiserror 2.0.20",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -8469,12 +8503,6 @@ dependencies = [
 "petgraph",
 ]

-[[package]]
-name = "trim-in-place"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daa60874b45b168f67f3f9ba1ee821ad77144d6fa19cef1cd1874a7450a948da"
-
 [[package]]
 name = "triomphe"
 version = "0.1.16"
@@ -8534,9 +8562,9 @@ dependencies = [

 [[package]]
 name = "typed-path"
-version = "0.13.0"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"

 [[package]]
 name = "typeid"
@@ -8564,7 +8592,48 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
 "memoffset",
 "tempfile",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "unic-char-property"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8c57a407d9b6fa02b4795eb81c5b6652060a15a7903ea981f3d723e6c0be221"
+dependencies = [
+ "unic-char-range",
+]
+
+[[package]]
+name = "unic-char-range"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0398022d5f700414f6b899e10b8348231abf9173fa93144cbc1a43b9793c1fbc"
+
+[[package]]
+name = "unic-common"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc"
+
+[[package]]
+name = "unic-ucd-ident"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e230a37c0381caa9219d67cf063aa3a375ffed5bf541a452db16e744bdab6987"
+dependencies = [
+ "unic-char-property",
+ "unic-char-range",
+ "unic-ucd-version",
+]
+
+[[package]]
+name = "unic-ucd-version"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96bd2f2237fe450fcd0a1d2f5f4e91711124f7857ba2e964247776ebeeb7b0c4"
+dependencies = [
+ "unic-common",
 ]

 [[package]]
@@ -8626,6 +8695,18 @@ dependencies = [
 "serde_derive",
 ]

+[[package]]
+name = "urlpattern"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70acd30e3aa1450bc2eece896ce2ad0d178e9c079493819301573dae3c37ba6d"
+dependencies = [
+ "regex",
+ "serde",
+ "unic-ucd-ident",
+ "url",
+]
+
 [[package]]
 name = "urlpattern"
 version = "0.6.0"
@@ -9017,6 +9098,20 @@ dependencies = [
 "rustls-pki-types",
 ]

+[[package]]
+name = "webview2-com"
+version = "0.38.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7130243a7a5b33c54a444e54842e6a9e133de08b5ad7b5861cd8ed9a6a5bc96a"
+dependencies = [
+ "webview2-com-macros",
+ "webview2-com-sys 0.38.2",
+ "windows 0.61.3",
+ "windows-core 0.61.2",
+ "windows-implement",
+ "windows-interface",
+]
+
 [[package]]
 name = "webview2-com"
 version = "0.39.1"
@@ -9024,7 +9119,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f89fca7a704cee10dcb3654c1dbb8941d1783132f1917358af75bec37a7d7e6"
 dependencies = [
 "webview2-com-macros",
- "webview2-com-sys",
+ "webview2-com-sys 0.39.1",
 "windows 0.62.2",
 "windows-core 0.62.2",
 ]
@@ -9040,6 +9135,17 @@ dependencies = [
 "syn 2.0.119",
 ]

+[[package]]
+name = "webview2-com-sys"
+version = "0.38.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "381336cfffd772377d291702245447a5251a2ffa5bad679c99e61bc48bacbf9c"
+dependencies = [
+ "thiserror 2.0.20",
+ "windows 0.61.3",
+ "windows-core 0.61.2",
+]
+
 [[package]]
 name = "webview2-com-sys"
 version = "0.39.1"
@@ -9106,7 +9212,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -9127,7 +9233,7 @@ dependencies = [
 "objc2-foundation",
 "objc2-quartz-core",
 "raw-window-handle",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 "windows-version",
 ]

@@ -9702,7 +9808,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d6f32a0ff4a9f6f01231eb2059cc85479330739333e0e58cadf03b6af2cca10"
 dependencies = [
 "cfg-if",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -9743,11 +9849,11 @@ checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"

 [[package]]
 name = "wry"
-version = "0.57.1"
+version = "0.57.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "759c50ddad0ef9913bb5496cb9d509a50433a3b78cb0238d61105526589cf0e9"
+checksum = "a819957a01b3119af85e638a38d242af76dbc87d130dca67bfd0441072e21ff0"
 dependencies = [
- "base64 0.23.1",
+ "base64 0.22.1",
 "block2",
 "cookie",
 "crossbeam-channel",
@@ -9768,6 +9874,7 @@ dependencies = [
 "objc2-foundation",
 "objc2-ui-kit",
 "objc2-web-kit",
+ "once_cell",
 "percent-encoding",
 "raw-window-handle",
 "sha2 0.10.9",
@@ -9778,7 +9885,7 @@ dependencies = [
 "url",
 "webkit2gtk",
 "webkit2gtk-sys",
- "webview2-com",
+ "webview2-com 0.39.1",
 "windows 0.62.2",
 "windows-core 0.62.2",
 "windows-version",
@@ -10034,9 +10141,21 @@ dependencies = [

 [[package]]
 name = "zip"
-version = "9.1.3"
+version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
+checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "indexmap 2.14.0",
+ "memchr",
+]
+
+[[package]]
+name = "zip"
+version = "9.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
 dependencies = [
 "aes",
 "bzip2",
@@ -10055,7 +10174,6 @@ dependencies = [
 "sha1 0.11.0",
 "time",
 "typed-path",
- "windows-sys 0.61.2",
 "zeroize",
 "zopfli",
 "zstd",
@@ -61,8 +61,8 @@ tracing-estuary = { git = "https://github.com/Tunglies/tracing-estuary.git", bra
 tauri-plugin-clash-verge-sysinfo = { path = "crates/tauri-plugin-clash-verge-sysinfo" }
 tracing = "0.1.44"

-tauri = { version = "2.12.4" }
-tauri-plugin-clipboard-manager = "2.5.0"
+tauri = { version = "2.12.1" }
+tauri-plugin-clipboard-manager = "2.4.1"
 parking_lot = { version = "0.12.5", features = ["hardware-lock-elision"] }
 anyhow = "1.0.104"
 chrono = "0.4.45"
@@ -1,23 +1,12 @@
 ## v2.5.9

- **Mihomo(Meta) 内核升级至 v1.19.33**
-
 <details>
 <summary><strong> 🐞 修复问题 </strong></summary>

- 修复规则扩展包含空列表项时，「编辑规则」界面报错的问题
- 修复 重启应用后定时自动备份不执行的问题
 - 修复托盘测速与代理页行为不一致的问题，移除托盘「测试延迟」入口
 - 修复通过 URL 导入订阅时，即使导入的订阅并非当前使用的订阅，也会重新加载当前配置
 - 修复 首页 网站测速失败后卡片一直显示测试中
 - 修复 代理 页展开分组后不显示最新测速结果，需切换节点才刷新
- 修复 代理 在全局模式下无法展开节点组
- 修复 自定义 CSS 无法修改编辑器字体和字号的问题
- 修复 WebDAV 设置清空后无法保存
-
-**🍎 macOS**
-
- macOS：修复 Bigsur 上首页测速和流量图无法显示的问题

 **🐧 Linux**

@@ -28,9 +17,6 @@
 <details>
 <summary><strong> ✨ 新增功能 </strong></summary>

- 新增虚拟网卡设置的「DNS 模式」选项，支持配置 mihomo 系统 DNS 行为
- 新增「IP 信息」自动刷新开关，关闭后仍可手动刷新
- 新增 Muse AI 解锁检测，针对 Muse AI 特有的 Cloudflare 人机验证增加「Risky」状态标记

