up 7.21.2

Fix bind interface handling in desktop and sing-box (#9258 )
* Fix desktop bind interface setting * Fix sing-box bind interface config * Update CoreConfigSingboxServiceTests.cs --------- Co-authored-by: 2dust <31833384+2dust@users.noreply.github.com>
2026-05-18 08:34:35 +03:00 · 2026-05-08 20:11:01 +08:00 · 2026-05-08 19:34:25 +08:00 · 2026-05-08 19:13:05 +08:00 · 2026-05-08 19:12:09 +08:00 · 2026-05-07 10:11:41 +08:00
193 changed files with 15849 additions and 7105 deletions
@@ -7,13 +7,16 @@ on:
        required: false
        type: string

+permissions: 
+  actions: write
+
 jobs:
  update:
    runs-on: ubuntu-latest
    steps:

      - name: Trigger build windows
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
        run: |
          curl -X POST \
            -H "Accept: application/vnd.github.v3+json" \
@@ -22,12 +25,12 @@ jobs:
            -d "{
              \"ref\": \"master\",
              \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
              }
            }"

      - name: Trigger build linux
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
        run: |
          curl -X POST \
            -H "Accept: application/vnd.github.v3+json" \
@@ -36,12 +39,12 @@ jobs:
            -d "{
              \"ref\": \"master\",
              \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
              }
            }"

      - name: Trigger build osx
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
        run: |
          curl -X POST \
            -H "Accept: application/vnd.github.v3+json" \
@@ -50,12 +53,12 @@ jobs:
            -d "{
              \"ref\": \"master\",
              \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
              }
            }"

      - name: Trigger build windows desktop
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
        run: |
          curl -X POST \
            -H "Accept: application/vnd.github.v3+json" \
@@ -64,6 +67,6 @@ jobs:
            -d "{
              \"ref\": \"master\",
              \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
              }
-            }"
+            }"
@@ -9,118 +9,153 @@ on:
  push:
    branches:
      - master
-    tags:
-      - 'v*'
-      - 'V*'

 permissions:
  contents: write

-env:
-  OutputArch: "linux-64"
-  OutputArchArm: "linux-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/linux-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/linux-arm64"
-
 jobs:
  build:
-    strategy:
-      matrix:
-        configuration: [Release]
+    uses: ./.github/workflows/build.yml
+    with:
+      target: linux
+
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: linux
+      release_tag: ${{ inputs.release_tag }}
+
+  deb:
+    name: build and release deb x64 & arm64
+    if: |
+      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
    runs-on: ubuntu-24.04
+    container: debian:13
+    env:
+      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}

    steps:
-    - name: Checkout
-      uses: actions/checkout@v6.0.1
+    - name: Prepare tools (Debian)
+      shell: bash
+      run: |
+        set -euo pipefail
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update
+        apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file \
+                           ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev \
+                           libc6 libgcc-s1 libstdc++6 zlib1g libicu-dev libssl-dev
+
+    - name: Checkout repo (for scripts)
+      uses: actions/checkout@v6.0.2
      with:
        submodules: 'recursive'
        fetch-depth: '0'

-    - name: Setup .NET
-      uses: actions/setup-dotnet@v5.0.1
-      with:
-        dotnet-version: '8.0.x'
+    - name: Ensure script permissions
+      run: chmod 755 package-debian.sh

-    - name: Build
+    - name: Package DEB (Debian-family)
+      run: ./package-debian.sh "${RELEASE_TAG}" --arch all
+
+    - name: Collect DEBs into workspace
      run: |
-        cd v2rayN
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r linux-x64   -p:SelfContained=true -o "$OutputPath64"
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r linux-arm64 -p:SelfContained=true -o "$OutputPathArm64"
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r linux-x64   -p:SelfContained=true -p:PublishTrimmed=true -o "$OutputPath64"
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r linux-arm64 -p:SelfContained=true -p:PublishTrimmed=true -o "$OutputPathArm64"
+        mkdir -p "$GITHUB_WORKSPACE/dist/deb"
+        rsync -av "$HOME/debbuild/" "$GITHUB_WORKSPACE/dist/deb/" || true
+        find "$GITHUB_WORKSPACE/dist/deb" -name "v2rayn_*_amd64.deb" \
+          -exec mv {} "$GITHUB_WORKSPACE/dist/deb/v2rayN-linux-64.deb" \; || true
+        find "$GITHUB_WORKSPACE/dist/deb" -name "v2rayn_*_arm64.deb" \
+          -exec mv {} "$GITHUB_WORKSPACE/dist/deb/v2rayN-linux-arm64.deb" \; || true
+        echo "==== Dist tree ===="
+        ls -R "$GITHUB_WORKSPACE/dist/deb" || true

-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v6.0.0
-      with:
-        name: v2rayN-linux
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/linux*
-
-    # release debian package
-    - name: Package debian
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-debian.sh
-        ./package-debian.sh "$OutputArch" "$OutputPath64" "${{ github.event.inputs.release_tag }}"
-        ./package-debian.sh "$OutputArchArm" "$OutputPathArm64" "${{ github.event.inputs.release_tag }}"
-
-    - name: Upload deb to release
+    - name: Upload DEBs to release
      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
      with:
-        file: ${{ github.workspace }}/v2rayN*.deb
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
-
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh "$OutputArch" "$OutputPath64"
-        ./package-release-zip.sh "$OutputArchArm" "$OutputPathArm64"
-    
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
+        file: dist/deb/**/*.deb
+        tag: ${{ env.RELEASE_TAG }}
        file_glob: true
        prerelease: true

  rpm:
-    needs: build
+    name: build and release rpm x64 & arm64
    if: |
-      (github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag != '') ||
+      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
    runs-on: ubuntu-24.04
-    container:
-      image: registry.access.redhat.com/ubi10/ubi
+    container: registry.access.redhat.com/ubi10/ubi
    env:
-      RELEASE_TAG: ${{ github.event.inputs.release_tag != '' && github.event.inputs.release_tag || github.ref_name }}
+      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}

    steps:
    - name: Prepare tools (Red Hat)
+      shell: bash
      run: |
-        dnf repolist all
-        dnf -y makecache
-        dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm
-        dnf -y install sudo git rpm-build rpmdevtools dnf-plugins-core rsync findutils tar gzip unzip which
+        set -euo pipefail
+
+        . /etc/os-release
+        EL_MAJOR="${VERSION_ID%%.*}"
+        echo "EL_MAJOR=${EL_MAJOR}"
+
+        dnf -y makecache || true
+        command -v curl >/dev/null || dnf -y install curl ca-certificates
+
+        ARCH="$(uname -m)"
+        case "$ARCH" in x86_64|aarch64) ;; *) echo "Unsupported arch: $ARCH"; exit 1 ;; esac
+
+        install_epel_from_dir() {
+          local base="$1" rpm
+          echo "Try: $base"
+
+          rpm="$(
+            {
+              curl -fsSL "$base/Packages/"   2>/dev/null
+              curl -fsSL "$base/Packages/e/" 2>/dev/null | sed 's|href="|href="e/|'
+            } |
+            sed -n 's/.*href="\([^"]*epel-release-[^"]*\.noarch\.rpm\)".*/\1/p' |
+            sort -V | tail -n1
+          )" || true
+
+          if [[ -n "$rpm" ]]; then
+            dnf -y install "$base/Packages/$rpm"
+            return 0
+          fi
+          return 1
+        }
+
+        FEDORA="https://dl.fedoraproject.org/pub/epel/epel-release-latest-${EL_MAJOR}.noarch.rpm"
+        echo "Try Fedora: $FEDORA"
+
+        if curl -fsSLI "$FEDORA" >/dev/null; then
+          dnf -y install "$FEDORA"
+        else
+          ROCKY="https://dl.rockylinux.org/pub/rocky/${EL_MAJOR}/extras/${ARCH}/os"
+          if install_epel_from_dir "$ROCKY"; then
+            :
+          else
+            ALMA="https://repo.almalinux.org/almalinux/${EL_MAJOR}/extras/${ARCH}/os"
+            if install_epel_from_dir "$ALMA"; then
+              :
+            else
+              echo "EPEL bootstrap failed (Fedora/Rocky/Alma)"
+              exit 1
+            fi
+          fi
+        fi
+
+        dnf -y install sudo git rpm-build rpmdevtools dnf-plugins-core \
+                       rsync findutils tar gzip unzip which
+
+        dnf repolist | grep -i epel || true

    - name: Checkout repo (for scripts)
-      uses: actions/checkout@v6.0.1
+      uses: actions/checkout@v6.0.2
      with:
        submodules: 'recursive'
        fetch-depth: '0'

-    - name: Restore build artifacts
-      uses: actions/download-artifact@v7
-      with:
-        name: v2rayN-linux
-        path: ${{ github.workspace }}/v2rayN/Release
-
    - name: Ensure script permissions
      run: chmod 755 package-rhel.sh

@@ -136,12 +171,6 @@ jobs:
        echo "==== Dist tree ===="
        ls -R "$GITHUB_WORKSPACE/dist/rpm" || true

-    - name: Upload RPM artifacts
-      uses: actions/upload-artifact@v6.0.0
-      with:
-        name: v2rayN-rpm
-        path: dist/rpm/**/*.rpm
-
    - name: Upload RPMs to release
      uses: svenstaro/upload-release-action@v2
      with:
@@ -149,3 +178,76 @@ jobs:
        tag: ${{ env.RELEASE_TAG }}
        file_glob: true
        prerelease: true
+
+  rpm-riscv64:
+    name: build and release rpm riscv64
+    if: |
+      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-24.04-riscv
+    container: rockylinux/rockylinux:10
+    env:
+      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
+
+    steps:
+    - name: Prepare tools (Red Hat)
+      shell: bash
+      run: |
+        set -euo pipefail
+        dnf -y makecache
+        dnf -y install \
+          sudo git rpm-build rpmdevtools dnf-plugins-core \
+          rsync findutils tar gzip unzip which jq
+
+    - name: Checkout repo (for scripts)
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        rm -rf ./*
+        git init .
+        git config --global --add safe.directory "$PWD"
+        git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+        git fetch --depth=1 origin "${GITHUB_SHA}"
+        git checkout FETCH_HEAD
+        git submodule update --init --recursive
+
+    - name: Ensure script permissions
+      run: chmod 755 package-rhel-riscv.sh
+
+    - name: Package RPM (RHEL-family)
+      run: ./package-rhel-riscv.sh "${RELEASE_TAG}"
+
+    - name: Collect RPMs into workspace
+      run: |
+        mkdir -p "$GITHUB_WORKSPACE/dist/rpm-riscv64"
+        rsync -av "$HOME/rpmbuild/RPMS/" "$GITHUB_WORKSPACE/dist/rpm-riscv64/" || true
+        find "$GITHUB_WORKSPACE/dist/rpm-riscv64" -name "*.riscv64.rpm" \
+          -exec mv {} "$GITHUB_WORKSPACE/dist/rpm-riscv64/v2rayN-linux-rhel-riscv64.rpm" \; || true
+        echo "==== Dist tree ===="
+        ls -R "$GITHUB_WORKSPACE/dist/rpm-riscv64" || true
+
+    - name: Upload RPMs to release
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        shopt -s globstar nullglob
+
+        files=(dist/rpm-riscv64/**/*.rpm)
+        (( ${#files[@]} )) || { echo "No RPMs found."; exit 1; }
+
+        api="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}"
+        upload_url="$(curl -fsSL -H "Authorization: Bearer ${GITHUB_TOKEN}" "$api" | jq -r '.upload_url // empty' | sed 's/{?name,label}//')"
+        [[ "$upload_url" ]] || { echo "Release upload URL not found: ${RELEASE_TAG}"; exit 1; }
+
+        for f in "${files[@]}"; do
+          echo "Uploading ${f##*/}"
+          curl -fsSL -X POST \
+            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$f" \
+            "${upload_url}?name=${f##*/}"
+        done
@@ -10,78 +10,65 @@ on:
    branches:
      - master

-env:
-  OutputArch: "macos-64"
-  OutputArchArm: "macos-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/macos-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/macos-arm64"
+permissions:
+  contents: write

 jobs:
  build:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: macos
+
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: macos
+      release_tag: ${{ inputs.release_tag }}
+    
+  dmg:
+    name: package and release macOS dmg
+    if: inputs.release_tag != ''
+    needs: build
    strategy:
      matrix:
-        configuration: [Release]
-
+        arch: [ x64, arm64 ]
    runs-on: macos-latest
-
+    env:
+      Arch: |-
+        ${{
+          case(
+            matrix.arch == 'x64', '64',
+            matrix.arch
+          ) 
+        }} 
    steps:
    - name: Checkout
-      uses: actions/checkout@v6.0.1
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'
+      uses: actions/checkout@v6.0.2

-    - name: Setup
-      uses: actions/setup-dotnet@v5.0.1
+    - name: Restore build artifacts
+      uses: actions/download-artifact@v8
      with:
-        dotnet-version: '8.0.x'
-
-    - name: Build
-      run: |
-        cd v2rayN 
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r osx-x64   -p:SelfContained=true -o $OutputPath64
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r osx-arm64 -p:SelfContained=true -o $OutputPathArm64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r osx-x64   -p:SelfContained=true -p:PublishTrimmed=true -o $OutputPath64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r osx-arm64 -p:SelfContained=true -p:PublishTrimmed=true -o $OutputPathArm64
-
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v6.0.0
-      with:
-        name: v2rayN-macos
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/macos*
+        name: ${{ matrix.arch }}
+        path: v2rayN-macos-${{ env.Arch }}
    
-    # release osx package
-    - name: Package osx
-      if: github.event.inputs.release_tag != ''
-      run: |
-        brew install create-dmg
-        chmod 755 package-osx.sh
-        ./package-osx.sh $OutputArch $OutputPath64 ${{ github.event.inputs.release_tag }}
-        ./package-osx.sh $OutputArchArm $OutputPathArm64 ${{ github.event.inputs.release_tag }}
+    - name: Setup create-dmg
+      run: brew install create-dmg
+
+    - name: Ensure script permissions
+      run: chmod 755 package-osx.sh
+
+    - name: Package dmg
+      run: ./package-osx.sh macos-$Arch v2rayN-macos-$Arch ${{ inputs.release_tag }}
+
+    - name: Sleep for race condition between matrix jobs
+      run: sleep $(awk 'BEGIN { srand(); printf "%.3f", rand()*2 }')
    
    - name: Upload dmg to release
      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
      with:
        file: ${{ github.workspace }}/v2rayN*.dmg
-        tag: ${{ github.event.inputs.release_tag }}
+        tag: ${{ inputs.release_tag }}
        file_glob: true
        prerelease: true
-
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh $OutputArch $OutputPath64
-        ./package-release-zip.sh $OutputArchArm $OutputPathArm64
-    
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
@@ -10,62 +10,19 @@ on:
    branches:
      - master

-env:
-  OutputArch: "windows-64"
-  OutputArchArm: "windows-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/windows-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/windows-arm64"
+permissions:
+  contents: write

 jobs:
  build:
-    strategy:
-      matrix:
-        configuration: [Release]
+    uses: ./.github/workflows/build.yml
+    with:
+      target: windows

-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v6.0.1
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'
-
-    - name: Setup
-      uses: actions/setup-dotnet@v5.0.1
-      with:
-        dotnet-version: '8.0.x'
-
-    - name: Build
-      run: |
-        cd v2rayN 
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPath64
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPathArm64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPath64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPathArm64
-
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v6.0.0
-      with:
-        name: v2rayN-windows-desktop
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/windows*
-
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh $OutputArch $OutputPath64
-        mv "v2rayN-${OutputArch}.zip" "v2rayN-${OutputArch}-desktop.zip"
-        ./package-release-zip.sh $OutputArchArm $OutputPathArm64
-        mv "v2rayN-${OutputArchArm}.zip" "v2rayN-${OutputArchArm}-desktop.zip"
-
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: windows-desktop
+      release_tag: ${{ inputs.release_tag }}
@@ -10,62 +10,20 @@ on:
    branches:
      - master

-env:
-  OutputArch: "windows-64"
-  OutputArchArm: "windows-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/windows-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/windows-arm64"
-  OutputPath64Sc:  "${{ github.workspace }}/v2rayN/Release/windows-64-SelfContained"
+permissions:
+  contents: write

 jobs:
  build:
-    strategy:
-      matrix:
-        configuration: [Release]
+    uses: ./.github/workflows/build.yml
+    with:
+      target: windows
+      project: ./v2rayN/v2rayN.csproj

-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v6.0.1
-
-    - name: Setup
-      uses: actions/setup-dotnet@v5.0.1
-      with:
-        dotnet-version: '8.0.x'
-
-    - name: Build
-      run: |
-        cd v2rayN 
-        dotnet publish ./v2rayN/v2rayN.csproj     -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPath64
-        dotnet publish ./v2rayN/v2rayN.csproj     -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPathArm64
-        dotnet publish ./v2rayN/v2rayN.csproj     -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPath64Sc
-        dotnet publish ./AmazTool/AmazTool.csproj -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPath64
-        dotnet publish ./AmazTool/AmazTool.csproj -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPathArm64
-        dotnet publish ./AmazTool/AmazTool.csproj -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPath64Sc
-
-  
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v6.0.0
-      with:
-        name: v2rayN-windows
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/windows*
-    
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh $OutputArch $OutputPath64
-        ./package-release-zip.sh $OutputArchArm $OutputPathArm64
-        ./package-release-zip.sh "windows-64-SelfContained" $OutputPath64Sc
-    
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: windows
+      release_tag: ${{ inputs.release_tag }}
@@ -0,0 +1,71 @@
+name: build
+
+on:
+  workflow_call:
+    inputs:
+      target: # windows linux macos
+        required: true
+        type: string
+      project:
+        required: false
+        type: string
+        default: './v2rayN.Desktop/v2rayN.Desktop.csproj'
+
+jobs:
+  build:
+    name: build x64 arm64
+    strategy:
+      matrix:
+        arch: [ x64, arm64 ]
+    runs-on: |-
+      ${{
+        case(
+          inputs.target == 'macos', 'macos-latest',
+          inputs.target == 'linux', 'ubuntu-24.04',
+          'ubuntu-latest'
+        )
+      }}
+    env:
+      Output: "${{ github.workspace }}/${{ matrix.arch }}"
+      RID: |-
+        ${{
+          case(
+            inputs.target == 'macos', format('osx-{0}', matrix.arch),
+            inputs.target == 'windows', format('win-{0}', matrix.arch),
+            format('{0}-{1}', inputs.target, matrix.arch)
+          )
+        }}
+      Project: ${{ inputs.project }}
+      ExtOpt: |-
+        ${{
+          case(
+            inputs.target == 'windows', '-p:EnableWindowsTargeting=true',
+            ''
+          )
+        }}
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6.0.2
+      with:
+        submodules: 'recursive'
+        fetch-depth: '0'
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5.2.0
+      with:
+        dotnet-version: '8.0.x'
+
+    - name: Build v2rayN
+      working-directory: ./v2rayN
+      run: dotnet publish $Project -c Release -r $RID -p:SelfContained=true $ExtOpt -o $Output
+
+    - name: Build AmazTool
+      working-directory: ./v2rayN
+      run: dotnet publish ./AmazTool/AmazTool.csproj -c Release -r $RID -p:SelfContained=true -p:PublishTrimmed=true $ExtOpt -o $Output
+
+    - name: Upload build artifacts
+      uses: actions/upload-artifact@v7.0.1
+      with:
+        name: ${{ matrix.arch }}
+        path: ${{ matrix.arch }}
@@ -0,0 +1,67 @@
+name: package and release Zip
+
+on:
+  workflow_call:
+    inputs:
+      release_tag:
+        required: true
+        type: string
+      target: # windows linux macos windows-desktop
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  package:
+    name: package x64 arm64
+    strategy:
+      matrix:
+        arch: [ x64, arm64 ]
+    runs-on: ubuntu-latest
+    env:
+      Target: |- 
+        ${{
+          case(
+            inputs.target == 'windows-desktop', 'windows',
+            inputs.target
+          )
+        }}
+      Arch: |-
+        ${{
+          case(
+            matrix.arch == 'x64', '64',
+            matrix.arch
+          ) 
+        }}
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6.0.2
+
+    - name: Restore build artifacts
+      uses: actions/download-artifact@v8
+      with:
+        name: ${{ matrix.arch }}
+        path: v2rayN-${{ env.Target }}-${{ env.Arch }}
+    
+    - name: Get v2rayN-core-bin
+      run: wget -nv -O v2rayN-$Target-$Arch.zip "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/v2rayN-$Target-$Arch.zip"
+    
+    - name: Package zip archive
+      run: 7z a -tZip v2rayN-$Target-$Arch.zip v2rayN-$Target-$Arch -mx1
+
+    - name: Rename windows-desktop 
+      if: inputs.target == 'windows-desktop'
+      run: mv "v2rayN-$Target-$Arch.zip" "v2rayN-$Target-$Arch-desktop.zip"
+    
+    - name: Sleep for race condition between matrix jobs
+      run: sleep $(awk 'BEGIN { srand(); printf "%.3f", rand()*2 }')
+
+    - name: Upload zip archive to release
+      uses: svenstaro/upload-release-action@v2
+      with:
+        file: ${{ github.workspace }}/v2rayN*.zip
+        tag: ${{ inputs.release_tag }}
+        file_glob: true
+        prerelease: true
@@ -0,0 +1,29 @@
+name: Code Test
+
+on:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - 'v2rayN/ServiceLib/Services/CoreConfig/**'
+      - 'v2rayN/ServiceLib/Handler/Fmt/**'
+      - '.github/workflows/test.yml'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6.0.2
+      with:
+        submodules: 'recursive'
+        fetch-depth: '0'
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5.2.0
+      with:
+        dotnet-version: '8.0.x'
+
+    - name: Test Code
+      working-directory: ./v2rayN
+      run: dotnet test ./ServiceLib.Tests
@@ -1,69 +1,612 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -euo pipefail

-Arch="$1"
-OutputPath="$2"
-Version="$3"
+# Require Debian base branch
+. /etc/os-release

-FileName="v2rayN-${Arch}.zip"
-wget -nv -O $FileName "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/$FileName"
-7z x $FileName
-cp -rf v2rayN-${Arch}/* $OutputPath
+case "${ID:-}" in
+  debian)
+    echo "Detected supported system: ${NAME:-$ID} ${VERSION_ID:-}"
+    ;;
+  *)
+    echo "Unsupported system: ${NAME:-unknown} (${ID:-unknown})."
+    echo "This script only supports: Debian."
+    exit 1
+    ;;
+esac

-PackagePath="v2rayN-Package-${Arch}"
-mkdir -p "${PackagePath}/DEBIAN"
-mkdir -p "${PackagePath}/opt"
-cp -rf $OutputPath "${PackagePath}/opt/v2rayN"
-echo "When this file exists, app will not store configs under this folder" > "${PackagePath}/opt/v2rayN/NotStoreConfigHere.txt"
+# Kernel version
+MIN_KERNEL="6.11"
+CURRENT_KERNEL="$(uname -r)"

-if [ $Arch = "linux-64" ]; then
-    Arch2="amd64" 
+lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$CURRENT_KERNEL" | sort -V | head -n1)"
+
+if [[ "$lowest" != "$MIN_KERNEL" ]]; then
+    echo "Kernel $CURRENT_KERNEL is below $MIN_KERNEL"
+    exit 1
+fi
+
+echo "[OK] Kernel $CURRENT_KERNEL verified."
+
+# Config & Parse arguments
+VERSION_ARG="${1:-}"     # Pass version number like 7.13.8, or leave empty
+WITH_CORE="both"         # Default: bundle both xray+sing-box
+FORCE_NETCORE=0          # --netcore => skip archive bundle, use separate downloads
+ARCH_OVERRIDE=""         # --arch x64|arm64|all (optional compile target)
+BUILD_FROM=""            # --buildfrom 1|2|3 to select channel non-interactively
+
+# If the first argument starts with --, do not treat it as a version number
+if [[ "${VERSION_ARG:-}" == --* ]]; then
+  VERSION_ARG=""
+fi
+# Take the first non --* argument as version, discard it
+if [[ -n "${VERSION_ARG:-}" ]]; then shift || true; fi
+
+# Parse remaining optional arguments
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --with-core)     WITH_CORE="${2:-both}"; shift 2;;
+    --xray-ver)      XRAY_VER="${2:-}"; shift 2;;
+    --singbox-ver)   SING_VER="${2:-}"; shift 2;;
+    --netcore)       FORCE_NETCORE=1; shift;;
+    --arch)          ARCH_OVERRIDE="${2:-}"; shift 2;;
+    --buildfrom)     BUILD_FROM="${2:-}"; shift 2;;
+    *)
+      if [[ -z "${VERSION_ARG:-}" ]]; then VERSION_ARG="$1"; fi
+      shift;;
+  esac
+done
+
+# Conflict: version number AND --buildfrom cannot be used together
+if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+  echo "You cannot specify both an explicit version and --buildfrom at the same time."
+  echo "        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  exit 1
+fi
+
+# Check and install dependencies
+host_arch="$(uname -m)"
+[[ "$host_arch" == "aarch64" || "$host_arch" == "x86_64" ]] || { echo "Only supports aarch64 / x86_64"; exit 1; }
+
+install_ok=0
+
+if command -v apt-get >/dev/null 2>&1; then
+  sudo apt-get update
+  sudo apt-get -y install \
+    curl unzip tar jq rsync ca-certificates git dpkg-dev fakeroot file \
+    desktop-file-utils xdg-utils wget
+
+  if [[ "$host_arch" == "aarch64" ]]; then
+    sudo dpkg --add-architecture amd64 || true
+    sudo apt-get update
+    sudo apt-get -y install \
+      libc6:amd64 libgcc-s1:amd64 libstdc++6:amd64 zlib1g:amd64 libfontconfig1:amd64
+  elif [[ "$host_arch" == "x86_64" ]]; then
+    sudo dpkg --add-architecture arm64 || true
+    sudo apt-get update
+    sudo apt-get -y install \
+      libc6:arm64 libgcc-s1:arm64 libstdc++6:arm64 zlib1g:arm64 libfontconfig1:arm64
+  fi
+
+  # Install .NET SDK 8 via official script
+  wget -q https://dot.net/v1/dotnet-install.sh
+  chmod +x dotnet-install.sh
+  ./dotnet-install.sh --channel 8.0 --install-dir "$HOME/.dotnet"
+
+  export PATH="$HOME/.dotnet:$PATH"
+  export DOTNET_ROOT="$HOME/.dotnet"
+
+  dotnet --info >/dev/null 2>&1 && install_ok=1
+fi
+
+if [[ "$install_ok" -ne 1 ]]; then
+  echo "Could not auto-install dependencies for '$ID'. Make sure these are available:"
+  echo "dotnet-sdk 8.x, curl, unzip, tar, rsync, git, dpkg-deb, desktop-file-utils, xdg-utils"
+  exit 1
+fi
+
+# Root directory
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+# Git submodules (best effort)
+if [[ -f .gitmodules ]]; then
+  git submodule sync --recursive || true
+  git submodule update --init --recursive || true
+fi
+
+# Locate project
+PROJECT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+if [[ ! -f "$PROJECT" ]]; then
+  PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+fi
+[[ -f "$PROJECT" ]] || { echo "v2rayN.Desktop.csproj not found"; exit 1; }
+
+choose_channel() {
+  # If --buildfrom provided, map it directly and skip interaction.
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0;;
+      2) echo "prerelease"; return 0;;
+      3) echo "keep"; return 0;;
+      *) echo "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." >&2; exit 1;;
+    esac
+  fi
+
+  # Print menu to stderr and read from /dev/tty so stdout only carries the token.
+  local ch="latest" sel=""
+
+  if [[ -t 0 ]]; then
+    echo "[?] Choose v2rayN release channel:" >&2
+    echo "    1) Latest (stable)  [default]" >&2
+    echo "    2) Pre-release (preview)" >&2
+    echo "    3) Keep current (do nothing)" >&2
+    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
+    if read -r sel </dev/tty; then
+      case "${sel:-}" in
+        2) ch="prerelease" ;;
+        3) ch="keep" ;;
+      esac
+    fi
+  fi
+
+  echo "$ch"
+}
+
+get_latest_tag_latest() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
+}
+
+get_latest_tag_prerelease() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
+}
+
+git_try_checkout() {
+  local want="$1" ref=""
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    git fetch --tags --force --prune --depth=1 || true
+    if git rev-parse "refs/tags/${want}" >/dev/null 2>&1; then
+      ref="${want}"
+    fi
+    if [[ -n "$ref" ]]; then
+      echo "[OK] Found ref '${ref}', checking out..."
+      git checkout -f "${ref}"
+      if [[ -f .gitmodules ]]; then
+        git submodule sync --recursive || true
+        git submodule update --init --recursive || true
+      fi
+      return 0
+    fi
+  fi
+  return 1
+}
+
+apply_channel_or_keep() {
+  local ch="$1" tag
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+  if [[ "$ch" == "prerelease" ]]; then
+    tag="$(get_latest_tag_prerelease || true)"
+  else
+    tag="$(get_latest_tag_latest || true)"
+  fi
+
+  [[ -n "$tag" ]] || { echo "Failed to resolve latest tag for channel '${ch}'."; exit 1; }
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || { echo "Failed to checkout '${tag}'."; exit 1; }
+  VERSION="${tag#v}"
+}
+
+if git rev-parse --git-dir >/dev/null 2>&1; then
+  if [[ -n "${VERSION_ARG:-}" ]]; then
+    clean_ver="${VERSION_ARG#v}"
+    if git_try_checkout "$clean_ver"; then
+      VERSION="$clean_ver"
+    else
+      echo "[WARN] Tag '${VERSION_ARG}' not found."
+      ch="$(choose_channel)"
+      apply_channel_or_keep "$ch"
+    fi
+  else
+    ch="$(choose_channel)"
+    apply_channel_or_keep "$ch"
+  fi
 else
-    Arch2="arm64"
+  echo "Current directory is not a git repo; proceeding on current tree."
+  VERSION="${VERSION_ARG:-0.0.0}"
 fi
-echo $Arch2

-# basic
-cat >"${PackagePath}/DEBIAN/control" <<-EOF
-Package: v2rayN
-Version: $Version
-Architecture: $Arch2
-Maintainer: https://github.com/2dust/v2rayN
-Depends: libc6 (>= 2.34), fontconfig (>= 2.13.1), desktop-file-utils (>= 0.26), xdg-utils (>= 1.1.3), coreutils (>= 8.32), bash (>= 5.1), libfreetype6 (>= 2.11)
-Description: A GUI client for Windows and Linux, support Xray core and sing-box-core and others
+VERSION="${VERSION#v}"
+echo "[*] GUI version resolved as: ${VERSION}"
+
+download_xray() {
+  local outdir="$1" rid="$2" ver="${XRAY_VER:-}" url tmp zipname="xray.zip"
+  mkdir -p "$outdir"
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
+        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
+  fi
+  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
+  if [[ "$rid" == "linux-arm64" ]]; then
+    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-arm64-v8a.zip"
+  else
+    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-64.zip"
+  fi
+  echo "[+] Download xray: $url"
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/$zipname"
+  unzip -q "$tmp/$zipname" -d "$tmp"
+  install -m 755 "$tmp/xray" "$outdir/xray"
+  rm -rf "$tmp"
+}
+
+download_singbox() {
+  # Download sing-box
+  local outdir="$1" rid="$2" ver="${SING_VER:-}" url tmp tarname="singbox.tar.gz" bin cronet
+  mkdir -p "$outdir"
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
+  if [[ "$rid" == "linux-arm64" ]]; then
+    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-arm64.tar.gz"
+  else
+    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-amd64.tar.gz"
+  fi
+  echo "[+] Download sing-box: $url"
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/$tarname"
+  tar -C "$tmp" -xzf "$tmp/$tarname"
+  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+  install -m 755 "$bin" "$outdir/sing-box"
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so"
+  rm -rf "$tmp"
+}
+
+unify_geo_layout() {
+  local outroot="$1"
+  mkdir -p "$outroot/bin"
+  local names=(
+    "geosite.dat"
+    "geoip.dat"
+    "geoip-only-cn-private.dat"
+    "Country.mmdb"
+    "geoip.metadb"
+  )
+  for n in "${names[@]}"; do
+    if [[ -f "$outroot/bin/xray/$n" ]]; then
+      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
+    fi
+  done
+}
+
+download_geo_assets() {
+  local outroot="$1"
+  local bin_dir="$outroot/bin"
+  local srss_dir="$bin_dir/srss"
+  mkdir -p "$bin_dir" "$srss_dir"
+
+  echo "[+] Download Xray Geo to ${bin_dir}"
+  curl -fsSL -o "$bin_dir/geosite.dat" \
+    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" \
+    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" \
+    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" \
+    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+
+  echo "[+] Download sing-box rule DB & rule-sets"
+  curl -fsSL -o "$bin_dir/geoip.metadb" \
+    "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb" || true
+
+  for f in \
+    geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs \
+    geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" \
+      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geoip/$f" || true
+  done
+
+  for f in \
+    geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs \
+    geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" \
+      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geosite/$f" || true
+  done
+
+  unify_geo_layout "$outroot"
+}
+
+download_v2rayn_bundle() {
+  local outroot="$1" rid="$2"
+  local url=""
+  if [[ "$rid" == "linux-arm64" ]]; then
+    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-arm64.zip"
+  else
+    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-64.zip"
+  fi
+  echo "[+] Try v2rayN bundle archive: $url"
+  local tmp zipname
+  tmp="$(mktemp -d)"; zipname="$tmp/v2rayn.zip"
+  curl -fL "$url" -o "$zipname" || { echo "[!] Bundle download failed"; return 1; }
+  unzip -q "$zipname" -d "$tmp" || { echo "[!] Bundle unzip failed"; return 1; }
+
+  if [[ -d "$tmp/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$tmp/bin/" "$outroot/bin/"
+  else
+    rsync -a "$tmp/" "$outroot/"
+  fi
+
+  rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
+  find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
+
+  local nested_dir
+  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$nested_dir/bin/" "$outroot/bin/"
+    rm -rf "$nested_dir"
+  fi
+
+  # Unify to bin/
+  unify_geo_layout "$outroot"
+
+  echo "[+] Bundle extracted to $outroot"
+}
+
+BUILT_DEBS=()
+BUILT_ALL=0
+OUTPUT_DIR="$HOME/debbuild"
+mkdir -p "$OUTPUT_DIR"
+
+build_for_arch() {
+  local short="$1"
+  local rid deb_arch outdir_name
+  case "$short" in
+    x64)   rid="linux-x64";   deb_arch="amd64"; outdir_name="amd64" ;;
+    arm64) rid="linux-arm64"; deb_arch="arm64"; outdir_name="arm64" ;;
+    *) echo "Unknown arch '$short' (use x64|arm64)"; return 1 ;;
+  esac
+
+  echo "[*] Building for target: $short  (RID=$rid, DEB arch=$deb_arch)"
+
+  dotnet clean "$PROJECT" -c Release
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net8.0" || true
+
+  dotnet restore "$PROJECT"
+  dotnet publish "$PROJECT" \
+    -c Release -r "$rid" \
+    -p:PublishSingleFile=false \
+    -p:SelfContained=true
+
+  local RID_DIR="$rid"
+  local PUBDIR
+  PUBDIR="$(dirname "$PROJECT")/bin/Release/net8.0/${RID_DIR}/publish"
+  [[ -d "$PUBDIR" ]] || { echo "Publish directory not found: $PUBDIR"; return 1; }
+
+  local WORKDIR PKGROOT STAGE DEBIAN_DIR
+  WORKDIR="$(mktemp -d)"
+  PKGROOT="v2rayN-publish"
+  STAGE="$WORKDIR/${PKGROOT}_${VERSION}_${deb_arch}"
+  DEBIAN_DIR="$STAGE/DEBIAN"
+
+  mkdir -p "$STAGE/opt/v2rayN"
+  mkdir -p "$STAGE/usr/bin"
+  mkdir -p "$STAGE/usr/share/applications"
+  mkdir -p "$STAGE/usr/share/icons/hicolor/256x256/apps"
+  mkdir -p "$DEBIAN_DIR"
+
+  # Stage publish content from source build
+  cp -a "$PUBDIR/." "$STAGE/opt/v2rayN/"
+
+  local ICON_CANDIDATE
+  PROJECT_DIR="$(cd "$(dirname "$PROJECT")" && pwd)"
+  ICON_CANDIDATE="$PROJECT_DIR/v2rayN.png"
+  [[ -f "$ICON_CANDIDATE" ]] && cp "$ICON_CANDIDATE" "$STAGE/usr/share/icons/hicolor/256x256/apps/v2rayn.png" || true
+
+  mkdir -p "$STAGE/opt/v2rayN/bin/xray" "$STAGE/opt/v2rayN/bin/sing_box"
+
+  fetch_separate_cores_and_rules() {
+    local outroot="$1"
+
+    if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+      download_xray "$outroot/bin/xray" "$RID_DIR" || echo "[!] xray download failed (skipped)"
+    fi
+    if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+      download_singbox "$outroot/bin/sing_box" "$RID_DIR" || echo "[!] sing-box download failed (skipped)"
+    fi
+    download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+  }
+
+  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
+    if download_v2rayn_bundle "$STAGE/opt/v2rayN" "$RID_DIR"; then
+      echo "[*] Using v2rayN bundle bin assets."
+    else
+      echo "[*] Bundle failed, fallback to separate core + rules."
+      fetch_separate_cores_and_rules "$STAGE/opt/v2rayN"
+    fi
+  else
+    echo "[*] --netcore specified: use separate core + rules."
+    fetch_separate_cores_and_rules "$STAGE/opt/v2rayN"
+  fi
+
+  # Wrapper
+  install -m 755 /dev/stdin "$STAGE/usr/bin/v2rayn" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+DIR="/opt/v2rayN"
+cd "$DIR"
+
+if [[ -x "$DIR/v2rayN" ]]; then
+  exec "$DIR/v2rayN" "$@"
+fi
+
+for dll in v2rayN.Desktop.dll v2rayN.dll; do
+  if [[ -f "$DIR/$dll" ]]; then
+    exec /usr/bin/dotnet "$DIR/$dll" "$@"
+  fi
+done
+
+echo "v2rayN launcher: no executable found in $DIR" >&2
+ls -l "$DIR" >&2 || true
+exit 1
 EOF

-cat >"${PackagePath}/DEBIAN/postinst" <<-EOF
-if [ ! -s /usr/share/applications/v2rayN.desktop ]; then
-    cat >/usr/share/applications/v2rayN.desktop<<-END
+  SHLIBS_DEPENDS=""
+  EXTRA_DEPENDS="libc6 (>= 2.34), fontconfig (>= 2.13.1), desktop-file-utils (>= 0.26), xdg-utils (>= 1.1.3), coreutils (>= 8.32), bash (>= 5.1), libfreetype6 (>= 2.11)"
+
+  mkdir -p "$WORKDIR/debian"
+  cat > "$WORKDIR/debian/control" <<EOF
+Source: v2rayn
+Section: net
+Priority: optional
+Maintainer: 2dust <noreply@github.com>
+Standards-Version: 4.7.0
+
+Package: v2rayn
+Architecture: ${deb_arch}
+Description: v2rayN
+EOF
+
+  local SYS_LIBDIR=""
+  local SYS_USRLIBDIR=""
+  multiarch="$(dpkg-architecture -a"$deb_arch" -qDEB_HOST_MULTIARCH)"
+
+  SYS_LIBDIR="/lib/$multiarch"
+  SYS_USRLIBDIR="/usr/lib/$multiarch"
+
+  : > "$DEBIAN_DIR/substvars"
+  mapfile -t ELF_FILES < <(
+    find "$STAGE/opt/v2rayN" -type f \( -name "*.so*" -o -perm -111 \) ! -name 'libcoreclrtraceptprovider.so'
+  )
+  if [[ "${#ELF_FILES[@]}" -gt 0 ]]; then
+    (
+      cd "$WORKDIR"
+      dpkg-shlibdeps \
+        -l"$STAGE/opt/v2rayN" \
+        -l"$SYS_LIBDIR" \
+        -l"$SYS_USRLIBDIR" \
+        -T"$DEBIAN_DIR/substvars" \
+        "${ELF_FILES[@]}"
+    ) >/dev/null 2>&1 || true
+  fi
+
+  SHLIBS_DEPENDS="$(sed -n 's/^shlibs:Depends=//p' "$DEBIAN_DIR/substvars" | head -n1 || true)"
+
+  if [[ -n "$SHLIBS_DEPENDS" ]]; then
+    SHLIBS_DEPENDS="$(echo "$SHLIBS_DEPENDS" \
+      | sed -E 's/ *\([^)]*\)//g' \
+      | sed -E 's/ *, */, /g' \
+      | sed -E 's/^, *//; s/, *$//')"
+    FINAL_DEPENDS="${SHLIBS_DEPENDS}, ${EXTRA_DEPENDS}"
+  else
+    FINAL_DEPENDS="${EXTRA_DEPENDS}"
+  fi
+
+  # Desktop file
+  install -m 644 /dev/stdin "$STAGE/usr/share/applications/v2rayn.desktop" <<'EOF'
 [Desktop Entry]
-Name=v2rayN
-Comment=A GUI client for Windows and Linux, support Xray core and sing-box-core and others
-Exec=/opt/v2rayN/v2rayN
-Icon=/opt/v2rayN/v2rayN.png
-Terminal=false
 Type=Application
-Categories=Network;Application;
-END
-fi
-
-update-desktop-database
+Name=v2rayN
+Comment=v2rayN for Debian GNU Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
 EOF

-sudo chmod 0755 "${PackagePath}/DEBIAN/postinst"
-sudo chmod 0755 "${PackagePath}/opt/v2rayN/v2rayN"
-sudo chmod 0755 "${PackagePath}/opt/v2rayN/AmazTool"
+  # Control file
+  cat > "$DEBIAN_DIR/control" <<EOF
+Package: v2rayn
+Version: ${VERSION}
+Architecture: ${deb_arch}
+Maintainer: 2dust <noreply@github.com>
+Homepage: https://github.com/2dust/v2rayN
+Section: net
+Priority: optional
+Depends: ${FINAL_DEPENDS}
+Description: v2rayN (Avalonia) GUI client for Linux
+ Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 /
+ Shadowsocks / tuic / WireGuard.
+EOF

-# Patch
-# set owner to root:root
-sudo chown -R root:root "${PackagePath}"
-# set all directories to 755 (readable & traversable by all users)
-sudo find "${PackagePath}/opt/v2rayN" -type d -exec chmod 755 {} +
-# set all regular files to 644 (readable by all users)
-sudo find "${PackagePath}/opt/v2rayN" -type f -exec chmod 644 {} +
-# ensure main binaries are 755 (executable by all users)
-sudo chmod 755 "${PackagePath}/opt/v2rayN/v2rayN" 2>/dev/null || true
-sudo chmod 755 "${PackagePath}/opt/v2rayN/AmazTool" 2>/dev/null || true
+  # postinst
+  install -m 755 /dev/stdin "$DEBIAN_DIR/postinst" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF

-# build deb package
-sudo dpkg-deb -Zxz --build $PackagePath
-sudo mv "${PackagePath}.deb" "v2rayN-${Arch}.deb"
+  # postrm
+  install -m 755 /dev/stdin "$DEBIAN_DIR/postrm" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF
+
+  # Normalize permissions
+  find "$STAGE/opt/v2rayN" -type d -exec chmod 0755 {} +
+  find "$STAGE/opt/v2rayN" -type f -exec chmod 0644 {} +
+  [[ -f "$STAGE/opt/v2rayN/v2rayN" ]] && chmod 0755 "$STAGE/opt/v2rayN/v2rayN" || true
+  
+  local deb_out
+  deb_out="$OUTPUT_DIR/v2rayn_${VERSION}_${deb_arch}.deb"
+
+  dpkg-deb --root-owner-group --build "$STAGE" "$deb_out"
+
+  echo "Build done for $short. DEB at:"
+  echo "  $deb_out"
+  BUILT_DEBS+=("$deb_out")
+
+  rm -rf "$WORKDIR"
+}
+
+case "${ARCH_OVERRIDE:-}" in
+  all)           targets=(x64 arm64); BUILT_ALL=1 ;;
+  x64|amd64)     targets=(x64) ;;
+  arm64|aarch64) targets=(arm64) ;;
+  "")            targets=($([[ "$host_arch" == "aarch64" ]] && echo arm64 || echo x64)) ;;
+  *)             echo "Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all."; exit 1 ;;
+esac
+
+for arch in "${targets[@]}"; do
+  build_for_arch "$arch"
+done
+
+echo ""
+echo "================ Build Summary ================="
+if [[ "${#BUILT_DEBS[@]}" -gt 0 ]]; then
+  echo "Output directory: $OUTPUT_DIR"
+  for pkg in "${BUILT_DEBS[@]}"; do
+    echo "$pkg"
+  done
+else
+  echo "No DEBs detected in summary (check build logs above)."
+fi
+echo "==============================================="
@@ -1,15 +0,0 @@
-#!/bin/bash
-
-Arch="$1"
-OutputPath="$2"
-
-OutputArch="v2rayN-${Arch}"
-FileName="v2rayN-${Arch}.zip"
-
-wget -nv -O $FileName "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/$FileName"
-
-ZipPath64="./$OutputArch"
-mkdir $ZipPath64
-
-cp -rf $OutputPath "$ZipPath64/$OutputArch"
-7z a -tZip $FileName "$ZipPath64/$OutputArch" -mx1
@@ -0,0 +1,703 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Require Red Hat base branch
+. /etc/os-release
+
+case "${ID:-}" in
+  rhel|rocky|almalinux|fedora|centos)
+    echo "Detected supported system: ${NAME:-$ID} ${VERSION_ID:-}"
+    ;;
+  *)
+    echo "Unsupported system: ${NAME:-unknown} (${ID:-unknown})."
+    echo "This script only supports: RHEL / Rocky / AlmaLinux / Fedora / CentOS."
+    exit 1
+    ;;
+esac
+
+# Kernel version
+MIN_KERNEL="5.10"
+CURRENT_KERNEL="$(uname -r)"
+
+lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$CURRENT_KERNEL" | sort -V | head -n1)"
+
+if [[ "$lowest" != "$MIN_KERNEL" ]]; then
+    echo "Kernel $CURRENT_KERNEL is below $MIN_KERNEL"
+    exit 1
+fi
+
+echo "[OK] Kernel $CURRENT_KERNEL verified."
+
+# Config & Parse arguments
+VERSION_ARG="${1:-}"     # Pass version number like 7.13.8, or leave empty
+WITH_CORE="both"         # Default: bundle both xray+sing-box
+FORCE_NETCORE=0          # --netcore => skip archive bundle, use separate downloads
+BUILD_FROM=""            # --buildfrom 1|2|3 to select channel non-interactively
+DOTNET_RISCV_VERSION="10.0.105"
+DOTNET_RISCV_BASE="https://github.com/filipnavara/dotnet-riscv/releases/download"
+DOTNET_RISCV_FILE="dotnet-sdk-${DOTNET_RISCV_VERSION}-linux-riscv64.tar.gz"
+DOTNET_SDK_URL="${DOTNET_RISCV_BASE}/${DOTNET_RISCV_VERSION}/${DOTNET_RISCV_FILE}"
+SKIA_VER="${SKIA_VER:-3.119.2}"
+HARFBUZZ_VER="${HARFBUZZ_VER:-8.3.1.1}"
+
+# If the first argument starts with --, do not treat it as a version number
+if [[ "${VERSION_ARG:-}" == --* ]]; then
+  VERSION_ARG=""
+fi
+# Take the first non --* argument as version, discard it
+if [[ -n "${VERSION_ARG:-}" ]]; then shift || true; fi
+
+# Parse remaining optional arguments
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --with-core)     WITH_CORE="${2:-both}"; shift 2;;
+    --xray-ver)      XRAY_VER="${2:-}"; shift 2;;
+    --singbox-ver)   SING_VER="${2:-}"; shift 2;;
+    --netcore)       FORCE_NETCORE=1; shift;;
+    --buildfrom)     BUILD_FROM="${2:-}"; shift 2;;
+    *)
+      if [[ -z "${VERSION_ARG:-}" ]]; then VERSION_ARG="$1"; fi
+      shift;;
+  esac
+done
+
+# Conflict: version number AND --buildfrom cannot be used together
+if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+  echo "You cannot specify both an explicit version and --buildfrom at the same time."
+  echo "        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  exit 1
+fi
+
+apply_riscv_patch() {
+  # Upgrade net8.0 -> net10.0
+  find . -type f \( -name "*.csproj" -o -name "*.props" -o -name "*.targets" \) \
+    -exec sed -i 's/net8\.0/net10.0/g' {} +
+
+  # Patch all Directory.Packages.props for SkiaSharp/HarfBuzzSharp
+  while IFS= read -r -d '' f; do
+    # replace existing versions if present
+    sed -i \
+      -e "s#<PackageVersion Include=\"SkiaSharp\" Version=\"[^\"]*\" */>#<PackageVersion Include=\"SkiaSharp\" Version=\"$SKIA_VER\" />#g" \
+      -e "s#<PackageVersion Include=\"SkiaSharp.NativeAssets.Linux\" Version=\"[^\"]*\" */>#<PackageVersion Include=\"SkiaSharp.NativeAssets.Linux\" Version=\"$SKIA_VER\" />#g" \
+      -e "s#<PackageVersion Include=\"HarfBuzzSharp\" Version=\"[^\"]*\" */>#<PackageVersion Include=\"HarfBuzzSharp\" Version=\"$HARFBUZZ_VER\" />#g" \
+      -e "s#<PackageVersion Include=\"HarfBuzzSharp.NativeAssets.Linux\" Version=\"[^\"]*\" */>#<PackageVersion Include=\"HarfBuzzSharp.NativeAssets.Linux\" Version=\"$HARFBUZZ_VER\" />#g" \
+      "$f"
+
+    grep -q 'PackageVersion Include="SkiaSharp"' "$f" || \
+      sed -i "/<\/ItemGroup>/i\    <PackageVersion Include=\"SkiaSharp\" Version=\"$SKIA_VER\" />" "$f"
+
+    grep -q 'PackageVersion Include="SkiaSharp.NativeAssets.Linux"' "$f" || \
+      sed -i "/<\/ItemGroup>/i\    <PackageVersion Include=\"SkiaSharp.NativeAssets.Linux\" Version=\"$SKIA_VER\" />" "$f"
+
+    grep -q 'PackageVersion Include="HarfBuzzSharp"' "$f" || \
+      sed -i "/<\/ItemGroup>/i\    <PackageVersion Include=\"HarfBuzzSharp\" Version=\"$HARFBUZZ_VER\" />" "$f"
+
+    grep -q 'PackageVersion Include="HarfBuzzSharp.NativeAssets.Linux"' "$f" || \
+      sed -i "/<\/ItemGroup>/i\    <PackageVersion Include=\"HarfBuzzSharp.NativeAssets.Linux\" Version=\"$HARFBUZZ_VER\" />" "$f"
+  done < <(find . -type f -name 'Directory.Packages.props' -print0)
+
+  # Patch SDK bundled RIDs
+  f="$(find "$DOTNET_ROOT/sdk/$(dotnet --version)" -type f -name 'Microsoft.NETCoreSdk.BundledVersions.props' | head -n1 || true)"
+  [[ -f "$f" ]] && sed -i \
+    -e 's/linux-arm64/&;linux-riscv64/g' \
+    -e 's/linux-musl-arm64/&;linux-musl-riscv64/g' \
+    "$f"
+}
+
+build_sqlite_native_riscv64() {
+  local outdir="$1"
+  local workdir sqlite_year sqlite_ver sqlite_zip srcdir
+
+  mkdir -p "$outdir"
+  workdir="$(mktemp -d)"
+
+  # SQLite 3.51.3 amalgamation
+  sqlite_year="2026"
+  sqlite_ver="3510300"
+  sqlite_zip="sqlite-amalgamation-${sqlite_ver}.zip"
+
+  echo "[+] Download SQLite amalgamation: ${sqlite_zip}"
+  curl -fL "https://www.sqlite.org/${sqlite_year}/${sqlite_zip}" -o "${workdir}/${sqlite_zip}"
+
+  unzip -q "${workdir}/${sqlite_zip}" -d "$workdir"
+  srcdir="$(find "$workdir" -maxdepth 1 -type d -name 'sqlite-amalgamation-*' | head -n1 || true)"
+  [[ -n "$srcdir" ]] || { echo "[!] SQLite source unpack failed"; rm -rf "$workdir"; return 1; }
+
+  echo "[+] Build libe_sqlite3.so for riscv64"
+  gcc -shared -fPIC -O2 \
+    -DSQLITE_THREADSAFE=1 \
+    -DSQLITE_ENABLE_FTS5 \
+    -DSQLITE_ENABLE_RTREE \
+    -DSQLITE_ENABLE_JSON1 \
+    -o "${outdir}/libe_sqlite3.so" "${srcdir}/sqlite3.c" -ldl -lpthread
+
+  rm -rf "$workdir"
+}
+
+copy_skiasharp_native_riscv64() {
+  local outdir="$1"
+  local skia_so=""
+  local harfbuzz_so=""
+
+  mkdir -p "$outdir"
+
+  skia_so="$(find "$HOME/.nuget/packages" -path "*/skiasharp.nativeassets.linux/${SKIA_VER}/runtimes/linux-riscv64/native/libSkiaSharp.so" | head -n1 || true)"
+  if [[ -z "$skia_so" ]]; then
+    skia_so="$(find "$HOME/.nuget/packages" -path "*/runtimes/linux-riscv64/native/libSkiaSharp.so" | head -n1 || true)"
+  fi
+
+  harfbuzz_so="$(find "$HOME/.nuget/packages" -path "*/harfbuzzsharp.nativeassets.linux/${HARFBUZZ_VER}/runtimes/linux-riscv64/native/libHarfBuzzSharp.so" | head -n1 || true)"
+  if [[ -z "$harfbuzz_so" ]]; then
+    harfbuzz_so="$(find "$HOME/.nuget/packages" -path "*/runtimes/linux-riscv64/native/libHarfBuzzSharp.so" | head -n1 || true)"
+  fi
+
+  if [[ -n "$skia_so" && -f "$skia_so" ]]; then
+    echo "[+] Copy libSkiaSharp.so from NuGet cache"
+    install -m 755 "$skia_so" "$outdir/libSkiaSharp.so"
+  else
+    echo "[WARN] libSkiaSharp.so for linux-riscv64 not found in NuGet cache"
+  fi
+
+  if [[ -n "$harfbuzz_so" && -f "$harfbuzz_so" ]]; then
+    echo "[+] Copy libHarfBuzzSharp.so from NuGet cache"
+    install -m 755 "$harfbuzz_so" "$outdir/libHarfBuzzSharp.so"
+  else
+    echo "[WARN] libHarfBuzzSharp.so for linux-riscv64 not found in NuGet cache"
+  fi
+}
+
+# Check and install dependencies
+host_arch="$(uname -m)"
+[[ "$host_arch" == "riscv64" ]] || { echo "Only supports riscv64"; exit 1; }
+
+install_ok=0
+
+if command -v dnf >/dev/null 2>&1; then
+  sudo dnf -y install \
+    rpm-build rpmdevtools curl unzip tar jq rsync git python3 gcc make \
+    glibc-devel kernel-headers libatomic file ca-certificates libicu\
+    && install_ok=1
+
+  mkdir -p "$HOME/.dotnet"
+  tmp_dotnet="$(mktemp -d)"
+  curl -fL "$DOTNET_SDK_URL" -o "$tmp_dotnet/$DOTNET_RISCV_FILE"
+  tar -C "$HOME/.dotnet" -xzf "$tmp_dotnet/$DOTNET_RISCV_FILE"
+  rm -rf "$tmp_dotnet"
+
+  export PATH="$HOME/.dotnet:$PATH"
+  export DOTNET_ROOT="$HOME/.dotnet"
+
+  dotnet --info >/dev/null 2>&1 || install_ok=0
+fi
+
+if [[ "$install_ok" -ne 1 ]]; then
+  echo "Could not auto-install dependencies for '$ID'. Make sure these are available:"
+  echo "dotnet-riscv SDK, curl, unzip, tar, rsync, git, python3, gcc, rpm, rpmdevtools, rpm-build (on Red Hat branch)"
+  exit 1
+fi
+
+# Root directory
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+# Git submodules (best effort)
+if [[ -f .gitmodules ]]; then
+  git submodule sync --recursive || true
+  git submodule update --init --recursive || true
+fi
+
+# Locate project
+PROJECT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+if [[ ! -f "$PROJECT" ]]; then
+  PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+fi
+[[ -f "$PROJECT" ]] || { echo "v2rayN.Desktop.csproj not found"; exit 1; }
+
+choose_channel() {
+  # If --buildfrom provided, map it directly and skip interaction.
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0;;
+      2) echo "prerelease"; return 0;;
+      3) echo "keep"; return 0;;
+      *) echo "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." >&2; exit 1;;
+    esac
+  fi
+
+  # Print menu to stderr and read from /dev/tty so stdout only carries the token.
+  local ch="latest" sel=""
+
+  if [[ -t 0 ]]; then
+    echo "[?] Choose v2rayN release channel:" >&2
+    echo "    1) Latest (stable)  [default]" >&2
+    echo "    2) Pre-release (preview)" >&2
+    echo "    3) Keep current (do nothing)" >&2
+    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
+    if read -r sel </dev/tty; then
+      case "${sel:-}" in
+        2) ch="prerelease" ;;
+        3) ch="keep" ;;
+      esac
+    fi
+  fi
+
+  echo "$ch"
+}
+
+get_latest_tag_latest() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
+}
+
+get_latest_tag_prerelease() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
+}
+
+git_try_checkout() {
+  # Try a series of refs and checkout when found.
+  local want="$1" ref=""
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    git fetch --tags --force --prune --depth=1 || true
+    if git rev-parse "refs/tags/${want}" >/dev/null 2>&1; then
+      ref="${want}"
+    fi
+    if [[ -n "$ref" ]]; then
+      echo "[OK] Found ref '${ref}', checking out..."
+      git checkout -f "${ref}"
+      if [[ -f .gitmodules ]]; then
+        git submodule sync --recursive || true
+        git submodule update --init --recursive || true
+      fi
+      return 0
+    fi
+  fi
+  return 1
+}
+
+apply_channel_or_keep() {
+  local ch="$1" tag
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+  if [[ "$ch" == "prerelease" ]]; then
+    tag="$(get_latest_tag_prerelease || true)"
+  else
+    tag="$(get_latest_tag_latest || true)"
+  fi
+
+  [[ -n "$tag" ]] || { echo "Failed to resolve latest tag for channel '${ch}'."; exit 1; }
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || { echo "Failed to checkout '${tag}'."; exit 1; }
+  VERSION="${tag#v}"
+}
+
+if git rev-parse --git-dir >/dev/null 2>&1; then
+  if [[ -n "${VERSION_ARG:-}" ]]; then
+    clean_ver="${VERSION_ARG#v}"
+    if git_try_checkout "$clean_ver"; then
+      VERSION="$clean_ver"
+    else
+      echo "[WARN] Tag '${VERSION_ARG}' not found."
+      ch="$(choose_channel)"
+      apply_channel_or_keep "$ch"
+    fi
+  else
+    ch="$(choose_channel)"
+    apply_channel_or_keep "$ch"
+  fi
+else
+  echo "Current directory is not a git repo; proceeding on current tree."
+  VERSION="${VERSION_ARG:-0.0.0}"
+fi
+
+VERSION="${VERSION#v}"
+echo "[*] GUI version resolved as: ${VERSION}"
+
+# riscv64 patch
+apply_riscv_patch
+
+# Helpers for core
+download_xray() {
+  # Download Xray core
+  local outdir="$1" rid="$2" ver="${XRAY_VER:-}" url="" tmp zipname="xray.zip"
+  mkdir -p "$outdir"
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
+        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
+  fi
+  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
+  if [[ "$rid" == "linux-riscv64" ]]; then
+    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-riscv64.zip"
+  fi
+  [[ -n "$url" ]] || { echo "[xray] Unsupported RID: $rid"; return 1; }
+  echo "[+] Download xray: $url"
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/$zipname"
+  unzip -q "$tmp/$zipname" -d "$tmp"
+  install -m 755 "$tmp/xray" "$outdir/xray"
+  rm -rf "$tmp"
+}
+
+download_singbox() {
+  # Download sing-box
+  local outdir="$1" rid="$2" ver="${SING_VER:-}" url="" tmp tarname="singbox.tar.gz" bin cronet
+  mkdir -p "$outdir"
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
+  if [[ "$rid" == "linux-riscv64" ]]; then
+    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-riscv64.tar.gz"
+  fi
+  [[ -n "$url" ]] || { echo "[sing-box] Unsupported RID: $rid"; return 1; }
+  echo "[+] Download sing-box: $url"
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/$tarname"
+  tar -C "$tmp" -xzf "$tmp/$tarname"
+  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+  install -m 755 "$bin" "$outdir/sing-box"
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so"
+  rm -rf "$tmp"
+}
+
+# Move geo files to outroot/bin
+unify_geo_layout() {
+  local outroot="$1"
+  mkdir -p "$outroot/bin"
+  local names=( \
+    "geosite.dat" \
+    "geoip.dat" \
+    "geoip-only-cn-private.dat" \
+    "Country.mmdb" \
+    "geoip.metadb" \
+  )
+  for n in "${names[@]}"; do
+    if [[ -f "$outroot/bin/xray/$n" ]]; then
+      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
+    fi
+  done
+}
+
+# Download geo/rule assets
+download_geo_assets() {
+  local outroot="$1"
+  local bin_dir="$outroot/bin"
+  local srss_dir="$bin_dir/srss"
+  mkdir -p "$bin_dir" "$srss_dir"
+
+  echo "[+] Download Xray Geo to ${bin_dir}"
+  curl -fsSL -o "$bin_dir/geosite.dat" \
+    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" \
+    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" \
+    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" \
+    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+
+  echo "[+] Download sing-box rule DB & rule-sets"
+  curl -fsSL -o "$bin_dir/geoip.metadb" \
+    "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb" || true
+
+  for f in \
+    geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs \
+    geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" \
+      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geoip/$f" || true
+  done
+  for f in \
+    geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs \
+    geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" \
+      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geosite/$f" || true
+  done
+
+  # Unify to bin
+  unify_geo_layout "$outroot"
+}
+
+# Prefer the prebuilt v2rayN core bundle; then unify geo layout
+download_v2rayn_bundle() {
+  local outroot="$1" rid="$2"
+  local url=""
+  if [[ "$rid" == "linux-riscv64" ]]; then
+    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-riscv64.zip"
+  fi
+  [[ -n "$url" ]] || { echo "[!] Bundle unsupported RID: $rid"; return 1; }
+  echo "[+] Try v2rayN bundle archive: $url"
+  local tmp zipname
+  tmp="$(mktemp -d)"; zipname="$tmp/v2rayn.zip"
+  curl -fL "$url" -o "$zipname" || { echo "[!] Bundle download failed"; return 1; }
+  unzip -q "$zipname" -d "$tmp" || { echo "[!] Bundle unzip failed"; return 1; }
+
+  if [[ -d "$tmp/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$tmp/bin/" "$outroot/bin/"
+  else
+    rsync -a "$tmp/" "$outroot/"
+  fi
+
+  rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
+  find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
+
+  local nested_dir
+  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$nested_dir/bin/" "$outroot/bin/"
+    rm -rf "$nested_dir"
+  fi
+
+  # Unify to bin/
+  unify_geo_layout "$outroot"
+
+  echo "[+] Bundle extracted to $outroot"
+}
+
+# ===== Build results collection ========================================================
+BUILT_RPMS=()
+
+# ===== Build (single-arch) function ====================================================
+build_for_arch() {
+  # $1: target short arch: riscv64
+  local short="$1"
+  local rid rpm_target archdir
+  case "$short" in
+    riscv64) rid="linux-riscv64"; rpm_target="riscv64"; archdir="riscv64" ;;
+    *) echo "Unknown arch '$short' (use riscv64)"; return 1;;
+  esac
+
+  echo "[*] Building for target: $short  (RID=$rid, RPM --target $rpm_target)"
+
+  # .NET publish (self-contained) for this RID
+  dotnet clean "$PROJECT" -c Release -p:TargetFramework=net10.0
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net10.0" || true
+
+  dotnet restore "$PROJECT" -r "$rid" -p:TargetFramework=net10.0
+  dotnet publish "$PROJECT" \
+    -c Release -r "$rid" \
+    -p:TargetFramework=net10.0 \
+    -p:PublishSingleFile=false \
+    -p:SelfContained=true
+
+  # Per-arch variables (scoped)
+  local RID_DIR="$rid"
+  local PUBDIR
+  PUBDIR="$(dirname "$PROJECT")/bin/Release/net10.0/${RID_DIR}/publish"
+  [[ -d "$PUBDIR" ]] || { echo "Publish directory not found: $PUBDIR"; return 1; }
+
+  # Per-arch working area
+  local PKGROOT="v2rayN-publish"
+  local WORKDIR
+  WORKDIR="$(mktemp -d)"
+  trap '[[ -n "${WORKDIR:-}" ]] && rm -rf "$WORKDIR"' RETURN
+
+  # rpmbuild topdir selection
+  local TOPDIR SPECDIR SOURCEDIR PROJECT_DIR
+  rpmdev-setuptree
+  TOPDIR="${HOME}/rpmbuild"
+  SPECDIR="${TOPDIR}/SPECS"
+  SOURCEDIR="${TOPDIR}/SOURCES"
+
+  # Stage publish content
+  mkdir -p "$WORKDIR/$PKGROOT"
+  cp -a "$PUBDIR/." "$WORKDIR/$PKGROOT/"
+
+  copy_skiasharp_native_riscv64 "$WORKDIR/$PKGROOT" || echo "[!] SkiaSharp native copy failed (skipped)"
+  build_sqlite_native_riscv64 "$WORKDIR/$PKGROOT" || echo "[!] sqlite native build failed (skipped)"
+
+  # Required icon
+  local ICON_CANDIDATE
+  PROJECT_DIR="$(cd "$(dirname "$PROJECT")" && pwd)"
+  ICON_CANDIDATE="$PROJECT_DIR/v2rayN.png"
+  [[ -f "$ICON_CANDIDATE" ]] || { echo "Required icon not found: $ICON_CANDIDATE"; return 1; }
+  cp "$ICON_CANDIDATE" "$WORKDIR/$PKGROOT/v2rayn.png"
+
+  # Prepare bin structure
+  mkdir -p "$WORKDIR/$PKGROOT/bin/xray" "$WORKDIR/$PKGROOT/bin/sing_box"
+
+  # Bundle / cores per-arch
+  fetch_separate_cores_and_rules() {
+    local outroot="$1"
+
+    if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+      download_xray "$outroot/bin/xray" "$RID_DIR" || echo "[!] xray download failed (skipped)"
+    fi
+    if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+      download_singbox "$outroot/bin/sing_box" "$RID_DIR" || echo "[!] sing-box download failed (skipped)"
+    fi
+    download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+  }
+
+  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
+    if download_v2rayn_bundle "$WORKDIR/$PKGROOT" "$RID_DIR"; then
+      echo "[*] Using v2rayN bundle archive."
+    else
+      echo "[*] Bundle failed, fallback to separate core + rules."
+      fetch_separate_cores_and_rules "$WORKDIR/$PKGROOT"
+    fi
+  else
+    echo "[*] --netcore specified: use separate core + rules."
+    fetch_separate_cores_and_rules "$WORKDIR/$PKGROOT"
+  fi
+
+  # Tarball
+  mkdir -p "$SOURCEDIR"
+  tar -C "$WORKDIR" -czf "$SOURCEDIR/$PKGROOT.tar.gz" "$PKGROOT"
+
+  # SPEC
+  local SPECFILE="$SPECDIR/v2rayN.spec"
+  mkdir -p "$SPECDIR"
+  cat > "$SPECFILE" <<'SPEC'
+%global debug_package %{nil}
+%undefine _debuginfo_subpackages
+%undefine _debugsource_packages
+# Ignore outdated LTTng dependencies incorrectly reported by the .NET runtime (to avoid installation failures)
+%global __requires_exclude ^liblttng-ust\.so\..*$
+
+Name:           v2rayN
+Version:        __VERSION__
+Release:        1%{?dist}
+Summary:        v2rayN (Avalonia) GUI client for Linux (riscv64)
+License:        GPL-3.0-only
+URL:            https://github.com/2dust/v2rayN
+BugURL:         https://github.com/2dust/v2rayN/issues
+ExclusiveArch:  riscv64
+Source0:        __PKGROOT__.tar.gz
+
+# Runtime dependencies (Avalonia / X11 / Fonts / GL)
+Requires:       cairo, pango, openssl, mesa-libEGL, mesa-libGL
+Requires:       glibc >= 2.34
+Requires:       fontconfig >= 2.13.1
+Requires:       desktop-file-utils >= 0.26
+Requires:       xdg-utils >= 1.1.3
+Requires:       coreutils >= 8.32
+Requires:       bash >= 5.1
+Requires:       freetype >= 2.10
+
+%description
+v2rayN Linux for Red Hat Enterprise Linux
+Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 / Shadowsocks / tuic / WireGuard
+Support Red Hat Enterprise Linux / Fedora Linux / Rocky Linux / AlmaLinux / CentOS
+For more information, Please visit our website
+https://github.com/2dust/v2rayN
+
+%prep
+%setup -q -n __PKGROOT__
+
+%build
+# no build
+
+%install
+install -dm0755 %{buildroot}/opt/v2rayN
+cp -a * %{buildroot}/opt/v2rayN/
+
+# Normalize permissions
+find %{buildroot}/opt/v2rayN -type d -exec chmod 0755 {} +
+find %{buildroot}/opt/v2rayN -type f -exec chmod 0644 {} +
+[ -f %{buildroot}/opt/v2rayN/v2rayN ] && chmod 0755 %{buildroot}/opt/v2rayN/v2rayN || :
+[ -f %{buildroot}/opt/v2rayN/libSkiaSharp.so ] && chmod 0755 %{buildroot}/opt/v2rayN/libSkiaSharp.so || :
+[ -f %{buildroot}/opt/v2rayN/libHarfBuzzSharp.so ] && chmod 0755 %{buildroot}/opt/v2rayN/libHarfBuzzSharp.so || :
+[ -f %{buildroot}/opt/v2rayN/libe_sqlite3.so ] && chmod 0755 %{buildroot}/opt/v2rayN/libe_sqlite3.so || :
+
+# Launcher (prefer native ELF first, then DLL fallback)
+install -dm0755 %{buildroot}%{_bindir}
+install -m0755 /dev/stdin %{buildroot}%{_bindir}/v2rayn << 'EOF'
+#!/usr/bin/bash
+set -euo pipefail
+DIR="/opt/v2rayN"
+export LD_LIBRARY_PATH="$DIR:${LD_LIBRARY_PATH:-}"
+
+# Prefer native apphost
+if [[ -x "$DIR/v2rayN" ]]; then exec "$DIR/v2rayN" "$@"; fi
+
+# DLL fallback
+for dll in v2rayN.Desktop.dll v2rayN.dll; do
+  if [[ -f "$DIR/$dll" ]]; then exec /usr/bin/dotnet "$DIR/$dll" "$@"; fi
+done
+
+echo "v2rayN launcher: no executable found in $DIR" >&2
+ls -l "$DIR" >&2 || true
+exit 1
+EOF
+
+# Desktop file
+install -dm0755 %{buildroot}%{_datadir}/applications
+install -m0644 /dev/stdin %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
+[Desktop Entry]
+Type=Application
+Name=v2rayN
+Comment=v2rayN for Red Hat Enterprise Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
+EOF
+
+# Icon
+install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
+install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
+
+%post
+/usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
+/usr/bin/gtk-update-icon-cache -f %{_datadir}/icons/hicolor >/dev/null 2>&1 || true
+
+%postun
+/usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
+/usr/bin/gtk-update-icon-cache -f %{_datadir}/icons/hicolor >/dev/null 2>&1 || true
+
+%files
+%{_bindir}/v2rayn
+/opt/v2rayN
+%{_datadir}/applications/v2rayn.desktop
+%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
+SPEC
+
+  # Replace placeholders
+  sed -i "s/__VERSION__/${VERSION}/g" "$SPECFILE"
+  sed -i "s/__PKGROOT__/${PKGROOT}/g" "$SPECFILE"
+
+  # Build RPM for this arch
+  rpmbuild -ba "$SPECFILE" --target "$rpm_target"
+
+  echo "Build done for $short. RPM at:"
+  local f
+  for f in "${TOPDIR}/RPMS/${archdir}/v2rayN-${VERSION}-1"*.rpm; do
+    [[ -e "$f" ]] || continue
+    echo "  $f"
+    BUILT_RPMS+=("$f")
+  done
+}
+
+# ===== Arch selection and build orchestration =========================================
+targets=(riscv64)
+
+for arch in "${targets[@]}"; do
+  build_for_arch "$arch"
+done
+
+echo ""
+echo "================ Build Summary ================"
+if [[ "${#BUILT_RPMS[@]}" -gt 0 ]]; then
+  for rp in "${BUILT_RPMS[@]}"; do
+    echo "$rp"
+  done
+else
+  echo "No RPMs detected in summary (check build logs above)."
+fi
+echo "=============================================="
@@ -1,45 +1,36 @@
 #!/usr/bin/env bash
 set -euo pipefail