 </details>

@@ -11,7 +11,6 @@ mod chatgpt;
 mod claude;
 mod disney_plus;
 mod gemini;
-mod muse;
 mod netflix;
 mod prime_video;
 mod spotify;
@@ -31,7 +30,6 @@ enum UnlockCheck {
    ChatGptWeb,
    Claude,
    Gemini,
-    MuseAi,
    YouTubePremium,
    BahamutAnime,
    Netflix,
@@ -48,7 +46,6 @@ impl UnlockCheck {
        Self::ChatGptWeb,
        Self::Claude,
        Self::Gemini,
-        Self::MuseAi,
        Self::YouTubePremium,
        Self::BahamutAnime,
        Self::Netflix,
@@ -69,7 +66,6 @@ impl UnlockCheck {
            Self::ChatGptWeb => chatgpt::CHATGPT_WEB_NAME,
            Self::Claude => claude::CLAUDE_NAME,
            Self::Gemini => gemini::GEMINI_NAME,
-            Self::MuseAi => muse::MUSE_AI_NAME,
            Self::YouTubePremium => youtube::YOUTUBE_PREMIUM_NAME,
            Self::BahamutAnime => bahamut::BAHAMUT_ANIME_NAME,
            Self::Netflix => netflix::NETFLIX_NAME,
@@ -87,7 +83,6 @@ impl UnlockCheck {
            Self::ChatGptWeb => chatgpt::check_chatgpt(client).await,
            Self::Claude => claude::check_claude(client).await,
            Self::Gemini => gemini::check_gemini(client).await,
-            Self::MuseAi => muse::check_muse_ai(client).await,
            Self::YouTubePremium => youtube::check_youtube_premium(client).await,
            Self::BahamutAnime => bahamut::check_bahamut_anime(client).await,
            Self::Netflix => netflix::check_netflix(client).await,
@@ -1,48 +0,0 @@
-use reqwest::Client;
-
-use crate::utils::{classify_restricted_status, get_trace_location};
-
-use super::UnlockItem;
-
-pub(crate) const MUSE_AI_NAME: &str = "Muse AI";
-
-const MUSE_URL: &str = "https://muse.ai";
-const CLOUDFLARE_TRACE_URL: &str = "https://www.cloudflare.com/cdn-cgi/trace";
-
-// The aymh ("Are You a Human") gateway answers plain HTTP requests with a
-// generic Meta error page that always contains the Facebook logo asset.
-const AYMH_ERROR_MARKERS: &[&str] = &["Sorry, something went wrong", "static.facebook.com/images/logos"];
-
-pub(super) async fn check_muse_ai(client: &Client) -> UnlockItem {
-    // muse.ai itself is served by Vercel, so resolve the exit region through
-    // the generic Cloudflare trace endpoint instead of a service-specific one.
-    let region = get_trace_location(client, CLOUDFLARE_TRACE_URL)
-        .await
-        .map(|code| code.trim().to_ascii_uppercase())
-        .map(|code| UnlockItem::region_label(&code));
-
-    let Ok(response) = client.get(MUSE_URL).send().await else {
-        return UnlockItem::checked(MUSE_AI_NAME, "Failed (Network Connection)", region);
-    };
-
-    let status = response.status();
-    let landed_on_aymh = response.url().host_str() == Some("auth.muse.ai");
-    let body = response.text().await.unwrap_or_default();
-
-    // Every region is redirected to the aymh anti-bot gateway before the app
-    // loads, and a non-browser HTTP client cannot finish the JavaScript
-    // challenge. It returns the Meta error page, so reaching this point only
-    // proves the exit can connect to Muse's auth infrastructure; availability
-    // cannot be verified over plain HTTP and is reported as `Risky`.
-    let behind_anti_bot = landed_on_aymh || AYMH_ERROR_MARKERS.iter().any(|marker| body.contains(marker));
-
-    let result = if behind_anti_bot {
-        "Risky"
-    } else if status.is_success() {
-        "Yes"
-    } else {
-        classify_restricted_status(status).unwrap_or("Failed")
-    };
-
-    UnlockItem::checked(MUSE_AI_NAME, result, region)
-}
@@ -129,7 +129,6 @@ export default defineConfig([
            'eslint.config.ts',
            `vite.config.mts`,
            'scripts/*.mjs',
-            'scripts-workflow/*.mjs',
            'tests/*.ts',
            'src/polyfills/*.js',
            'tests/*.mjs',
@@ -239,13 +238,6 @@ export default defineConfig([
      },
    },
  },
-  {
-    files: ['scripts-workflow/*.mjs'],
-    languageOptions: {
-      globals: globals.node,
-    },
-    rules: { 'es-x/no-object-groupby': 'off' },
-  },
  {
    files: ['scripts/perf/*.{mjs,mts}'],
    languageOptions: {
@@ -14,7 +14,7 @@
    "build:fast": "cross-env NODE_OPTIONS='--max-old-space-size=4096' tauri build -- --profile fast-release",
    "tauri": "tauri",
    "web:dev": "vite",
-    "web:build": "tsrs -p . --noEmit && vite build",
+    "web:build": "tsc --noEmit && vite build",
    "web:serve": "vite preview",
    "prebuild": "node scripts/prebuild.mjs",
    "updater": "node scripts/updater.mjs",
@@ -32,7 +32,7 @@
    "i18n:types": "node scripts/generate-i18n-keys.mjs",
    "gen:contract": "node scripts/gen-contract.mjs",
    "arch:check": "node scripts/check-architecture.mjs listen emit invoke",
-    "typecheck": "tsrs -p . --noEmit",
+    "typecheck": "tsc --noEmit",
    "test": "vitest run",
    "test:watch": "vitest",
    "knip:check": "knip",
@@ -54,13 +54,13 @@
    "@mui/icons-material": "^9.4.0",
    "@mui/material": "^9.4.0",
    "@tanstack/react-virtual": "^3.14.13",
-    "@tauri-apps/api": "2.12.4",
-    "@tauri-apps/plugin-clipboard-manager": "2.5.0",
-    "@tauri-apps/plugin-dialog": "2.8.3",
-    "@tauri-apps/plugin-fs": "2.7.1",
-    "@tauri-apps/plugin-http": "2.8.3",
-    "@tauri-apps/plugin-opener": "2.7.2",
-    "@tauri-apps/plugin-updater": "2.14.1",
+    "@tauri-apps/api": "2.12.1",
+    "@tauri-apps/plugin-clipboard-manager": "2.4.0",
+    "@tauri-apps/plugin-dialog": "2.8.0",
+    "@tauri-apps/plugin-fs": "2.6.0",
+    "@tauri-apps/plugin-http": "2.8.0",
+    "@tauri-apps/plugin-opener": "2.7.0",
+    "@tauri-apps/plugin-updater": "2.13.1",
    "ahooks": "^3.10.0",
    "cidr-block": "^2.3.0",
    "compare-versions": "^6.1.1",
@@ -79,11 +79,12 @@
    "react-dom": "19.3.1",
    "react-error-boundary": "6.1.6",
    "react-hook-form": "^7.88.0",
-    "react-i18next": "17.1.9",
+    "react-i18next": "17.0.19",
    "react-markdown": "10.1.0",
    "react-router": "^8.4.0",
    "rehype-raw": "^7.0.0",
    "rehype-sanitize": "^6.0.0",
+    "remark-gfm": "^4.0.1",
    "swr": "^2.5.1",
    "tauri-plugin-mihomo-api": "github:clash-verge-rev/tauri-plugin-mihomo#main",
    "types-pac": "^1.0.3",
@@ -94,15 +95,15 @@
    "@biomejs/biome": "^2.5.14",
    "@eslint-react/eslint-plugin": "^5.20.5",
    "@eslint/js": "^10.0.1",
-    "@tauri-apps/cli": "2.12.3",
+    "@tauri-apps/cli": "2.12.1",
    "@types/lodash-es": "^4.17.12",
-    "@types/node": "^26.0.0",
+    "@types/node": "^24.13.6",
    "@types/react": "19.3.0",
    "@types/react-dom": "19.3.0",
    "@types/validator": "^13.15.10",
    "@vitejs/plugin-legacy": "^8.2.3",
    "@vitejs/plugin-react": "^6.1.1",
-    "@wdio/tauri-service": "1.5.0",
+    "@wdio/tauri-service": "1.4.0",
    "adm-zip": "^0.6.1",
    "axios": "^1.20.0",
    "cli-color": "^2.0.4",
@@ -117,24 +118,23 @@
    "eslint-plugin-react-refresh": "^0.5.7",
    "eslint-plugin-sukka": "^10.2.0",
    "eslint-plugin-unused-imports": "^4.4.1",
-    "glob": "^14.0.0",
+    "glob": "^13.0.6",
    "globals": "^17.12.0",
    "https-proxy-agent": "^9.1.0",
    "husky": "^9.1.7",
    "jiti": "^2.7.0",
-    "knip": "6.44.1",
+    "knip": "6.41.0",
    "lint-staged": "^17.5.1",
    "sass": "^1.104.1",
    "tar": "^7.5.22",
    "terser": "^5.51.2",
-    "tsrs": "0.20.0-ts7.1.0-beta",
    "typescript": "^6.0.3",
    "typescript-eslint": "^8.70.0",
    "vite": "^8.3.0",
    "vite-plugin-svgr": "^5.2.0",
    "vitest": "^5.0.1",
-    "webdriverio": "10.1.0",
-    "ws": "8.22.1"
+    "webdriverio": "10.0.2",
+    "ws": "8.22.0"
  },
  "lint-staged": {
    "*.{ts,tsx,js,mjs}": [
@@ -146,5 +146,5 @@
    ]
  },
  "type": "module",
-  "packageManager": "pnpm@12.16.1"
+  "packageManager": "pnpm@12.14.0"
 }
@@ -10,11 +10,3 @@ allowBuilds:
  unrs-resolver: true
 minimumReleaseAgeExclude:
  - dayjs@1.11.21
-  - "@tsrs/darwin-arm64@0.20.0-ts7.1.0-beta"
-  - "@tsrs/darwin-x64@0.20.0-ts7.1.0-beta"
-  - "@tsrs/linux-arm64-gnu@0.20.0-ts7.1.0-beta"
-  - "@tsrs/linux-arm64-musl@0.20.0-ts7.1.0-beta"
-  - "@tsrs/linux-x64-gnu@0.20.0-ts7.1.0-beta"
-  - "@tsrs/linux-x64-musl@0.20.0-ts7.1.0-beta"
-  - "@tsrs/win32-x64@0.20.0-ts7.1.0-beta"
-  - tsrs@0.20.0-ts7.1.0-beta
@@ -79,13 +79,6 @@
      "matchPackageNames": ["typescript"],
      "allowedVersions": "<7.0.0 || >=7.1.0"
    },
-    {
-      "description": "Review tsrs bumps alone; the version encodes the pinned TypeScript release",
-      "matchPackageNames": ["tsrs", "/^@tsrs//"],
-      "groupName": "tsrs",
-      "rangeStrategy": "pin",
-      "automerge": false
-    },
    {
      "description": "Prevent project from supply chain attack",
      "matchDatasources": ["npm"],
@@ -1,796 +0,0 @@
-import { execFileSync } from 'node:child_process'
-import { appendFileSync, readFileSync, writeFileSync } from 'node:fs'
-
-const env = process.env
-const repository = env.GITHUB_REPOSITORY
-const refreshLabel = 'Refresh this PR from latest dev'
-const publishLabel = 'Publish this approved release'
-const minorLabel = 'Use the next minor version'
-const checked = (body, label = refreshLabel) =>
-  (body || '')
-    .split('\n')
-    .some((line) => line.toLowerCase() === `- [x] ${label}`.toLowerCase())
-const versionPattern = '(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)'
-const rcPattern = new RegExp(`^v${versionPattern}-rc(?:\\.(0|[1-9][0-9]*))?$`)
-const stablePattern = new RegExp(`^v${versionPattern}$`)
-const versionFiles = [
-  'package.json',
-  'src-tauri/tauri.conf.json',
-  'src-tauri/Cargo.toml',
-  'Cargo.lock',
-]
-const read = (path) => readFileSync(path, 'utf8')
-const json = (path) => JSON.parse(read(path))
-const run = (command, args, options = {}) =>
-  execFileSync(command, args, { encoding: 'utf8', ...options }).trim()
-const git = (...args) => run('git', args)
-const gitFile = (sha, path) =>
-  execFileSync('git', ['show', `${sha}:${path}`], { encoding: 'utf8' })
-const isRc = (tag) => tag.match(rcPattern)?.[0] === tag
-const isRelease = (tag) => isRc(tag) || stablePattern.test(tag)
-const titleFor = (tag) => `${isRc(tag) ? 'Pre-Release' : 'Release'}: ${tag}`
-const branchTag = (branch, prefix = 'release/') =>
-  branch.startsWith(prefix) && isRelease(branch.slice(prefix.length))
-    ? branch.slice(prefix.length)
-    : undefined
-const latest = (tags) =>
-  tags.sort((a, b) => a.localeCompare(b, 'en', { numeric: true })).at(-1)
-const summary = (text) => appendFileSync(env.GITHUB_STEP_SUMMARY, `${text}\n`)
-const endpoint = (path) =>
-  path === 'graphql' ? path : `repos/${repository}/${path}`
-const list = (path) =>
-  JSON.parse(run('gh', ['api', '--paginate', '--slurp', endpoint(path)])).flat()
-
-function api(path, body, method = 'POST') {
-  const response = run(
-    'gh',
-    ['api', '--method', method, endpoint(path), '--input', '-'],
-    {
-      input: JSON.stringify(body),
-    },
-  )
-  const result = response ? JSON.parse(response) : null
-  if (result?.errors) throw new Error(JSON.stringify(result.errors))
-  return result
-}
-
-const get = (path) => JSON.parse(run('gh', ['api', endpoint(path)]))
-const canWrite = (login) =>
-  ['write', 'maintain', 'admin'].includes(
-    get(`collaborators/${login}/permission`).permission,
-  )
-
-function output(values) {
-  appendFileSync(
-    env.GITHUB_OUTPUT,
-    Object.entries(values)
-      .map(([key, value]) => `${key}=${value}\n`)
-      .join(''),
-  )
-}
-
-function versionPatternFor(path) {
-  if (path.endsWith('.json')) return /("version"\s*:\s*")[^"]+/
-  return path === 'Cargo.lock'
-    ? /(\[\[package\]\]\r?\nname = "clash-verge"\r?\nversion = ")[^"]+/
-    : /(^version\s*=\s*")[^"]+/m
-}
-
-function validateVersions(tag, sha) {
-  for (const path of versionFiles) {
-    const content = sha ? gitFile(sha, path) : read(path)
-    const version = path.endsWith('.json')
-      ? JSON.parse(content).version
-      : content.match(versionPatternFor(path))?.[0].split('"').at(-1)
-    if (`v${version}` !== tag)
-      throw new Error(`${path} version does not match ${tag}.`)
-  }
-}
-
-function validateVersionCommit(tag, sha) {
-  validateVersions(tag, sha)
-  const commit = get(`commits/${sha}`)
-  if (!commit.commit.verification.verified || commit.parents.length !== 1)
-    throw new Error('The version commit must be signed and have one parent.')
-  const title = commit.commit.message.split('\n')[0]
-  if (title.replace(/ \(#\d+\)$/, '') !== titleFor(tag))
-    throw new Error('The final version commit has an unexpected title.')
-  const parent = commit.parents[0].sha
-  const changed = git('diff', '--name-only', parent, sha)
-    .split('\n')
-    .filter(Boolean)
-  if (
-    changed.some((path) => !versionFiles.includes(path)) ||
-    git('diff', '--summary', parent, sha)
-  )
-    throw new Error(
-      'The version commit changes files outside the four version files.',
-    )
-  for (const path of versionFiles) {
-    const before = gitFile(parent, path)
-    const after = gitFile(sha, path)
-    if (
-      before.replace(versionPatternFor(path), '$1VERSION') !==
-      after.replace(versionPatternFor(path), '$1VERSION')
-    )
-      throw new Error(`${path} contains changes other than its version.`)
-  }
-}
-
-function remoteRefs() {
-  return git('ls-remote', '--heads', '--tags', '--refs', 'origin')
-    .split('\n')
-    .filter(Boolean)
-    .map((line) => line.split('\t'))
-}
-
-function fetchBranches() {
-  git(
-    'fetch',
-    '--no-tags',
-    'origin',
-    '+refs/heads/dev:refs/remotes/origin/dev',
-    '+refs/heads/main:refs/remotes/origin/main',
-  )
-}
-
-function discardClosedCandidate(branch, base, prefix) {
-  const candidates = list(
-    `pulls?state=all&base=${base}&head=${repository.split('/')[0]}:${branch}&per_page=100`,
-  )
-  const latest = candidates[0]
-  if (!latest || candidates.some((pr) => pr.state === 'open'))
-    throw new Error(
-      `Branch ${branch} is reserved by an active or unknown candidate.`,
-    )
-  const pr = get(`pulls/${latest.number}`)
-  requireBotPr(pr, base, prefix)
-  if (pr.state !== 'closed' || pr.merged)
-    throw new Error(
-      `Close the unmerged candidate before retrying: ${pr.html_url}`,
-    )
-  updateRefs(pr.base.repo.node_id, [
-    {
-      name: `refs/heads/${branch}`,
-      beforeOid: pr.head.sha,
-      afterOid: '0'.repeat(40),
-    },
-  ])
-  summary(`Released the unused branch from closed PR: ${pr.html_url}`)
-}
-
-function prepare() {
-  let refresh
-  if (env.GITHUB_EVENT_NAME === 'pull_request_target') {
-    const event = json(env.GITHUB_EVENT_PATH)
-    if (checked(event.changes?.body?.from) || !checked(event.pull_request.body))
-      return
-    if (!canWrite(event.sender.login))
-      throw new Error('Refreshing a version PR requires write access.')
-    refresh = get(`pulls/${event.pull_request.number}`)
-    if (refresh.state !== 'open' || !checked(refresh.body)) return
-    requireBotPr(refresh, 'dev', 'release/')
-  }
-  fetchBranches()
-  git('checkout', '--detach', 'origin/dev')
-  const channel = refresh
-    ? isRc(branchTag(refresh.head.ref))
-      ? 'rc'
-      : 'stable'
-    : env.RELEASE_CHANNEL || 'rc'
-  if (!['rc', 'stable'].includes(channel))
-    throw new Error('Unknown release channel.')
-  const requested = refresh
-    ? branchTag(refresh.head.ref)
-    : env.RELEASE_TAG || ''
-  if (
-    requested &&
-    !(channel === 'rc' ? isRc(requested) : stablePattern.test(requested))
-  )
-    throw new Error(
-      channel === 'rc'
-        ? 'Expected vX.Y.Z-rc or vX.Y.Z-rc.N.'
-        : 'Expected vX.Y.Z.',
-    )
-  const existing =
-    !refresh &&
-    list('pulls?state=open&base=dev&per_page=100').find(
-      (pr) =>
-        pr.head.repo?.full_name === repository &&
-        pr.user.login === 'github-actions[bot]' &&
-        branchTag(pr.head.ref) &&
-        isRc(branchTag(pr.head.ref)) === (channel === 'rc') &&
-        (!requested || branchTag(pr.head.ref) === requested),
-    )
-  if (existing) {
-    api(`issues/${existing.number}/labels`, { labels: ['release'] })
-    output({ existing_pr: existing.html_url })
-    summary(
-      `Existing version PR: ${existing.html_url}\nClose it before preparing a replacement; its candidate is unchanged.`,
-    )
-    return
-  }
-  const base = (requested || `v${json('package.json').version}`).split(
-    /[-+]/,
-  )[0]
-  if (!stablePattern.test(base))
-    throw new Error(`Invalid base version: ${base}`)
-  const refs = remoteRefs().map(([, ref]) => ref)
-  const tags = refs
-    .filter((ref) => ref.startsWith('refs/tags/'))
-    .map((ref) => ref.slice(10))
-  const reserved = refs
-    .filter((ref) => ref.startsWith('refs/heads/'))
-    .filter((ref) => !refresh || ref !== `refs/heads/${refresh.head.ref}`)
-    .map(
-      (ref) => branchTag(ref.slice(11)) || branchTag(ref.slice(11), 'publish/'),
-    )
-    .filter(Boolean)
-  const sameBase = (tag) => isRc(tag) && tag.startsWith(`${base}-rc`)
-  const occupied = [...tags, ...reserved]
-  const last = latest(occupied.filter(sameBase))
-  const tag =
-    requested ||
-    (channel === 'stable'
-      ? base
-      : last
-        ? `${base}-rc.${BigInt(last.match(rcPattern)[4] ?? 0) + 1n}`
-        : `${base}-rc`)
-  if (tags.includes(tag)) throw new Error(`Tag ${tag} already exists.`)
-  for (const [prefix, target] of [
-    ['release/', 'dev'],
-    ['publish/', 'main'],
-  ]) {
-    const branch = `${prefix}${tag}`
-    if (refs.includes(`refs/heads/${branch}`) && branch !== refresh?.head.ref)
-      discardClosedCandidate(branch, target, prefix)
-  }
-  const sha = git('rev-parse', 'HEAD')
-  const body = releaseBody(tag, sha, tags, false)
-  summary(body)
-  if (
-    remoteRefs().some(
-      ([, ref]) =>
-        ref === `refs/tags/${tag}` || ref === `refs/heads/publish/${tag}`,
-    )
-  )
-    throw new Error(`Tag ${tag} already exists or is reserved for publication.`)
-  if (json('package.json').version !== tag.slice(1))
-    run('node', ['scripts/release-version.mjs', tag])
-  validateVersions(tag)
-  const title = titleFor(tag)
-  const branch = refresh
-    ? `release-refresh/${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`
-    : `release/${tag}`
-  writeVersionPr({ sha, body, refresh, title, branch, files: versionFiles })
-}
-
-function releaseBody(tag, sha, tags, publishing) {
-  const previous =
-    (isRc(tag) &&
-      latest(
-        tags.filter(
-          (value) =>
-            isRc(value) &&
-            value.startsWith(`${tag.split('-')[0]}-rc`) &&
-            value !== tag,
-        ),
-      )) ||
-    latest(tags.filter((value) => stablePattern.test(value) && value !== tag))
-  const url = `${env.GITHUB_SERVER_URL}/${repository}`
-  let range = sha
-  let comparison = 'No previous release tag'
-  if (previous) {
-    git('fetch', '--no-tags', 'origin', `refs/tags/${previous}`)
-    range = `${git('rev-parse', 'FETCH_HEAD^{commit}')}..${sha}`
-    comparison = `Changes since **${previous}** · [Compare changes](${url}/compare/${previous}...${sha})`
-  }
-  comparison += ` · **${git('rev-list', '--count', range)} commits**`
-  const commits = git('log', '--format=%h %s', range)
-  const groups = Object.groupBy(commits ? commits.split('\n') : [], (line) => {
-    if (/^\S+ chore\(deps\)!?: /i.test(line)) return 'deps'
-    const type = line.match(/^\S+ (\w+)(?:\([^)]*\))?!?: /)?.[1]?.toLowerCase()
-    return type === 'doc' ? 'docs' : type || 'other'
-  })
-  const labels = {
-    fix: 'Fixes',
-    feat: 'Features',
-    perf: 'Performance',
-    revert: 'Reverts',
-    refactor: 'Refactoring',
-    build: 'Build',
-    deps: 'Dependencies',
-    ci: 'CI',
-    docs: 'Documentation',
-    test: 'Tests',
-    chore: 'Maintenance',
-    style: 'Style',
-    other: 'Other',
-  }
-  const names = {
-    macos: 'macOS',
-    windows: 'Windows',
-    ui: 'UI',
-    ci: 'CI',
-    tun: 'TUN',
-  }
-  const order = Object.keys(labels)
-  const rank = (type) =>
-    order.includes(type) ? order.indexOf(type) : order.length
-  const scope =
-    Object.entries(groups)
-      .sort(([a], [b]) => rank(a) - rank(b) || a.localeCompare(b))
-      .map(([type, lines]) => {
-        const entries = lines.map((line) => {
-          const hash = line.slice(0, line.indexOf(' '))
-          const title = line
-            .slice(hash.length + 1)
-            .replace(/\s*\((?:[\w.-]+\/[\w.-]+)?#\d+\)/g, '')
-            .replace(/(?:[\w.-]+\/[\w.-]+)?#\d+\b/g, '')
-            .replace(/\s{2,}/g, ' ')
-            .trim()
-            .replace(
-              /^\w+(?:\(([^)]*)\))?(!)?:\s*/,
-              (_, scope, breaking) =>
-                `${breaking ? 'Breaking: ' : ''}${scope ? `${Object.hasOwn(names, scope) ? names[scope] : scope}: ` : ''}`,
-            )
-            .replaceAll('&', '&amp;')
-            .replaceAll('<', '&lt;')
-            .replaceAll('>', '&gt;')
-            .replace(/[\\`*_[\]]/g, '\\$&')
-          return `- ${title} [#${hash}](${url}/commit/${hash})`
-        })
-        return `### ${Object.hasOwn(labels, type) ? labels[type] : type} · ${lines.length}\n\n${entries.join('\n')}`
-      })
-      .join('\n\n') || 'No new commits.'
-  return `## ${titleFor(tag)}
-
-Source: \`dev\` · [${sha}](${url}/commit/${sha})  \n${comparison}
-${
-  publishing
-    ? `<!-- release-source:${sha} -->
-
-After approval, select the checkbox below to publish.
-Do not use the normal Squash or Rebase merge buttons.
-
- [ ] ${publishLabel}`
-    : `
- [ ] ${refreshLabel}
-
-Refreshing requires a new approval.`
-}
-
-## Changes
-
-${scope}
-`
-}
-
-function writeVersionPr({ sha, body, refresh, title, branch, files }) {
-  // Create-only ref and expectedHeadOid prevent replacing another candidate.
-  api('git/refs', { ref: `refs/heads/${branch}`, sha })
-  let pr
-  try {
-    const commit = api('graphql', {
-      query: `mutation($input: CreateCommitOnBranchInput!) {
-      createCommitOnBranch(input: $input) { commit { oid } }
-    }`,
-      variables: {
-        input: {
-          branch: { repositoryNameWithOwner: repository, branchName: branch },
-          expectedHeadOid: sha,
-          message: { headline: title },
-          fileChanges: {
-            additions: files.map((path) => ({
-              path,
-              contents: readFileSync(path).toString('base64'),
-            })),
-          },
-        },
-      },
-    })
-    if (!commit.data?.createCommitOnBranch?.commit?.oid)
-      throw new Error('Signed version commit failed.')
-    if (refresh) {
-      const current = get(`pulls/${refresh.number}`)
-      if (
-        current.state !== 'open' ||
-        current.head.sha !== refresh.head.sha ||
-        current.base.ref !== refresh.base.ref ||
-        current.body !== refresh.body
-      )
-        throw new Error(
-          'The version pull request changed while preparing the update.',
-        )
-      const oid = commit.data.createCommitOnBranch.commit.oid
-      updateRefs(refresh.base.repo.node_id, [
-        {
-          name: `refs/heads/${refresh.head.ref}`,
-          beforeOid: refresh.head.sha,
-          afterOid: oid,
-          force: true,
-        },
-        {
-          name: `refs/heads/${branch}`,
-          beforeOid: oid,
-          afterOid: '0'.repeat(40),
-        },
-      ])
-      for (const review of list(
-        `pulls/${refresh.number}/reviews?per_page=100`,
-      )) {
-        if (review.state === 'APPROVED')
-          api(
-            `pulls/${refresh.number}/reviews/${review.id}/dismissals`,
-            {
-              message:
-                'The version PR was refreshed from dev; please review again.',
-            },
-            'PUT',
-          )
-      }
-      pr = api(`pulls/${refresh.number}`, { title, body }, 'PATCH')
-    } else {
-      pr = api('pulls', {
-        head: branch,
-        base: 'dev',
-        title,
-        body,
-      })
-    }
-  } catch (error) {
-    if (refresh) {
-      try {
-        api(`git/refs/heads/${branch}`, {}, 'DELETE')
-      } catch {}
-    }
-    throw error
-  }
-  api(`issues/${pr.number}/labels`, { labels: ['release'] })
-  summary(`Version pull request: ${pr.html_url}`)
-}
-
-function updateRefs(repositoryId, refUpdates) {
-  api('graphql', {
-    query: `mutation($input: UpdateRefsInput!) { updateRefs(input: $input) { clientMutationId } }`,
-    variables: { input: { repositoryId, refUpdates } },
-  })
-}
-
-function requireBotPr(pr, base, prefix) {
-  const tag = branchTag(pr.head.ref, prefix)
-  if (
-    !tag ||
-    pr.base.ref !== base ||
-    pr.base.repo.full_name !== repository ||
-    pr.head.repo?.full_name !== repository ||
-    pr.user.login !== 'github-actions[bot]'
-  )
-    throw new Error(
-      'Expected a release PR created by this repository workflow.',
-    )
-  return tag
-}
-
-function publishPr() {
-  const event = json(env.GITHUB_EVENT_PATH)
-  const pr = get(`pulls/${event.pull_request.number}`)
-  const tag = requireBotPr(pr, 'dev', 'release/')
-  if (!pr.merged || pr.merge_commit_sha !== event.pull_request.merge_commit_sha)
-    throw new Error('Expected the final merged version commit on dev.')
-  const sha = pr.merge_commit_sha
-  fetchBranches()
-  git('fetch', '--no-tags', 'origin', sha)
-  git('merge-base', '--is-ancestor', sha, 'origin/dev')
-  validateVersionCommit(tag, sha)
-  const branch = `publish/${tag}`
-  const existing = list(
-    `pulls?state=open&base=main&head=${repository.split('/')[0]}:${branch}&per_page=100`,
-  )
-  if (existing.length) {
-    const publication = existing[0]
-    requireBotPr(publication, 'main', 'publish/')
-    if (publication.head.sha !== sha)
-      throw new Error(
-        'This tag is already reserved by a different publication snapshot.',
-      )
-    summary(`Existing publication PR: ${publication.html_url}`)
-    return
-  }
-  const refs = remoteRefs()
-  if (refs.some(([, ref]) => ref === `refs/tags/${tag}`))
-    throw new Error(`Tag ${tag} already exists.`)
-  git('merge-base', '--is-ancestor', 'origin/main', sha)
-  const head = refs.find(([, ref]) => ref === `refs/heads/${branch}`)?.[0]
-  if (head && head !== sha)
-    throw new Error('Publication branch already points to another commit.')
-  if (!head) api('git/refs', { ref: `refs/heads/${branch}`, sha })
-  const body = releaseBody(
-    tag,
-    sha,
-    refs
-      .filter(([, ref]) => ref.startsWith('refs/tags/'))
-      .map(([, ref]) => ref.slice(10)),
-    true,
-  )
-  const publication = api('pulls', {
-    head: branch,
-    base: 'main',
-    title: titleFor(tag),
-    body,
-  })
-  api(`issues/${publication.number}/labels`, { labels: ['release'] })
-  summary(`Publication PR: ${publication.html_url}\n\n${body}`)
-}
-
-function requireApproval(pr, sha) {
-  const reviews = new Map()
-  for (const review of list(`pulls/${pr.number}/reviews?per_page=100`)) {
-    if (['APPROVED', 'CHANGES_REQUESTED', 'DISMISSED'].includes(review.state))
-      reviews.set(review.user.login, review)
-  }
-  let approved = false
-  for (const review of reviews.values()) {
-    if (!canWrite(review.user.login)) continue
-    if (review.state === 'CHANGES_REQUESTED')
-      throw new Error('A reviewer with write access has requested changes.')
-    if (review.state === 'APPROVED' && review.commit_id === sha) approved = true
-  }
-  if (!approved)
-    throw new Error(
-      'The current PR head needs approval from a reviewer with write access.',
-    )
-}
-
-function releaseOutput(tag, sha) {
-  output({
-    release_tag: tag,
-    source_sha: sha,
-    channel: isRc(tag) ? 'rc' : 'stable',
-  })
-}
-
-function publish() {
-  const event = json(env.GITHUB_EVENT_PATH)
-  const tag = requireBotPr(event.pull_request, 'main', 'publish/')
-  if (
-    checked(event.changes?.body?.from, publishLabel) ||
-    !checked(event.pull_request.body, publishLabel)
-  )
-    throw new Error('Publishing requires a new checkbox selection.')
-  if (!canWrite(event.sender.login))
-    throw new Error('Publishing requires write access.')
-  const sha = event.pull_request.head.sha
-  const pr = get(`pulls/${event.pull_request.number}`)
-  requireBotPr(pr, 'main', 'publish/')
-  if (
-    pr.head.sha !== sha ||
-    !checked(pr.body, publishLabel) ||
-    !pr.body.includes(`<!-- release-source:${sha} -->`)
-  )
-    throw new Error(
-      'The publication snapshot changed after the checkbox selection.',
-    )
-  fetchBranches()
-  git('fetch', '--no-tags', 'origin', sha)
-  git('merge-base', '--is-ancestor', sha, 'origin/dev')
-  validateVersionCommit(tag, sha)
-  const marker = `Release workflow run: ${env.GITHUB_RUN_ID}\nSource: ${sha}\nPR: ${pr.number}`
-  const existing = remoteRefs().find(([, ref]) => ref === `refs/tags/${tag}`)
-  if (existing) {
-    const ref = get(`git/ref/tags/${tag}`)
-    const object =
-      ref.object.type === 'tag' && get(`git/tags/${ref.object.sha}`)
-    if (
-      !object ||
-      object.object.type !== 'commit' ||
-      object.object.sha !== sha ||
-      object.message.trim() !== marker ||
-      Number(env.GITHUB_RUN_ATTEMPT) <= 1
-    )
-      throw new Error(
-        'An existing tag can only be recovered by its original release run.',
-      )
-    git('merge-base', '--is-ancestor', sha, 'origin/main')
-    summary(`Resuming ${tag} at ${sha} from this release run.`)
-  } else {
-    if (pr.state !== 'open' || pr.draft)
-      throw new Error('Expected an open, ready publication PR.')
-    requireApproval(pr, sha)
-    const main = git('rev-parse', 'origin/main')
-    git('merge-base', '--is-ancestor', main, sha)
-    git(
-      '-c',
-      'user.name=github-actions[bot]',
-      '-c',
-      'user.email=41898282+github-actions[bot]@users.noreply.github.com',
-      'tag',
-      '--annotate',
-      '--no-sign',
-      '--message',
-      marker,
-      tag,
-      sha,
-    )
-    // GraphQL updateRefs rejects annotated tag objects; Git preserves atomicity.
-    git(
-      'push',
-      '--atomic',
-      `--force-with-lease=refs/heads/main:${main}`,
-      `--force-with-lease=refs/heads/${pr.head.ref}:${sha}`,
-      `--force-with-lease=refs/tags/${tag}:`,
-      'origin',
-      `${sha}:refs/heads/main`,
-      `${sha}:refs/heads/${pr.head.ref}`,
-      `refs/tags/${tag}:refs/tags/${tag}`,
-    )
-    summary(`Fast-forwarded main and tagged ${tag} at approved commit ${sha}.`)
-  }
-  releaseOutput(tag, sha)
-}
-
-function validateTag() {
-  const tag = env.GITHUB_REF_NAME
-  if (!isRelease(tag)) throw new Error('Expected a stable or RC release tag.')
-  fetchBranches()
-  const sha = git('rev-parse', `${env.GITHUB_SHA}^{commit}`)
-  const ref = get(`git/ref/tags/${tag}`)
-  const object = ref.object.type === 'tag' && get(`git/tags/${ref.object.sha}`)
-  if (object && object.message.includes('Release workflow run:'))
-    throw new Error(
-      'Resume the original publication run for workflow-owned tags.',
-    )
-  git('fetch', '--no-tags', 'origin', `refs/tags/${tag}`)
-  if (git('rev-parse', 'FETCH_HEAD^{commit}') !== sha)
-    throw new Error('The tag moved after this run started.')
-  for (const branch of ['main', 'dev'])
-    git('merge-base', '--is-ancestor', sha, `origin/${branch}`)
-  validateVersions(tag, sha)
-  releaseOutput(tag, sha)
-}
-
-function prepareDraft() {
-  const tag = env.RELEASE_TAG
-  verifyTarget()
-  const release = list('releases?per_page=100').find(
-    (release) => release.tag_name === tag,
-  )
-  if (release && !release.draft)
-    throw new Error('This release is already public.')
-  const draft =
-    release ||
-    api('releases', {
-      tag_name: tag,
-      target_commitish: env.SOURCE_SHA,
-      name: `Clash Verge Rev ${tag}`,
-      body: 'Draft release, will be updated later.',
-      draft: true,
-      prerelease: isRc(tag),
-    })
-  output({ id: draft.id })
-}
-
-function verifyTarget(tag = env.RELEASE_TAG, sha = env.SOURCE_SHA) {
-  const ref = get(`git/ref/tags/${tag}`)
-  const target =
-    ref.object.type === 'tag'
-      ? get(`git/tags/${ref.object.sha}`).object
-      : ref.object
-  if (target.type !== 'commit' || target.sha !== sha)
-    throw new Error('The release tag no longer points to the validated source.')
-}
-
-function nextDev() {
-  let refresh
-  let tag = env.RELEASE_TAG
-  let source = env.SOURCE_SHA
-  let minor = false
-  if (env.GITHUB_EVENT_NAME === 'pull_request_target') {
-    const event = json(env.GITHUB_EVENT_PATH)
-    const oldBody = event.changes?.body?.from
-    const body = event.pull_request.body
-    if (
-      checked(oldBody, minorLabel) === checked(body, minorLabel) &&
-      (checked(oldBody) || !checked(body))
-    )
-      return
-    if (!canWrite(event.sender.login))
-      throw new Error('Changing the next dev version requires write access.')
-    refresh = get(`pulls/${event.pull_request.number}`)
-    if (refresh.state !== 'open') return
-    tag = requireBotPr(refresh, 'dev', 'next-dev/')
-    if (
-      refresh.head.sha !== event.pull_request.head.sha ||
-      refresh.body !== body
-    )
-      throw new Error(
-        'The version update PR changed after the checkbox selection.',
-      )
-    minor = checked(body, minorLabel)
-    source = body.match(/<!-- next-dev-source:([a-f0-9]{40}) -->/)?.[1]
-  }
-  if (!stablePattern.test(tag) || !/^[a-f0-9]{40}$/.test(source))
-    throw new Error('The next dev version requires a stable release snapshot.')
-  verifyTarget(tag, source)
-  const release = get(`releases/tags/${tag}`)
-  if (release.draft || release.prerelease)
-    throw new Error('The stable release must be public before preparing dev.')
-  const branch = `next-dev/${tag}`
-  if (!refresh) {
-    const existing = list(
-      `pulls?state=all&base=dev&head=${repository.split('/')[0]}:${branch}&per_page=100`,
-    )[0]
-    if (existing) {
-      requireBotPr(existing, 'dev', 'next-dev/')
-      summary(`Existing dev version PR: ${existing.html_url}`)
-      return
-    }
-  }
-  fetchBranches()
-  git('fetch', '--no-tags', 'origin', source)
-  git('merge-base', '--is-ancestor', source, 'origin/main')
-  git('merge-base', '--is-ancestor', source, 'origin/dev')
-  git('checkout', '--detach', 'origin/dev')
-  const sha = git('rev-parse', 'HEAD')
-  validateVersions(tag, source)
-  validateVersions(tag, sha)
-  if (read('Changelog.md') !== gitFile(source, 'Changelog.md'))
-    throw new Error(
-      'Changelog.md changed after this release. Preserve the unreleased entries and prepare the dev update manually.',
-    )
-  if (
-    !read('Changelog.md').split('\n').includes(`## ${tag}`) ||
-    read('docs/Changelog.history.md').split('\n').includes(`## ${tag}`)
-  )
-    throw new Error('The released changelog is missing or already archived.')
-  const [major, minorVersion, patch] = tag.slice(1).split('.').map(BigInt)
-  const patchTag = `v${major}.${minorVersion}.${patch + 1n}`
-  const minorTag = `v${major}.${minorVersion + 1n}.0`
-  const nextTag = minor ? minorTag : patchTag
-  run('pnpm', ['release-version', nextTag])
-  run('bash', ['scripts-workflow/bump_changelog.sh'])
-  const changelog = read('Changelog.md')
-  if (!changelog.includes('## v(Version Goes Here)'))
-    throw new Error('The changelog template has no version placeholder.')
-  writeFileSync(
-    'Changelog.md',
-    changelog.replace('## v(Version Goes Here)', `## ${nextTag}`),
-  )
-  validateVersions(nextTag)
-  const title = `Dev: ${nextTag}`
-  const body = `## ${title}
-
-After [${tag}](${env.GITHUB_SERVER_URL}/${repository}/releases/tag/${tag}).
-<!-- next-dev-source:${source} -->
-
-Patch: \`${patchTag}\` · Minor: \`${minorTag}\`
-
- [${minor ? 'x' : ' '}] ${minorLabel}
- [ ] ${refreshLabel}
-
-Changing the version or refreshing requires a new approval.
-`
-  writeVersionPr({
-    sha,
-    body,
-    refresh,
-    title,
-    branch: refresh
-      ? `next-dev-refresh/${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`
-      : branch,
-    files: [...versionFiles, 'Changelog.md', 'docs/Changelog.history.md'],
-  })
-}
-
-const commands = {
-  prepare,
-  'next-dev': nextDev,
-  'publish-pr': publishPr,
-  publish,
-  'validate-tag': validateTag,
-  'prepare-draft': prepareDraft,
-  'verify-target': verifyTarget,
-}
-const command = commands[process.argv[2]]
-if (!command) throw new Error('Unknown release command.')
-command()
@@ -17,7 +17,7 @@
    "pnpm-lock.yaml",
    "pnpm-workspace.yaml",
    "scripts/contract-inputs.json",
-    ".github/workflows/contract-parity.yml",
+    ".github/workflows/frontend-check.yml",
    ".husky/pre-push"
  ]
 }
@@ -434,13 +434,12 @@ for (let iteration = 0; iteration < repeat && !interrupted; iteration++) {
      devicePixelRatio,
    ])
    run.viewport = { dom: viewport, driver: await browser.getWindowRect() }
-    const driverScale = run.viewport.driver.width / 1000
    assert(
-      viewport[0] === 1000 &&
+      run.viewport.driver.width / viewport[2] === 1000 &&
+        run.viewport.driver.height / viewport[2] === 700 &&
+        viewport[0] === 1000 &&
        viewport[1] > 0 &&
-        viewport[1] <= 700 &&
-        (driverScale === 1 || driverScale === viewport[2]) &&
-        run.viewport.driver.height / driverScale === 700,
+        viewport[1] <= 700,
      `unexpected window dimensions: ${JSON.stringify(run.viewport)}`,
    )
    assert(
@@ -29,7 +29,7 @@ perf-harness = ["dep:tauri-plugin-wdio-webdriver"]
 identifier = "io.github.clash-verge-rev.clash-verge-rev"