-# ====== Require Red Hat Enterprise Linux/FedoraLinux/RockyLinux/AlmaLinux/CentOS ======
-if [[ -r /etc/os-release ]]; then
-  . /etc/os-release
-  case "$ID" in
-    rhel|rocky|almalinux|fedora|centos)
-      echo "[OK] Detected supported system: $NAME $VERSION_ID"
-      ;;
-    *)
-      echo "[ERROR] Unsupported system: $NAME ($ID)."
-      echo "This script only supports Red Hat Enterprise Linux/RockyLinux/AlmaLinux/CentOS or Ubuntu/Debian."
-      exit 1
-      ;;
-  esac
-else
-  echo "[ERROR] Cannot detect system (missing /etc/os-release)."
-  exit 1
+# Require Red Hat base branch
+. /etc/os-release
+
+case "${ID:-}" in
+  rhel|rocky|almalinux|fedora|centos)
+    echo "Detected supported system: ${NAME:-$ID} ${VERSION_ID:-}"
+    ;;
+  *)
+    echo "Unsupported system: ${NAME:-unknown} (${ID:-unknown})."
+    echo "This script only supports: RHEL / Rocky / AlmaLinux / Fedora / CentOS."
+    exit 1
+    ;;
+esac
+
+# Kernel version
+MIN_KERNEL="6.11"
+CURRENT_KERNEL="$(uname -r)"
+
+lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$CURRENT_KERNEL" | sort -V | head -n1)"
+
+if [[ "$lowest" != "$MIN_KERNEL" ]]; then
+    echo "Kernel $CURRENT_KERNEL is below $MIN_KERNEL"
+    exit 1
 fi

-# ======================== Kernel version check (require >= 6.11) =======================
-MIN_KERNEL_MAJOR=6
-MIN_KERNEL_MINOR=11
-KERNEL_FULL=$(uname -r)
-KERNEL_MAJOR=$(echo "$KERNEL_FULL" | cut -d. -f1)
-KERNEL_MINOR=$(echo "$KERNEL_FULL" | cut -d. -f2)
+echo "[OK] Kernel $CURRENT_KERNEL verified."

-echo "[INFO] Detected kernel version: $KERNEL_FULL"
-
-if (( KERNEL_MAJOR < MIN_KERNEL_MAJOR )) || { (( KERNEL_MAJOR == MIN_KERNEL_MAJOR )) && (( KERNEL_MINOR < MIN_KERNEL_MINOR )); }; then
-  echo "[ERROR] Kernel $KERNEL_FULL is too old. Requires Linux >= ${MIN_KERNEL_MAJOR}.${MIN_KERNEL_MINOR}."
-  echo "Please upgrade your system or use a newer container (e.g. Fedora 42+, RHEL 10+)."
-  exit 1
-fi
-
-echo "[OK] Kernel version >= ${MIN_KERNEL_MAJOR}.${MIN_KERNEL_MINOR}."
-
-# ===== Config & Parse arguments =========================================================
+# Config & Parse arguments
 VERSION_ARG="${1:-}"     # Pass version number like 7.13.8, or leave empty
 WITH_CORE="both"         # Default: bundle both xray+sing-box
-AUTOSTART=0              # 1 = enable system-wide autostart (/etc/xdg/autostart)
 FORCE_NETCORE=0          # --netcore => skip archive bundle, use separate downloads
 ARCH_OVERRIDE=""         # --arch x64|arm64|all (optional compile target)
 BUILD_FROM=""            # --buildfrom 1|2|3 to select channel non-interactively
@@ -55,7 +46,6 @@ if [[ -n "${VERSION_ARG:-}" ]]; then shift || true; fi
 while [[ $# -gt 0 ]]; do
  case "$1" in
    --with-core)     WITH_CORE="${2:-both}"; shift 2;;
-    --autostart)     AUTOSTART=1; shift;;
    --xray-ver)      XRAY_VER="${2:-}"; shift 2;;
    --singbox-ver)   SING_VER="${2:-}"; shift 2;;
    --netcore)       FORCE_NETCORE=1; shift;;
@@ -69,38 +59,26 @@ done

 # Conflict: version number AND --buildfrom cannot be used together
 if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
-  echo "[ERROR] You cannot specify both an explicit version and --buildfrom at the same time."
+  echo "You cannot specify both an explicit version and --buildfrom at the same time."
  echo "        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
  exit 1
 fi

-# ===== Environment check + Dependencies ========================================
+# Check and install dependencies
 host_arch="$(uname -m)"
 [[ "$host_arch" == "aarch64" || "$host_arch" == "x86_64" ]] || { echo "Only supports aarch64 / x86_64"; exit 1; }

 install_ok=0
-case "$ID" in
-  rhel|rocky|almalinux|centos)
-    if command -v dnf >/dev/null 2>&1; then
-      sudo dnf -y install dotnet-sdk-8.0 rpm-build rpmdevtools curl unzip tar rsync || \
-      sudo dnf -y install dotnet-sdk rpm-build rpmdevtools curl unzip tar rsync
-      install_ok=1
-    elif command -v yum >/dev/null 2>&1; then
-      sudo yum -y install dotnet-sdk-8.0 rpm-build rpmdevtools curl unzip tar rsync || \
-      sudo yum -y install dotnet-sdk rpm-build rpmdevtools curl unzip tar rsync
-      install_ok=1
-    fi
-    ;;
-  *)
-    ;;
-esac

-if [[ "$install_ok" -ne 1 ]]; then
-  echo "[WARN] Could not auto-install dependencies for '$ID'. Make sure these are available:"
-  echo "       dotnet-sdk 8.x, curl, unzip, tar, rsync, rpm, rpmdevtools, rpm-build (on RPM-based distros)"
+if command -v dnf >/dev/null 2>&1; then
+  sudo dnf -y install rpm-build rpmdevtools curl unzip tar jq rsync dotnet-sdk-8.0 \
+    && install_ok=1
 fi

-command -v curl >/dev/null
+if [[ "$install_ok" -ne 1 ]]; then
+  echo "Could not auto-install dependencies for '$ID'. Make sure these are available:"
+  echo "dotnet-sdk 8.x, curl, unzip, tar, rsync, rpm, rpmdevtools, rpm-build (on Red Hat branch)"
+fi

 # Root directory
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
@@ -119,9 +97,6 @@ if [[ ! -f "$PROJECT" ]]; then
 fi
 [[ -f "$PROJECT" ]] || { echo "v2rayN.Desktop.csproj not found"; exit 1; }

-# Resolve GUI version & auto checkout
-VERSION=""
-
 choose_channel() {
  # If --buildfrom provided, map it directly and skip interaction.
  if [[ -n "${BUILD_FROM:-}" ]]; then
@@ -135,60 +110,35 @@ choose_channel() {

  # Print menu to stderr and read from /dev/tty so stdout only carries the token.
  local ch="latest" sel=""
+
  if [[ -t 0 ]]; then
    echo "[?] Choose v2rayN release channel:" >&2
    echo "    1) Latest (stable)  [default]" >&2
    echo "    2) Pre-release (preview)" >&2
    echo "    3) Keep current (do nothing)" >&2
    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
    if read -r sel </dev/tty; then
      case "${sel:-}" in
        2) ch="prerelease" ;;
        3) ch="keep" ;;
-        *) ch="latest" ;;
      esac
-    else
-      ch="latest"
    fi
-  else
-    ch="latest"
  fi
+
  echo "$ch"
 }

 get_latest_tag_latest() {
-  # Resolve /releases/latest → tag_name
  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
-    | grep -Eo '"tag_name":\s*"v?[^"]+"' \
-    | head -n1 \
-    | sed -E 's/.*"tag_name":\s*"v?([^"]+)".*/\1/'
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
 }

 get_latest_tag_prerelease() {
-  # Resolve newest prerelease=true tag; prefer jq, fallback to sed/grep (no awk)
-  local json tag
-  json="$(curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20")" || return 1
-
-  # 1) Use jq if present
-  if command -v jq >/dev/null 2>&1; then
-    tag="$(printf '%s' "$json" \
-      | jq -r '[.[] | select(.prerelease==true)][0].tag_name' 2>/dev/null \
-      | sed 's/^v//')" || true
-  fi
-
-  # 2) Fallback to sed/grep only
-  if [[ -z "${tag:-}" || "${tag:-}" == "null" ]]; then
-    tag="$(printf '%s' "$json" \
-      | tr '\n' ' ' \
-      | sed 's/},[[:space:]]*{/\n/g' \
-      | grep -m1 -E '"prerelease"[[:space:]]*:[[:space:]]*true' \
-      | grep -Eo '"tag_name"[[:space:]]*:[[:space:]]*"v?[^"]+"' \
-      | head -n1 \
-      | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"v?([^"]+)".*/\1/')" || true
-  fi
-
-  [[ -n "${tag:-}" && "${tag:-}" != "null" ]] || return 1
-  printf '%s\n' "$tag"
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
 }

 git_try_checkout() {
@@ -196,11 +146,7 @@ git_try_checkout() {
  local want="$1" ref=""
  if git rev-parse --git-dir >/dev/null 2>&1; then
    git fetch --tags --force --prune --depth=1 || true
-    if git rev-parse "refs/tags/v${want}" >/dev/null 2>&1; then
-      ref="v${want}"
-    elif git rev-parse "refs/tags/${want}" >/dev/null 2>&1; then
-      ref="${want}"
-    elif git rev-parse --verify "${want}" >/dev/null 2>&1; then
+    if git rev-parse "refs/tags/${want}" >/dev/null 2>&1; then
      ref="${want}"
    fi
    if [[ -n "$ref" ]]; then
@@ -216,130 +162,103 @@ git_try_checkout() {
  return 1
 }

+apply_channel_or_keep() {
+  local ch="$1" tag
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+  if [[ "$ch" == "prerelease" ]]; then
+    tag="$(get_latest_tag_prerelease || true)"
+  else
+    tag="$(get_latest_tag_latest || true)"
+  fi
+
+  [[ -n "$tag" ]] || { echo "Failed to resolve latest tag for channel '${ch}'."; exit 1; }
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || { echo "Failed to checkout '${tag}'."; exit 1; }
+  VERSION="${tag#v}"
+}
+
 if git rev-parse --git-dir >/dev/null 2>&1; then
  if [[ -n "${VERSION_ARG:-}" ]]; then
-    echo "[*] Trying to switch v2rayN repo to version: ${VERSION_ARG}"
-    if git_try_checkout "${VERSION_ARG#v}"; then
-      VERSION="${VERSION_ARG#v}"
+    clean_ver="${VERSION_ARG#v}"
+    if git_try_checkout "$clean_ver"; then
+      VERSION="$clean_ver"
    else
      echo "[WARN] Tag '${VERSION_ARG}' not found."
      ch="$(choose_channel)"
-      if [[ "$ch" == "keep" ]]; then
-        echo "[*] Keep current repository state (no checkout)."
-        if git describe --tags --abbrev=0 >/dev/null 2>&1; then
-          VERSION="$(git describe --tags --abbrev=0)"
-        else
-          VERSION="0.0.0+git"
-        fi
-        VERSION="${VERSION#v}"
-      else
-        echo "[*] Resolving ${ch} tag from GitHub releases..."
-        tag=""
-        if [[ "$ch" == "prerelease" ]]; then
-          tag="$(get_latest_tag_prerelease || true)"
-          if [[ -z "$tag" ]]; then
-            echo "[WARN] Failed to resolve prerelease tag, falling back to latest."
-            tag="$(get_latest_tag_latest || true)"
-          fi
-        else
-          tag="$(get_latest_tag_latest || true)"
-        fi
-        [[ -n "$tag" ]] || { echo "[ERROR] Failed to resolve latest tag for channel '${ch}'."; exit 1; }
-        echo "[*] Latest tag for '${ch}': ${tag}"
-        git_try_checkout "$tag" || { echo "[ERROR] Failed to checkout '${tag}'."; exit 1; }
-        VERSION="${tag#v}"
-      fi
+      apply_channel_or_keep "$ch"
    fi
  else
    ch="$(choose_channel)"
-    if [[ "$ch" == "keep" ]]; then
-      echo "[*] Keep current repository state (no checkout)."
-      if git describe --tags --abbrev=0 >/dev/null 2>&1; then
-        VERSION="$(git describe --tags --abbrev=0)"
-      else
-        VERSION="0.0.0+git"
-      fi
-      VERSION="${VERSION#v}"
-    else
-      echo "[*] Resolving ${ch} tag from GitHub releases..."
-      tag=""
-      if [[ "$ch" == "prerelease" ]]; then
-        tag="$(get_latest_tag_prerelease || true)"
-        if [[ -z "$tag" ]]; then
-          echo "[WARN] Failed to resolve prerelease tag, falling back to latest."
-          tag="$(get_latest_tag_latest || true)"
-        fi
-      else
-        tag="$(get_latest_tag_latest || true)"
-      fi
-      [[ -n "$tag" ]] || { echo "[ERROR] Failed to resolve latest tag for channel '${ch}'."; exit 1; }
-      echo "[*] Latest tag for '${ch}': ${tag}"
-      git_try_checkout "$tag" || { echo "[ERROR] Failed to checkout '${tag}'."; exit 1; }
-      VERSION="${tag#v}"
-    fi
+    apply_channel_or_keep "$ch"
  fi
 else
-  echo "[WARN] Current directory is not a git repo; cannot checkout version. Proceeding on current tree."
-  VERSION="${VERSION_ARG:-}"
-  if [[ -z "$VERSION" ]]; then
-    if git describe --tags --abbrev=0 >/dev/null 2>&1; then
-      VERSION="$(git describe --tags --abbrev=0)"
-    else
-      VERSION="0.0.0+git"
-    fi
-  fi
-  VERSION="${VERSION#v}"
+  echo "Current directory is not a git repo; proceeding on current tree."
+  VERSION="${VERSION_ARG:-0.0.0}"
 fi
+
+VERSION="${VERSION#v}"
 echo "[*] GUI version resolved as: ${VERSION}"

-# ===== Helpers for core/rules download (use RID_DIR for arch sync) =====================
+# Helpers for core
 download_xray() {
-  # Download Xray core and install to outdir/xray
-  local outdir="$1" ver="${XRAY_VER:-}" url tmp zipname="xray.zip"
+  # Download Xray core
+  local outdir="$1" rid="$2" ver="${XRAY_VER:-}" url tmp zipname="xray.zip"
  mkdir -p "$outdir"
-  if [[ -n "${XRAY_VER:-}" ]]; then ver="${XRAY_VER}"; fi
  if [[ -z "$ver" ]]; then
    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
  fi
  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
-  if [[ "$RID_DIR" == "linux-arm64" ]]; then
+  if [[ "$rid" == "linux-arm64" ]]; then
    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-arm64-v8a.zip"
  else
    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-64.zip"
  fi
  echo "[+] Download xray: $url"
-  tmp="$(mktemp -d)"; trap '[[ -n "${tmp:-}" ]] && rm -rf "$tmp"' RETURN
+  tmp="$(mktemp -d)"
  curl -fL "$url" -o "$tmp/$zipname"
  unzip -q "$tmp/$zipname" -d "$tmp"
-  install -Dm755 "$tmp/xray" "$outdir/xray"
+  install -m 755 "$tmp/xray" "$outdir/xray"
+  rm -rf "$tmp"
 }

 download_singbox() {
-  # Download sing-box core and install to outdir/sing-box
-  local outdir="$1" ver="${SING_VER:-}" url tmp tarname="singbox.tar.gz" bin
+  # Download sing-box
+  local outdir="$1" rid="$2" ver="${SING_VER:-}" url tmp tarname="singbox.tar.gz" bin cronet
  mkdir -p "$outdir"
-  if [[ -n "${SING_VER:-}" ]]; then ver="${SING_VER}"; fi
  if [[ -z "$ver" ]]; then
    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
-        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
  fi
  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
-  if [[ "$RID_DIR" == "linux-arm64" ]]; then
+  if [[ "$rid" == "linux-arm64" ]]; then
    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-arm64.tar.gz"
  else
    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-amd64.tar.gz"
  fi
  echo "[+] Download sing-box: $url"
-  tmp="$(mktemp -d)"; trap '[[ -n "${tmp:-}" ]] && rm -rf "$tmp"' RETURN
+  tmp="$(mktemp -d)"
  curl -fL "$url" -o "$tmp/$tarname"
  tar -C "$tmp" -xzf "$tmp/$tarname"
  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
-  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; return 1; }
-  install -Dm755 "$bin" "$outdir/sing-box"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+  install -m 755 "$bin" "$outdir/sing-box"
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so"
+  rm -rf "$tmp"
 }

-# Move geo files to a unified path: outroot/bin
+# Move geo files to outroot/bin
 unify_geo_layout() {
  local outroot="$1"
  mkdir -p "$outroot/bin"
@@ -351,18 +270,13 @@ unify_geo_layout() {
    "geoip.metadb" \
  )
  for n in "${names[@]}"; do
-    # If file exists under bin/xray/, move it up to bin/
    if [[ -f "$outroot/bin/xray/$n" ]]; then
      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
    fi
-    # If file already in bin/, leave it as-is
-    if [[ -f "$outroot/bin/$n" ]]; then
-      :
-    fi
  done
 }