 [build-dependencies]
-tauri-build = { version = "2.7.3", features = [] }
+tauri-build = { version = "2.7.1", features = [] }

 [dependencies]
 clash-verge-draft = { workspace = true }
@@ -72,14 +72,14 @@ sysproxy = { git = "https://github.com/clash-verge-rev/sysproxy-rs.git", branch
  "guard",
 ] }
 network-interface = { version = "2.0.5", features = ["serde"] }
-tauri-plugin-shell = "2.5.0"
-tauri-plugin-opener = "2.7.2"
-tauri-plugin-dialog = "2.8.3"
-tauri-plugin-fs = "2.7.1"
+tauri-plugin-shell = "2.4.0"
+tauri-plugin-opener = "2.7.0"
+tauri-plugin-dialog = "2.8.1"
+tauri-plugin-fs = "2.6.0"
 tauri-plugin-process = "2.4.0"
-tauri-plugin-deep-link = "2.6.2"
+tauri-plugin-deep-link = "2.6.1"
 tauri-plugin-window-state = "2.5.0"
-zip = "9.1.3"
+zip = "9.0.4"
 flate2 = "1.1.10"
 reqwest_dav = "0.3.3"
 aes-gcm = { version = "0.11.1" }
@@ -90,10 +90,10 @@ getrandom = "0.4.3"
 futures = "0.3.34"
 gethostname = "1.1.0"
 scopeguard = "1.2.0"
-tauri-plugin-notification = "2.7.0"
+tauri-plugin-notification = "2.5.1"
 tokio-stream = "0.1.19"
 backon = { version = "1.6.0", features = ["tokio-sleep"] }
-tauri-plugin-http = "2.8.3"
+tauri-plugin-http = "2.8.0"
 tracing = { workspace = true }
 tauri-plugin-devtools = { version = "2.2.2", optional = true }
 tauri-plugin-mihomo = { git = "https://github.com/clash-verge-rev/tauri-plugin-mihomo", rev = "7a03d16f4d39b1bb885b7babe66b9e153e34b615" }
@@ -120,7 +120,7 @@ libc = "0.2.191"
 clash-verge-signal = { workspace = true }

 [target.'cfg(target_os = "macos")'.dependencies]
-tauri-plugin-wdio-webdriver = { version = "=1.5.0", optional = true }
+tauri-plugin-wdio-webdriver = { version = "=1.4.0", optional = true }
 objc2 = "0.6.5"
 objc2-foundation = { version = "0.3.2", features = [
  "NSString",
@@ -153,8 +153,8 @@ windows-sys.workspace = true

 [target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
 tauri-plugin-autostart = "2.7.0"
-tauri-plugin-global-shortcut = "2.4.1"
-tauri-plugin-updater = "2.14.1"
+tauri-plugin-global-shortcut = "2.4.0"
+tauri-plugin-updater = "2.13.1"

 [dev-dependencies]
 criterion = { workspace = true }
@@ -1,9 +1,10 @@
 fn main() -> Result<(), Box<dyn std::error::Error>> {
    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() == Ok("windows")
        && std::env::var("CARGO_CFG_TARGET_ENV").as_deref() == Ok("msvc")
+        && std::env::var_os("CARGO_FEATURE_CLIPPY").is_some()
    {
-        // Tauri's resource is linked to the app binary, but not to Rust unit-test harnesses or examples.
-        // Give non-app targets their own manifest so tests and examples can resolve TaskDialogIndirect.
+        // Tauri's resource is linked to the app binary, but not to Rust unit-test harnesses.
+        // Give mock-context builds their own manifest so tests can resolve TaskDialogIndirect.
        let out_dir = std::env::var_os("OUT_DIR").ok_or_else(|| std::io::Error::other("OUT_DIR is not set"))?;
        let manifest_path = std::path::PathBuf::from(out_dir).join("windows-test-manifest.xml");
        std::fs::write(
@@ -24,14 +25,8 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
 </assembly>
 "#,
        )?;
-        let manifest_display = manifest_path.display();
-        if std::env::var_os("CARGO_FEATURE_CLIPPY").is_some() {
-            println!("cargo:rustc-link-arg=/MANIFEST:EMBED");
-            println!("cargo:rustc-link-arg=/MANIFESTINPUT:{manifest_display}");
-        } else {
-            println!("cargo:rustc-link-arg-examples=/MANIFEST:EMBED");
-            println!("cargo:rustc-link-arg-examples=/MANIFESTINPUT:{manifest_display}");
-        }
+        println!("cargo:rustc-link-arg=/MANIFEST:EMBED");
+        println!("cargo:rustc-link-arg=/MANIFESTINPUT:{}", manifest_path.display());
    }