-# Download geo/rule assets; then unify to bin/
+# Download geo/rule assets
 download_geo_assets() {
  local outroot="$1"
  local bin_dir="$outroot/bin"
@@ -396,15 +310,15 @@ download_geo_assets() {
      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geosite/$f" || true
  done

-  # Unify to bin/
+  # Unify to bin
  unify_geo_layout "$outroot"
 }

 # Prefer the prebuilt v2rayN core bundle; then unify geo layout
 download_v2rayn_bundle() {
-  local outroot="$1"
+  local outroot="$1" rid="$2"
  local url=""
-  if [[ "$RID_DIR" == "linux-arm64" ]]; then
+  if [[ "$rid" == "linux-arm64" ]]; then
    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-arm64.zip"
  else
    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-64.zip"
@@ -427,7 +341,7 @@ download_v2rayn_bundle() {

  local nested_dir
  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
-  if [[ -n "${nested_dir:-}" && -d "$nested_dir/bin" ]]; then
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
    mkdir -p "$outroot/bin"
    rsync -a "$nested_dir/bin/" "$outroot/bin/"
    rm -rf "$nested_dir"
@@ -451,7 +365,7 @@ build_for_arch() {
  case "$short" in
    x64)   rid="linux-x64";   rpm_target="x86_64"; archdir="x86_64" ;;
    arm64) rid="linux-arm64"; rpm_target="aarch64"; archdir="aarch64" ;;
-    *) echo "[ERROR] Unknown arch '$short' (use x64|arm64)"; return 1;;
+    *) echo "Unknown arch '$short' (use x64|arm64)"; return 1;;
  esac

  echo "[*] Building for target: $short  (RID=$rid, RPM --target $rpm_target)"
@@ -464,17 +378,13 @@ build_for_arch() {
  dotnet publish "$PROJECT" \
    -c Release -r "$rid" \
    -p:PublishSingleFile=false \
-    -p:SelfContained=true \
-    -p:IncludeNativeLibrariesForSelfExtract=true
+    -p:SelfContained=true

  # Per-arch variables (scoped)
  local RID_DIR="$rid"
  local PUBDIR
  PUBDIR="$(dirname "$PROJECT")/bin/Release/net8.0/${RID_DIR}/publish"
-  [[ -d "$PUBDIR" ]]
-
-  # Make RID_DIR visible to download helpers (they read this var)
-  export RID_DIR
+  [[ -d "$PUBDIR" ]] || { echo "Publish directory not found: $PUBDIR"; return 1; }

  # Per-arch working area
  local PKGROOT="v2rayN-publish"
@@ -483,58 +393,49 @@ build_for_arch() {
  trap '[[ -n "${WORKDIR:-}" ]] && rm -rf "$WORKDIR"' RETURN

  # rpmbuild topdir selection
-  local TOPDIR SPECDIR SOURCEDIR USE_TOPDIR_DEFINE
-  if [[ "$ID" =~ ^(rhel|rocky|almalinux|centos)$ ]]; then
-    rpmdev-setuptree
-    TOPDIR="${HOME}/rpmbuild"
-    SPECDIR="${TOPDIR}/SPECS"
-    SOURCEDIR="${TOPDIR}/SOURCES"
-    USE_TOPDIR_DEFINE=0
-  else
-    TOPDIR="${WORKDIR}/rpmbuild"
-    SPECDIR="${TOPDIR}/SPECS}"
-    SOURCEDIR="${TOPDIR}/SOURCES"
-    mkdir -p "${SPECDIR}" "${SOURCEDIR}" "${TOPDIR}/BUILD" "${TOPDIR}/RPMS" "${TOPDIR}/SRPMS"
-    USE_TOPDIR_DEFINE=1
-  fi
+  local TOPDIR SPECDIR SOURCEDIR
+  rpmdev-setuptree
+  TOPDIR="${HOME}/rpmbuild"
+  SPECDIR="${TOPDIR}/SPECS"
+  SOURCEDIR="${TOPDIR}/SOURCES"

  # Stage publish content
  mkdir -p "$WORKDIR/$PKGROOT"
  cp -a "$PUBDIR/." "$WORKDIR/$PKGROOT/"

-  # Optional icon
+  # Required icon
  local ICON_CANDIDATE
-  ICON_CANDIDATE="$(dirname "$PROJECT")/../v2rayN.Desktop/v2rayN.png"
-  [[ -f "$ICON_CANDIDATE" ]] && cp "$ICON_CANDIDATE" "$WORKDIR/$PKGROOT/v2rayn.png" || true
+  PROJECT_DIR="$(cd "$(dirname "$PROJECT")" && pwd)"
+  ICON_CANDIDATE="$PROJECT_DIR/v2rayN.png"
+  [[ -f "$ICON_CANDIDATE" ]] || { echo "Required icon not found: $ICON_CANDIDATE"; return 1; }
+  cp "$ICON_CANDIDATE" "$WORKDIR/$PKGROOT/v2rayn.png"

  # Prepare bin structure
  mkdir -p "$WORKDIR/$PKGROOT/bin/xray" "$WORKDIR/$PKGROOT/bin/sing_box"

  # Bundle / cores per-arch
+  fetch_separate_cores_and_rules() {
+    local outroot="$1"
+
+    if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+      download_xray "$outroot/bin/xray" "$RID_DIR" || echo "[!] xray download failed (skipped)"
+    fi
+    if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+      download_singbox "$outroot/bin/sing_box" "$RID_DIR" || echo "[!] sing-box download failed (skipped)"
+    fi
+    download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+  }
+
  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
-    if download_v2rayn_bundle "$WORKDIR/$PKGROOT"; then
+    if download_v2rayn_bundle "$WORKDIR/$PKGROOT" "$RID_DIR"; then
      echo "[*] Using v2rayN bundle archive."
    else
      echo "[*] Bundle failed, fallback to separate core + rules."
-      if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
-        download_xray "$WORKDIR/$PKGROOT/bin/xray" || echo "[!] xray download failed (skipped)"
-      fi
-      if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
-        download_singbox "$WORKDIR/$PKGROOT/bin/sing_box" || echo "[!] sing-box download failed (skipped)"
-      fi
-      download_geo_assets "$WORKDIR/$PKGROOT" || echo "[!] Geo rules download failed (skipped)"
+      fetch_separate_cores_and_rules "$WORKDIR/$PKGROOT"
    fi
  else
    echo "[*] --netcore specified: use separate core + rules."
-    if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
-      download_xray "$WORKDIR/$PKGROOT/bin/xray" || echo "[!] xray download failed (skipped)"
-    fi
-    if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
-      download_singbox "$WORKDIR/$PKGROOT/bin/sing_box" || echo "[!] sing-box download failed (skipped)"
-    fi
-    download_geo_assets "$WORKDIR/$PKGROOT" || echo "[!] Geo rules download failed (skipped)"
-    # ---- REQUIRED: always fetch mihomo in netcore mode, per-arch ----
-    # download_mihomo "$WORKDIR/$PKGROOT" || echo "[!] mihomo download failed (skipped)"
+    fetch_separate_cores_and_rules "$WORKDIR/$PKGROOT"
  fi

  # Tarball
@@ -588,9 +489,14 @@ https://github.com/2dust/v2rayN
 install -dm0755 %{buildroot}/opt/v2rayN
 cp -a * %{buildroot}/opt/v2rayN/

+# Normalize permissions
+find %{buildroot}/opt/v2rayN -type d -exec chmod 0755 {} +
+find %{buildroot}/opt/v2rayN -type f -exec chmod 0644 {} +
+[ -f %{buildroot}/opt/v2rayN/v2rayN ] && chmod 0755 %{buildroot}/opt/v2rayN/v2rayN || :
+
 # Launcher (prefer native ELF first, then DLL fallback)
 install -dm0755 %{buildroot}%{_bindir}
-cat > %{buildroot}%{_bindir}/v2rayn << 'EOF'
+install -m0755 /dev/stdin %{buildroot}%{_bindir}/v2rayn << 'EOF'
 #!/usr/bin/bash
 set -euo pipefail
 DIR="/opt/v2rayN"
@@ -607,11 +513,10 @@ echo "v2rayN launcher: no executable found in $DIR" >&2
 ls -l "$DIR" >&2 || true
 exit 1
 EOF
-chmod 0755 %{buildroot}%{_bindir}/v2rayn

 # Desktop file
 install -dm0755 %{buildroot}%{_datadir}/applications
-cat > %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
+install -m0644 /dev/stdin %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
 [Desktop Entry]
 Type=Application
 Name=v2rayN
@@ -623,10 +528,8 @@ Categories=Network;
 EOF

 # Icon
-if [ -f "%{_builddir}/__PKGROOT__/v2rayn.png" ]; then
-  install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
-  install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
-fi
+install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
+install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png

 %post
 /usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
@@ -643,72 +546,12 @@ fi
 %{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
 SPEC

-  # Autostart injection (inside %install) and %files entry
-  if [[ "$AUTOSTART" -eq 1 ]]; then
-    awk '
-      BEGIN{ins=0}
-      /^%post$/ && !ins {
-        print "# --- Autostart (.desktop) ---"
-        print "install -dm0755 %{buildroot}/etc/xdg/autostart"
-        print "cat > %{buildroot}/etc/xdg/autostart/v2rayn.desktop << '\''EOF'\''"
-        print "[Desktop Entry]"
-        print "Type=Application"
-        print "Name=v2rayN (Autostart)"
-        print "Exec=v2rayn"
-        print "X-GNOME-Autostart-enabled=true"
-        print "NoDisplay=false"
-        print "EOF"
-        ins=1
-      }
-      {print}
-    ' "$SPECFILE" > "${SPECFILE}.tmp" && mv "${SPECFILE}.tmp" "$SPECFILE"
-
-    awk '
-      BEGIN{infiles=0; done=0}
-      /^%files$/        {infiles=1}
-      infiles && done==0 && $0 ~ /%{_datadir}\/icons\/hicolor\/256x256\/apps\/v2rayn\.png/ {
-        print
-        print "%config(noreplace) /etc/xdg/autostart/v2rayn.desktop"
-        done=1
-        next
-      }
-      {print}
-    ' "$SPECFILE" > "${SPECFILE}.tmp" && mv "${SPECFILE}.tmp" "$SPECFILE"
-  fi
-
  # Replace placeholders
  sed -i "s/__VERSION__/${VERSION}/g" "$SPECFILE"
  sed -i "s/__PKGROOT__/${PKGROOT}/g" "$SPECFILE"

-  # ----- Select proper 'strip' per target arch on Ubuntu only (cross-binutils) -----
-  # NOTE: We define only __strip to point to the target-arch strip.
-  #       DO NOT override __brp_strip (it must stay the brp script path).
-  local STRIP_ARGS=()
-  if [[ "$ID" == "ubuntu" ]]; then
-    local STRIP_BIN=""
-    if [[ "$short" == "x64" ]]; then
-      STRIP_BIN="/usr/bin/x86_64-linux-gnu-strip"
-    else
-      STRIP_BIN="/usr/bin/aarch64-linux-gnu-strip"
-    fi
-    if [[ -x "$STRIP_BIN" ]]; then
-      STRIP_ARGS=( --define "__strip $STRIP_BIN" )
-    fi
-  fi
-
-  # Build RPM for this arch (force rpm --target to match compile arch)
-  if [[ "$USE_TOPDIR_DEFINE" -eq 1 ]]; then
-    rpmbuild -ba "$SPECFILE" --define "_topdir $TOPDIR" --target "$rpm_target" "${STRIP_ARGS[@]}"
-  else
-    rpmbuild -ba "$SPECFILE" --target "$rpm_target" "${STRIP_ARGS[@]}"
-  fi
-
-  # Copy temporary rpmbuild to ~/rpmbuild on Debian/Ubuntu path
-  if [[ "$USE_TOPDIR_DEFINE" -eq 1 ]]; then
-    mkdir -p "$HOME/rpmbuild"
-    rsync -a "$TOPDIR"/ "$HOME/rpmbuild"/
-    TOPDIR="$HOME/rpmbuild"
-  fi
+  # Build RPM for this arch
+  rpmbuild -ba "$SPECFILE" --target "$rpm_target"

  echo "Build done for $short. RPM at:"
  local f
@@ -721,33 +564,18 @@ SPEC

 # ===== Arch selection and build orchestration =========================================
 case "${ARCH_OVERRIDE:-}" in
-  "")
-    # No --arch: use host architecture
-    if [[ "$host_arch" == "aarch64" ]]; then
-      build_for_arch arm64
-    else
-      build_for_arch x64
-    fi
-    ;;
-  x64|amd64)
-    build_for_arch x64
-    ;;
-  arm64|aarch64)
-    build_for_arch arm64
-    ;;
-  all)
-    BUILT_ALL=1
-    # Build x64 and arm64 separately; each package contains its own arch-only binaries.
-    build_for_arch x64
-    build_for_arch arm64
-    ;;
-  *)
-    echo "[ERROR] Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all."
-    exit 1
-    ;;
+  all)           targets=(x64 arm64); BUILT_ALL=1 ;;
+  x64|amd64)     targets=(x64) ;;
+  arm64|aarch64) targets=(arm64) ;;
+  "")            targets=($([[ "$host_arch" == "aarch64" ]] && echo arm64 || echo x64)) ;;
+  *)             echo "Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all."; exit 1 ;;
 esac

-# ===== Final summary if building both arches ==========================================
+for arch in "${targets[@]}"; do
+  build_for_arch "$arch"
+done
+
+# Print Both arches information
 if [[ "$BUILT_ALL" -eq 1 ]]; then
  echo ""
  echo "================ Build Summary (both architectures) ================"
@@ -756,7 +584,7 @@ if [[ "$BUILT_ALL" -eq 1 ]]; then
      echo "$rp"
    done
  else
-    echo "[WARN] No RPMs detected in summary (check build logs above)."
+    echo "No RPMs detected in summary (check build logs above)."
  fi
-  echo "==================================================================="
+  echo "===================================================================="
 fi
@@ -1,7 +1,7 @@
 <Project>

    <PropertyGroup>
-        <Version>7.17.0</Version>
+        <Version>7.21.2</Version>
    </PropertyGroup>