    #[cfg(feature = "clippy")]
@@ -75,7 +75,6 @@ pub mod tun {
        "auto-redirect",
        "auto-detect-interface",
        "dns-hijack",
-        "dns-mode",
        "strict-route",
        "mtu",
    ];
@@ -109,7 +109,7 @@ impl AutoBackupManager {
        {
            *self.settings.write() = settings;
        }
-        let _ = self.settings_tx.send_replace(settings);
+        let _ = self.settings_tx.send(settings);
        self.maybe_start_runner(settings);
        Ok(())
    }
@@ -119,7 +119,7 @@ impl AutoBackupManager {
        {
            *self.settings.write() = settings;
        }
-        let _ = self.settings_tx.send_replace(settings);
+        let _ = self.settings_tx.send(settings);
        self.maybe_start_runner(settings);
        Ok(())
    }
@@ -0,0 +1,237 @@
+//! Live handles into the attached tray menu and the reconcile decision:
+//! state-only changes mutate items in place, a proxy-only structure change
+//! swaps the group submenus, anything else rebuilds.
+
+use crate::Type;
+use crate::config::{IProfiles, IVerge};
+use clash_verge_logging::logging_error;
+use parking_lot::Mutex;
+use smartstring::alias::String;
+use std::collections::HashMap;
+use tauri::menu::{CheckMenuItem, IsMenuItem, Submenu};
+use tauri::tray::TrayIcon;
+use tauri::{AppHandle, Wry};
+use tauri_plugin_mihomo::models::Proxies;
+
+use super::{TrayMenuOptions, build_tray_menu, create_subcreate_proxy_menu_item};
+
+pub(super) struct ProxyNodeItem {
+    pub(super) name: String,
+    pub(super) item: CheckMenuItem<Wry>,
+    pub(super) text: String,
+    pub(super) checked: bool,
+}
+
+pub(super) struct ProxyGroupItems {
+    pub(super) name: String,
+    pub(super) nodes: Vec<ProxyNodeItem>,
+}
+
+pub(super) struct TrayMenuState {
+    pub(super) mode_items: [CheckMenuItem<Wry>; 3],
+    pub(super) system_proxy_item: CheckMenuItem<Wry>,
+    pub(super) tun_item: CheckMenuItem<Wry>,
+    pub(super) lightweight_item: CheckMenuItem<Wry>,
+    pub(super) profile_items: Vec<(String, CheckMenuItem<Wry>)>,
+    pub(super) proxies_submenu: Option<Submenu<Wry>>,
+    pub(super) proxy_groups: Vec<ProxyGroupItems>,
+    pub(super) signature: String,
+    pub(super) proxy_signature: Option<String>,
+}
+
+pub(super) fn proxy_delay_text(proxy_nodes_data: &Proxies, proxy_str: &str) -> String {
+    proxy_nodes_data
+        .proxies
+        .get(proxy_str)
+        .and_then(|h| h.history.last())
+        .map(|h| match h.delay {
+            0 => "-ms".into(),
+            delay if delay >= 10000 => "-ms".into(),
+            _ => format!("{}ms", h.delay).into(),
+        })
+        .unwrap_or_else(|| "-ms".into())
+}
+
+/// Topology inputs that a rebuild cannot reconcile by mutating items.
+pub(super) fn menu_signature(verge: &IVerge, profiles: &IProfiles, mode: &str) -> String {
+    let hotkeys = verge.hotkeys.as_ref().map(|h| h.join(",")).unwrap_or_default();
+    let profiles = profiles
+        .profiles_preview()
+        .unwrap_or_default()
+        .into_iter()
+        .map(|profile| format!("{}:{}", profile.uid, profile.name))
+        .collect::<Vec<_>>()
+        .join(";");
+    format!(
+        "{}|{}|{mode}|{}|{hotkeys}|{profiles}",
+        verge.tray_proxy_groups_display_mode.as_deref().unwrap_or("default"),
+        verge.tray_inline_outbound_modes.unwrap_or(false),
+        verge.language.as_deref().unwrap_or(""),
+    )
+    .into()
+}
+
+/// Group/node identity plus ordering, canonicalized so it is stable across fetches.
+pub(super) fn proxy_structure_signature(
+    proxy_mode: &str,
+    order_map: Option<&HashMap<String, usize>>,
+    proxy_nodes_data: &Proxies,
+) -> String {
+    let mut parts: Vec<std::string::String> = proxy_nodes_data
+        .proxies
+        .iter()
+        .filter(|(name, data)| {
+            let global = name.as_str() == "GLOBAL";
+            (match proxy_mode {
+                "global" => global,
+                _ => !global,
+            }) && !data.hidden.unwrap_or_default()
+        })
+        .filter_map(|(name, data)| {
+            data.all.as_ref().map(|all| {
+                let order = order_map
+                    .and_then(|map| map.get(name.as_str()))
+                    .map_or_else(|| "-".to_owned(), |index| index.to_string());
+                format!(
+                    "{}@{order}:{}",
+                    name,
+                    all.iter().map(|node| node.as_str()).collect::<Vec<_>>().join(",")
+                )
+            })
+        })
+        .collect();
+    parts.sort();
+    parts.join(";").into()
+}
+
+pub(super) struct ReconcileContext<'a> {
+    pub(super) app_handle: &'a AppHandle<Wry>,
+    pub(super) tray: &'a TrayIcon<Wry>,
+    pub(super) options: TrayMenuOptions<'a>,
+    pub(super) verge: &'a IVerge,
+    pub(super) profiles: &'a IProfiles,
+    pub(super) fetched_proxies: Option<&'a Proxies>,
+    pub(super) order_map: Option<&'a HashMap<String, usize>>,
+    pub(super) menu_signature: &'a str,
+    pub(super) proxy_signature: Option<&'a str>,
+    pub(super) fetched: bool,
+}
+
+pub(super) fn reconcile(state_store: &Mutex<Option<TrayMenuState>>, ctx: ReconcileContext<'_>) -> anyhow::Result<()> {
+    let tun_mode_available = crate::core::runstate::RUN_STATE.state().tun_capable();
+    {
+        let mut attached = state_store.lock();
+        if let Some(state) = attached.as_mut().filter(|state| state.signature == ctx.menu_signature) {
+            let in_place = !ctx.fetched || state.proxy_signature.as_deref() == ctx.proxy_signature;
+            let swapped = !in_place
+                && ctx.fetched_proxies.is_some_and(|data| {
+                    state.swap_proxy_section(
+                        ctx.app_handle,
+                        ctx.options.mode.unwrap_or(""),
+                        ctx.order_map,
+                        data,
+                        ctx.proxy_signature,
+                    )
+                });
+            if in_place || swapped {
+                state.apply_static(&ctx.options, ctx.profiles, tun_mode_available);
+                if in_place && let Some(data) = ctx.fetched_proxies {
+                    state.apply_proxy(data);
+                }
+                return Ok(());
+            }
+        }
+    }
+
+    let (menu, mut new_state) = build_tray_menu(
+        ctx.app_handle,
+        ctx.options,
+        ctx.verge,
+        ctx.profiles,
+        ctx.order_map,
+        ctx.fetched_proxies,
+    )?;
+    new_state.signature = ctx.menu_signature.into();
+    new_state.proxy_signature = if ctx.fetched {
+        ctx.proxy_signature.map(Into::into)
+    } else {
+        None
+    };
+    logging_error!(Type::Tray, ctx.tray.set_menu(Some(menu)));
+    *state_store.lock() = Some(new_state);
+    Ok(())
+}
+
+impl TrayMenuState {
+    fn apply_static(&self, options: &TrayMenuOptions<'_>, profiles: &IProfiles, tun_mode_available: bool) {
+        let mode = options.mode.unwrap_or("");
+        for (item, name) in self.mode_items.iter().zip(["rule", "global", "direct"]) {
+            logging_error!(Type::Tray, item.set_checked(mode == name));
+        }
+        logging_error!(
+            Type::Tray,
+            self.system_proxy_item.set_checked(options.system_proxy_enabled)
+        );
+        logging_error!(Type::Tray, self.tun_item.set_enabled(tun_mode_available));
+        logging_error!(Type::Tray, self.tun_item.set_checked(options.tun_mode_enabled));
+        logging_error!(
+            Type::Tray,
+            self.lightweight_item.set_checked(options.is_lightweight_mode)
+        );
+        let current = profiles.current.as_deref();
+        for (uid, item) in &self.profile_items {
+            logging_error!(Type::Tray, item.set_checked(current == Some(uid.as_str())));
+        }
+    }
+
+    fn apply_proxy(&mut self, proxy_nodes_data: &Proxies) {
+        for group in self.proxy_groups.iter_mut() {
+            let Some(group_data) = proxy_nodes_data.proxies.get(group.name.as_str()) else {
+                continue;
+            };
+            let now = group_data.now.as_deref().unwrap_or_default();
+            for node in group.nodes.iter_mut() {
+                let text: String = format!(
+                    "{}   | {}",
+                    node.name,
+                    proxy_delay_text(proxy_nodes_data, node.name.as_str())
+                )
+                .into();
+                if node.text != text {
+                    logging_error!(Type::Tray, node.item.set_text(&text));
+                    node.text = text;
+                }
+                let checked = node.name == now;
+                if node.checked != checked {
+                    logging_error!(Type::Tray, node.item.set_checked(checked));
+                    node.checked = checked;
+                }
+            }
+        }
+    }
+
+    fn swap_proxy_section(
+        &mut self,
+        app_handle: &AppHandle<Wry>,
+        proxy_mode: &str,
+        order_map: Option<&HashMap<String, usize>>,
+        proxy_nodes_data: &Proxies,
+        proxy_signature: Option<&str>,
+    ) -> bool {
+        let Some(proxies_submenu) = self.proxies_submenu.clone() else {
+            return false;
+        };
+        let (group_menus, group_state) =
+            create_subcreate_proxy_menu_item(app_handle, proxy_mode, order_map, proxy_nodes_data);
+        if group_menus.is_empty() {
+            return false;
+        }
+        while proxies_submenu.remove_at(0).is_ok_and(|item| item.is_some()) {}
+        let group_menus_refs: Vec<&dyn IsMenuItem<Wry>> =
+            group_menus.iter().map(|menu| menu as &dyn IsMenuItem<Wry>).collect();
+        logging_error!(Type::Tray, proxies_submenu.append_items(&group_menus_refs));
+        self.proxy_groups = group_state;
+        self.proxy_signature = proxy_signature.map(Into::into);
+        true
+    }
+}
@@ -1,4 +1,4 @@
-use crate::config::{IProfilePreview, IVerge};
+use crate::config::{IProfilePreview, IProfiles, IVerge};
 use crate::core::lightweight;
 use crate::core::tray::menu_def::TrayAction;
 use crate::process::AsyncHandler;
@@ -13,6 +13,7 @@ use crate::{
 };
 use clash_verge_limiter::{Limiter, SystemClock, SystemLimiter};
 use clash_verge_logging::logging_error;
+use parking_lot::Mutex;
 use tauri::tray::{MouseButton, MouseButtonState, TrayIcon, TrayIconBuilder, TrayIconEvent};
 use tauri_plugin_mihomo::models::Proxies;
 use tokio::fs;
@@ -29,9 +30,14 @@ use tauri::{
 };

 mod menu_def;
+mod menu_state;
 #[cfg(target_os = "macos")]
 mod speed_task;
 use menu_def::{MenuIds, MenuTexts};
+use menu_state::{
+    ProxyGroupItems, ProxyNodeItem, ReconcileContext, TrayMenuState, menu_signature, proxy_delay_text,
+    proxy_structure_signature, reconcile,
+};

 // TODO: 是否需要将可变菜单抽离存储起来，后续直接更新对应菜单实例，无需重新创建菜单(待考虑)

@@ -41,7 +47,10 @@ const TRAY_CLICK_DEBOUNCE_MS: u64 = 300;
 pub const TRAY_ID: &str = "clash-verge-rev-tray";

 #[derive(Clone, Copy)]
-struct TrayMenuOptions {
+struct TrayMenuOptions<'a> {
+    mode: Option<&'a str>,
+    system_proxy_enabled: bool,
+    tun_mode_enabled: bool,
    is_lightweight_mode: bool,
    include_proxy_groups: bool,
 }
@@ -59,6 +68,7 @@ pub struct Tray {
    limiter: SystemLimiter,
    #[cfg(target_os = "macos")]
    speed_controller: speed_task::TraySpeedController,
+    menu_state: Mutex<Option<TrayMenuState>>,
 }

 impl TrayState {
@@ -132,6 +142,7 @@ impl Default for Tray {
            limiter: Limiter::new(Duration::from_millis(TRAY_CLICK_DEBOUNCE_MS), SystemClock),
            #[cfg(target_os = "macos")]
            speed_controller: speed_task::TraySpeedController::new(),
+            menu_state: Mutex::new(None),
        }
    }
 }
@@ -201,9 +212,8 @@ impl Tray {
        };

        let verge = Config::verge().await.latest_arc();
-        let system_proxy = verge.enable_system_proxy.as_ref().unwrap_or(&false);
-        let tun_mode = verge.enable_tun_mode.as_ref().unwrap_or(&false);
-        let tun_mode_available = crate::core::runstate::RUN_STATE.state().tun_capable();
+        let system_proxy = verge.enable_system_proxy.unwrap_or(false);
+        let tun_mode = verge.enable_tun_mode.unwrap_or(false);
        let mode = {
            Config::clash()
                .await
@@ -214,29 +224,81 @@ impl Tray {
                .unwrap_or("rule")
                .to_owned()
        };
-        let profiles_config = Config::profiles().await;
-        let profiles_arc = profiles_config.latest_arc();
-        let profiles_preview = profiles_arc.profiles_preview().unwrap_or_default();
        let is_lightweight_mode = is_in_lightweight_mode();

-        logging_error!(
-            Type::Tray,
-            tray.set_menu(Some(
-                create_tray_menu(
-                    app_handle,
-                    Some(mode.as_str()),
-                    *system_proxy,
-                    *tun_mode,
-                    tun_mode_available,
-                    profiles_preview,
-                    TrayMenuOptions {
-                        is_lightweight_mode,
-                        include_proxy_groups,
+        let fetch_proxy_groups =
+            include_proxy_groups && verge.tray_proxy_groups_display_mode.as_deref() != Some("disable");
+
+        // TODO: should update tray menu again when it was timeout error
+        let (proxy_nodes_data, runtime_proxy_groups_order) = if fetch_proxy_groups {
+            let proxy_nodes_data =
+                tokio::time::timeout(Duration::from_millis(1000), handle::Handle::mihomo().get_proxies())
+                    .await
+                    .map_or(None, |res| res.ok());
+
+            let runtime = Config::runtime().await.latest_arc();
+            let runtime_proxy_groups_order = runtime.config.as_ref().map(|config| {
+                config
+                    .get("proxy-groups")
+                    .and_then(|groups| groups.as_sequence())
+                    .map(|groups| {
+                        groups
+                            .iter()
+                            .filter_map(|group| group.get("name"))
+                            .filter_map(|name| name.as_str())
+                            .enumerate()
+                            .map(|(index, name)| (name.into(), index))
+                            .collect::<HashMap<String, usize>>()
+                    })
+                    .unwrap_or_default()
+            });
+
+            (proxy_nodes_data, runtime_proxy_groups_order)
+        } else {
+            (None, None)
+        };
+
+        let verge = if fetch_proxy_groups {
+            Config::verge().await.latest_arc()
+        } else {
+            verge
+        };
+        let profiles = Config::profiles().await.latest_arc();
+
+        let menu_signature = menu_signature(&verge, &profiles, &mode);
+        let proxy_signature = proxy_nodes_data
+            .as_ref()
+            .map(|data| proxy_structure_signature(&mode, runtime_proxy_groups_order.as_ref(), data));
+
+        let (tx, rx) = tokio::sync::oneshot::channel();
+        let dispatch_handle = app_handle.clone();
+        app_handle
+            .run_on_main_thread(move || {
+                let _ = tx.send(reconcile(
+                    &Self::global().menu_state,
+                    ReconcileContext {
+                        app_handle: &dispatch_handle,
+                        tray: &tray,
+                        options: TrayMenuOptions {
+                            mode: Some(mode.as_str()),
+                            system_proxy_enabled: system_proxy,
+                            tun_mode_enabled: tun_mode,
+                            is_lightweight_mode,
+                            include_proxy_groups,
+                        },
+                        verge: &verge,
+                        profiles: &profiles,
+                        fetched_proxies: proxy_nodes_data.as_ref(),
+                        order_map: runtime_proxy_groups_order.as_ref(),
+                        menu_signature: &menu_signature,
+                        proxy_signature: proxy_signature.as_deref(),
+                        fetched: fetch_proxy_groups,
                    },
-                )
-                .await?,
-            ))
-        );
+                ));
+            })
+            .map_err(|e| anyhow::anyhow!("Failed to dispatch tray menu update: {e}"))?;
+        rx.await
+            .map_err(|_| anyhow::anyhow!("Tray menu update returned no result"))??;

        logging!(debug, Type::Tray, "托盘菜单更新成功");
        Ok(())
@@ -422,11 +484,12 @@ fn create_hotkeys(hotkeys: &Option<Vec<String>>) -> HashMap<&str, &str> {
                    let mut parts = item.split(',');
                    match (parts.next(), parts.next()) {
                        (Some(func), Some(key)) => {
-                            // 托盘菜单的 `accelerator` 在 Linux/Windows 下不支持小键盘按键，Windows 下也不支持 Win 键（前端上报为 `CMD`）
-                            let uppercase_key = key.to_uppercase();
-                            let unsupported =
-                                uppercase_key.contains("NUMPAD") || (cfg!(windows) && uppercase_key.contains("CMD"));
-                            if unsupported { None } else { Some((func, key)) }
+                            // 托盘菜单中的 `accelerator` 属性，在 Linux/Windows 中都不支持小键盘按键的解析
+                            if key.to_uppercase().contains("NUMPAD") {
+                                None
+                            } else {
+                                Some((func, key))
+                            }
                        }
                        _ => None,
                    }
@@ -439,7 +502,7 @@ fn create_hotkeys(hotkeys: &Option<Vec<String>>) -> HashMap<&str, &str> {
 fn create_profile_menu_item(
    app_handle: &AppHandle,
    profiles_preview: Vec<IProfilePreview<'_>>,
-) -> Result<Vec<CheckMenuItem<Wry>>> {
+) -> Result<Vec<(String, CheckMenuItem<Wry>)>> {
    profiles_preview
        .into_iter()
        .map(|profile| {
@@ -451,6 +514,7 @@ fn create_profile_menu_item(
                profile.is_current,
                None::<&str>,
            )
+            .map(|item| (profile.uid.clone(), item))
            .map_err(|e| e.into())
        })
        .collect()
@@ -459,93 +523,96 @@ fn create_profile_menu_item(
 fn create_subcreate_proxy_menu_item(
    app_handle: &AppHandle,
    proxy_mode: &str,
-    proxy_group_order_map: Option<HashMap<String, usize>>,
-    proxy_nodes_data: Option<Proxies>,
-) -> Vec<Submenu<Wry>> {
-    let proxy_submenus: Vec<Submenu<Wry>> = {
-        let mut submenus: Vec<(String, usize, Submenu<Wry>)> = Vec::new();
+    proxy_group_order_map: Option<&HashMap<String, usize>>,
+    proxy_nodes_data: &Proxies,
+) -> (Vec<Submenu<Wry>>, Vec<ProxyGroupItems>) {
+    let mut submenus: Vec<(String, usize, Submenu<Wry>, Vec<ProxyNodeItem>)> = Vec::new();

-        // TODO: 应用启动时，内核还未启动完全，无法获取代理节点信息
-        if let Some(proxy_nodes_data) = proxy_nodes_data {
-            for (group_name, group_data) in proxy_nodes_data.proxies.iter() {
-                let should_show = match proxy_mode {
-                    "global" => group_name == "GLOBAL",
-                    _ => group_name != "GLOBAL",
-                } && !group_data.hidden.unwrap_or_default();
+    // TODO: 应用启动时，内核还未启动完全，无法获取代理节点信息
+    for (group_name, group_data) in proxy_nodes_data.proxies.iter() {
+        let should_show = match proxy_mode {
+            "global" => group_name == "GLOBAL",
+            _ => group_name != "GLOBAL",
+        } && !group_data.hidden.unwrap_or_default();

-                if !should_show {
-                    continue;
-                }
-
-                let Some(all_proxies) = group_data.all.as_ref() else {
-                    continue;
-                };
-
-                let now_proxy = group_data.now.as_deref().unwrap_or_default();
-
-                let group_items: Vec<CheckMenuItem<Wry>> = all_proxies
-                    .iter()
-                    .filter_map(|proxy_str| {
-                        let is_selected = *proxy_str == now_proxy;
-                        let item_id = format!("proxy_{}_{}", group_name, proxy_str);
-
-                        let delay_text = proxy_nodes_data
-                            .proxies
-                            .get(proxy_str)
-                            .and_then(|h| h.history.last())
-                            .map(|h| match h.delay {
-                                0 => "-ms".into(),
-                                delay if delay >= 10000 => "-ms".into(),
-                                _ => format!("{}ms", h.delay),
-                            })
-                            .unwrap_or_else(|| "-ms".into());
-
-                        let display_text = format!("{}   | {}", proxy_str, delay_text);
-
-                        CheckMenuItem::with_id(app_handle, item_id, display_text, true, is_selected, None::<&str>)
-                            .map_err(|e| logging!(warn, Type::Tray, "Failed to create proxy menu item: {}", e))
-                            .ok()
-                    })
-                    .collect();
-
-                if group_items.is_empty() {
-                    continue;
-                }
-
-                let group_display_name = group_name.to_string();
-
-                let group_items_refs: Vec<&dyn IsMenuItem<Wry>> =
-                    group_items.iter().map(|item| item as &dyn IsMenuItem<Wry>).collect();
-
-                if let Ok(submenu) = Submenu::with_id_and_items(
-                    app_handle,
-                    format!("proxy_group_{}", group_name),
-                    group_display_name,
-                    true,
-                    &group_items_refs,
-                ) {
-                    let insertion_index = submenus.len();
-                    submenus.push((group_name.into(), insertion_index, submenu));
-                } else {
-                    logging!(warn, Type::Tray, "Failed to create proxy group submenu: {}", group_name);
+        if !should_show {
+            continue;
+        }
+
+        let Some(all_proxies) = group_data.all.as_ref() else {
+            continue;
+        };
+
+        let now_proxy = group_data.now.as_deref().unwrap_or_default();
+
+        let mut group_items: Vec<CheckMenuItem<Wry>> = Vec::with_capacity(all_proxies.len());
+        let mut nodes: Vec<ProxyNodeItem> = Vec::with_capacity(all_proxies.len());
+        for proxy_str in all_proxies {
+            let is_selected = proxy_str == now_proxy;
+            let item_id = format!("proxy_{}_{}", group_name, proxy_str);
+            let display_text = format!(
+                "{}   | {}",
+                proxy_str,
+                proxy_delay_text(proxy_nodes_data, proxy_str.as_str())
+            );
+
+            match CheckMenuItem::with_id(app_handle, item_id, &display_text, true, is_selected, None::<&str>) {
+                Ok(item) => {
+                    group_items.push(item.clone());
+                    nodes.push(ProxyNodeItem {
+                        name: proxy_str.clone().into(),
+                        item,
+                        text: display_text.as_str().into(),
+                        checked: is_selected,
+                    });
                }
+                Err(e) => logging!(warn, Type::Tray, "Failed to create proxy menu item: {}", e),
            }
        }

-        if let Some(order_map) = proxy_group_order_map.as_ref() {
-            submenus.sort_by(|(name_a, original_index_a, _), (name_b, original_index_b, _)| {
-                match (order_map.get(name_a), order_map.get(name_b)) {
-                    (Some(index_a), Some(index_b)) => index_a.cmp(index_b),
-                    (Some(_), None) => std::cmp::Ordering::Less,
-                    (None, Some(_)) => std::cmp::Ordering::Greater,
-                    (None, None) => original_index_a.cmp(original_index_b),
-                }
-            });
+        if group_items.is_empty() {
+            continue;
        }

-        submenus.into_iter().map(|(_, _, submenu)| submenu).collect()
-    };
-    proxy_submenus
+        let group_display_name = group_name.to_string();
+
+        let group_items_refs: Vec<&dyn IsMenuItem<Wry>> =
+            group_items.iter().map(|item| item as &dyn IsMenuItem<Wry>).collect();
+
+        if let Ok(submenu) = Submenu::with_id_and_items(
+            app_handle,
+            format!("proxy_group_{}", group_name),
+            group_display_name,
+            true,
+            &group_items_refs,
+        ) {
+            let insertion_index = submenus.len();
+            submenus.push((group_name.into(), insertion_index, submenu, nodes));
+        } else {
+            logging!(warn, Type::Tray, "Failed to create proxy group submenu: {}", group_name);
+        }
+    }
+
+    if let Some(order_map) = proxy_group_order_map {
+        submenus.sort_by(|(name_a, original_index_a, _, _), (name_b, original_index_b, _, _)| {
+            match (order_map.get(name_a), order_map.get(name_b)) {
+                (Some(index_a), Some(index_b)) => index_a.cmp(index_b),
+                (Some(_), None) => std::cmp::Ordering::Less,
+                (None, Some(_)) => std::cmp::Ordering::Greater,
+                (None, None) => original_index_a.cmp(original_index_b),
+            }
+        });
+    }
+
+    let mut groups = Vec::with_capacity(submenus.len());
+    let group_menus = submenus
+        .into_iter()
+        .map(|(name, _, submenu, nodes)| {
+            groups.push(ProxyGroupItems { name, nodes });
+            submenu
+        })
+        .collect();
+    (group_menus, groups)
 }

 fn create_proxy_menu_item(
@@ -584,53 +651,16 @@ fn create_proxy_menu_item(
    Ok((proxies_submenu, inline_proxy_items))
 }

-async fn create_tray_menu(
+fn build_tray_menu(
    app_handle: &AppHandle,
-    mode: Option<&str>,
-    system_proxy_enabled: bool,
-    tun_mode_enabled: bool,
-    tun_mode_available: bool,
-    profiles_preview: Vec<IProfilePreview<'_>>,
-    options: TrayMenuOptions,
-) -> Result<tauri::menu::Menu<Wry>> {
-    let current_proxy_mode = mode.unwrap_or("");
-
-    let mut verge_settings = Config::verge().await.latest_arc();
-    let fetch_proxy_groups =
-        options.include_proxy_groups && verge_settings.tray_proxy_groups_display_mode.as_deref() != Some("disable");
-
-    // TODO: should update tray menu again when it was timeout error
-    let (proxy_nodes_data, runtime_proxy_groups_order) = if fetch_proxy_groups {
-        let proxy_nodes_data =
-            tokio::time::timeout(Duration::from_millis(1000), handle::Handle::mihomo().get_proxies())
-                .await
-                .map_or(None, |res| res.ok());
-
-        let runtime = Config::runtime().await.latest_arc();
-        let runtime_proxy_groups_order = runtime.config.as_ref().map(|config| {
-            config
-                .get("proxy-groups")
-                .and_then(|groups| groups.as_sequence())
-                .map(|groups| {
-                    groups
-                        .iter()
-                        .filter_map(|group| group.get("name"))
-                        .filter_map(|name| name.as_str())
-                        .enumerate()
-                        .map(|(index, name)| (name.into(), index))
-                        .collect::<HashMap<String, usize>>()
-                })
-                .unwrap_or_default()
-        });
-
-        (proxy_nodes_data, runtime_proxy_groups_order)
-    } else {
-        (None, None)
-    };
-
-    if fetch_proxy_groups {
-        verge_settings = Config::verge().await.latest_arc();
-    }
+    options: TrayMenuOptions<'_>,
+    verge_settings: &IVerge,
+    profiles_config: &IProfiles,
+    proxy_group_order_map: Option<&HashMap<String, usize>>,
+    proxy_nodes_data: Option<&Proxies>,
+) -> Result<(tauri::menu::Menu<Wry>, TrayMenuState)> {
+    let current_proxy_mode = options.mode.unwrap_or("");
+    let tun_mode_available = crate::core::runstate::RUN_STATE.state().tun_capable();

    let tray_proxy_groups_display_mode = verge_settings
        .tray_proxy_groups_display_mode
@@ -638,20 +668,19 @@ async fn create_tray_menu(
        .unwrap_or("default");
    let include_proxy_groups = options.include_proxy_groups && tray_proxy_groups_display_mode != "disable";

-    let proxy_group_order_map = runtime_proxy_groups_order;
-
    let show_outbound_modes_inline = verge_settings.tray_inline_outbound_modes.unwrap_or(false);

    let version = env!("CARGO_PKG_VERSION");

    let hotkeys = create_hotkeys(&verge_settings.hotkeys);

-    let profile_menu_items: Vec<CheckMenuItem<Wry>> = create_profile_menu_item(app_handle, profiles_preview)?;
+    let profiles_preview = profiles_config.profiles_preview().unwrap_or_default();
+    let profile_menu_items: Vec<(String, CheckMenuItem<Wry>)> = create_profile_menu_item(app_handle, profiles_preview)?;

    let texts = MenuTexts::new();
    let profile_menu_items_refs: Vec<&dyn IsMenuItem<Wry>> = profile_menu_items
        .iter()
-        .map(|item| item as &dyn IsMenuItem<Wry>)
+        .map(|(_, item)| item as &dyn IsMenuItem<Wry>)
        .collect();

    let open_window = &MenuItem::with_id(
@@ -719,12 +748,20 @@ async fn create_tray_menu(
        &profile_menu_items_refs,
    )?;

-    let (proxies_menu, inline_proxy_items) = if include_proxy_groups {
-        let proxy_sub_menus =
+    let mut proxy_groups: Vec<ProxyGroupItems> = Vec::new();
+    let mut proxies_submenu_handle: Option<Submenu<Wry>> = None;
+    let (proxies_menu, inline_proxy_items) = if include_proxy_groups && let Some(proxy_nodes_data) = proxy_nodes_data {
+        let (proxy_sub_menus, groups) =
            create_subcreate_proxy_menu_item(app_handle, current_proxy_mode, proxy_group_order_map, proxy_nodes_data);
+        proxy_groups = groups;

        match tray_proxy_groups_display_mode {
-            "default" => create_proxy_menu_item(app_handle, false, proxy_sub_menus, &texts.proxies)?,
+            "default" => {
+                let (submenu, inline_items) =
+                    create_proxy_menu_item(app_handle, false, proxy_sub_menus, &texts.proxies)?;
+                proxies_submenu_handle = submenu.clone();
+                (submenu, inline_items)
+            }
            "inline" => create_proxy_menu_item(app_handle, true, proxy_sub_menus, &texts.proxies)?,
            _ => (None, Vec::new()),
        }
@@ -737,7 +774,7 @@ async fn create_tray_menu(
        MenuIds::SYSTEM_PROXY,
        &texts.system_proxy,
        true,
-        system_proxy_enabled,
+        options.system_proxy_enabled,
        hotkeys.get("toggle_system_proxy").copied(),
    )?;

@@ -746,7 +783,7 @@ async fn create_tray_menu(
        MenuIds::TUN_MODE,
        &texts.tun_mode,
        tun_mode_available,
-        tun_mode_enabled,
+        options.tun_mode_enabled,
        hotkeys.get("toggle_tun_mode").copied(),
    )?;

@@ -865,7 +902,18 @@ async fn create_tray_menu(
    ]);

    let menu = tauri::menu::MenuBuilder::new(app_handle).items(&menu_items).build()?;
-    Ok(menu)
+    let state = TrayMenuState {
+        mode_items: [rule_mode.clone(), global_mode.clone(), direct_mode.clone()],
+        system_proxy_item: system_proxy.clone(),
+        tun_item: tun_mode.clone(),
+        lightweight_item: lightweight_mode.clone(),
+        profile_items: profile_menu_items,
+        proxies_submenu: proxies_submenu_handle,
+        proxy_groups,
+        signature: String::new(),
+        proxy_signature: None,
+    };
+    Ok((menu, state))
 }

 fn on_tray_icon_event(_tray_icon: &TrayIcon, tray_event: TrayIconEvent) {
@@ -27,7 +27,7 @@ pub async fn patch_verge(patch: &IVerge, not_save_file: bool) -> Result<()> {

 /// Apply a patch without post-update reconciliation.
 pub(super) async fn apply_verge_patch(patch: &IVerge, not_save_file: bool) -> Result<()> {
-    let config_write = Config::lock_config_write().await;
+    let config_write = Config::try_lock_config_write()?;
    apply_verge_patch_locked(&config_write, patch, not_save_file).await
 }

@@ -316,6 +316,7 @@ pub async fn hide() {
    {
        let _ = window.hide();
    }
+    handle::Handle::global().set_activation_policy_accessory();
 }

 #[cfg(test)]
@@ -289,6 +289,9 @@ pub fn run() -> std::process::ExitCode {
        }

        pub fn handle_window_close(api: &tauri::WindowEvent) {
+            #[cfg(target_os = "macos")]
+            handle::Handle::global().set_activation_policy_accessory();
+
            if core::handle::Handle::global().is_exiting() {
                return;
            }
@@ -4,19 +4,10 @@ import {
  VisibilityOffOutlined,
  VisibilityOutlined,
 } from '@mui/icons-material'
-import {
-  Box,
-  Button,
-  FormControlLabel,
-  IconButton,
-  Skeleton,
-  Switch,
-  Typography,
-} from '@mui/material'
+import { Box, Button, IconButton, Skeleton, Typography } from '@mui/material'
 import { getCurrentWebviewWindow } from '@tauri-apps/api/webviewWindow'
 import { useEffect } from 'foxact/use-abortable-effect'
 import { useIntersection } from 'foxact/use-intersection'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import type { XOR } from 'foxts/ts-xor'
 import {
  forwardRef,
@@ -108,13 +99,9 @@ const IPInfoCardContainer = forwardRef<HTMLElement, React.PropsWithChildren>(
 export const IpInfoCard = () => {
  const { t } = useTranslation()
  const [showIp, setShowIp] = useState(false)
-  const [autoRefresh, setAutoRefresh] = useLocalStorage(
-    'ip-info-auto-refresh',
-    true,
-  )
  const appWindow = useMemo(() => getCurrentWebviewWindow(), [])