    <PropertyGroup>
@@ -5,27 +5,31 @@
    <CentralPackageVersionOverrideEnabled>false</CentralPackageVersionOverrideEnabled>
  </PropertyGroup>
  <ItemGroup>
-    <PackageVersion Include="Avalonia.AvaloniaEdit" Version="11.3.0" />
-    <PackageVersion Include="Avalonia.Controls.DataGrid" Version="11.3.10" />
-    <PackageVersion Include="Avalonia.Desktop" Version="11.3.10" />
-    <PackageVersion Include="Avalonia.Diagnostics" Version="11.3.10" />
-    <PackageVersion Include="ReactiveUI.Avalonia" Version="11.3.8" />
-    <PackageVersion Include="CliWrap" Version="3.10.0" />
-    <PackageVersion Include="Downloader" Version="4.0.3" />
+    <PackageVersion Include="Avalonia.AvaloniaEdit" Version="11.4.1" />
+    <PackageVersion Include="Avalonia.Controls.DataGrid" Version="11.3.13" />
+    <PackageVersion Include="Avalonia.Desktop" Version="11.3.13" />
+    <PackageVersion Include="Avalonia.Diagnostics" Version="11.3.13" />
+    <PackageVersion Include="AwesomeAssertions" Version="9.4.0" />
+    <PackageVersion Include="DialogHost.Avalonia" Version="0.11.0" />
+    <PackageVersion Include="ReactiveUI.Avalonia" Version="11.4.12" />
+    <PackageVersion Include="CliWrap" Version="3.10.1" />
+    <PackageVersion Include="Downloader" Version="5.2.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.4.0" />
    <PackageVersion Include="H.NotifyIcon.Wpf" Version="2.4.1" />
-    <PackageVersion Include="MaterialDesignThemes" Version="5.3.0" />
-    <PackageVersion Include="MessageBox.Avalonia" Version="3.3.1.1" />
-    <PackageVersion Include="QRCoder" Version="1.7.0" />
-    <PackageVersion Include="ReactiveUI" Version="22.3.1" />
+    <PackageVersion Include="MaterialDesignThemes" Version="5.3.1" />
+    <PackageVersion Include="QRCoder" Version="1.8.0" />
+    <PackageVersion Include="ReactiveUI" Version="23.2.1" />
    <PackageVersion Include="ReactiveUI.Fody" Version="19.5.41" />
-    <PackageVersion Include="ReactiveUI.WPF" Version="22.3.1" />
-    <PackageVersion Include="Semi.Avalonia" Version="11.3.7.2" />
-    <PackageVersion Include="Semi.Avalonia.AvaloniaEdit" Version="11.2.0.1" />
-    <PackageVersion Include="Semi.Avalonia.DataGrid" Version="11.3.7.2" />
-    <PackageVersion Include="NLog" Version="6.0.7" />
+    <PackageVersion Include="ReactiveUI.WPF" Version="23.2.1" />
+    <PackageVersion Include="Semi.Avalonia" Version="11.3.7.3" />
+    <PackageVersion Include="Semi.Avalonia.AvaloniaEdit" Version="11.2.0.2" />
+    <PackageVersion Include="Semi.Avalonia.DataGrid" Version="11.3.7.3" />
+    <PackageVersion Include="NLog" Version="6.1.2" />
    <PackageVersion Include="sqlite-net-pcl" Version="1.9.172" />
    <PackageVersion Include="TaskScheduler" Version="2.12.2" />
    <PackageVersion Include="WebDav.Client" Version="2.9.0" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
+    <PackageVersion Include="xunit.v3" Version="3.2.2" />
    <PackageVersion Include="YamlDotNet" Version="16.3.0" />
    <PackageVersion Include="ZXing.Net.Bindings.SkiaSharp" Version="0.16.14" />
  </ItemGroup>
@@ -0,0 +1,113 @@
+using AwesomeAssertions;
+using ServiceLib.Enums;
+using ServiceLib.Handler.Builder;
+using ServiceLib.Helper;
+using ServiceLib.Models;
+using Xunit;
+
+namespace ServiceLib.Tests.CoreConfig.Context;
+
+public class CoreConfigContextBuilderTests
+{
+    [Fact]
+    public async Task ResolveNodeAsync_DirectCycleDependency_ShouldFailWithCycleError()
+    {
+        var config = CoreConfigTestFactory.CreateConfig();
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var groupAId = NewId("group-a");
+        var groupBId = NewId("group-b");
+        var groupA = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupAId, "group-a", [groupBId]);
+        var groupB = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupBId, "group-b", [groupAId]);
+
+        await UpsertProfilesAsync(groupA, groupB);
+
+        var context = CoreConfigTestFactory.CreateContext(config, groupA, ECoreType.Xray);
+        context.AllProxiesMap.Clear();
+
+        var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
+
+        validatorResult.Success.Should().BeFalse();
+        validatorResult.Errors.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+        context.AllProxiesMap.Should().NotContainKey(groupA.IndexId);
+        context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+    }
+
+    [Fact]
+    public async Task ResolveNodeAsync_IndirectCycleDependency_ShouldFailWithCycleError()
+    {
+        var config = CoreConfigTestFactory.CreateConfig();
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var groupAId = NewId("group-a");
+        var groupBId = NewId("group-b");
+        var groupCId = NewId("group-c");
+        var groupA = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupAId, "group-a", [groupBId]);
+        var groupB = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupBId, "group-b", [groupCId]);
+        var groupC = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupCId, "group-c", [groupAId]);
+
+        await UpsertProfilesAsync(groupA, groupB, groupC);
+
+        var context = CoreConfigTestFactory.CreateContext(config, groupA, ECoreType.Xray);
+        context.AllProxiesMap.Clear();
+
+        var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
+
+        validatorResult.Success.Should().BeFalse();
+        validatorResult.Errors.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+        context.AllProxiesMap.Should().NotContainKey(groupA.IndexId);
+        context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+        context.AllProxiesMap.Should().NotContainKey(groupC.IndexId);
+    }
+
+    [Fact]
+    public async Task ResolveNodeAsync_CycleWithValidBranch_ShouldSkipCycleAndKeepValidChild()
+    {
+        var config = CoreConfigTestFactory.CreateConfig();
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var groupAId = NewId("group-a");
+        var groupBId = NewId("group-b");
+        var leafId = NewId("leaf");
+        var groupA = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupAId, "group-a", [groupBId, leafId]);
+        var groupB = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupBId, "group-b", [groupAId]);
+        var leaf = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, leafId, "leaf");
+
+        await UpsertProfilesAsync(groupA, groupB, leaf);
+
+        var context = CoreConfigTestFactory.CreateContext(config, groupA, ECoreType.Xray);
+        context.AllProxiesMap.Clear();
+
+        var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
+
+        validatorResult.Success.Should().BeTrue();
+        validatorResult.Errors.Should().BeEmpty();
+        validatorResult.Warnings.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+
+        context.AllProxiesMap.Should().ContainKey(leaf.IndexId);
+        context.AllProxiesMap.Should().ContainKey(groupA.IndexId);
+        context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+        groupA.GetProtocolExtra().ChildItems.Should().Be(leaf.IndexId);
+    }
+
+    private static string NewId(string prefix)
+    {
+        return $"{prefix}-{Guid.NewGuid():N}";
+    }
+
+    private static bool ContainsCycleDependencyMessage(string message)
+    {
+        return message.Contains("cycle dependency", StringComparison.OrdinalIgnoreCase)
+               || message.Contains("循环依赖", StringComparison.Ordinal)
+               || message.Contains("循環依賴", StringComparison.Ordinal);
+    }
+
+    private static async Task UpsertProfilesAsync(params ProfileItem[] profiles)
+    {
+        SQLiteHelper.Instance.CreateTable<ProfileItem>();
+        foreach (var profile in profiles)
+        {
+            await SQLiteHelper.Instance.ReplaceAsync(profile);
+        }
+    }
+}
@@ -0,0 +1,209 @@
+using System.Reflection;
+using ServiceLib.Enums;
+using ServiceLib.Manager;
+using ServiceLib.Models;
+
+namespace ServiceLib.Tests.CoreConfig;
+
+internal static class CoreConfigTestFactory
+{
+    public static void BindAppManagerConfig(Config config)
+    {
+        var field = typeof(AppManager).GetField("_config", BindingFlags.Instance | BindingFlags.NonPublic);
+        field?.SetValue(AppManager.Instance, config);
+    }
+
+    public static Config CreateConfig(ECoreType vmessCoreType = ECoreType.Xray)
+    {
+        return new Config
+        {
+            CoreBasicItem = new CoreBasicItem { Loglevel = "warning", MuxEnabled = false },
+            TunModeItem = new TunModeItem { EnableTun = false, IcmpRouting = "default" },
+            KcpItem = new KcpItem(),
+            GrpcItem = new GrpcItem(),
+            RoutingBasicItem =
+                new RoutingBasicItem
+                {
+                    DomainStrategy = Global.AsIs,
+                    DomainStrategy4Singbox = string.Empty,
+                    RoutingIndexId = string.Empty,
+                },
+            GuiItem = new GUIItem { EnableStatistics = false, DisplayRealTimeSpeed = false, EnableLog = false },
+            MsgUIItem = new MsgUIItem(),
+            UiItem =
+                new UIItem
+                {
+                    CurrentLanguage = "en",
+                    CurrentFontFamily = "sans",
+                    MainColumnItem = [],
+                    WindowSizeItem = []
+                },
+            ConstItem = new ConstItem(),
+            SpeedTestItem = new SpeedTestItem
+            {
+                SpeedPingTestUrl = Global.SpeedPingTestUrls.First(),
+                SpeedTestUrl = Global.SpeedTestUrls.First(),
+                SpeedTestTimeout = 10,
+                MixedConcurrencyCount = 1,
+                IPAPIUrl = string.Empty,
+            },
+            Mux4RayItem = new Mux4RayItem { Concurrency = 8, XudpConcurrency = 16, XudpProxyUDP443 = "reject" },
+            Mux4SboxItem = new Mux4SboxItem { Protocol = Global.SingboxMuxs.First(), MaxConnections = 8 },
+            HysteriaItem = new HysteriaItem { UpMbps = 100, DownMbps = 100 },
+            ClashUIItem = new ClashUIItem { ConnectionsColumnItem = [] },
+            SystemProxyItem =
+                new SystemProxyItem
+                {
+                    SystemProxyExceptions = string.Empty,
+                    SystemProxyAdvancedProtocol = string.Empty
+                },
+            WebDavItem = new WebDavItem(),
+            CheckUpdateItem = new CheckUpdateItem(),
+            Fragment4RayItem = new Fragment4RayItem { Packets = "tlshello", Length = "100-200", Interval = "10-20" },
+            Inbound =
+            [
+                new InItem
+                {
+                    Protocol = nameof(EInboundProtocol.socks),
+                    LocalPort = 10808,
+                    UdpEnabled = true,
+                    SniffingEnabled = true,
+                    RouteOnly = false,
+                    DestOverride = ["http", "tls"],
+                }
+            ],
+            GlobalHotkeys = [],
+            CoreTypeItem =
+            [
+                new CoreTypeItem { ConfigType = EConfigType.VMess, CoreType = vmessCoreType }
+            ],
+            SimpleDNSItem = new SimpleDNSItem
+            {
+                BootstrapDNS = Global.DomainPureIPDNSAddress.FirstOrDefault(),
+                ServeStale = false,
+                ParallelQuery = false,
+                Strategy4Freedom = Global.AsIs,
+                Strategy4Proxy = Global.AsIs,
+            },
+            IndexId = string.Empty,
+            SubIndexId = string.Empty,
+        };
+    }
+
+    public static ProfileItem CreateVmessNode(ECoreType coreType, string indexId = "node-1", string remarks = "demo")
+    {
+        var node = new ProfileItem
+        {
+            IndexId = indexId,
+            ConfigType = EConfigType.VMess,
+            CoreType = coreType,
+            Remarks = remarks,
+            Address = "example.com",
+            Port = 443,
+            Password = Guid.NewGuid().ToString(),
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+            Subid = string.Empty,
+        };
+
+        node.SetProtocolExtra(node.GetProtocolExtra() with { AlterId = "0", VmessSecurity = Global.DefaultSecurity, });
+
+        return node;
+    }
+
+    public static ProfileItem CreateSocksNode(ECoreType coreType, string indexId = "node-socks-1",
+        string remarks = "demo-socks")
+    {
+        return new ProfileItem
+        {
+            IndexId = indexId,
+            ConfigType = EConfigType.SOCKS,
+            CoreType = coreType,
+            Remarks = remarks,
+            Address = "127.0.0.1",
+            Port = 1080,
+            Password = "pass",
+            Username = "user",
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+            Subid = string.Empty,
+        };
+    }
+
+    public static ProfileItem CreatePolicyGroupNode(ECoreType coreType, string indexId, string remarks,
+        IEnumerable<string> childIndexIds)
+    {
+        var node = new ProfileItem
+        {
+            IndexId = indexId,
+            ConfigType = EConfigType.PolicyGroup,
+            CoreType = coreType,
+            Remarks = remarks,
+        };
+        node.SetProtocolExtra(node.GetProtocolExtra() with
+        {
+            GroupType = nameof(EConfigType.PolicyGroup),
+            ChildItems = string.Join(",", childIndexIds),
+        });
+
+        return node;
+    }
+
+    public static ProfileItem CreateProxyChainNode(ECoreType coreType, string indexId, string remarks,
+        IEnumerable<string> childIndexIds)
+    {
+        var node = new ProfileItem
+        {
+            IndexId = indexId,
+            ConfigType = EConfigType.ProxyChain,
+            CoreType = coreType,
+            Remarks = remarks,
+        };
+        node.SetProtocolExtra(node.GetProtocolExtra() with
+        {
+            GroupType = nameof(EConfigType.ProxyChain),
+            ChildItems = string.Join(",", childIndexIds),
+        });
+
+        return node;
+    }
+
+    public static CoreConfigContext CreateContext(Config config, ProfileItem node, ECoreType runCoreType)
+    {
+        return new CoreConfigContext
+        {
+            Node = node,
+            RunCoreType = runCoreType,
+            AppConfig = config,
+            RoutingItem = new RoutingItem
+            {
+                Id = "r1",
+                Remarks = "default",
+                RuleSet = "[]",
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            },
+            RawDnsItem = null,
+            SimpleDnsItem = config.SimpleDNSItem,
+            AllProxiesMap = new Dictionary<string, ProfileItem> { [node.IndexId] = node },
+            FullConfigTemplate = null,
+            IsTunEnabled = false,
+            ProtectDomainList = [],
+        };
+    }
+
+    public static Config CreateConfigWithDirectExpectedIPs(ECoreType coreType,
+        string directExpectedIPs = "192.168.0.0/16,geoip:cn")
+    {
+        var config = CreateConfig(coreType);
+        config.SimpleDNSItem.DirectExpectedIPs = directExpectedIPs;
+        return config;
+    }
+
+    public static Config CreateConfigWithBootstrapDNS(ECoreType coreType, string bootstrapDns = "8.8.8.8")
+    {
+        var config = CreateConfig(coreType);
+        config.SimpleDNSItem.BootstrapDNS = bootstrapDns;
+        return config;
+    }
+}
@@ -0,0 +1,560 @@
+using AwesomeAssertions;
+using ServiceLib.Common;
+using ServiceLib.Enums;
+using ServiceLib.Manager;
+using ServiceLib.Models;
+using ServiceLib.Services.CoreConfig;
+using Xunit;
+
+namespace ServiceLib.Tests.CoreConfig.Singbox;
+
+public class CoreConfigSingboxServiceTests
+{
+    [Fact]
+    public void GenerateClientConfigContent_ShouldGenerateBasicProxyConfig()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box);
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        result.Data.Should().NotBeNull();
+
+        var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString());
+        singboxConfig.Should().NotBeNull();
+        singboxConfig!.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "socks");
+        singboxConfig.inbounds.Should().Contain(i => i.type == nameof(EInboundProtocol.mixed));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_TunWithLoopbackPreSocks_ShouldKeepMixedInbound()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box);
+        node.Address = Global.Loopback;
+        node.Port = 1080;
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            IsTunEnabled = true,
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.inbounds.Should().Contain(i =>
+            i.type == nameof(EInboundProtocol.mixed)
+            && i.listen == Global.Loopback
+            && i.listen_port == AppManager.Instance.GetLocalPort(EInboundProtocol.socks));
+        cfg.inbounds.Should().Contain(i => i.type == "tun");
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_BindInterface_ShouldUseDialBindInterface()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.CoreBasicItem.BindInterface = "eth0";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.sing_box);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            IsTunEnabled = true,
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var proxy = cfg.outbounds.First(o => o.tag == Global.ProxyTag);
+
+        proxy.bind_interface.Should().Be("eth0");
+        proxy.detour.Should().BeNullOrEmpty();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroup_ShouldExpandChildrenAndBuildSelector()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.sing_box, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChain_ShouldBuildDetourChain()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.sing_box, "c1", "chain",
+            [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "socks");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o =>
+            o.tag == Global.ProxyTag &&
+            (o.detour ?? string.Empty).StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroupWithProxyChain_ShouldBuildCombinedOutbounds()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n3", "node-3");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.sing_box, "c1", "chain",
+            [n1.IndexId, n2.IndexId]);
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.sing_box, "g1", "group",
+            [chain.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[chain.IndexId] = chain;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChainWithPolicyGroup_ShouldBuildClonedChainBranches()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n3", "node-3");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.sing_box, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.sing_box, "c1", "chain",
+            [group.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[group.IndexId] = group;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-2-", StringComparison.Ordinal));
+
+        var proxyCloneCount = cfg.outbounds.Count(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal));
+        proxyCloneCount.Should().Be(2);
+
+        var allCloneDetoursPointToGroupBranches = cfg.outbounds
+            .Where(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal))
+            .All(o => (o.detour ?? string.Empty).StartsWith("chain-proxy-1-group-", StringComparison.Ordinal));
+        allCloneDetoursPointToGroupBranches.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_DirectAndBlock_ShouldApplyRules()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-1",
+                Remarks = "split-direct-block",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["full:direct.example.com"],
+                    },
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.BlockTag,
+                        Domain = ["full:block.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasDirectRule = cfg.route.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("direct.example.com")
+            && r.outbound == Global.DirectTag);
+        hasDirectRule.Should().BeTrue();
+
+        var hasBlockRule = cfg.route.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("block.example.com")
+            && r.action == "reject");
+        hasBlockRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_ByRemark_ShouldGenerateTargetOutbound()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var routeNode = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-route", "route-node");
+
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-2",
+                Remarks = "split-remark",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = routeNode.Remarks,
+                        Domain = ["full:route.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+        context.AllProxiesMap[$"remark:{routeNode.Remarks}"] = routeNode;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var expectedPrefix = $"{routeNode.IndexId}-{Global.ProxyTag}-{routeNode.Remarks}";
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith(expectedPrefix, StringComparison.Ordinal));
+
+        var hasRouteRule = cfg.route.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("route.example.com")
+            && (r.outbound ?? string.Empty).StartsWith(expectedPrefix, StringComparison.Ordinal));
+        hasRouteRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_ShouldApplyGeoipAndCidrToDirectDnsRule()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(
+            ECoreType.sing_box,
+            "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-expected",
+                Remarks = "dns-direct-expected",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:cn"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasExpectedRule = cfg.dns.rules?.Any(r =>
+            r.server == Global.SingboxDirectDNSTag
+            && r.ip_cidr?.Contains("192.168.0.0/16") == true
+            && r.rule_set?.Contains("geosite-cn") == true
+            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
+
+        hasExpectedRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_BootstrapDNS_ShouldConfigurePureIPResolver()
+    {
+        var bootstrapDns = "8.8.8.8";
+        var config = CoreConfigTestFactory.CreateConfigWithBootstrapDNS(ECoreType.sing_box, bootstrapDns);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box);
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        config.SimpleDNSItem.BootstrapDNS.Should().Be(bootstrapDns);
+
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var bootstrapServer = cfg.dns.servers?.FirstOrDefault(s => s.tag == Global.SingboxLocalDNSTag);
+        bootstrapServer.Should().NotBeNull();
+        (bootstrapServer?.server ?? string.Empty).Should().Contain(bootstrapDns);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DnsFallback_LastRuleDirect_ShouldUseDirectFinalDns()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.SimpleDNSItem.DirectDNS = "1.1.1.1";
+        config.SimpleDNSItem.RemoteDNS = "9.9.9.9";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-direct-final",
+                Remarks = "direct-final",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Ip = ["0.0.0.0/0"],
+                        Port = "0-65535",
+                        Network = "tcp,udp",
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.dns.final.Should().Be(Global.SingboxDirectDNSTag);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_NonMatchingRegion_ShouldNotApplyExpectedRule()
+    {
+        var config =
+            CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.sing_box, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-unmatched",
+                Remarks = "dns-direct-unmatched",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:us"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasExpectedRule = cfg.dns.rules?.Any(r =>
+            r.server == Global.SingboxDirectDNSTag
+            && r.ip_cidr?.Contains("192.168.0.0/16") == true
+            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
+        hasExpectedRule.Should().BeFalse();
+    }
+
+    [Theory]
+    [InlineData("geosite:cn", "geosite-cn")]
+    [InlineData("geosite:geolocation-cn", "geosite-geolocation-cn")]
+    [InlineData("geosite:tld-cn", "geosite-tld-cn")]
+    public void GenerateClientConfigContent_DirectExpectedIPs_RegionVariant_ShouldApplyExpectedRule(string domainTag,
+        string expectedRuleSetTag)
+    {
+        var config =
+            CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.sing_box, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-variant",
+                Remarks = "dns-direct-variant",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true, RuleType = ERuleType.DNS, OutboundTag = Global.DirectTag, Domain = [domainTag],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasExpectedRule = cfg.dns.rules?.Any(r =>
+            r.server == Global.SingboxDirectDNSTag
+            && r.ip_cidr?.Contains("192.168.0.0/16") == true
+            && r.rule_set?.Contains(expectedRuleSetTag) == true
+            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
+        hasExpectedRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_Hosts_ShouldPopulateHostsServerAndDomainResolver()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.SimpleDNSItem.Hosts = "resolver.example 1.1.1.1";
+        config.SimpleDNSItem.DirectDNS = "https://resolver.example/dns-query";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box);
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hostsServer = cfg.dns.servers.FirstOrDefault(s => s.tag == Global.SingboxHostsDNSTag);
+        hostsServer.Should().NotBeNull();
+        hostsServer!.predefined.Should().ContainKey("resolver.example");
+        hostsServer.predefined!["resolver.example"].Should().Contain("1.1.1.1");
+
+        var directServer = cfg.dns.servers.FirstOrDefault(s => s.tag == Global.SingboxDirectDNSTag);
+        directServer.Should().NotBeNull();
+        directServer!.domain_resolver.Should().Be(Global.SingboxHostsDNSTag);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RawDnsEnabled_ShouldUseCustomDnsAndInjectLocalResolver()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var rawDns = new Dns4Sbox
+        {
+            servers =
+            [
+                new Server4Sbox { tag = "remote", type = "udp", server = "8.8.8.8", detour = Global.ProxyTag, }
+            ],
+            rules = [],
+        };
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RawDnsItem = new DNSItem
+            {
+                Id = "dns-raw-1",
+                Remarks = "raw",
+                Enabled = true,
+                CoreType = ECoreType.sing_box,
+                NormalDNS = JsonUtils.Serialize(rawDns),
+                DomainDNSAddress = "1.1.1.1",
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.dns.servers.Should().Contain(s => s.tag == "remote" && s.type == "udp" && s.server == "8.8.8.8");
+        cfg.dns.servers.Should().Contain(s => s.tag == Global.SingboxLocalDNSTag);
+        cfg.dns.rules.Should().Contain(r => r.clash_mode == ERuleMode.Global.ToString());
+        cfg.dns.rules.Should().Contain(r => r.clash_mode == ERuleMode.Direct.ToString());
+    }
+}
@@ -0,0 +1,539 @@
+using AwesomeAssertions;
+using ServiceLib.Common;
+using ServiceLib.Enums;
+using ServiceLib.Models;
+using ServiceLib.Services.CoreConfig;
+using Xunit;
+
+namespace ServiceLib.Tests.CoreConfig.V2ray;
+
+public class CoreConfigV2rayServiceTests
+{
+    [Fact]
+    public void GenerateClientConfigContent_ShouldGenerateBasicProxyConfig()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        result.Data.Should().NotBeNull();
+
+        var v2rayConfig = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString());
+        v2rayConfig.Should().NotBeNull();
+        v2rayConfig!.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.protocol == "vmess");
+        v2rayConfig.inbounds.Should().Contain(i => i.protocol == nameof(EInboundProtocol.mixed));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroup_ShouldExpandChildrenAndBuildBalancer()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+        cfg.routing.balancers.Should().NotBeNull();
+        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChain_ShouldBuildDialerProxyChain()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.Xray, "c1", "chain", [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        var hasDialerChain = cfg.outbounds.Any(o =>
+            o.tag == Global.ProxyTag
+            && o.streamSettings is not null
+            && o.streamSettings.sockopt is not null
+            && (o.streamSettings.sockopt.dialerProxy ?? string.Empty).StartsWith("chain-proxy-1-",
+                StringComparison.Ordinal));
+        hasDialerChain.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroupWithProxyChain_ShouldBuildCombinedOutbounds()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n3", "node-3");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.Xray, "c1", "chain", [n1.IndexId, n2.IndexId]);
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "g1", "group",
+            [chain.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[chain.IndexId] = chain;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+        cfg.routing.balancers.Should().NotBeNull();
+        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChainWithPolicyGroup_ShouldBuildClonedChainBranches()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n3", "node-3");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.Xray, "c1", "chain",
+            [group.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[group.IndexId] = group;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-2-", StringComparison.Ordinal));
+
+        var proxyCloneCount = cfg.outbounds.Count(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal));
+        proxyCloneCount.Should().Be(2);
+
+        var allCloneDialersPointToGroupBranches = cfg.outbounds
+            .Where(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal))
+            .All(o => (o.streamSettings?.sockopt?.dialerProxy ?? string.Empty).StartsWith("chain-proxy-1-group-",
+                StringComparison.Ordinal));
+        allCloneDialersPointToGroupBranches.Should().BeTrue();
+
+        cfg.routing.balancers.Should().NotBeNull();
+        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_DirectAndBlock_ShouldApplyRules()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-1",
+                Remarks = "split-direct-block",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["full:direct.example.com"],
+                    },
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.BlockTag,
+                        Domain = ["full:block.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        var hasDirectRule = cfg.routing.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("full:direct.example.com")
+            && r.outboundTag == Global.DirectTag);
+        hasDirectRule.Should().BeTrue();
+
+        var hasBlockRule = cfg.routing.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("full:block.example.com")
+            && r.outboundTag == Global.BlockTag);
+        hasBlockRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_ByRemark_ShouldGenerateTargetOutbound()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var routeNode = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n-route", "route-node");
+
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-2",
+                Remarks = "split-remark",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = routeNode.Remarks,
+                        Domain = ["full:route.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+        context.AllProxiesMap[$"remark:{routeNode.Remarks}"] = routeNode;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var expectedPrefix = $"{routeNode.IndexId}-{Global.ProxyTag}-{routeNode.Remarks}";
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith(expectedPrefix, StringComparison.Ordinal));
+        var hasRouteRule = cfg.routing.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("full:route.example.com")
+            && (r.outboundTag ?? string.Empty).StartsWith(expectedPrefix, StringComparison.Ordinal));
+        hasRouteRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_ShouldApplyExpectedIPsToDirectDnsServer()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-expected",
+                Remarks = "dns-direct-expected",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:cn"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasExpectedServer = dnsServers.Any(s =>
+            (s.tag ?? string.Empty).StartsWith(Global.DirectDnsTag, StringComparison.Ordinal)
+            && s.domains?.Contains("geosite:cn") == true
+            && s.expectedIPs?.Contains("192.168.0.0/16") == true
+            && s.expectedIPs?.Contains("geoip:cn") == true);
+        hasExpectedServer.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_BootstrapDNS_ShouldApplyToDnsServerDomains()
+    {
+        var bootstrapDns = "8.8.8.8";
+        var config = CoreConfigTestFactory.CreateConfigWithBootstrapDNS(ECoreType.Xray, bootstrapDns);
+        config.SimpleDNSItem.DirectDNS = "https://dns-direct.example/dns-query";
+        config.SimpleDNSItem.RemoteDNS = "https://dns-remote.example/dns-query";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasBootstrapServer = dnsServers.Any(s =>
+            s.address == bootstrapDns
+            && s.domains?.Contains("full:dns-direct.example") == true
+            && s.domains?.Contains("full:dns-remote.example") == true);
+        hasBootstrapServer.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DnsFallback_LastRuleDirect_ShouldUseDirectDnsServers()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        config.SimpleDNSItem.DirectDNS = "1.1.1.1";
+        config.SimpleDNSItem.RemoteDNS = "9.9.9.9";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-direct-final",
+                Remarks = "direct-final",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Ip = ["0.0.0.0/0"],
+                        Port = "0-65535",
+                        Network = "tcp,udp",
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasDirectFallback = dnsServers.Any(s =>
+            (s.tag ?? string.Empty).StartsWith(Global.DirectDnsTag, StringComparison.Ordinal)
+            && s.address == "1.1.1.1");
+        hasDirectFallback.Should().BeTrue();
+
+        var hasRemoteFallback = dnsServers.Any(s => s.address == "9.9.9.9");
+        hasRemoteFallback.Should().BeFalse();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_NonMatchingRegion_ShouldNotApplyExpectedIPs()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-unmatched",
+                Remarks = "dns-direct-unmatched",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:us"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasExpectedIPs = dnsServers.Any(s =>
+            s.expectedIPs?.Contains("192.168.0.0/16") == true
+            || s.expectedIPs?.Contains("geoip:cn") == true);
+        hasExpectedIPs.Should().BeFalse();
+    }
+
+    [Theory]
+    [InlineData("geosite:cn")]
+    [InlineData("geosite:geolocation-cn")]
+    [InlineData("geosite:tld-cn")]
+    public void GenerateClientConfigContent_DirectExpectedIPs_RegionVariant_ShouldApplyExpectedIPs(string domainTag)
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-variant",
+                Remarks = "dns-direct-variant",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true, RuleType = ERuleType.DNS, OutboundTag = Global.DirectTag, Domain = [domainTag],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasExpectedServer = dnsServers.Any(s =>
+            (s.tag ?? string.Empty).StartsWith(Global.DirectDnsTag, StringComparison.Ordinal)
+            && s.domains?.Contains(domainTag) == true
+            && s.expectedIPs?.Contains("192.168.0.0/16") == true
+            && s.expectedIPs?.Contains("geoip:cn") == true);
+        hasExpectedServer.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_Hosts_ShouldPopulateDnsHosts()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        config.SimpleDNSItem.Hosts = "resolver.example 1.1.1.1";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        dns.hosts.Should().NotBeNull();
+        dns.hosts!.Should().ContainKey("resolver.example");
+        JsonUtils.Serialize(dns.hosts!["resolver.example"]).Should().Contain("1.1.1.1");
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RawDnsEnabled_ShouldUseCustomDnsConfig()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RawDnsItem = new DNSItem
+            {
+                Id = "dns-raw-1",
+                Remarks = "raw",
+                Enabled = true,
+                CoreType = ECoreType.Xray,
+                NormalDNS = "{\"servers\":[\"8.8.8.8\"],\"hosts\":{\"raw.example\":\"1.1.1.1\"}}",
+                DomainStrategy4Freedom = "UseIPv4",
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        JsonUtils.Serialize(dns.servers).Should().Contain("8.8.8.8");
+        dns.hosts.Should().NotBeNull();
+        dns.hosts!.Should().ContainKey("raw.example");
+        JsonUtils.Serialize(dns.hosts!["raw.example"]).Should().Contain("1.1.1.1");
+
+        var directOutbound = cfg.outbounds.FirstOrDefault(o => o.tag == Global.DirectTag && o.protocol == "freedom");
+        directOutbound.Should().NotBeNull();
+        directOutbound!.settings.domainStrategy.Should().Be("UseIPv4");
+    }
+}
@@ -0,0 +1,173 @@
+using AwesomeAssertions;
+using ServiceLib.Enums;
+using ServiceLib.Handler.Fmt;
+using ServiceLib.Models;
+using Xunit;
+
+namespace ServiceLib.Tests.Fmt;
+
+public class FmtHandlerTests
+{
+    [Fact]
+    public void GetShareUriAndResolveConfig_Vmess_ShouldRoundTripBasicFields()
+    {
+        var source = CreateVmessProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.VMess);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Password.Should().Be(source.Password);
+        resolved.GetProtocolExtra().AlterId.Should().Be(source.GetProtocolExtra().AlterId);
+    }
+
+    [Fact]
+    public void GetShareUriAndResolveConfig_Vless_ShouldRoundTripBasicFields()
+    {
+        var source = CreateVlessProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.VLESS);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Password.Should().Be(source.Password);
+        resolved.GetProtocolExtra().VlessEncryption.Should().Be(Global.None);
+    }
+
+    [Fact]
+    public void GetShareUriAndResolveConfig_Shadowsocks_ShouldRoundTripBasicFields()
+    {
+        var source = CreateShadowsocksProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.Shadowsocks);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Password.Should().Be(source.Password);
+        resolved.GetProtocolExtra().SsMethod.Should().Be(source.GetProtocolExtra().SsMethod);
+    }
+
+    [Fact]
+    public void GetShareUriAndResolveConfig_Socks_ShouldRoundTripBasicFields()
+    {
+        var source = CreateSocksProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.SOCKS);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Username.Should().Be(source.Username);
+        resolved.Password.Should().Be(source.Password);
+    }
+
+    [Fact]
+    public void ResolveConfig_UnsupportedProtocol_ShouldReturnNull()
+    {
+        var resolved = FmtHandler.ResolveConfig("not-a-share-uri", out var msg);
+
+        resolved.Should().BeNull();
+        msg.Should().NotBeNullOrWhiteSpace();
+    }
+
+    [Fact]
+    public void GetShareUri_UnsupportedConfigType_ShouldReturnNull()
+    {
+        var item = new ProfileItem { ConfigType = EConfigType.PolicyGroup, Remarks = "group", };
+
+        var uri = FmtHandler.GetShareUri(item);
+
+        uri.Should().BeNull();
+    }
+
+    private static ProfileItem ExportThenImport(ProfileItem source)
+    {
+        var uri = FmtHandler.GetShareUri(source);
+
+        uri.Should().NotBeNullOrWhiteSpace();
+        uri!.StartsWith(Global.ProtocolShares[source.ConfigType], StringComparison.OrdinalIgnoreCase).Should()
+            .BeTrue();
+
+        var resolved = FmtHandler.ResolveConfig(uri, out var msg);
+
+        resolved.Should().NotBeNull($"uri: {uri}, msg: {msg}");
+        return resolved!;
+    }
+
+    private static ProfileItem CreateVmessProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.VMess,
+            Remarks = "vmess demo",
+            Address = "example.com",
+            Port = 443,
+            Password = Guid.NewGuid().ToString(),
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { AlterId = "0", VmessSecurity = Global.DefaultSecurity, });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateVlessProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.VLESS,
+            Remarks = "vless demo",
+            Address = "vless.example",
+            Port = 8443,
+            Password = Guid.NewGuid().ToString(),
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { VlessEncryption = Global.None, });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateShadowsocksProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.Shadowsocks,
+            Remarks = "ss demo",
+            Address = "1.2.3.4",
+            Port = 8388,
+            Password = "pass123",
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { SsMethod = "aes-128-gcm", });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateSocksProfile()
+    {
+        return new ProfileItem
+        {
+            ConfigType = EConfigType.SOCKS,
+            Remarks = "socks demo",
+            Address = "127.0.0.1",
+            Port = 1080,
+            Username = "user",
+            Password = "pass",
+        };
+    }
+}
@@ -0,0 +1,37 @@
+using AwesomeAssertions;
+using ServiceLib.Enums;
+using ServiceLib.Handler.Fmt;
+using ServiceLib.Tests.CoreConfig;
+using Xunit;
+
+namespace ServiceLib.Tests.Fmt;
+
+public class InnerFmtTests
+{
+    [Fact]
+    public void ToUriAndResolve_ShouldRoundTripPolicyGroupReferences()
+    {
+        var childA = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "child-a", "child-a");
+        var childB = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "child-b", "child-b");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "group-1", "group-1",
+            [childA.IndexId, childB.IndexId]);
+        group.SetProtocolExtra(group.GetProtocolExtra() with { SubChildItems = "original-sub" });
+
+        var uri = InnerFmt.ToUri([group, childA, childB]);
+
+        uri.Should().NotBeNullOrWhiteSpace();
+
+        var resolved = InnerFmt.Resolve(uri!, "sub-123");
+
+        resolved.Should().NotBeNull();
+        resolved.Should().HaveCount(3);
+
+        var resolvedGroup = resolved!.Single(x => x.Remarks == group.Remarks);
+        var resolvedChildA = resolved.Single(x => x.Remarks == childA.Remarks);
+        var resolvedChildB = resolved.Single(x => x.Remarks == childB.Remarks);
+
+        resolvedGroup.ConfigType.Should().Be(EConfigType.PolicyGroup);
+        resolvedGroup.GetProtocolExtra().SubChildItems.Should().Be("sub-123");
+        resolvedGroup.GetProtocolExtra().ChildItems.Should().Be($"{resolvedChildA.IndexId},{resolvedChildB.IndexId}");
+    }
+}
@@ -0,0 +1,47 @@
+using AwesomeAssertions;
+using ServiceLib.Handler.Fmt;
+using Xunit;
+
+namespace ServiceLib.Tests.Fmt;
+
+public class WireguardFmtTests
+{
+    [Fact]
+    public void ResolveConfig_ShouldParsePeersAndIgnoreInlineComments()
+    {
+        const string config =
+            """
+            [Interface]
+            PrivateKey = interface-private-key
+            Address = 10.0.0.2/32, fd00::2/128 ; inline comment
+            MTU = 1420
+
+            [Peer]
+            PublicKey = peer-public-key
+            PresharedKey = peer-preshared-key
+            Reserved = 1, 2, 3 # inline comment
+            Endpoint = [2001:db8::1]:51820 # inline comment
+
+            [Peer]
+            PublicKey = peer-public-key-2
+            Endpoint = example.com:12345
+            """;
+
+        var resolved = WireguardFmt.ResolveConfig(config);
+
+        resolved.Should().NotBeNull();
+        resolved.Should().HaveCount(2);
+
+        var first = resolved![0];
+        first.Address.Should().Be("2001:db8::1");
+        first.Port.Should().Be(51820);
+        first.Password.Should().Be("interface-private-key");
+        first.GetProtocolExtra().WgReserved.Should().Be("1, 2, 3");
+        first.GetProtocolExtra().WgInterfaceAddress.Should().Be("10.0.0.2/32, fd00::2/128");
+        first.GetProtocolExtra().WgMtu.Should().Be(1420);
+
+        var second = resolved[1];
+        second.Address.Should().Be("example.com");
+        second.Port.Should().Be(12345);
+    }
+}
@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="AwesomeAssertions" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="xunit.runner.visualstudio">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+    <PackageReference Include="xunit.v3" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\ServiceLib\ServiceLib.csproj" />
+  </ItemGroup>
+
+</Project>
@@ -0,0 +1,5 @@
+global using System.Buffers.Binary;
+global using System.Diagnostics;
+global using System.Net;
+global using System.Net.Sockets;
+global using System.Text;
@@ -0,0 +1,7 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+      <OutputType>Library</OutputType>
+  </PropertyGroup>
+
+</Project>
@@ -0,0 +1,420 @@
+namespace ServiceLib.UdpTest;
+
+public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposable
+{
+    private TcpClient _tcpClient;
+    private UdpClient _udpClient;
+    private IPEndPoint _relayEndPoint;
+
+    private bool _initialized = false;
+
+    /// <summary>
+    /// Send UDP data to a remote endpoint (IP address)
+    /// </summary>
+    public async Task SendAsync(IPEndPoint remote, byte[] data)
+    {
+        var addrData = new Socks5AddressData
+        {
+            AddressType = remote.Address.AddressFamily == AddressFamily.InterNetwork
+                ? Socks5AddressData.AddrTypeIPv4
+                : Socks5AddressData.AddrTypeIPv6,
+            Host = remote.Address.ToString(),
+            Port = (ushort)remote.Port
+        };
+        var packet = BuildSocks5UdpPacket(addrData, data);
+        await _udpClient.SendAsync(packet, packet.Length, _relayEndPoint);
+    }
+
+    /// <summary>
+    /// Send UDP data to a remote endpoint (domain name or IP address)
+    /// </summary>
+    /// <param name="host">Domain name or IP address</param>
+    /// <param name="port">Port number</param>
+    /// <param name="data">Data to send</param>
+    public async Task SendAsync(string host, ushort port, byte[] data)
+    {
+        var addrData = new Socks5AddressData();
+
+        // Try to parse as IP address first
+        if (IPAddress.TryParse(host, out var ipAddr))
+        {
+            addrData.AddressType = ipAddr.AddressFamily == AddressFamily.InterNetwork
+                ? Socks5AddressData.AddrTypeIPv4
+                : Socks5AddressData.AddrTypeIPv6;
+            addrData.Host = ipAddr.ToString();
+        }
+        else
+        {
+            // Treat as domain name
+            addrData.AddressType = Socks5AddressData.AddrTypeDomain;
+            addrData.Host = host;
+        }
+
+        addrData.Port = port;
+
+        var packet = BuildSocks5UdpPacket(addrData, data);
+        await _udpClient.SendAsync(packet, packet.Length, _relayEndPoint);
+    }
+
+    /// <summary>
+    /// Receive UDP data from remote endpoint
+    /// </summary>
+    /// <param name="cancellationToken">Cancellation token to cancel the receive operation</param>
+    /// <returns>Remote endpoint information and received data</returns>
+    public async Task<(Socks5RemoteEndpoint Remote, byte[] Data)> ReceiveAsync(
+        CancellationToken cancellationToken = default)
+    {
+        var result = await _udpClient.ReceiveAsync(cancellationToken).ConfigureAwait(false);
+        var (remote, payload) = ParseSocks5UdpPacket(result.Buffer);
+        return (remote, payload);
+    }
+
+    /// <summary>
+    /// Represents a remote endpoint that can be either an IP address or a domain name
+    /// </summary>
+    public class Socks5RemoteEndpoint(string host, ushort port, bool isDomain)
+    {
+        public string Host { get; set; } = host;
+        public ushort Port { get; set; } = port;
+        public bool IsDomain { get; set; } = isDomain;
+    }
+
+    private static byte[] BuildSocks5UdpPacket(Socks5AddressData addressData, byte[] data)
+    {
+        using var ms = new MemoryStream();
+
+        // RSV (2 bytes) + FRAG (1 byte) - Reserved and Fragment fields
+        ms.WriteByte(0x00);
+        ms.WriteByte(0x00);
+        ms.WriteByte(0x00);
+
+        // Write address (ATYP + address + port)
+        ms.Write(addressData.ToBytes());
+
+        // User data payload
+        ms.Write(data);
+
+        return ms.ToArray();
+    }
+
+    private static (Socks5RemoteEndpoint Remote, byte[] Data) ParseSocks5UdpPacket(byte[] packet)
+    {
+        if (packet.Length < 10) // Minimum length: RSV(2) + FRAG(1) + ATYP(1) + IPv4(4) + Port(2) = 10
+        {
+            throw new ArgumentException("Invalid SOCKS5 UDP packet: too short");
+        }
+
+        var offset = 0;
+
+        // RSV (2 bytes) - Reserved field, skip
+        offset += 2;
+
+        // FRAG (1 byte) - Fragment number, currently only support 0 (no fragmentation)
+        var frag = packet[offset++];
+        if (frag != 0x00)
+        {
+            throw new NotSupportedException("SOCKS5 UDP fragmentation is not supported");
+        }
+
+        // ATYP (1 byte) - Address type
+        var addressType = packet[offset++];
+
+        string host;
+        int addressLength;
+        bool isDomain;
+
+        switch (addressType)
+        {
+            case Socks5AddressData.AddrTypeIPv4:
+                if (packet.Length < offset + 4)
+                {
+                    throw new ArgumentException("Invalid SOCKS5 UDP packet: IPv4 address incomplete");
+                }
+
+                var ipv4Bytes = new byte[4];
+                Array.Copy(packet, offset, ipv4Bytes, 0, 4);
+                host = new IPAddress(ipv4Bytes).ToString();
+                addressLength = 4;
+                isDomain = false;
+                break;
+
+            case Socks5AddressData.AddrTypeIPv6:
+                if (packet.Length < offset + 16)
+                {
+                    throw new ArgumentException("Invalid SOCKS5 UDP packet: IPv6 address incomplete");
+                }
+
+                var ipv6Bytes = new byte[16];
+                Array.Copy(packet, offset, ipv6Bytes, 0, 16);
+                host = new IPAddress(ipv6Bytes).ToString();
+                addressLength = 16;
+                isDomain = false;
+                break;
+
+            case Socks5AddressData.AddrTypeDomain:
+                if (packet.Length < offset + 1)
+                {
+                    throw new ArgumentException("Invalid SOCKS5 UDP packet: domain length missing");
+                }
+
+                var domainLength = packet[offset++];
+                if (packet.Length < offset + domainLength)
+                {
+                    throw new ArgumentException("Invalid SOCKS5 UDP packet: domain incomplete");
+                }
+
+                host = Encoding.ASCII.GetString(packet, offset, domainLength);
+                addressLength = domainLength;
+                isDomain = true;
+                break;
+
+            default:
+                throw new NotSupportedException($"Unsupported SOCKS5 address type: {addressType}");
+        }
+
+        offset += addressLength;
+
+        // Port (2 bytes, big-endian)
+        if (packet.Length < offset + 2)
+        {
+            throw new ArgumentException("Invalid SOCKS5 UDP packet: port incomplete");
+        }
+
+        var port = BinaryPrimitives.ReadUInt16BigEndian(packet.AsSpan(offset, 2));
+        offset += 2;
+
+        // Data (remaining bytes)
+        var dataLength = packet.Length - offset;
+        var data = new byte[dataLength];
+        if (dataLength > 0)
+        {
+            Array.Copy(packet, offset, data, 0, dataLength);
+        }
+
+        // Create remote endpoint without DNS resolution
+        var remote = new Socks5RemoteEndpoint(host, port, isDomain);
+        return (remote, data);
+    }
+
+    public void Dispose()
+    {
+        _tcpClient.Dispose();
+        _udpClient.Dispose();
+    }
+
+    #region SOCKS5 Connection Handling
+
+    private const byte Socks5Version = 0x05;
+    private const byte SocksCmdUdpAssociate = 0x03;
+
+    public async Task<bool> EstablishUdpAssociationAsync(CancellationToken cancellationToken)
+    {
+        if (_initialized)
+        {
+            Dispose();
+            _initialized = false;
+        }
+
+        _udpClient = new UdpClient(new IPEndPoint(IPAddress.Any, 0));
+        _tcpClient = new TcpClient();
+        try
+        {
+            await _tcpClient.ConnectAsync(socks5Host, socks5TcpPort, cancellationToken).ConfigureAwait(false);
+        }
+        catch (SocketException)
+        {
+            return false;
+        }
+
+        var tcpControlStream = _tcpClient.GetStream();
+
+        byte[] handshakeRequest = [Socks5Version, 0x01, 0x00];
+        await tcpControlStream.WriteAsync(handshakeRequest, cancellationToken).ConfigureAwait(false);
+        var handshakeResponse = new byte[2];
+        if (await tcpControlStream.ReadAsync(handshakeResponse, cancellationToken).ConfigureAwait(false) < 2 ||
+            handshakeResponse[0] != Socks5Version || handshakeResponse[1] != 0x00)
+        {
+            return false;
+        }
+
+        var clientAddrForSocks = new Socks5AddressData
+        {
+            AddressType = Socks5AddressData.AddrTypeIPv4,
+            Host = "0.0.0.0",
+            Port = 0
+        };
+        using var udpAssociateReqMs = new MemoryStream();
+        udpAssociateReqMs.WriteByte(Socks5Version);
+        udpAssociateReqMs.WriteByte(SocksCmdUdpAssociate);
+        udpAssociateReqMs.WriteByte(0x00);
+        udpAssociateReqMs.Write(clientAddrForSocks.ToBytes());
+        await tcpControlStream.WriteAsync(udpAssociateReqMs.ToArray(), cancellationToken).ConfigureAwait(false);
+
+        var verRepRsv = new byte[3];
+        if (await tcpControlStream.ReadAsync(verRepRsv, cancellationToken).ConfigureAwait(false) < 3 ||
+            verRepRsv[0] != Socks5Version || verRepRsv[1] != 0x00)
+        {
+            return false;
+        }
+
+        var proxyRelaySocksAddr =
+            await Socks5AddressData.ParseAsync(tcpControlStream, cancellationToken).ConfigureAwait(false);
+        if (proxyRelaySocksAddr == null || !IPAddress.TryParse(proxyRelaySocksAddr.Host, out var proxyRelayIp))
+        {
+            return false;
+        }
+
+        _relayEndPoint = new IPEndPoint(proxyRelayIp, proxyRelaySocksAddr.Port);
+        _initialized = true;
+        return true;
+    }
+
+    #endregion SOCKS5 Connection Handling
+
+    #region SOCKS5 Address Handling
+
+    private class Socks5AddressData
+    {
+        public const byte AddrTypeIPv4 = 0x01;
+        public const byte AddrTypeDomain = 0x03;
+        public const byte AddrTypeIPv6 = 0x04;
+
+        public byte AddressType { get; set; }
+        public string Host { get; set; } = string.Empty;
+        public ushort Port { get; set; }
+
+        public byte[] ToBytes()
+        {
+            using var ms = new MemoryStream();
+            ms.WriteByte(AddressType);
+            switch (AddressType)
+            {
+                case AddrTypeIPv4:
+                    if (IPAddress.TryParse(Host, out var ip) && ip.AddressFamily == AddressFamily.InterNetwork)
+                    {
+                        ms.Write(ip.GetAddressBytes(), 0, 4);
+                    }
+                    else
+                    {
+                        ms.Write([0, 0, 0, 0]);
+                    }
+
+                    break;
+
+                case AddrTypeDomain:
+                    if (string.IsNullOrEmpty(Host))
+                    {
+                        ms.WriteByte(0);
+                    }
+                    else
+                    {
+                        var domainBytes = Encoding.ASCII.GetBytes(Host);
+                        ms.WriteByte((byte)domainBytes.Length);
+                        ms.Write(domainBytes);
+                    }
+
+                    break;
+
+                case AddrTypeIPv6:
+                    if (IPAddress.TryParse(Host, out var ip6) && ip6.AddressFamily == AddressFamily.InterNetworkV6)
+                    {
+                        ms.Write(ip6.GetAddressBytes(), 0, 16);
+                    }
+                    else
+                    {
+                        ms.Write(new byte[16]);
+                    }
+
+                    break;
+
+                default:
+                    throw new NotSupportedException($"SOCKS5 address type {AddressType} not supported.");
+            }
+
+            var portBytes = new byte[2];
+            BinaryPrimitives.WriteUInt16BigEndian(portBytes, Port);
+            ms.Write(portBytes);
+            return ms.ToArray();
+        }
+
+        public static async Task<Socks5AddressData?> ParseAsync(Stream stream, CancellationToken ct)
+        {
+            var addr = new Socks5AddressData();
+            var typeByte = new byte[1];
+            try
+            {
+                if (await stream.ReadAsync(typeByte.AsMemory(0, 1), ct).ConfigureAwait(false) < 1)
+                {
+                    return null;
+                }
+
+                addr.AddressType = typeByte[0];
+                switch (addr.AddressType)
+                {
+                    case AddrTypeIPv4:
+                        var ipv4Bytes = new byte[4];
+                        if (await stream.ReadAsync(ipv4Bytes.AsMemory(0, 4), ct).ConfigureAwait(false) < 4)
+                        {
+                            return null;
+                        }
+
+                        addr.Host = new IPAddress(ipv4Bytes).ToString();
+                        break;
+
+                    case AddrTypeDomain:
+                        var lenByte = new byte[1];
+                        if (await stream.ReadAsync(lenByte.AsMemory(0, 1), ct).ConfigureAwait(false) < 1)
+                        {
+                            return null;
+                        }
+
+                        if (lenByte[0] == 0)
+                        {
+                            addr.Host = string.Empty;
+                        }
+                        else
+                        {
+                            var domainBytes = new byte[lenByte[0]];
+                            if (await stream.ReadAsync(domainBytes.AsMemory(0, domainBytes.Length), ct)
+                                    .ConfigureAwait(false) < domainBytes.Length)
+                            {
+                                return null;
+                            }
+
+                            addr.Host = Encoding.ASCII.GetString(domainBytes);
+                        }
+
+                        break;
+
+                    case AddrTypeIPv6:
+                        var ipv6Bytes = new byte[16];
+                        if (await stream.ReadAsync(ipv6Bytes.AsMemory(0, 16), ct).ConfigureAwait(false) < 16)
+                        {
+                            return null;
+                        }
+
+                        addr.Host = new IPAddress(ipv6Bytes).ToString();
+                        break;
+
+                    default:
+                        return null;
+                }
+
+                var portBytes = new byte[2];
+                if (await stream.ReadAsync(portBytes.AsMemory(0, 2), ct).ConfigureAwait(false) < 2)
+                {
+                    return null;
+                }
+
+                addr.Port = BinaryPrimitives.ReadUInt16BigEndian(portBytes);
+                return addr;
+            }
+            catch (Exception ex) when (ex is IOException or ObjectDisposedException)
+            {
+                return null;
+            }
+        }
+    }
+
+    #endregion SOCKS5 Address Handling
+}
@@ -0,0 +1,77 @@
+namespace ServiceLib.UdpTest.Tester;
+
+public class DnsService : IUdpTest
+{
+    private const int DnsDefaultPort = 53;
+    private const string DnsDefaultServer = "8.8.8.8"; // Google Public DNS
+
+    private static readonly byte[] DnsQueryPacket =
+    [
+        // Header: ID=0x1234, Standard query with RD set, QDCOUNT=1
+        0x12, 0x34, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00,
+        // Question: www.google.com, Type A, Class IN
+        0x03, 0x77, 0x77, 0x77, 0x06, 0x67, 0x6F, 0x6F,
+        0x67, 0x6C, 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
+        0x00, 0x01, 0x00, 0x01
+    ];
+
+    public byte[] BuildUdpRequestPacket()
+    {
+        return (byte[])DnsQueryPacket.Clone();
+    }
+
+    public bool VerifyAndExtractUdpResponse(byte[] dnsResponseBytes)
+    {
+        if (dnsResponseBytes.Length < 12)
+        {
+            return false;
+        }
+
+        try
+        {
+            // Check transaction ID (should match 0x1234)
+            var transactionId = BinaryPrimitives.ReadUInt16BigEndian(dnsResponseBytes.AsSpan(0, 2));
+            if (transactionId != 0x1234)
+            {
+                return false;
+            }
+
+            // Check flags - should be a response (QR=1)
+            var flags = BinaryPrimitives.ReadUInt16BigEndian(dnsResponseBytes.AsSpan(2, 2));
+            if ((flags & 0x8000) == 0)
+            {
+                return false; // Not a response
+            }
+
+            // Check response code (RCODE) - should be 0 (no error)
+            if ((flags & 0x000F) != 0)
+            {
+                return false; // DNS error
+            }
+
+            // Check answer count
+            var answerCount = BinaryPrimitives.ReadUInt16BigEndian(dnsResponseBytes.AsSpan(6, 2));
+            if (answerCount == 0)
+            {
+                return false; // No answers
+            }
+
+            return true;
+        }
+        catch
+        {
+            return false;
+        }
+    }
+
+    public ushort GetDefaultTargetPort()
+    {
+        return DnsDefaultPort;
+    }
+
+    public string GetDefaultTargetHost()
+    {
+        return DnsDefaultServer;
+    }
+}
@@ -0,0 +1,12 @@
+namespace ServiceLib.UdpTest.Tester;
+
+public interface IUdpTest
+{
+    public byte[] BuildUdpRequestPacket();
+
+    public bool VerifyAndExtractUdpResponse(byte[] udpResponseBytes);
+
+    public ushort GetDefaultTargetPort();
+
+    public string GetDefaultTargetHost();
+}
@@ -0,0 +1,84 @@
+namespace ServiceLib.UdpTest.Tester;
+
+public class McBeService : IUdpTest
+{
+    private const int McBeDefaultPort = 19132;
+    private const string McBeDefaultServer = "pms.mc-complex.com";
+
+    // 0x01 | client alive time in ms (unsigned long long) | magic | client GUID
+    private static readonly byte[] McBeQueryPacket =
+    [
+        // 0x01
+        0x01,
+        // Client alive time (1000 ms)
+        0x27, 0xC4, 0x15, 0x00, 0x00, 0x00, 0x00, 0x00,
+        // Magic
+        0x00, 0xFF, 0xFF, 0x00, 0xFE, 0xFE, 0xFE, 0xFE,
+        0xFD, 0xFD, 0xFD, 0xFD, 0x12, 0x34, 0x56, 0x78,
+        // Client GUID (random 16 bytes)
+        0x66, 0x0E, 0xAB, 0xBC, 0x61, 0x0D, 0x1F, 0x4E,
+        0xA4, 0x40, 0x8C, 0x65, 0xC1, 0xBE, 0xF5, 0x4B
+    ];
+
+    private static readonly byte[] McBeMagicBytes =
+    [
+        0x00, 0xFF, 0xFF, 0x00, 0xFE, 0xFE, 0xFE, 0xFE,
+        0xFD, 0xFD, 0xFD, 0xFD, 0x12, 0x34, 0x56, 0x78
+    ];
+
+    private static readonly List<string> ValidGameModes =
+    [
+        "Survival",
+        "Creative",
+        "Adventure",
+        "Spectator"
+    ];
+
+    public byte[] BuildUdpRequestPacket()
+    {
+        return (byte[])McBeQueryPacket.Clone();
+    }
+
+    public bool VerifyAndExtractUdpResponse(byte[] mcbeResponseBytes)
+    {
+        // 0x1c | client alive time in ms (recorded from previous ping) |
+        // server GUID | Magic | string length | Edition
+        //
+        // Edition Example:
+        //
+        // MCPE;Dedicated Server;527;1.19.1;0;10;13253860892328930865;Bedrock level;Survival;1;19132;19133;
+        if (mcbeResponseBytes.Length < 48)
+        {
+            return false;
+        }
+        if (mcbeResponseBytes[0] != 0x1C)
+        {
+            return false; // Invalid packet type
+        }
+        var pongMagic = mcbeResponseBytes.Skip(17).Take(16).ToArray();
+        if (!pongMagic.SequenceEqual(McBeMagicBytes))
+        {
+            return false; // Magic bytes do not match
+        }
+        var stringLength = (ushort)((mcbeResponseBytes[33] << 8) | mcbeResponseBytes[34]);
+        var stringData = Encoding.UTF8.GetString(mcbeResponseBytes.Skip(35).Take(stringLength).ToArray());
+        var stringParts = stringData.Split(';');
+        // check Game Mode str
+        var gameMode = stringParts.Length > 8 ? stringParts[8] : "";
+        if (!ValidGameModes.Contains(gameMode))
+        {
+            return false; // Invalid game mode
+        }
+        return true;
+    }
+
+    public ushort GetDefaultTargetPort()
+    {
+        return McBeDefaultPort;
+    }
+
+    public string GetDefaultTargetHost()
+    {
+        return McBeDefaultServer;
+    }
+}
@@ -0,0 +1,37 @@
+namespace ServiceLib.UdpTest.Tester;
+
+public class NtpService : IUdpTest
+{
+    private const int NtpDefaultPort = 123;
+    private const string NtpDefaultServer = "pool.ntp.org";
+
+    public byte[] BuildUdpRequestPacket()
+    {
+        var ntpReq = new byte[48];
+        ntpReq[0] = 0x23; // LI=0, VN=4, Mode=3
+        return ntpReq;
+    }
+
+    public bool VerifyAndExtractUdpResponse(byte[] ntpResponseBytes)
+    {
+        if (ntpResponseBytes.Length < 48)
+        {
+            return false;
+        }
+        if ((ntpResponseBytes[0] & 0x07) != 4)
+        {
+            return false;
+        }
+        return true;
+    }
+
+    public ushort GetDefaultTargetPort()
+    {
+        return NtpDefaultPort;
+    }
+
+    public string GetDefaultTargetHost()
+    {
+        return NtpDefaultServer;
+    }
+}
@@ -0,0 +1,52 @@
+namespace ServiceLib.UdpTest.Tester;
+
+public class StunService : IUdpTest
+{
+    private const int StunDefaultPort = 3478;
+    private const string StunDefaultServer = "stun.voztovoice.org";
+
+    private static readonly byte[] StunBindingRequestPacket =
+    [
+        // STUN Binding Request
+        0x00, 0x01, // Message Type: Binding Request (0x0001)
+        0x00, 0x00, // Message Length: 0 (no attributes)
+        0x21, 0x12, 0xA4, 0x42, // Magic Cookie: 0x2112A442
+        // Transaction ID: 96 bits (12 bytes) random
+        0x66, 0x0E, 0xAB, 0xBC, 0x61, 0x0D,
+        0xA4, 0x40, 0x8C, 0x65, 0xC1, 0xBE,
+    ];
+
+    public byte[] BuildUdpRequestPacket()
+    {
+        return (byte[])StunBindingRequestPacket.Clone();
+    }
+
+    public bool VerifyAndExtractUdpResponse(byte[] stunResponseBytes)
+    {
+        if (stunResponseBytes.Length < 20)
+        {
+            return false;
+        }
+
+        if (stunResponseBytes.Length >= 2)
+        {
+            var messageType = (stunResponseBytes[0] << 8) | stunResponseBytes[1];
+            if (messageType is 0x0101 or 0x0111)
+            {
+                return true;
+            }
+        }
+
+        return true;
+    }
+
+    public ushort GetDefaultTargetPort()
+    {
+        return StunDefaultPort;
+    }
+
+    public string GetDefaultTargetHost()
+    {
+        return StunDefaultServer;
+    }
+}
@@ -0,0 +1,154 @@
+using ServiceLib.UdpTest.Tester;
+
+namespace ServiceLib.UdpTest;
+
+public class UdpTestService
+{
+    private const string DefaultUdpTestType = "ntp";
+    private readonly IUdpTest _udpTest;
+
+    private static readonly IReadOnlyDictionary<string, Func<IUdpTest>> UdpTestFactories =
+        new Dictionary<string, Func<IUdpTest>>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["ntp"] = () => new NtpService(),
+            ["dns"] = () => new DnsService(),
+            ["stun"] = () => new StunService(),
+            ["mcbe"] = () => new McBeService(),
+        };
+
+    private UdpTestService(IUdpTest udpTest)
+    {
+        _udpTest = udpTest;
+    }
+
+    public static UdpTestService Create(string? udpTestType)
+    {
+        if (string.IsNullOrEmpty(udpTestType))
+        {
+            return new UdpTestService(UdpTestFactories[DefaultUdpTestType]());
+        }
+
+        return UdpTestFactories.TryGetValue(udpTestType, out var factory)
+            ? new UdpTestService(factory())
+            : new UdpTestService(UdpTestFactories[DefaultUdpTestType]());
+    }
+
+    public static UdpTestService CreateFromTarget(string? udpTestTarget, out string targetServerHost)
+    {
+        var parts = udpTestTarget?.Split(':', 2);
+        var udpTestType = parts?.Length > 0 ? parts[0] : DefaultUdpTestType;
+
+        var udpService = Create(udpTestType);
+        targetServerHost = parts?.Length > 1 && !string.IsNullOrEmpty(parts[1])
+            ? parts[1]
+            : udpService._udpTest.GetDefaultTargetHost();
+
+        return udpService;
+    }
+
+    private (string host, ushort port) ParseHostAndPort(string targetServerHost)
+    {
+        if (string.IsNullOrEmpty(targetServerHost))
+        {
+            return (_udpTest.GetDefaultTargetHost(), _udpTest.GetDefaultTargetPort());
+        }
+
+        // Handle IPv6 format: [::1]:port or [2001:db8::1]:port
+        if (targetServerHost.StartsWith('['))
+        {
+            var closeBracketIndex = targetServerHost.IndexOf(']');
+            if (closeBracketIndex > 0)
+            {
+                var host = targetServerHost.Substring(1, closeBracketIndex - 1);
+                if (closeBracketIndex < targetServerHost.Length - 1 && targetServerHost[closeBracketIndex + 1] == ':')
+                {
+                    var portStr = targetServerHost.Substring(closeBracketIndex + 2);
+                    if (ushort.TryParse(portStr, out var port))
+                    {
+                        return (host, port);
+                    }
+                }
+                return (host, _udpTest.GetDefaultTargetPort());
+            }
+        }
+
+        // Handle IPv4 or domain format: 1.1.1.1:53 or exam.com:333
+        var lastColonIndex = targetServerHost.LastIndexOf(':');
+        if (lastColonIndex > 0)
+        {
+            var host = targetServerHost.Substring(0, lastColonIndex);
+            var portStr = targetServerHost.Substring(lastColonIndex + 1);
+            if (ushort.TryParse(portStr, out var port))
+            {
+                return (host, port);
+            }
+        }
+
+        // No port specified, use default
+        return (targetServerHost, _udpTest.GetDefaultTargetPort());
+    }
+
+    public async Task<TimeSpan> SendUdpRequestAsync(string targetServerHost, int socks5Port, TimeSpan operationTimeout)
+    {
+        using var cts = new CancellationTokenSource(operationTimeout);
+        var cancellationToken = cts.Token;
+        var udpRequestPacket = _udpTest.BuildUdpRequestPacket();
+        if (udpRequestPacket == null || udpRequestPacket.Length == 0)
+        {
+            throw new InvalidOperationException("Failed to build UDP request packet.");
+        }
+        using var channel = new Socks5UdpChannel("127.0.0.1", socks5Port);
+        if (!await channel.EstablishUdpAssociationAsync(cancellationToken).ConfigureAwait(false))
+        {
+            throw new Exception("Failed to establish UDP association with SOCKS5 proxy.");
+        }
+
+        var (targetHost, targetPort) = ParseHostAndPort(targetServerHost);
+
+        byte[] udpReceiveResult = null;
+
+        // Get minimum round trip time from two attempts
+        var roundTripTime = TimeSpan.MaxValue;
+
+        for (var attempt = 0; attempt < 2; attempt++)
+        {
+            try
+            {
+                var stopwatch = new Stopwatch();
+                stopwatch.Start();
+                await channel.SendAsync(targetHost, targetPort, udpRequestPacket).ConfigureAwait(false);
+                var (_, receiveResult) = await channel.ReceiveAsync(cancellationToken).ConfigureAwait(false);
+                stopwatch.Stop();
+
+                udpReceiveResult = receiveResult;
+
+                var currentRoundTripTime = stopwatch.Elapsed;
+                if (currentRoundTripTime < roundTripTime)
+                {
+                    roundTripTime = currentRoundTripTime;
+                }
+            }
+            catch
+            {
+                if (attempt == 1 && roundTripTime == TimeSpan.MaxValue)
+                {
+                    throw;
+                }
+            }
+        }
+
+        if ((udpReceiveResult?.Length ?? 0) < 4 + 1 + 4 + 2)
+        {
+            throw new Exception("Received NTP response is too short.");
+        }
+
+        if (udpReceiveResult != null && _udpTest.VerifyAndExtractUdpResponse(udpReceiveResult))
+        {
+            return roundTripTime;
+        }
+        else
+        {
+            throw new Exception("Failed to verify and extract UDP response.");
+        }
+    }
+}
@@ -94,4 +94,28 @@ public static class Extension
    {
        return configType is EConfigType.Custom or EConfigType.PolicyGroup or EConfigType.ProxyChain;
    }
+
+    /// <summary>
+    /// Safely adds elements from a collection to the list. Does nothing if the source is null.
+    /// </summary>
+    public static void AddRangeSafe<T>(this ICollection<T> destination, IEnumerable<T>? source)
+    {
+        ArgumentNullException.ThrowIfNull(destination);
+
+        if (source is null)
+        {
+            return;
+        }
+
+        if (destination is List<T> list)
+        {
+            list.AddRange(source);
+            return;
+        }
+
+        foreach (var item in source)
+        {
+            destination.Add(item);
+        }
+    }
 }
@@ -17,6 +17,13 @@ public class JsonUtils
        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
    };

+    private static readonly JsonSerializerOptions _defaultSerializeNoIndentedOptions = new()
+    {
+        WriteIndented = false,
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+    };
+
    private static readonly JsonSerializerOptions _nullValueSerializeOptions = new()
    {
        WriteIndented = true,
@@ -24,6 +31,13 @@ public class JsonUtils
        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
    };

+    private static readonly JsonSerializerOptions _nullValueSerializeNoIndentedOptions = new()
+    {
+        WriteIndented = false,
+        DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+    };
+
    private static readonly JsonDocumentOptions _defaultDocumentOptions = new()
    {
        CommentHandling = JsonCommentHandling.Skip
@@ -104,7 +118,13 @@ public class JsonUtils
            {
                return result;
            }
-            var options = nullValue ? _nullValueSerializeOptions : _defaultSerializeOptions;
+            var options = (nullValue, indented) switch
+            {
+                (true, true) => _nullValueSerializeOptions,
+                (true, false) => _nullValueSerializeNoIndentedOptions,
+                (false, true) => _defaultSerializeOptions,
+                _ => _defaultSerializeNoIndentedOptions
+            };
            result = JsonSerializer.Serialize(obj, options);
        }
        catch (Exception ex)
@@ -46,7 +46,7 @@ public static class ProcUtils
        return null;
    }

-    public static void RebootAsAdmin(bool blAdmin = true)
+    public static bool RebootAsAdmin(bool blAdmin = true)
    {
        try
        {
@@ -58,11 +58,12 @@ public static class ProcUtils
                FileName = Utils.GetExePath().AppendQuotes(),
                Verb = blAdmin ? "runas" : null,
            };
-            _ = Process.Start(startInfo);
+            return Process.Start(startInfo) != null;
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
+            return false;
        }
    }
 }
@@ -332,19 +332,17 @@ public class Utils
            .ToList();
    }

-    public static Dictionary<string, List<string>> ParseHostsToDictionary(string hostsContent)
+    public static Dictionary<string, List<string>> ParseHostsToDictionary(string? hostsContent)
    {
+        if (hostsContent.IsNullOrEmpty())
+        {
+            return new();
+        }
        var userHostsMap = hostsContent
            .Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries)
            .Select(line => line.Trim())
            // skip full-line comments
-            .Where(line => !string.IsNullOrWhiteSpace(line) && !line.StartsWith("#"))
-            // strip inline comments (truncate at '#')
-            .Select(line =>
-            {
-                var index = line.IndexOf('#');
-                return index >= 0 ? line.Substring(0, index).Trim() : line;
-            })
+            .Where(line => !string.IsNullOrWhiteSpace(line) && !line.StartsWith('#'))
            // ensure line still contains valid parts
            .Where(line => !string.IsNullOrWhiteSpace(line) && line.Contains(' '))
            .Select(line => line.Split(new[] { ' ', '\t' }, StringSplitOptions.RemoveEmptyEntries))
@@ -462,6 +460,18 @@ public class Utils
        return (domain, port);
    }

+    public static string? DomainStrategy4Sbox(string? strategy)
+    {
+        return strategy switch
+        {
+            not null when strategy.StartsWith("UseIPv4") => "prefer_ipv4",
+            not null when strategy.StartsWith("UseIPv6") => "prefer_ipv6",
+            not null when strategy.StartsWith("ForceIPv4") => "ipv4_only",
+            not null when strategy.StartsWith("ForceIPv6") => "ipv6_only",
+            _ => null
+        };
+    }
+
    #endregion Conversion Functions

    #region Data Checks
@@ -487,6 +497,13 @@ public class Utils
            return false;
        }

+        var ext = Path.GetExtension(domain);
+        if (ext.IsNotEmpty()
+            && ext[1..].ToLowerInvariant() is "json" or "txt" or "xml" or "cfg" or "ini" or "log" or "yaml" or "yml" or "toml")
+        {
+            return false;
+        }
+
        return Uri.CheckHostName(domain) == UriHostNameType.Dns;
    }

@@ -505,6 +522,48 @@ public class Utils
        return false;
    }

+    public static bool IsIpv4(string? ip)
+    {
+        if (ip.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        ip = ip.Trim();
+        if (!IPAddress.TryParse(ip, out var address))
+        {
+            return false;
+        }
+
+        return address.AddressFamily == AddressFamily.InterNetwork
+               && ip.Count(c => c == '.') == 3;
+    }
+
+    public static bool IsIpAddress(string? ip)
+    {
+        if (ip.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        ip = ip.Trim();
+
+        // First, validate using built-in parser
+        if (!IPAddress.TryParse(ip, out var address))
+        {
+            return false;
+        }
+
+        // For IPv4: ensure it has exactly 3 dots (meaning 4 parts)
+        if (address.AddressFamily == AddressFamily.InterNetwork)
+        {
+            return ip.Count(c => c == '.') == 3;
+        }
+
+        // For IPv6: TryParse is already strict enough
+        return address.AddressFamily == AddressFamily.InterNetworkV6;
+    }
+
    public static Uri? TryUri(string url)
    {
        try
@@ -594,12 +653,7 @@ public class Utils
    {
        try
        {
-            List<IPEndPoint> lstIpEndPoints = new();
-            List<TcpConnectionInformation> lstTcpConns = new();
-
-            lstIpEndPoints.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpListeners());
-            lstIpEndPoints.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveUdpListeners());
-            lstTcpConns.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpConnections());
+            var (lstIpEndPoints, lstTcpConns) = GetActiveNetworkInfo();

            if (lstIpEndPoints?.FindIndex(it => it.Port == port) >= 0)
            {
@@ -641,6 +695,27 @@ public class Utils
        return 59090;
    }

+    public static (List<IPEndPoint> endpoints, List<TcpConnectionInformation> connections) GetActiveNetworkInfo()
+    {
+        var endpoints = new List<IPEndPoint>();
+        var connections = new List<TcpConnectionInformation>();
+
+        try
+        {
+            var ipGlobalProperties = IPGlobalProperties.GetIPGlobalProperties();
+
+            endpoints.AddRange(ipGlobalProperties.GetActiveTcpListeners());
+            endpoints.AddRange(ipGlobalProperties.GetActiveUdpListeners());
+            connections.AddRange(ipGlobalProperties.GetActiveTcpConnections());
+        }
+        catch (Exception ex)
+        {
+            Logging.SaveLog(_tag, ex);
+        }
+
+        return (endpoints, connections);
+    }
+
    #endregion Speed Test

    #region Miscellaneous
@@ -719,33 +794,65 @@ public class Utils
        return Guid.TryParse(strSrc, out _);
    }

-    public static Dictionary<string, string> GetSystemHosts()
+    private static Dictionary<string, string> GetSystemHosts(string hostFile)
    {
        var systemHosts = new Dictionary<string, string>();
-        var hostFile = @"C:\Windows\System32\drivers\etc\hosts";
        try
        {
-            if (File.Exists(hostFile))
+            if (!File.Exists(hostFile))
            {
-                var hosts = File.ReadAllText(hostFile).Replace("\r", "");
-                var hostsList = hosts.Split(new[] { '\n' }, StringSplitOptions.RemoveEmptyEntries);
-
-                foreach (var host in hostsList)
-                {
-                    if (host.StartsWith("#"))
-                    {
-                        continue;
-                    }
-
-                    var hostItem = host.Split(new[] { ' ', '\t' }, StringSplitOptions.RemoveEmptyEntries);
-                    if (hostItem.Length < 2)
-                    {
-                        continue;
-                    }
-
-                    systemHosts.Add(hostItem[1], hostItem[0]);
-                }
+                return systemHosts;
            }
+            var hosts = File.ReadAllText(hostFile).Replace("\r", "");
+            var hostsList = hosts.Split(new[] { '\n' }, StringSplitOptions.RemoveEmptyEntries);
+
+            foreach (var host in hostsList)
+            {
+                // Trim whitespace
+                var line = host.Trim();
+
+                // Skip comments and empty lines
+                if (line.IsNullOrEmpty() || line.StartsWith("#"))
+                {
+                    continue;
+                }
+
+                // Strip inline comments
+                var commentIndex = line.IndexOf('#');
+                if (commentIndex >= 0)
+                {
+                    line = line.Substring(0, commentIndex).Trim();
+                }
+                if (line.IsNullOrEmpty())
+                {
+                    continue;
+                }
+
+                var hostItem = line.Split(new[] { ' ', '\t' }, StringSplitOptions.RemoveEmptyEntries);
+                if (hostItem.Length < 2)
+                {
+                    continue;
+                }
+
+                var ipAddress = hostItem[0];
+                var domain = hostItem[1];
+
+                // Validate IP address
+                if (!IsIpAddress(ipAddress))
+                {
+                    continue;
+                }
+
+                // Validate domain name
+                if (domain.IsNullOrEmpty() || domain.Length > 255)
+                {
+                    continue;
+                }
+
+                systemHosts[domain] = ipAddress;
+            }
+
+            return systemHosts;
        }
        catch (Exception ex)
        {
@@ -755,6 +862,19 @@ public class Utils
        return systemHosts;
    }