-  // Once intersected, the card stays eligible for refresh until unmount.
+  // Once intersected, refreshes stay enabled until unmount.
  const [containerRef, hasIntersected, _resetIntersected] = useIntersection({
    rootMargin: '0px',
  })
@@ -164,8 +151,6 @@ export const IpInfoCard = () => {
  })

  useEffect(() => {
-    if (!autoRefresh) return
-
    let timer: number | null = null

    // Prefer DOM intersection state; Tauri visibility is unreliable on some platforms.
@@ -205,7 +190,7 @@ export const IpInfoCard = () => {
      if (timer != null) clearInterval(timer)
      document.removeEventListener('visibilitychange', onVisibilityChange)
    }
-  }, [autoRefresh, hasIntersected])
+  }, [hasIntersected])

  const toggleShowIp = useCallback(() => {
    setShowIp((prev) => !prev)
@@ -379,25 +364,12 @@ export const IpInfoCard = () => {
              fontSize: '0.7rem',
            }}
          >
-            <FormControlLabel
-              sx={{ m: 0 }}
-              control={
-                <Switch
-                  size="small"
-                  checked={autoRefresh}
-                  onChange={(_, checked) => setAutoRefresh(checked)}
-                />
-              }
-              label={
-                <Typography variant="caption">
-                  {t('home.components.ipInfo.labels.autoRefresh')}
-                  {autoRefresh &&
-                    (countdown.type === 'countdown'
-                      ? `: ${countdown.remainingSeconds}s`
-                      : '...')}
-                </Typography>
-              }
-            />
+            <Typography variant="caption">
+              {t('home.components.ipInfo.labels.autoRefresh')}
+              {countdown.type === 'countdown'
+                ? `: ${countdown.remainingSeconds}s`
+                : '...'}
+            </Typography>
            <Typography
              variant="caption"
              sx={{
@@ -397,9 +397,9 @@ export const RulesEditorViewer = (props: Props) => {
      return
    }

-    setPrependSeq((obj?.prepend || []).filter((rule) => rule !== null))
-    setAppendSeq((obj?.append || []).filter((rule) => rule !== null))
-    setDeleteSeq((obj?.delete || []).filter((rule) => rule !== null))
+    setPrependSeq(obj?.prepend || [])
+    setAppendSeq(obj?.append || [])
+    setDeleteSeq(obj?.delete || [])
    hasLoadedSeqConfigRef.current = true
  }, [property])

@@ -417,9 +417,9 @@ export const RulesEditorViewer = (props: Props) => {

    hasLoadedSeqConfigRef.current = true
    startTransition(() => {
-      setPrependSeq((obj?.prepend ?? []).filter((rule) => rule !== null))
-      setAppendSeq((obj?.append ?? []).filter((rule) => rule !== null))
-      setDeleteSeq((obj?.delete ?? []).filter((rule) => rule !== null))
+      setPrependSeq(obj?.prepend ?? [])
+      setAppendSeq(obj?.append ?? [])
+      setDeleteSeq(obj?.delete ?? [])
    })
    setVisualization(true)
  }
@@ -608,7 +608,7 @@ function NormalProxyGroups(props: { mode: string }) {
        />
      </DragDropProvider>

-      {(mode === 'rule' || mode === 'global') && (
+      {mode === 'rule' && (
        <ProxyGroupNavigator
          proxyGroupNames={proxyGroupNames}
          onGroupLocation={handleGroupLocationByName}
@@ -211,7 +211,7 @@ export const useRenderList = (
    if (!proxyView) return []
    if (isChainMode)
      return selectedGroup ? [selectedGroup] : [CHAIN_DELAY_GROUP]
-    return mode === 'rule' || mode === 'global'
+    return mode === 'rule' || mode === 'script'
      ? proxyView.groups.map(({ name }) => name)
      : proxyView.global
        ? [proxyView.global.name]
@@ -257,7 +257,7 @@ export const useRenderList = (
      }))
    }

-    const useRule = mode === 'rule' || mode === 'global'
+    const useRule = mode === 'rule' || mode === 'script'
    const renderGroups = useRule
      ? proxyView.groups
      : proxyView.global === null
@@ -40,9 +40,9 @@ export const BackupConfigViewer = memo(

    const { register, handleSubmit, watch } = useForm<IWebDavConfig>({
      defaultValues: {
-        url: webdav_url ?? '',
-        username: webdav_username ?? '',
-        password: webdav_password ?? '',
+        url: webdav_url!,
+        username: webdav_username!,
+        password: webdav_password!,
      },
    })
    const url = watch('url')
@@ -50,9 +50,9 @@ export const BackupConfigViewer = memo(
    const password = watch('password')

    const webdavChanged =
-      (webdav_url ?? '') !== url ||
-      (webdav_username ?? '') !== username ||
-      (webdav_password ?? '') !== password
+      webdav_url !== url ||
+      webdav_username !== username ||
+      webdav_password !== password

    const webdavSignature = buildWebdavSignature(verge)
    const webdavStatus = getWebdavStatus(webdavSignature)
@@ -69,9 +69,9 @@ export const BackupConfigViewer = memo(
    }, [webdav_url, webdav_username, webdav_password, onInit, shouldAutoInit])

    const checkForm = () => {
-      const username = usernameRef.current?.value.trim()
+      const username = usernameRef.current?.value
      const password = passwordRef.current?.value
-      const url = urlRef.current?.value.trim()
+      const url = urlRef.current?.value

      if (!url) {
        urlRef.current?.focus()
@@ -95,15 +95,14 @@ export const BackupConfigViewer = memo(
    }

    const save = useLockFn(async (data: IWebDavConfig) => {
-      const trimmedUrl = data.url.trim()
-      const trimmedUsername = data.username.trim()
-      const isClearing = !trimmedUrl && !trimmedUsername && !data.password
-      if (!isClearing) checkForm()
+      checkForm()
      const signature = buildWebdavSignature({
        webdav_url: data.url,
        webdav_username: data.username,
        webdav_password: data.password,
      })
+      const trimmedUrl = data.url.trim()
+      const trimmedUsername = data.username.trim()

      try {
        setLoading(true)
@@ -128,7 +127,7 @@ export const BackupConfigViewer = memo(
        )
        setWebdavStatus(signature, 'unknown')
        showNotice.success('settings.modals.backup.messages.webdavConfigSaved')
-        if (!isClearing) await onSaveSuccess(signature)
+        await onSaveSuccess(signature)
      } catch (error) {
        showNotice.error(
          'settings.modals.backup.messages.webdavConfigSaveFailed',
@@ -224,9 +223,9 @@ export const BackupConfigViewer = memo(
              }}
            >
              {webdavChanged ||
-              !webdav_url ||
-              !webdav_username ||
-              !webdav_password ? (
+              webdav_url === undefined ||
+              webdav_username === undefined ||
+              webdav_password === undefined ? (
                <Button
                  variant="contained"
                  color={'primary'}
@@ -1,43 +0,0 @@
-import { Button, ButtonGroup } from '@mui/material'
-
-interface Props {
-  value?: string
-  onChange?: (value: string) => void
-}
-
-export const DnsModeSwitch = (props: Props) => {
-  const { value, onChange } = props
-
-  return (
-    <ButtonGroup size="small" sx={{ my: '4px' }}>
-      <Button
-        variant={!value ? 'contained' : 'outlined'}
-        onClick={() => onChange?.('')}
-        sx={{ textTransform: 'capitalize' }}
-      >
-        Auto
-      </Button>
-      <Button
-        variant={value === 'disabled' ? 'contained' : 'outlined'}
-        onClick={() => onChange?.('disabled')}
-        sx={{ textTransform: 'capitalize' }}
-      >
-        Disabled
-      </Button>
-      <Button
-        variant={value === 'native' ? 'contained' : 'outlined'}
-        onClick={() => onChange?.('native')}
-        sx={{ textTransform: 'capitalize' }}
-      >
-        Native
-      </Button>
-      <Button
-        variant={value === 'hijack' ? 'contained' : 'outlined'}
-        onClick={() => onChange?.('hijack')}
-        sx={{ textTransform: 'capitalize' }}
-      >
-        Hijack
-      </Button>
-    </ButtonGroup>
-  )
-}
@@ -26,7 +26,6 @@ import { showNotice } from '@/services/notice-service'
 import getSystem from '@/utils/get-system'
 import { areValidIpCidrs } from '@/utils/network'

-import { DnsModeSwitch } from './dns-mode-switch'
 import { StackModeSwitch } from './stack-mode-switch'

 const OS = getSystem()
@@ -53,7 +52,6 @@ export function TunViewer({ ref }: { ref?: Ref<DialogRef> }) {
    dnsHijack: ['any:53'],
    strictRoute: false,
    mtu: 1500,
-    dnsMode: '',
  })

  const routeExcludeAddressItems = splitRouteExcludeAddress(
@@ -86,7 +84,6 @@ export function TunViewer({ ref }: { ref?: Ref<DialogRef> }) {
        dnsHijack: clash?.tun['dns-hijack'] ?? ['any:53'],
        strictRoute: clash?.tun['strict-route'] ?? false,
        mtu: clash?.tun.mtu ?? 1500,
-        dnsMode: clash?.tun['dns-mode'] ?? '',
      })
    },
    close: () => setOpen(false),
@@ -120,7 +117,6 @@ export function TunViewer({ ref }: { ref?: Ref<DialogRef> }) {
          : {}),
        'auto-detect-interface': values.autoDetectInterface,
        'dns-hijack': values.dnsHijack[0] === '' ? [] : values.dnsHijack,
-        'dns-mode': values.dnsMode,
        'strict-route': values.strictRoute,
        mtu: values.mtu ?? 1500,
      }
@@ -167,7 +163,6 @@ export function TunViewer({ ref }: { ref?: Ref<DialogRef> }) {
                'auto-detect-interface': true,
                'dns-hijack': ['any:53'],
                'route-exclude-address': [],
-                'dns-mode': '',
                'strict-route': false,
                mtu: 1500,
              }
@@ -181,7 +176,6 @@ export function TunViewer({ ref }: { ref?: Ref<DialogRef> }) {
                dnsHijack: ['any:53'],
                strictRoute: false,
                mtu: 1500,
-                dnsMode: '',
              })
              await patchClash({ tun })
              await mutateClash(
@@ -218,25 +212,6 @@ export function TunViewer({ ref }: { ref?: Ref<DialogRef> }) {
          />
        </ListItem>

-        <ListItem sx={{ padding: '5px 2px' }}>
-          <ListItemText
-            primary={t('settings.modals.tun.fields.dnsMode')}
-            sx={{ maxWidth: 'fit-content' }}
-          />
-          <TooltipIcon
-            title={t('settings.modals.tun.tooltips.dnsMode')}
-            sx={{ opacity: 0.7 }}
-          />
-          <Box sx={{ marginLeft: 'auto' }}>
-            <DnsModeSwitch
-              value={values.dnsMode}
-              onChange={(value) => {
-                setValues((v) => ({ ...v, dnsMode: value }))
-              }}
-            />
-          </Box>
-        </ListItem>
-
        <ListItem sx={{ padding: '5px 2px' }}>
          <ListItemText primary={t('settings.modals.tun.fields.device')} />
          <TextField
@@ -72,10 +72,12 @@ const LazyReactMarkdown = lazy(async () => {
    { default: ReactMarkdown },
    { default: rehypeRaw },
    { default: rehypeSanitize, defaultSchema },
+    { default: remarkGfm },
  ] = await Promise.all([
    import('react-markdown'),
    import('rehype-raw'),
    import('rehype-sanitize'),
+    import('remark-gfm'),
  ])