+    public static Dictionary<string, string> GetSystemHosts()
+    {
+        var hosts = GetSystemHosts(@"C:\Windows\System32\drivers\etc\hosts");
+        var hostsIcs = GetSystemHosts(@"C:\Windows\System32\drivers\etc\hosts.ics");
+
+        foreach (var (key, value) in hostsIcs)
+        {
+            hosts[key] = value;
+        }
+
+        return hosts;
+    }
+
    public static async Task<string?> GetCliWrapOutput(string filePath, string? arg)
    {
        return await GetCliWrapOutput(filePath, arg != null ? new List<string>() { arg } : null);
@@ -1004,7 +1124,19 @@ public class Utils

    public static string GetExeName(string name)
    {
-        return IsWindows() ? $"{name}.exe" : name;
+        if (name.IsNullOrEmpty() || IsNonWindows())
+        {
+            return name;
+        }
+
+        if (name.EndsWith(".exe", StringComparison.OrdinalIgnoreCase))
+        {
+            return name;
+        }
+        else
+        {
+            return $"{name}.exe";
+        }
    }

    public static bool IsAdministrator()
@@ -53,19 +53,23 @@ internal static class WindowsUtils

    public static async Task RemoveTunDevice()
    {
-        try
+        var tunNameList = new List<string> { "wintunsingbox_tun", "xray_tun" };
+        foreach (var tunName in tunNameList)
        {
-            var sum = MD5.HashData(Encoding.UTF8.GetBytes("wintunsingbox_tun"));
-            var guid = new Guid(sum);
-            var pnpUtilPath = @"C:\Windows\System32\pnputil.exe";
-            var arg = $$""" /remove-device  "SWD\Wintun\{{{guid}}}" """;
+            try
+            {
+                var sum = MD5.HashData(Encoding.UTF8.GetBytes(tunName));
+                var guid = new Guid(sum);
+                var pnpUtilPath = @"C:\Windows\System32\pnputil.exe";
+                var arg = $$""" /remove-device  "SWD\Wintun\{{{guid}}}" """;

-            // Try to remove the device
-            _ = await Utils.GetCliWrapOutput(pnpUtilPath, arg);
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
+                // Try to remove the device
+                _ = await Utils.GetCliWrapOutput(pnpUtilPath, arg);
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog(_tag, ex);
+            }
        }
    }
 }
@@ -13,6 +13,7 @@ public enum EConfigType
    WireGuard = 9,
    HTTP = 10,
    Anytls = 11,
+    Naive = 12,
    PolicyGroup = 101,
    ProxyChain = 102,
 }
@@ -4,6 +4,7 @@ public enum ESpeedActionType
 {
    Tcping,
    Realping,
+    UdpTest,
    Speedtest,
    Mixedtest,
    FastRealping
@@ -2,7 +2,7 @@ namespace ServiceLib.Enums;

 public enum ETransport
 {
-    tcp,
+    raw,
    kcp,
    ws,
    httpupgrade,
@@ -15,7 +15,6 @@ public class Global
    public const string CoreConfigFileName = "config.json";
    public const string CorePreConfigFileName = "configPre.json";
    public const string CoreSpeedtestConfigFileName = "configTest{0}.json";
-    public const string CoreMultipleLoadConfigFileName = "configMultipleLoad.json";
    public const string ClashMixinConfigFileName = "Mixin.yaml";

    public const string NamespaceSample = "ServiceLib.Sample.";
@@ -25,6 +24,8 @@ public class Global
    public const string V2raySampleHttpResponseFileName = NamespaceSample + "SampleHttpResponse";
    public const string V2raySampleInbound = NamespaceSample + "SampleInbound";
    public const string V2raySampleOutbound = NamespaceSample + "SampleOutbound";
+    public const string V2raySampleTunInbound = NamespaceSample + "SampleTunInbound";
+    public const string V2raySampleTunRules = NamespaceSample + "SampleTunRules";
    public const string SingboxSampleOutbound = NamespaceSample + "SingboxSampleOutbound";
    public const string CustomRoutingFileName = NamespaceSample + "custom_routing_";
    public const string TunSingboxDNSFileName = NamespaceSample + "tun_singbox_dns";
@@ -43,13 +44,17 @@ public class Global
    public const string SingboxFakeIPFilterFileName = NamespaceSample + "singbox_fakeip_filter";

    public const string DefaultSecurity = "auto";
-    public const string DefaultNetwork = "tcp";
-    public const string TcpHeaderHttp = "http";
+    public const string DefaultNetwork = "raw";
+    public const string RawHeaderHttp = "http";
    public const string None = "none";
+    public const string RawNetworkAlias = "tcp";
+    public const string DefaultXhttpMode = "auto";
    public const string ProxyTag = "proxy";
    public const string DirectTag = "direct";
    public const string BlockTag = "block";
+    public const string DnsOutboundTag = "dns";
    public const string DnsTag = "dns-module";
+    public const string DirectDnsTag = "direct-dns";
    public const string BalancerTagSuffix = "-round";
    public const string StreamSecurity = "tls";
    public const string StreamSecurityReality = "reality";
@@ -59,9 +64,12 @@ public class Global
    public const string HttpsProtocol = "https://";
    public const string SocksProtocol = "socks://";
    public const string Socks5Protocol = "socks5://";
+    public const string InnerUriProtocol = "v2rayn://";
    public const string AsIs = "AsIs";
    public const string IPIfNonMatch = "IPIfNonMatch";
    public const string IPOnDemand = "IPOnDemand";
+    public const string GeoSitePrefix = "geosite:";
+    public const string GeoIPPrefix = "geoip:";

    public const string UserEMail = "t@t.tt";
    public const string AutoRunRegPath = @"Software\Microsoft\Windows\CurrentVersion\Run";
@@ -88,7 +96,24 @@ public class Global
    public const string SingboxLocalDNSTag = "local_local";
    public const string SingboxHostsDNSTag = "hosts_dns";
    public const string SingboxFakeDNSTag = "fake_dns";
-    public const string SingboxEchDNSTag = "ech_dns";
+
+    public const int Hysteria2DefaultHopInt = 30;
+
+    public const string PolicyGroupExcludeKeywords = @"剩余|过期|到期|重置|[Rr]emaining|[Ee]xpir|[Rr]eset";
+
+    public const string PolicyGroupDefaultAllFilter = $"^(?!.*(?:{PolicyGroupExcludeKeywords})).*$";
+
+    public static readonly List<string> PolicyGroupDefaultFilterList =
+    [
+        // All nodes (exclude traffic/expiry info)
+        PolicyGroupDefaultAllFilter,
+        // Low multiplier nodes, e.g. ×0.1, 0.5x, 0.1倍
+        @"^.*(?:[×xX✕*]\s*0\.[0-9]+|0\.[0-9]+\s*[×xX✕*倍]).*$",
+        // Dedicated line nodes, e.g. IPLC, IEPL
+        $@"^(?!.*(?:{PolicyGroupExcludeKeywords})).*(?:专线|IPLC|IEPL|中转).*$",
+        // Japan nodes
+        $@"^(?!.*(?:{PolicyGroupExcludeKeywords})).*(?:日本|\\b[Jj][Pp]\\b|🇯🇵|[Jj]apan).*$",
+    ];

    public static readonly List<string> IEProxyProtocols =
    [
@@ -126,7 +151,7 @@ public class Global
        @"https://cachefly.cachefly.net/50mb.test",
        @"https://speed.cloudflare.com/__down?bytes=10000000",
        @"https://speed.cloudflare.com/__down?bytes=50000000",
-        @"https://speed.cloudflare.com/__down?bytes=100000000",
+        @"https://speed.cloudflare.com/__down?bytes=99999999",
    ];

    public static readonly List<string> SpeedPingTestUrls =
@@ -165,17 +190,23 @@ public class Global
        @"https://raw.githubusercontent.com/Chocolate4U/Iran-v2ray-rules/main/v2rayN/"
    ];

-    public static readonly Dictionary<string, string> UserAgentTexts = new()
+    public static readonly Dictionary<string, string> RawHttpUserAgentTexts = new()
    {
        {"chrome","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36" },
        {"firefox","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0" },
        {"safari","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15" },
        {"edge","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.70" },
-        {"none",""}
+        {"none",""},
+        {"golang","Go-http-client/1.1"},
+        {"curl","curl/7.68.0"},
    };

    public const string Hysteria2ProtocolShare = "hy2://";

+    public const string NaiveHttpsProtocolShare = "naive+https://";
+
+    public const string NaiveQuicProtocolShare = "naive+quic://";
+
    public static readonly Dictionary<EConfigType, string> ProtocolShares = new()
    {
        { EConfigType.VMess, "vmess://" },
@@ -186,7 +217,8 @@ public class Global
        { EConfigType.Hysteria2, "hysteria2://" },
        { EConfigType.TUIC, "tuic://" },
        { EConfigType.WireGuard, "wireguard://" },
-        { EConfigType.Anytls, "anytls://" }
+        { EConfigType.Anytls, "anytls://" },
+        { EConfigType.Naive, "naive://" }
    };

    public static readonly Dictionary<EConfigType, string> ProtocolTypes = new()
@@ -200,7 +232,8 @@ public class Global
        { EConfigType.Hysteria2, "hysteria2" },
        { EConfigType.TUIC, "tuic" },
        { EConfigType.WireGuard, "wireguard" },
-        { EConfigType.Anytls, "anytls" }
+        { EConfigType.Anytls, "anytls" },
+        { EConfigType.Naive, "naive" }
    };

    public static readonly List<string> VmessSecurities =
@@ -268,14 +301,12 @@ public class Global

    public static readonly List<string> Networks =
    [
-        "tcp",
-        "kcp",
-        "ws",
-        "httpupgrade",
+        "raw",
        "xhttp",
-        "h2",
-        "quic",
-        "grpc"
+        "kcp",
+        "grpc",
+        "ws",
+        "httpupgrade"
    ];

    public static readonly List<string> KcpHeaderTypes =
@@ -288,6 +319,16 @@ public class Global
        "dns"
    ];

+    public static readonly Dictionary<string, string> KcpHeaderMaskMap = new()
+    {
+        { "srtp", "header-srtp" },
+        { "utp", "header-utp" },
+        { "wechat-video", "header-wechat" },
+        { "dtls", "header-dtls" },
+        { "wireguard", "header-wireguard" },
+        { "dns", "header-dns" }
+    };
+
    public static readonly List<string> CoreTypes =
    [
        "Xray",
@@ -300,6 +341,7 @@ public class Global
        EConfigType.VLESS,
        EConfigType.Shadowsocks,
        EConfigType.Trojan,
+        EConfigType.Hysteria2,
        EConfigType.WireGuard,
        EConfigType.SOCKS,
        EConfigType.HTTP,
@@ -314,6 +356,7 @@ public class Global
        EConfigType.Hysteria2,
        EConfigType.TUIC,
        EConfigType.Anytls,
+        EConfigType.Naive,
        EConfigType.WireGuard,
        EConfigType.SOCKS,
        EConfigType.HTTP,
@@ -328,13 +371,13 @@ public class Global
        IPOnDemand
    ];

-    public static readonly List<string> DomainStrategies4Singbox =
+    public static readonly List<string> DomainStrategies4Sbox =
    [
-        "ipv4_only",
-        "ipv6_only",
+        "",
        "prefer_ipv4",
        "prefer_ipv6",
-        ""
+        "ipv4_only",
+        "ipv6_only"
    ];

    public static readonly List<string> Fingerprints =
@@ -356,9 +399,9 @@ public class Global
    [
        "chrome",
        "firefox",
-        "safari",
        "edge",
-        "none"
+        "curl",
+        "golang",
    ];

    public static readonly List<string> XhttpMode =
@@ -376,41 +419,37 @@ public class Global
        ""
    ];

-    public static readonly List<string> DomainStrategy4Freedoms =
+    public static readonly List<string> DomainStrategy =
    [
        "AsIs",
        "UseIP",
+        "UseIPv4v6",
+        "UseIPv6v4",
        "UseIPv4",
        "UseIPv6",
        ""
    ];

-    public static readonly List<string> SingboxDomainStrategy4Out =
-    [
-        "",
-        "ipv4_only",
-        "prefer_ipv4",
-        "prefer_ipv6",
-        "ipv6_only"
-    ];
-
    public static readonly List<string> DomainDirectDNSAddress =
    [
-        "https://dns.alidns.com/dns-query",
-        "https://doh.pub/dns-query",
-        "223.5.5.5",
        "119.29.29.29",
+        "223.5.5.5",
+        "119.29.29.29,223.5.5.5,https://doh.pub/dns-query",
+        "https://doh.pub/dns-query",
+        "https://dns.alidns.com/dns-query",
+        "https://doh.pub/dns-query,https://dns.alidns.com/dns-query",
        "localhost"
    ];

    public static readonly List<string> DomainRemoteDNSAddress =
    [
        "https://cloudflare-dns.com/dns-query",
-        "https://dns.cloudflare.com/dns-query",
        "https://dns.google/dns-query",
+        "https://cloudflare-dns.com/dns-query,https://dns.google/dns-query,8.8.8.8",
+        "https://dns.cloudflare.com/dns-query",
        "https://doh.dns.sb/dns-query",
        "https://doh.opendns.com/dns-query",
-        "https://common.dot.dns.yandex.net",
+        "https://common.dot.dns.yandex.net/dns-query",
        "8.8.8.8",
        "1.1.1.1",
        "185.222.222.222",
@@ -420,8 +459,8 @@ public class Global

    public static readonly List<string> DomainPureIPDNSAddress =
    [
-        "223.5.5.5",
        "119.29.29.29",
+        "223.5.5.5",
        "localhost"
    ];

@@ -475,6 +514,7 @@ public class Global
    [
        "http",
        "tls",
+        "quic",
        "bittorrent"
    ];

@@ -492,7 +532,6 @@ public class Global
        "tls",
        "quic",
        "fakedns",
-        "fakedns+others"
    ];

    public static readonly List<int> TunMtus =
@@ -535,6 +574,14 @@ public class Global
        "bbr"
    ];

+    public static readonly List<string> NaiveCongestionControls =
+    [
+        "bbr",
+        "bbr2",
+        "cubic",
+        "reno"
+    ];
+
    public static readonly List<string> allowSelectType =
    [
        "selector",
@@ -596,6 +643,24 @@ public class Global
        @""
    ];

+    public static readonly List<string> UdpTestTargets =
+    [
+        "ntp:pool.ntp.org",
+        "ntp:time.google.com",
+        "dns:1.1.1.1",
+        "dns:8.8.8.8",
+        "dns:dns.google",
+        "stun:stun.voztovoice.org",
+        "stun:stun.cloudflare.com",
+        "stun:stun.l.google.com:19302",
+        "mcbe:pms.mc-complex.com",
+        "mcbe:bedrock.opblocks.com",
+        "mcbe:opsucht.net",
+        "mcbe:play.craftersmc.net",
+        "mcbe:mps.lemoncloud.net",
+        "mcbe:bedrock.talonmc.net",
+    ];
+
    public static readonly List<string> OutboundTags =
    [
        ProxyTag,
@@ -605,20 +670,20 @@ public class Global

    public static readonly Dictionary<string, List<string>> PredefinedHosts = new()
    {
-        { "dns.google", new List<string> { "8.8.8.8", "8.8.4.4", "2001:4860:4860::8888", "2001:4860:4860::8844" } },
-        { "dns.alidns.com", new List<string> { "223.5.5.5", "223.6.6.6", "2400:3200::1", "2400:3200:baba::1" } },
-        { "one.one.one.one", new List<string> { "1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001" } },
-        { "1dot1dot1dot1.cloudflare-dns.com", new List<string> { "1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001" } },
-        { "cloudflare-dns.com", new List<string> { "104.16.249.249", "104.16.248.249", "2606:4700::6810:f8f9", "2606:4700::6810:f9f9" } },
-        { "dns.cloudflare.com", new List<string> { "104.16.132.229", "104.16.133.229", "2606:4700::6810:84e5", "2606:4700::6810:85e5" } },
-        { "dot.pub", new List<string> { "1.12.12.12", "120.53.53.53" } },
-        { "doh.pub", new List<string> { "1.12.12.12", "120.53.53.53" } },
-        { "dns.quad9.net", new List<string> { "9.9.9.9", "149.112.112.112", "2620:fe::fe", "2620:fe::9" } },
-        { "dns.yandex.net", new List<string> { "77.88.8.8", "77.88.8.1", "2a02:6b8::feed:0ff", "2a02:6b8:0:1::feed:0ff" } },
-        { "dns.sb", new List<string> { "185.222.222.222", "2a09::" } },
-        { "dns.umbrella.com", new List<string> { "208.67.220.220", "208.67.222.222", "2620:119:35::35", "2620:119:53::53" } },
-        { "dns.sse.cisco.com", new List<string> { "208.67.220.220", "208.67.222.222", "2620:119:35::35", "2620:119:53::53" } },
-        { "engage.cloudflareclient.com", new List<string> { "162.159.192.1", "2606:4700:d0::a29f:c001" } }
+        { "dns.google", ["8.8.8.8", "8.8.4.4", "2001:4860:4860::8888", "2001:4860:4860::8844"] },
+        { "dns.alidns.com", ["223.5.5.5", "223.6.6.6", "2400:3200::1", "2400:3200:baba::1"] },
+        { "one.one.one.one", ["1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001"] },
+        { "1dot1dot1dot1.cloudflare-dns.com", ["1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001"] },
+        { "cloudflare-dns.com", ["104.16.249.249", "104.16.248.249", "2606:4700::6810:f8f9", "2606:4700::6810:f9f9"] },
+        { "dns.cloudflare.com", ["104.16.132.229", "104.16.133.229", "2606:4700::6810:84e5", "2606:4700::6810:85e5"] },
+        { "dot.pub", ["1.12.12.12", "120.53.53.53"] },
+        { "doh.pub", ["1.12.12.12", "120.53.53.53"] },
+        { "dns.quad9.net", ["9.9.9.9", "149.112.112.112", "2620:fe::fe", "2620:fe::9"] },
+        { "dns.yandex.net", ["77.88.8.8", "77.88.8.1", "2a02:6b8::feed:0ff", "2a02:6b8:0:1::feed:0ff"] },
+        { "dns.sb", ["185.222.222.222", "2a09::"] },
+        { "dns.umbrella.com", ["208.67.220.220", "208.67.222.222", "2620:119:35::35", "2620:119:53::53"] },
+        { "dns.sse.cisco.com", ["208.67.220.220", "208.67.222.222", "2620:119:35::35", "2620:119:53::53"] },
+        { "engage.cloudflareclient.com", ["162.159.192.1"] }
    };

    public static readonly List<string> ExpectedIPs =
@@ -629,12 +694,13 @@ public class Global
        ""
    ];

-    public static readonly List<string> EchForceQuerys =
+    public static readonly List<string> TunIcmpRoutingPolicies =
    [
-        "none",
-        "half",
-        "full",
-        ""
+        "rule",
+        "direct",
+        "unreachable",
+        "drop",
+        "reply",
    ];