  const sanitizeSchema = {
@@ -102,6 +104,7 @@ const LazyReactMarkdown = lazy(async () => {
    default: (props: ReactMarkdownOptions) => (
      <ReactMarkdown
        {...props}
+        remarkPlugins={[remarkGfm, ...(props.remarkPlugins ?? [])]}
        rehypePlugins={[rehypeRaw, [rehypeSanitize, sanitizeSchema]]}
      />
    ),
@@ -495,13 +495,11 @@
        "strictRoute": "توجيه صارم",
        "autoDetectInterface": "الكشف التلقائي عن الواجهة",
        "dnsHijack": "اختطاف DNS",
-        "dnsMode": "وضع DNS",
        "mtu": "وحدة الإرسال القصوى",
        "autoRedirect": "Auto Redirect"
      },
      "tooltips": {
        "dnsHijack": "Please use , to separate multiple DNS servers",
-        "dnsMode": "يحافظ Auto على السلوك القديم؛ يتطلب hijack تفعيل توجيه صارم على Windows أو Auto Redirect على Linux",
        "autoRedirect": "Automatically configures nftables/iptables TCP redirects"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "Yes",
      "no": "No",
      "failed": "Failed",
-      "risky": "غير مؤكد",
      "completed": "Completed",
      "disallowedIsp": "Disallowed ISP",
      "originalsOnly": "Originals Only",
@@ -495,13 +495,11 @@
        "strictRoute": "Strenges Routing",
        "autoDetectInterface": "Netzwerkschnittstelle automatisch auswählen",
        "dnsHijack": "DNS-Hijacking",
-        "dnsMode": "DNS-Modus",
        "mtu": "Maximale Übertragungseinheit",
        "autoRedirect": "Automatische Umleitung"
      },
      "tooltips": {
        "dnsHijack": "Mehrere DNS-Server durch Kommas trennen",
-        "dnsMode": "Auto behält das alte Verhalten bei; hijack erfordert Strenges Routing unter Windows oder Automatische Umleitung unter Linux",
        "autoRedirect": "Richtet TCP-Umleitungen per nftables/iptables automatisch ein"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "Unterstützt",
      "no": "Nicht unterstützt",
      "failed": "Test fehlgeschlagen",
-      "risky": "Ungewiss",
      "completed": "Prüfung abgeschlossen",
      "disallowedIsp": "Nicht zugelassener Internetdienstanbieter",
      "originalsOnly": "Nur Original",
@@ -495,13 +495,11 @@
        "strictRoute": "Strict Route",
        "autoDetectInterface": "Auto Detect Interface",
        "dnsHijack": "DNS Hijack",
-        "dnsMode": "DNS Mode",
        "mtu": "Max Transmission Unit",
        "autoRedirect": "Auto Redirect"
      },
      "tooltips": {
        "dnsHijack": "Please use , to separate multiple DNS servers",
-        "dnsMode": "Auto keeps the legacy behavior; hijack requires Strict Route on Windows or Auto Redirect on Linux",
        "autoRedirect": "Automatically configures nftables/iptables TCP redirects"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "Yes",
      "no": "No",
      "failed": "Failed",
-      "risky": "Risky",
      "completed": "Completed",
      "disallowedIsp": "Disallowed ISP",
      "originalsOnly": "Originals Only",
@@ -495,13 +495,11 @@
        "strictRoute": "Enrutamiento estricto",
        "autoDetectInterface": "Detectar automáticamente la interfaz de salida del tráfico",
        "dnsHijack": "Secuestro de DNS",
-        "dnsMode": "Modo DNS",
        "mtu": "Unidad máxima de transmisión",
        "autoRedirect": "Auto Redirect"
      },
      "tooltips": {
        "dnsHijack": "Please use , to separate multiple DNS servers",
-        "dnsMode": "Auto mantiene el comportamiento anterior; hijack requiere Enrutamiento estricto en Windows o Auto Redirect en Linux",
        "autoRedirect": "Automatically configures nftables/iptables TCP redirects"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "Soportado",
      "no": "No soportado",
      "failed": "Prueba fallida",
-      "risky": "Dudoso",
      "completed": "Detección completada",
      "disallowedIsp": "Proveedor de servicios de Internet no permitido",
      "originalsOnly": "Solo originales",
@@ -495,13 +495,11 @@
        "strictRoute": "مسیر دقیق",
        "autoDetectInterface": "تشخیص خودکار رابط",
        "dnsHijack": "ربایش DNS",
-        "dnsMode": "حالت DNS",
        "mtu": "واحد حداکثر انتقال",
        "autoRedirect": "Auto Redirect"
      },
      "tooltips": {
        "dnsHijack": "لطفا برای جدا کردن چندین سرور DNS از , استفاده کنید.",
-        "dnsMode": "Auto رفتار قدیمی را حفظ می‌کند؛ hijack در ویندوز نیاز به مسیر دقیق یا در لینوکس نیاز به Auto Redirect دارد",
        "autoRedirect": "پیکربندی خودکار ریدایرکت‌های TCP در nftables/iptables"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "Yes",
      "no": "No",
      "failed": "Failed",
-      "risky": "نامشخص",
      "completed": "Completed",
      "disallowedIsp": "Disallowed ISP",
      "originalsOnly": "Originals Only",
@@ -495,13 +495,11 @@
        "strictRoute": "Rute Ketat",
        "autoDetectInterface": "Deteksi Antarmuka Otomatis",
        "dnsHijack": "Pembajakan DNS",
-        "dnsMode": "Mode DNS",
        "mtu": "Unit Transmisi Maksimum",
        "autoRedirect": "Auto Redirect"
      },
      "tooltips": {
        "dnsHijack": "Please use , to separate multiple DNS servers",
-        "dnsMode": "Auto mempertahankan perilaku lama; hijack memerlukan Rute Ketat di Windows atau Auto Redirect di Linux",
        "autoRedirect": "Automatically configures nftables/iptables TCP redirects"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "Yes",
      "no": "No",
      "failed": "Failed",
-      "risky": "Tidak pasti",
      "completed": "Completed",
      "disallowedIsp": "Disallowed ISP",
      "originalsOnly": "Originals Only",
@@ -495,13 +495,11 @@
        "strictRoute": "厳格なルート",
        "autoDetectInterface": "トラフィックの出口インターフェースを自動選択",
        "dnsHijack": "DNSハイジャック",
-        "dnsMode": "DNSモード",
        "mtu": "最大転送単位",
        "autoRedirect": "Auto Redirect"
      },
      "tooltips": {
        "dnsHijack": "Please use , to separate multiple DNS servers",
-        "dnsMode": "Auto は従来の動作を維持します。hijack には Windows で厳格なルートまたは Linux で Auto Redirect が必要です",
        "autoRedirect": "Automatically configures nftables/iptables TCP redirects"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "サポートする",
      "no": "サポートしない",
      "failed": "テストに失敗しました。",
-      "risky": "要確認",
      "completed": "検査完了",
      "disallowedIsp": "許可されていないインターネットサービスプロバイダー",
      "originalsOnly": "オリジナルのみ",
@@ -495,13 +495,11 @@
        "strictRoute": "엄격 라우팅",
        "autoDetectInterface": "인터페이스 자동 감지",
        "dnsHijack": "DNS 하이재킹",
-        "dnsMode": "DNS 모드",
        "mtu": "MTU",
        "autoRedirect": "Auto Redirect"
      },
      "tooltips": {
        "dnsHijack": "여러 DNS 서버는 쉼표(,)로 구분하세요",
-        "dnsMode": "Auto는 기존 동작을 유지합니다. hijack은 Windows에서 엄격 라우팅 또는 Linux에서 Auto Redirect가 필요합니다",
        "autoRedirect": "Automatically configures nftables/iptables TCP redirects"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "예",
      "no": "아니오",
      "failed": "실패",
-      "risky": "확인 필요",
      "completed": "완료",
      "disallowedIsp": "허용되지 않는 ISP",
      "originalsOnly": "오리지널만",
@@ -495,13 +495,11 @@
        "strictRoute": "Rota Estrita",
        "autoDetectInterface": "Detectar Interface Automaticamente",
        "dnsHijack": "Sequestro de DNS",
-        "dnsMode": "Modo DNS",
        "mtu": "Unidade Máxima de Transmissão",
        "autoRedirect": "Redirecionamento Automático"
      },
      "tooltips": {
        "dnsHijack": "Use , para separar vários servidores DNS",
-        "dnsMode": "Auto mantém o comportamento antigo; hijack requer Rota Estrita no Windows ou Redirecionamento Automático no Linux",
        "autoRedirect": "Configura automaticamente os redirecionamentos TCP do nftables/iptables"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "Sim",
      "no": "Não",
      "failed": "Falhou",
-      "risky": "Incerto",
      "completed": "Concluído",
      "disallowedIsp": "ISP não permitido",
      "originalsOnly": "Somente originais",
@@ -495,13 +495,11 @@
        "strictRoute": "Строгая маршрутизация",
        "autoDetectInterface": "Автоопределение интерфейса",
        "dnsHijack": "Перехват DNS",
-        "dnsMode": "Режим DNS",
        "mtu": "MTU",
        "autoRedirect": "Автоматическое перенаправление"
      },
      "tooltips": {
        "dnsHijack": "Используйте запятую для разделения нескольких DNS-серверов",
-        "dnsMode": "Auto сохраняет прежнее поведение; для hijack нужна Строгая маршрутизация в Windows или Автоматическое перенаправление в Linux",
        "autoRedirect": "Автоматически настраивает перенаправление TCP через nftables/iptables"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "Да",
      "no": "Нет",
      "failed": "Ошибка",
-      "risky": "Неясно",
      "completed": "Завершено",
      "disallowedIsp": "Провайдер заблокирован",
      "originalsOnly": "Только Originals",
@@ -495,13 +495,11 @@
        "strictRoute": "Katı Yönlendirme",
        "autoDetectInterface": "Arayüzü Otomatik Algıla",
        "dnsHijack": "DNS Ele Geçirme",
-        "dnsMode": "DNS Modu",
        "mtu": "Maksimum İletim Birimi",
        "autoRedirect": "Otomatik Yönlendirme"
      },
      "tooltips": {
        "dnsHijack": "Birden fazla DNS sunucusunu ayırmak için lütfen , kullanın",
-        "dnsMode": "Auto eski davranışı korur; hijack için Windows'ta Katı Yönlendirme veya Linux'ta Otomatik Yönlendirme gerekir",
        "autoRedirect": "nftables/iptables TCP yönlendirmelerini otomatik olarak yapılandırır"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "Evet",
      "no": "Hayır",
      "failed": "Başarısız",
-      "risky": "Belirsiz",
      "completed": "Tamamlandı",
      "disallowedIsp": "İzin Verilmeyen ISP",
      "originalsOnly": "Yalnızca Orijinaller",
@@ -495,13 +495,11 @@
        "strictRoute": "Катгый маршрутлау",
        "autoDetectInterface": "Интерфейсны автоматик ачыклау",
        "dnsHijack": "DNS'ны үзгәртеп тоту (hijack)",
-        "dnsMode": "DNS режиме",
        "mtu": "MTU (макс. тапшыру берәмлеге)",
        "autoRedirect": "Auto Redirect"
      },
      "tooltips": {
        "dnsHijack": "Please use , to separate multiple DNS servers",
-        "dnsMode": "Auto иске тәртипне саклый; hijack өчен Windows'ta Катгый маршрутлау яки Linux'ta Auto Redirect кирәк",
        "autoRedirect": "Automatically configures nftables/iptables TCP redirects"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "Yes",
      "no": "No",
      "failed": "Failed",
-      "risky": "Билгесез",
      "completed": "Completed",
      "disallowedIsp": "Disallowed ISP",
      "originalsOnly": "Originals Only",
@@ -495,13 +495,11 @@
        "strictRoute": "严格路由",
        "autoDetectInterface": "自动选择流量出口接口",
        "dnsHijack": "DNS 劫持",
-        "dnsMode": "DNS 模式",
        "mtu": "最大传输单元",
        "autoRedirect": "自动重定向"
      },
      "tooltips": {
        "dnsHijack": "多个 DNS 服务器请使用 , 分隔",
-        "dnsMode": "Auto 保持旧行为；hijack 需 Windows 开启严格路由或 Linux 开启自动重定向",
        "autoRedirect": "自动配置 nftables/iptables 的 TCP 重定向"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "支持",
      "no": "不支持",
      "failed": "测试失败",
-      "risky": "存疑",
      "completed": "检测完成",
      "disallowedIsp": "不允许的 ISP",
      "originalsOnly": "仅限原创",
@@ -495,13 +495,11 @@
        "strictRoute": "嚴格路由",
        "autoDetectInterface": "自動偵測流量輸出介面",
        "dnsHijack": "DNS 綁架",
-        "dnsMode": "DNS 模式",
        "mtu": "最大傳輸單位",
        "autoRedirect": "自動重導"
      },
      "tooltips": {
        "dnsHijack": "請用半形逗號來區隔多個 DNS 伺服器",
-        "dnsMode": "Auto 保持舊行為；hijack 需 Windows 開啟嚴格路由或 Linux 開啟自動重導",
        "autoRedirect": "自動配置 nftables/iptables 的 TCP 重導"
      },
      "messages": {
@@ -36,7 +36,6 @@
      "yes": "支援",
      "no": "不支援",
      "failed": "測試失敗",
-      "risky": "存疑",
      "completed": "檢測完成",
      "disallowedIsp": "不允許的網際網路服務供應商",
      "originalsOnly": "僅限原創",
@@ -55,7 +55,7 @@ const wrapCssInjectionWithScope = (css?: string) => {
    return null
  }
  const scopeRoot = CSS_INJECTION_SCOPE_ROOT
-  const scopeLimit = `${CSS_INJECTION_SCOPE_LIMIT} > *`
+  const scopeLimit = CSS_INJECTION_SCOPE_LIMIT
  const scopedBlock = `@scope (${scopeRoot}) to (${scopeLimit}) {
 ${css}
 }`
@@ -40,7 +40,6 @@ const STATUS_LABEL_KEYS: Record<string, string> = {
  Yes: 'tests.statuses.test.yes',
  No: 'tests.statuses.test.no',
  Failed: 'tests.statuses.test.failed',
-  Risky: 'tests.statuses.test.risky',
  Completed: 'tests.statuses.test.completed',
  'Disallowed ISP': 'tests.statuses.test.disallowedIsp',
  'Originals Only': 'tests.statuses.test.originalsOnly',
@@ -197,7 +196,7 @@ const UnlockPage = () => {
    if (status === 'Pending') return 'default'
    if (status === 'Yes') return 'success'
    if (status === 'No') return 'error'
-    if (status === 'Soon' || status === 'Risky') return 'warning'
+    if (status === 'Soon') return 'warning'
    if (status.includes('Failed')) return 'error'
    if (status === 'Completed') return 'info'
    if (
@@ -223,8 +222,7 @@ const UnlockPage = () => {
  const getStatusBorderColor = (status: string) => {
    if (status === 'Yes') return theme.palette.success.main
    if (status === 'No') return theme.palette.error.main
-    if (status === 'Soon' || status === 'Risky')
-      return theme.palette.warning.main
+    if (status === 'Soon') return theme.palette.warning.main
    if (status.includes('Failed')) return theme.palette.error.main
    if (status === 'Completed') return theme.palette.info.main
    return theme.palette.divider
@@ -43,11 +43,7 @@ export const getWebdavStatus = (signature: string): WebdavStatus => {
 }

 export const setWebdavStatus = (signature: string, status: WebdavStatus) => {
-  if (!canUseStorage()) return
-  if (!signature) {
-    localStorage.removeItem(WEBDAV_STATUS_KEY)
-    return
-  }
+  if (!signature || !canUseStorage()) return

  const payload: WebdavStatusCache = {
    signature,
@@ -704,11 +704,9 @@ export const translationKeys = [
  'settings.modals.tun.fields.strictRoute',
  'settings.modals.tun.fields.autoDetectInterface',
  'settings.modals.tun.fields.dnsHijack',
-  'settings.modals.tun.fields.dnsMode',
  'settings.modals.tun.fields.mtu',
  'settings.modals.tun.fields.autoRedirect',
  'settings.modals.tun.tooltips.dnsHijack',
-  'settings.modals.tun.tooltips.dnsMode',
  'settings.modals.tun.tooltips.autoRedirect',
  'settings.modals.tun.messages.applied',
  'settings.modals.tun.messages.invalidRouteExcludeAddress',
@@ -1190,7 +1190,6 @@ export interface TranslationResources {
            autoRoute: string
            device: string
            dnsHijack: string
-            dnsMode: string
            mtu: string
            routeExcludeAddress: string
            stack: string
@@ -1205,7 +1204,6 @@ export interface TranslationResources {
          tooltips: {
            autoRedirect: string
            dnsHijack: string
-            dnsMode: string
          }
        }
        update: {
@@ -40,7 +40,6 @@ interface IConfigData {
    'auto-redirect'?: boolean
    'auto-detect-interface': boolean
    'dns-hijack': string[]
-    'dns-mode'?: string
    'route-exclude-address'?: string[]
    'strict-route': boolean
    mtu: number
@@ -14,9 +14,7 @@ export default defineConfig({
    legacy({
      modernTargets: ['edge>=109', 'safari>=14'],
      renderLegacyChunks: false,
-      // Auto-detected from the emitted bundle, dependencies included,
-      // so post-Safari-14 APIs never depend on extending a manual list.
-      modernPolyfills: true,
+      modernPolyfills: ['es.object.has-own', 'web.structured-clone'],
      additionalModernPolyfills: [
        path.resolve('./src/polyfills/matchMedia.js'),
        path.resolve('./src/polyfills/WeakRef.js'),