    #endregion const
@@ -24,6 +24,7 @@ global using ServiceLib.Common;
 global using ServiceLib.Enums;
 global using ServiceLib.Events;
 global using ServiceLib.Handler;
+global using ServiceLib.Handler.Builder;
 global using ServiceLib.Handler.Fmt;
 global using ServiceLib.Handler.SysProxy;
 global using ServiceLib.Helper;
@@ -0,0 +1,429 @@
+namespace ServiceLib.Handler.Builder;
+
+public record CoreConfigContextBuilderResult(CoreConfigContext Context, NodeValidatorResult ValidatorResult)
+{
+    public bool Success => ValidatorResult.Success;
+}
+
+/// <summary>
+/// Holds the results of a full context build, including the main context and an optional
+/// pre-socks context (e.g. for TUN protection or pre-socks chaining).
+/// </summary>
+public record CoreConfigContextBuilderAllResult(
+    CoreConfigContextBuilderResult MainResult,
+    CoreConfigContextBuilderResult? PreSocksResult)
+{
+    /// <summary>True only when both the main result and (if present) the pre-socks result succeeded.</summary>
+    public bool Success => MainResult.Success && (PreSocksResult?.Success ?? true);
+
+    /// <summary>
+    /// Merges all errors and warnings from the main result and the optional pre-socks result
+    /// into a single <see cref="NodeValidatorResult"/> for unified notification.
+    /// </summary>
+    public NodeValidatorResult CombinedValidatorResult => new(
+        [.. MainResult.ValidatorResult.Errors, .. PreSocksResult?.ValidatorResult.Errors ?? []],
+        [.. MainResult.ValidatorResult.Warnings, .. PreSocksResult?.ValidatorResult.Warnings ?? []]);
+}
+
+public class CoreConfigContextBuilder
+{
+    /// <summary>
+    /// Builds a <see cref="CoreConfigContext"/> for the given node, resolves its proxy map,
+    /// and processes outbound nodes referenced by routing rules.
+    /// </summary>
+    public static async Task<CoreConfigContextBuilderResult> Build(Config config, ProfileItem node)
+    {
+        var runCoreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
+        var coreType = runCoreType == ECoreType.sing_box ? ECoreType.sing_box : ECoreType.Xray;
+        var context = new CoreConfigContext()
+        {
+            Node = node,
+            RunCoreType = runCoreType,
+            AllProxiesMap = [],
+            AppConfig = config,
+            FullConfigTemplate = await AppManager.Instance.GetFullConfigTemplateItem(coreType),
+            IsTunEnabled = config.TunModeItem.EnableTun,
+            SimpleDnsItem = config.SimpleDNSItem,
+            ProtectDomainList = [],
+            RawDnsItem = await AppManager.Instance.GetDNSItem(coreType),
+            RoutingItem = await ConfigHandler.GetDefaultRouting(config),
+            IsWindows = Utils.IsWindows(),
+            IsMacOS = Utils.IsMacOS(),
+        };
+        var validatorResult = NodeValidatorResult.Empty();
+        var (actNode, nodeValidatorResult) = await ResolveNodeAsync(context, node);
+        if (!nodeValidatorResult.Success)
+        {
+            return new CoreConfigContextBuilderResult(context, nodeValidatorResult);
+        }
+        context = context with { Node = actNode };
+        validatorResult.Warnings.AddRange(nodeValidatorResult.Warnings);
+        if (!(context.RoutingItem?.RuleSet.IsNullOrEmpty() ?? true))
+        {
+            var rules = JsonUtils.Deserialize<List<RulesItem>>(context.RoutingItem?.RuleSet) ?? [];
+            foreach (var ruleItem in rules.Where(ruleItem => ruleItem.Enabled && !Global.OutboundTags.Contains(ruleItem.OutboundTag)))
+            {
+                if (ruleItem.OutboundTag.IsNullOrEmpty())
+                {
+                    validatorResult.Warnings.Add(string.Format(ResUI.MsgRoutingRuleEmptyOutboundTag, ruleItem.Remarks));
+                    ruleItem.OutboundTag = Global.ProxyTag;
+                    continue;
+                }
+                var ruleOutboundNode = await AppManager.Instance.GetProfileItemViaRemarks(ruleItem.OutboundTag);
+                if (ruleOutboundNode == null)
+                {
+                    validatorResult.Warnings.Add(string.Format(ResUI.MsgRoutingRuleOutboundNodeNotFound, ruleItem.Remarks, ruleItem.OutboundTag));
+                    ruleItem.OutboundTag = Global.ProxyTag;
+                    continue;
+                }
+
+                var (actRuleNode, ruleNodeValidatorResult) = await ResolveNodeAsync(context, ruleOutboundNode, false);
+                validatorResult.Warnings.AddRange(ruleNodeValidatorResult.Warnings.Select(w =>
+                    string.Format(ResUI.MsgRoutingRuleOutboundNodeWarning, ruleItem.Remarks, ruleItem.OutboundTag, w)));
+                if (!ruleNodeValidatorResult.Success)
+                {
+                    validatorResult.Warnings.AddRange(ruleNodeValidatorResult.Errors.Select(e =>
+                        string.Format(ResUI.MsgRoutingRuleOutboundNodeError, ruleItem.Remarks, ruleItem.OutboundTag, e)));
+                    ruleItem.OutboundTag = Global.ProxyTag;
+                    continue;
+                }
+
+                context.AllProxiesMap[$"remark:{ruleItem.OutboundTag}"] = actRuleNode;
+            }
+        }
+
+        return new CoreConfigContextBuilderResult(context, validatorResult);
+    }
+
+    /// <summary>
+    /// Builds the main <see cref="CoreConfigContext"/> for <paramref name="node"/> and, when
+    /// the main build succeeds, also builds the optional pre-socks context required for TUN
+    /// protection or pre-socks proxy chaining.
+    /// </summary>
+    public static async Task<CoreConfigContextBuilderAllResult> BuildAll(Config config, ProfileItem node)
+    {
+        var mainResult = await Build(config, node);
+        if (!mainResult.Success)
+        {
+            return new CoreConfigContextBuilderAllResult(mainResult, null);
+        }
+
+        var preResult = await BuildPreSocksIfNeeded(mainResult.Context);
+        if (preResult is null)
+        {
+            return new CoreConfigContextBuilderAllResult(mainResult, null);
+        }
+
+        var resolvedMainResult = mainResult with
+        {
+            Context = mainResult.Context with
+            {
+                IsTunEnabled = false, // main core doesn't handle tun directly when pre-socks is used
+                ProtectDomainList = [.. mainResult.Context.ProtectDomainList, .. preResult.Context.ProtectDomainList],
+            }
+        };
+        return new CoreConfigContextBuilderAllResult(resolvedMainResult, preResult);
+    }
+
+    /// <summary>
+    /// Determines whether a pre-socks context is required for <paramref name="nodeContext"/>
+    /// and, if so, builds and returns it. Returns <c>null</c> when no pre-socks core is needed.
+    /// </summary>
+    private static async Task<CoreConfigContextBuilderResult?> BuildPreSocksIfNeeded(CoreConfigContext nodeContext)
+    {
+        var config = nodeContext.AppConfig;
+        var node = nodeContext.Node;
+        var coreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
+
+        var preSocksItem = ConfigHandler.GetPreSocksItem(config, node, coreType);
+        if (preSocksItem != null)
+        {
+            var preSocksResult = await Build(nodeContext.AppConfig, preSocksItem);
+            return preSocksResult with
+            {
+                Context = preSocksResult.Context with
+                {
+                    ProtectDomainList = [.. nodeContext.ProtectDomainList ?? [], .. preSocksResult.Context.ProtectDomainList ?? []],
+                }
+            };
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// Resolves a node into the context, optionally wrapping it in a subscription-level proxy chain.
+    /// Returns the effective (possibly replaced) node and the validation result.
+    /// </summary>
+    public static async Task<(ProfileItem, NodeValidatorResult)> ResolveNodeAsync(CoreConfigContext context,
+        ProfileItem node,
+        bool includeSubChain = true)
+    {
+        if (node.IndexId.IsNullOrEmpty())
+        {
+            return (node, NodeValidatorResult.Empty());
+        }
+
+        if (includeSubChain)
+        {
+            var (virtualChainNode, chainValidatorResult) = await BuildSubscriptionChainNodeAsync(node);
+            if (virtualChainNode != null)
+            {
+                context.AllProxiesMap[virtualChainNode.IndexId] = virtualChainNode;
+                var (resolvedNode, resolvedResult) = await ResolveNodeAsync(context, virtualChainNode, false);
+                resolvedResult.Warnings.InsertRange(0, chainValidatorResult.Warnings);
+                return (resolvedNode, resolvedResult);
+            }
+            // Chain not built but warnings may still exist (e.g. missing profiles)
+            if (chainValidatorResult.Warnings.Count > 0)
+            {
+                var fillResult = await RegisterNodeAsync(context, node);
+                fillResult.Warnings.InsertRange(0, chainValidatorResult.Warnings);
+                return (node, fillResult);
+            }
+        }
+
+        var registerResult = await RegisterNodeAsync(context, node);
+        return (node, registerResult);
+    }
+
+    /// <summary>
+    /// If the node's subscription defines prev/next profiles, creates a virtual
+    /// <see cref="EConfigType.ProxyChain"/> node that wraps them together.
+    /// Returns <c>null</c> as the chain item when no chain is needed.
+    /// Any warnings (e.g. missing prev/next profile) are returned in the validator result.
+    /// </summary>
+    private static async Task<(ProfileItem? ChainNode, NodeValidatorResult ValidatorResult)> BuildSubscriptionChainNodeAsync(ProfileItem node)
+    {
+        var result = NodeValidatorResult.Empty();
+
+        if (node.Subid.IsNullOrEmpty() || node.ConfigType == EConfigType.Custom)
+        {
+            return (null, result);
+        }
+
+        var subItem = await AppManager.Instance.GetSubItem(node.Subid);
+        if (subItem == null)
+        {
+            return (null, result);
+        }
+
+        ProfileItem? prevNode = null;
+        ProfileItem? nextNode = null;
+
+        if (!subItem.PrevProfile.IsNullOrEmpty())
+        {
+            prevNode = await AppManager.Instance.GetProfileItemViaRemarks(subItem.PrevProfile);
+            if (prevNode == null)
+            {
+                result.Warnings.Add(string.Format(ResUI.MsgSubscriptionPrevProfileNotFound, subItem.PrevProfile));
+            }
+        }
+        if (!subItem.NextProfile.IsNullOrEmpty())
+        {
+            nextNode = await AppManager.Instance.GetProfileItemViaRemarks(subItem.NextProfile);
+            if (nextNode == null)
+            {
+                result.Warnings.Add(string.Format(ResUI.MsgSubscriptionNextProfileNotFound, subItem.NextProfile));
+            }
+        }
+
+        if (prevNode is null && nextNode is null)
+        {
+            return (null, result);
+        }
+
+        // Build new proxy chain node
+        var chainNode = new ProfileItem()
+        {
+            IndexId = $"inner-{Utils.GetGuid(false)}",
+            ConfigType = EConfigType.ProxyChain,
+            CoreType = AppManager.Instance.GetCoreType(node, node.ConfigType),
+            Remarks = node.Remarks,
+        };
+        List<string?> childItems = [prevNode?.IndexId, node.IndexId, nextNode?.IndexId];
+        var chainExtraItem = chainNode.GetProtocolExtra() with
+        {
+            GroupType = chainNode.ConfigType.ToString(),
+            ChildItems = string.Join(",", childItems.Where(x => !x.IsNullOrEmpty())),
+        };
+        chainNode.SetProtocolExtra(chainExtraItem);
+        return (chainNode, result);
+    }
+
+    /// <summary>
+    /// Dispatches registration to either <see cref="RegisterGroupNodeAsync"/> or
+    /// <see cref="RegisterSingleNodeAsync"/> based on the node's config type.
+    /// </summary>
+    private static async Task<NodeValidatorResult> RegisterNodeAsync(CoreConfigContext context, ProfileItem node)
+    {
+        if (node.ConfigType.IsGroupType())
+        {
+            return await RegisterGroupNodeAsync(context, node);
+        }
+        else
+        {
+            return RegisterSingleNodeAsync(context, node);
+        }
+    }
+
+    /// <summary>
+    /// Validates a single (non-group) node and, on success, adds it to the proxy map
+    /// and records any domain addresses that should bypass the proxy.
+    /// </summary>
+    private static NodeValidatorResult RegisterSingleNodeAsync(CoreConfigContext context, ProfileItem node)
+    {
+        if (node.ConfigType.IsGroupType())
+        {
+            return NodeValidatorResult.Empty();
+        }
+
+        var nodeValidatorResult = NodeValidator.Validate(node, context.RunCoreType);
+        var msgs = new List<string>([.. nodeValidatorResult.Errors, .. nodeValidatorResult.Warnings]);
+        if (msgs.Count > 0)
+        {
+            Logging.SaveLog($"{node.Remarks}: {string.Join("; ", msgs)}");
+        }
+        if (!nodeValidatorResult.Success)
+        {
+            return nodeValidatorResult;
+        }
+
+        context.AllProxiesMap[node.IndexId] = node;
+
+        var address = node.Address;
+        if (Utils.IsDomain(address))
+        {
+            context.ProtectDomainList.Add(address);
+        }
+
+        // ech query server name protect
+        if (!node.EchConfigList.IsNullOrEmpty())
+        {
+            var echQuerySni = node.Sni;
+            if (node.StreamSecurity == Global.StreamSecurity
+                && node.EchConfigList?.Contains("://") == true)
+            {
+                var idx = node.EchConfigList.IndexOf('+');
+                echQuerySni = idx > 0 ? node.EchConfigList[..idx] : node.Sni;
+            }
+
+            if (Utils.IsDomain(echQuerySni))
+            {
+                context.ProtectDomainList.Add(echQuerySni);
+            }
+        }
+
+        // xhttp downloadSettings address protect
+        var xhttpExtra = node.GetTransportExtra().XhttpExtra;
+        if (!string.IsNullOrEmpty(xhttpExtra)
+            && JsonUtils.ParseJson(xhttpExtra) is JsonObject extra
+            && extra.TryGetPropertyValue("downloadSettings", out var dsNode)
+            && dsNode is JsonObject downloadSettings
+            && downloadSettings.TryGetPropertyValue("address", out var dAddrNode)
+            && dAddrNode is JsonValue dAddrValue
+            && dAddrValue.TryGetValue(out string? dAddr)
+            && !string.IsNullOrEmpty(dAddr)
+            && Utils.IsDomain(dAddr))
+        {
+            context.ProtectDomainList.Add(dAddr);
+        }
+
+        return nodeValidatorResult;
+    }
+
+    /// <summary>
+    /// Entry point for registering a group node. Initialises the visited/ancestor sets
+    /// and delegates to <see cref="TraverseGroupNodeAsync"/>.
+    /// </summary>
+    private static async Task<NodeValidatorResult> RegisterGroupNodeAsync(CoreConfigContext context,
+        ProfileItem node)
+    {
+        if (!node.ConfigType.IsGroupType())
+        {
+            return NodeValidatorResult.Empty();
+        }
+
+        HashSet<string> ancestors = [node.IndexId];
+        HashSet<string> globalVisited = [node.IndexId];
+        return await TraverseGroupNodeAsync(context, node, globalVisited, ancestors);
+    }
+
+    /// <summary>
+    /// Recursively walks the children of a group node, registering valid leaf nodes
+    /// and nested groups. Detects cycles via <paramref name="ancestorsGroup"/> and
+    /// deduplicates shared nodes via <paramref name="globalVisitedGroup"/>.
+    /// </summary>
+    private static async Task<NodeValidatorResult> TraverseGroupNodeAsync(
+        CoreConfigContext context,
+        ProfileItem node,
+        HashSet<string> globalVisitedGroup,
+        HashSet<string> ancestorsGroup)
+    {
+        var (groupChildList, _) = await GroupProfileManager.GetChildProfileItems(node);
+        List<string> childIndexIdList = [];
+        var childNodeValidatorResult = NodeValidatorResult.Empty();
+        foreach (var childNode in groupChildList)
+        {
+            if (ancestorsGroup.Contains(childNode.IndexId))
+            {
+                childNodeValidatorResult.Errors.Add(
+                    string.Format(ResUI.MsgGroupCycleDependency, node.Remarks, childNode.Remarks));
+                continue;
+            }
+
+            if (globalVisitedGroup.Contains(childNode.IndexId))
+            {
+                childIndexIdList.Add(childNode.IndexId);
+                continue;
+            }
+
+            if (!childNode.ConfigType.IsGroupType())
+            {
+                var childNodeResult = RegisterSingleNodeAsync(context, childNode);
+                childNodeValidatorResult.Warnings.AddRange(childNodeResult.Warnings.Select(w =>
+                    string.Format(ResUI.MsgGroupChildNodeWarning, node.Remarks, childNode.Remarks, w)));
+                childNodeValidatorResult.Errors.AddRange(childNodeResult.Errors.Select(e =>
+                    string.Format(ResUI.MsgGroupChildNodeError, node.Remarks, childNode.Remarks, e)));
+                if (!childNodeResult.Success)
+                {
+                    continue;
+                }
+
+                globalVisitedGroup.Add(childNode.IndexId);
+                childIndexIdList.Add(childNode.IndexId);
+                continue;
+            }
+
+            var newAncestorsGroup = new HashSet<string>(ancestorsGroup) { childNode.IndexId };
+            var childGroupResult =
+                await TraverseGroupNodeAsync(context, childNode, globalVisitedGroup, newAncestorsGroup);
+            childNodeValidatorResult.Warnings.AddRange(childGroupResult.Warnings.Select(w =>
+                string.Format(ResUI.MsgGroupChildGroupNodeWarning, node.Remarks, childNode.Remarks, w)));
+            childNodeValidatorResult.Errors.AddRange(childGroupResult.Errors.Select(e =>
+                string.Format(ResUI.MsgGroupChildGroupNodeError, node.Remarks, childNode.Remarks, e)));
+            if (!childGroupResult.Success)
+            {
+                continue;
+            }
+
+            globalVisitedGroup.Add(childNode.IndexId);
+            childIndexIdList.Add(childNode.IndexId);
+        }
+
+        if (childIndexIdList.Count == 0)
+        {
+            childNodeValidatorResult.Errors.Add(string.Format(ResUI.MsgGroupNoValidChildNode, node.Remarks));
+            return childNodeValidatorResult;
+        }
+        else
+        {
+            childNodeValidatorResult.Warnings.AddRange(childNodeValidatorResult.Errors);
+            childNodeValidatorResult.Errors.Clear();
+        }
+
+        node.SetProtocolExtra(node.GetProtocolExtra() with { ChildItems = Utils.List2String(childIndexIdList), });
+        context.AllProxiesMap[node.IndexId] = node;
+        return childNodeValidatorResult;
+    }
+}
@@ -0,0 +1,186 @@
+namespace ServiceLib.Handler.Builder;
+
+public record NodeValidatorResult(List<string> Errors, List<string> Warnings)
+{
+    public bool Success => Errors.Count == 0;
+
+    public static NodeValidatorResult Empty()
+    {
+        return new NodeValidatorResult([], []);
+    }
+}
+
+public class NodeValidator
+{
+    // Static validator rules
+    private static readonly HashSet<string> SingboxUnsupportedTransports =
+        [nameof(ETransport.kcp), nameof(ETransport.xhttp)];
+
+    private static readonly HashSet<EConfigType> SingboxTransportSupportedProtocols =
+        [EConfigType.VMess, EConfigType.VLESS, EConfigType.Trojan, EConfigType.Shadowsocks];
+
+    private static readonly HashSet<string> SingboxShadowsocksAllowedTransports =
+        [nameof(ETransport.raw), nameof(ETransport.ws)];
+
+    public static NodeValidatorResult Validate(ProfileItem item, ECoreType coreType)
+    {
+        var v = new ValidationContext();
+        ValidateNodeAndCoreSupport(item, coreType, v);
+        return v.ToResult();
+    }
+
+    private class ValidationContext
+    {
+        public List<string> Errors { get; } = [];
+        public List<string> Warnings { get; } = [];
+
+        public void Error(string message)
+        {
+            Errors.Add(message);
+        }
+
+        public void Warning(string message)
+        {
+            Warnings.Add(message);
+        }
+
+        public void Assert(bool condition, string errorMsg)
+        {
+            if (!condition)
+            {
+                Error(errorMsg);
+            }
+        }
+
+        public NodeValidatorResult ToResult()
+        {
+            return new NodeValidatorResult(Errors, Warnings);
+        }
+    }
+
+    private static void ValidateNodeAndCoreSupport(ProfileItem item, ECoreType coreType, ValidationContext v)
+    {
+        if (item.ConfigType is EConfigType.Custom)
+        {
+            return;
+        }
+
+        if (item.ConfigType.IsGroupType())
+        {
+            // Group logic is handled in ValidateGroupNode
+            return;
+        }
+
+        // Basic Property Validation
+        v.Assert(!item.Address.IsNullOrEmpty(), string.Format(ResUI.MsgInvalidProperty, "Address"));
+        v.Assert(item.Port is > 0 and <= 65535, string.Format(ResUI.MsgInvalidProperty, "Port"));
+
+        // Network & Core Logic
+        var net = item.GetNetwork();
+        if (coreType == ECoreType.sing_box)
+        {
+            var transportError = ValidateSingboxTransport(item.ConfigType, net);
+            if (transportError != null)
+            {
+                v.Error(transportError);
+            }
+
+            if (!Global.SingboxSupportConfigType.Contains(item.ConfigType))
+            {
+                v.Error(string.Format(ResUI.MsgCoreNotSupportProtocol, nameof(ECoreType.sing_box), item.ConfigType));
+            }
+        }
+        else if (coreType is ECoreType.Xray)
+        {
+            if (!Global.XraySupportConfigType.Contains(item.ConfigType))
+            {
+                v.Error(string.Format(ResUI.MsgCoreNotSupportProtocol, nameof(ECoreType.Xray), item.ConfigType));
+            }
+        }
+
+        // Protocol Specifics
+        var protocolExtra = item.GetProtocolExtra();
+        switch (item.ConfigType)
+        {
+            case EConfigType.VMess:
+                v.Assert(!item.Password.IsNullOrEmpty() && Utils.IsGuidByParse(item.Password),
+                    string.Format(ResUI.MsgInvalidProperty, "Password"));
+                break;
+
+            case EConfigType.VLESS:
+                v.Assert(
+                    !item.Password.IsNullOrEmpty()
+                    && (Utils.IsGuidByParse(item.Password) || item.Password.Length <= 30),
+                    string.Format(ResUI.MsgInvalidProperty, "Password")
+                );
+                v.Assert(Global.Flows.Contains(protocolExtra.Flow ?? string.Empty),
+                    string.Format(ResUI.MsgInvalidProperty, "Flow"));
+                break;
+
+            case EConfigType.Shadowsocks:
+                v.Assert(!item.Password.IsNullOrEmpty(), string.Format(ResUI.MsgInvalidProperty, "Password"));
+                v.Assert(
+                    !string.IsNullOrEmpty(protocolExtra.SsMethod) &&
+                    Global.SsSecuritiesInSingbox.Contains(protocolExtra.SsMethod),
+                    string.Format(ResUI.MsgInvalidProperty, "SsMethod"));
+                break;
+        }
+
+        // TLS & Security
+        if (item.StreamSecurity == Global.StreamSecurity)
+        {
+            if (!item.Cert.IsNullOrEmpty() && CertPemManager.ParsePemChain(item.Cert).Count == 0 &&
+                !item.CertSha.IsNullOrEmpty())
+            {
+                v.Error(string.Format(ResUI.MsgInvalidProperty, "TLS Certificate"));
+            }
+        }
+
+        if (item.StreamSecurity == Global.StreamSecurityReality)
+        {
+            v.Assert(!item.PublicKey.IsNullOrEmpty(), string.Format(ResUI.MsgInvalidProperty, "PublicKey"));
+        }
+
+        var transport = item.GetTransportExtra();
+        if (item.Network == nameof(ETransport.xhttp) && !transport.XhttpExtra.IsNullOrEmpty())
+        {
+            if (JsonUtils.ParseJson(transport.XhttpExtra) is not JsonObject)
+            {
+                v.Error(string.Format(ResUI.MsgInvalidProperty, "XHTTP Extra"));
+            }
+        }
+
+        if (!item.Finalmask.IsNullOrEmpty())
+        {
+            if (JsonUtils.ParseJson(item.Finalmask) is not JsonObject)
+            {
+                v.Error(string.Format(ResUI.MsgInvalidProperty, "Finalmask"));
+            }
+        }
+    }
+
+    private static string? ValidateSingboxTransport(EConfigType configType, string net)
+    {
+        // sing-box does not support xhttp / kcp transports
+        if (SingboxUnsupportedTransports.Contains(net))
+        {
+            return string.Format(ResUI.MsgCoreNotSupportNetwork, nameof(ECoreType.sing_box), net);
+        }
+
+        // sing-box does not support non-tcp transports for protocols other than vmess/trojan/vless/shadowsocks
+        if (!SingboxTransportSupportedProtocols.Contains(configType) && net != nameof(ETransport.raw))
+        {
+            return string.Format(ResUI.MsgCoreNotSupportProtocolTransport,
+                nameof(ECoreType.sing_box), configType.ToString(), net);
+        }
+
+        // sing-box shadowsocks only supports tcp/ws/quic transports
+        if (configType == EConfigType.Shadowsocks && !SingboxShadowsocksAllowedTransports.Contains(net))
+        {
+            return string.Format(ResUI.MsgCoreNotSupportProtocolTransport,
+                nameof(ECoreType.sing_box), configType.ToString(), net);
+        }
+
+        return null;
+    }
+}
@@ -7,27 +7,27 @@ public static class CoreConfigHandler
 {
    private static readonly string _tag = "CoreConfigHandler";

-    public static async Task<RetResult> GenerateClientConfig(ProfileItem node, string? fileName)
+    public static async Task<RetResult> GenerateClientConfig(CoreConfigContext context, string? fileName)
    {
        var config = AppManager.Instance.Config;
        var result = new RetResult();
+        var node = context.Node;

        if (node.ConfigType == EConfigType.Custom)
        {
            result = node.CoreType switch
            {
                ECoreType.mihomo => await new CoreConfigClashService(config).GenerateClientCustomConfig(node, fileName),
-                ECoreType.sing_box => await new CoreConfigSingboxService(config).GenerateClientCustomConfig(node, fileName),
                _ => await GenerateClientCustomConfig(node, fileName)
            };
        }
-        else if (AppManager.Instance.GetCoreType(node, node.ConfigType) == ECoreType.sing_box)
+        else if (context.RunCoreType == ECoreType.sing_box)
        {
-            result = await new CoreConfigSingboxService(config).GenerateClientConfigContent(node);
+            result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
        }
        else
        {
-            result = await new CoreConfigV2rayService(config).GenerateClientConfigContent(node);
+            result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
        }
        if (result.Success != true)
        {
@@ -93,13 +93,29 @@ public static class CoreConfigHandler
    public static async Task<RetResult> GenerateClientSpeedtestConfig(Config config, string fileName, List<ServerTestItem> selecteds, ECoreType coreType)
    {
        var result = new RetResult();
+        var dummyNode = new ProfileItem
+        {
+            CoreType = coreType
+        };
+        var builderResult = await CoreConfigContextBuilder.Build(config, dummyNode);
+        var context = builderResult.Context;
+        foreach (var testItem in selecteds)
+        {
+            var node = testItem.Profile;
+            var (actNode, _) = await CoreConfigContextBuilder.ResolveNodeAsync(context, node, true);
+            if (node.IndexId == actNode.IndexId)
+            {
+                continue;
+            }
+            context.ServerTestItemMap[node.IndexId] = actNode.IndexId;
+        }
        if (coreType == ECoreType.sing_box)
        {
-            result = await new CoreConfigSingboxService(config).GenerateClientSpeedtestConfig(selecteds);
+            result = new CoreConfigSingboxService(context).GenerateClientSpeedtestConfig(selecteds);
        }
        else if (coreType == ECoreType.Xray)
        {
-            result = await new CoreConfigV2rayService(config).GenerateClientSpeedtestConfig(selecteds);
+            result = new CoreConfigV2rayService(context).GenerateClientSpeedtestConfig(selecteds);
        }
        if (result.Success != true)
        {
@@ -109,20 +125,20 @@ public static class CoreConfigHandler
        return result;
    }

-    public static async Task<RetResult> GenerateClientSpeedtestConfig(Config config, ProfileItem node, ServerTestItem testItem, string fileName)
+    public static async Task<RetResult> GenerateClientSpeedtestConfig(Config config, CoreConfigContext context, ServerTestItem testItem, string fileName)
    {
        var result = new RetResult();
        var initPort = AppManager.Instance.GetLocalPort(EInboundProtocol.speedtest);
        var port = Utils.GetFreePort(initPort + testItem.QueueNum);
        testItem.Port = port;

-        if (AppManager.Instance.GetCoreType(node, node.ConfigType) == ECoreType.sing_box)
+        if (context.RunCoreType == ECoreType.sing_box)
        {
-            result = await new CoreConfigSingboxService(config).GenerateClientSpeedtestConfig(node, port);
+            result = new CoreConfigSingboxService(context).GenerateClientSpeedtestConfig(port);
        }
        else
        {
-            result = await new CoreConfigV2rayService(config).GenerateClientSpeedtestConfig(node, port);
+            result = new CoreConfigV2rayService(context).GenerateClientSpeedtestConfig(port);
        }
        if (result.Success != true)
        {
@@ -20,7 +20,7 @@ public class AnytlsFmt : BaseFmt
            Port = parsedUrl.Port,
        };
        var rawUserInfo = Utils.UrlDecode(parsedUrl.UserInfo);
-        item.Id = rawUserInfo;
+        item.Password = rawUserInfo;

        var query = Utils.ParseQueryString(parsedUrl.Query);
        ResolveUriQuery(query, ref item);
@@ -39,7 +39,7 @@ public class AnytlsFmt : BaseFmt
        {
            remark = "#" + Utils.UrlEncode(item.Remarks);
        }
-        var pw = item.Id;
+        var pw = item.Password;
        var dicQuery = new Dictionary<string, string>();
        ToUriQuery(item, Global.None, ref dicQuery);

@@ -6,6 +6,8 @@ public class BaseFmt
 {
    private static readonly string[] _allowInsecureArray = new[] { "insecure", "allowInsecure", "allow_insecure" };

+    private static string UrlEncodeSafe(string? value) => Utils.UrlEncode(value ?? string.Empty);
+
    protected static string GetIpv6(string address)
    {
        if (Utils.IsIpv6(address))
@@ -21,10 +23,7 @@ public class BaseFmt

    protected static int ToUriQuery(ProfileItem item, string? securityDef, ref Dictionary<string, string> dicQuery)
    {
-        if (item.Flow.IsNotEmpty())
-        {
-            dicQuery.Add("flow", item.Flow);
-        }
+        var transport = item.GetTransportExtra();

        if (item.StreamSecurity.IsNotEmpty())
        {
@@ -74,55 +73,87 @@ public class BaseFmt
        {
            dicQuery.Add("ech", Utils.UrlEncode(item.EchConfigList));
        }
-
-        dicQuery.Add("type", item.Network.IsNotEmpty() ? item.Network : nameof(ETransport.tcp));
-
-        switch (item.Network)
+        if (item.CertSha.IsNotEmpty())
        {
-            case nameof(ETransport.tcp):
-                dicQuery.Add("headerType", item.HeaderType.IsNotEmpty() ? item.HeaderType : Global.None);
-                if (item.RequestHost.IsNotEmpty())
+            dicQuery.Add("pcs", Utils.UrlEncode(item.CertSha));
+        }
+        if (item.Finalmask.IsNotEmpty())
+        {
+            var node = JsonUtils.ParseJson(item.Finalmask);
+            var finalmask = node != null
+                ? JsonUtils.Serialize(node, new JsonSerializerOptions
                {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
+                    WriteIndented = false,
+                    DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+                    Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+                })
+                : item.Finalmask;
+            dicQuery.Add("fm", Utils.UrlEncode(finalmask));
+        }
+
+        var network = item.GetNetwork();
+        if (!Global.Networks.Contains(network))
+        {
+            network = nameof(ETransport.raw);
+        }
+
+        //dicQuery.Add("type", network);
+        dicQuery.Add("type", network == nameof(ETransport.raw) ? Global.RawNetworkAlias : network);
+
+        switch (network)
+        {
+            case nameof(ETransport.raw):
+                dicQuery.Add("headerType", transport.RawHeaderType.IsNotEmpty() ? transport.RawHeaderType : Global.None);
+                if (transport.Host.IsNotEmpty())
+                {
+                    dicQuery.Add("host", UrlEncodeSafe(transport.Host));
+                }
+                if (transport.Path.IsNotEmpty())
+                {
+                    dicQuery.Add("path", UrlEncodeSafe(transport.Path));
                }
                break;

            case nameof(ETransport.kcp):
-                dicQuery.Add("headerType", item.HeaderType.IsNotEmpty() ? item.HeaderType : Global.None);
-                if (item.Path.IsNotEmpty())
+                dicQuery.Add("headerType", transport.KcpHeaderType.IsNotEmpty() ? transport.KcpHeaderType : Global.None);
+                if (transport.KcpSeed.IsNotEmpty())
                {
-                    dicQuery.Add("seed", Utils.UrlEncode(item.Path));
+                    dicQuery.Add("seed", UrlEncodeSafe(transport.KcpSeed));
+                }
+                if (transport.KcpMtu > 0)
+                {
+                    dicQuery.Add("mtu", transport.KcpMtu.ToString());
                }
                break;

            case nameof(ETransport.ws):
            case nameof(ETransport.httpupgrade):
-                if (item.RequestHost.IsNotEmpty())
+                if (transport.Host.IsNotEmpty())
                {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
+                    dicQuery.Add("host", UrlEncodeSafe(transport.Host));
                }
-                if (item.Path.IsNotEmpty())
+                if (transport.Path.IsNotEmpty())
                {
-                    dicQuery.Add("path", Utils.UrlEncode(item.Path));
+                    dicQuery.Add("path", UrlEncodeSafe(transport.Path));
                }
                break;

            case nameof(ETransport.xhttp):
-                if (item.RequestHost.IsNotEmpty())
+                if (transport.Host.IsNotEmpty())
                {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
+                    dicQuery.Add("host", UrlEncodeSafe(transport.Host));
                }
-                if (item.Path.IsNotEmpty())
+                if (transport.Path.IsNotEmpty())
                {
-                    dicQuery.Add("path", Utils.UrlEncode(item.Path));
+                    dicQuery.Add("path", UrlEncodeSafe(transport.Path));
                }
-                if (item.HeaderType.IsNotEmpty() && Global.XhttpMode.Contains(item.HeaderType))
+                if (transport.XhttpMode.IsNotEmpty() && Global.XhttpMode.Contains(transport.XhttpMode))
                {
-                    dicQuery.Add("mode", Utils.UrlEncode(item.HeaderType));
+                    dicQuery.Add("mode", UrlEncodeSafe(transport.XhttpMode));
                }
-                if (item.Extra.IsNotEmpty())
+                if (transport.XhttpExtra.IsNotEmpty())
                {
-                    var node = JsonUtils.ParseJson(item.Extra);
+                    var node = JsonUtils.ParseJson(transport.XhttpExtra);
                    var extra = node != null
                        ? JsonUtils.Serialize(node, new JsonSerializerOptions
                        {
@@ -130,38 +161,19 @@ public class BaseFmt
                            DefaultIgnoreCondition = JsonIgnoreCondition.Never,
                            Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
                        })
-                        : item.Extra;
-                    dicQuery.Add("extra", Utils.UrlEncode(extra));
+                        : transport.XhttpExtra;
+                    dicQuery.Add("extra", UrlEncodeSafe(extra));
                }
                break;

-            case nameof(ETransport.http):
-            case nameof(ETransport.h2):
-                dicQuery["type"] = nameof(ETransport.http);
-                if (item.RequestHost.IsNotEmpty())
-                {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
-                }
-                if (item.Path.IsNotEmpty())
-                {
-                    dicQuery.Add("path", Utils.UrlEncode(item.Path));
-                }
-                break;
-
-            case nameof(ETransport.quic):
-                dicQuery.Add("headerType", item.HeaderType.IsNotEmpty() ? item.HeaderType : Global.None);
-                dicQuery.Add("quicSecurity", Utils.UrlEncode(item.RequestHost));
-                dicQuery.Add("key", Utils.UrlEncode(item.Path));
-                break;
-
            case nameof(ETransport.grpc):
-                if (item.Path.IsNotEmpty())
+                if (transport.GrpcServiceName.IsNotEmpty())
                {
-                    dicQuery.Add("authority", Utils.UrlEncode(item.RequestHost));
-                    dicQuery.Add("serviceName", Utils.UrlEncode(item.Path));
-                    if (item.HeaderType is Global.GrpcGunMode or Global.GrpcMultiMode)
+                    dicQuery.Add("authority", UrlEncodeSafe(transport.GrpcAuthority));
+                    dicQuery.Add("serviceName", UrlEncodeSafe(transport.GrpcServiceName));
+                    if (transport.GrpcMode is Global.GrpcGunMode or Global.GrpcMultiMode)
                    {
-                        dicQuery.Add("mode", Utils.UrlEncode(item.HeaderType));
+                        dicQuery.Add("mode", UrlEncodeSafe(transport.GrpcMode));
                    }
                }
                break;
@@ -204,7 +216,8 @@ public class BaseFmt

    protected static int ResolveUriQuery(NameValueCollection query, ref ProfileItem item)
    {
-        item.Flow = GetQueryValue(query, "flow");
+        var transport = item.GetTransportExtra();
+
        item.StreamSecurity = GetQueryValue(query, "security");
        item.Sni = GetQueryValue(query, "sni");
        item.Alpn = GetQueryDecoded(query, "alpn");
@@ -214,6 +227,25 @@ public class BaseFmt
        item.SpiderX = GetQueryDecoded(query, "spx");
        item.Mldsa65Verify = GetQueryDecoded(query, "pqv");
        item.EchConfigList = GetQueryDecoded(query, "ech");
+        item.CertSha = GetQueryDecoded(query, "pcs");
+
+        var finalmaskDecoded = GetQueryDecoded(query, "fm");
+        if (finalmaskDecoded.IsNotEmpty())
+        {
+            var node = JsonUtils.ParseJson(finalmaskDecoded);
+            item.Finalmask = node != null
+                ? JsonUtils.Serialize(node, new JsonSerializerOptions
+                {
+                    WriteIndented = true,
+                    DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+                    Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+                })
+                : finalmaskDecoded;
+        }
+        else
+        {
+            item.Finalmask = string.Empty;
+        }

        if (_allowInsecureArray.Any(k => GetQueryDecoded(query, k) == "1"))
        {
@@ -228,36 +260,57 @@ public class BaseFmt
            item.AllowInsecure = string.Empty;
        }

-        item.Network = GetQueryValue(query, "type", nameof(ETransport.tcp));
+        var net = GetQueryValue(query, "type", nameof(ETransport.raw));
+        if (net == Global.RawNetworkAlias)
+        {
+            net = nameof(ETransport.raw);
+        }
+        if (!Global.Networks.Contains(net))
+        {
+            net = nameof(ETransport.raw);
+        }
+
+        item.Network = net;
        switch (item.Network)
        {
-            case nameof(ETransport.tcp):
-                item.HeaderType = GetQueryValue(query, "headerType", Global.None);
-                item.RequestHost = GetQueryDecoded(query, "host");
+            case nameof(ETransport.raw):
+                transport = transport with
+                {
+                    RawHeaderType = GetQueryValue(query, "headerType", Global.None),
+                    Host = GetQueryDecoded(query, "host"),
+                    Path = GetQueryDecoded(query, "path"),
+                };
                break;

            case nameof(ETransport.kcp):
-                item.HeaderType = GetQueryValue(query, "headerType", Global.None);
-                item.Path = GetQueryDecoded(query, "seed");
+                var kcpSeed = GetQueryDecoded(query, "seed");
+                var kcpMtuStr = GetQueryValue(query, "mtu");
+                var kcpMtu = int.TryParse(kcpMtuStr, out var mtu) ? mtu : 0;
+                transport = transport with
+                {
+                    KcpHeaderType = GetQueryValue(query, "headerType", Global.None),
+                    KcpSeed = kcpSeed,
+                    KcpMtu = kcpMtu > 0 ? mtu : null,
+                };
                break;

            case nameof(ETransport.ws):
            case nameof(ETransport.httpupgrade):
-                item.RequestHost = GetQueryDecoded(query, "host");
-                item.Path = GetQueryDecoded(query, "path", "/");
+                transport = transport with
+                {
+                    Host = GetQueryDecoded(query, "host"),
+                    Path = GetQueryDecoded(query, "path", "/"),
+                };
                break;

            case nameof(ETransport.xhttp):
-                item.RequestHost = GetQueryDecoded(query, "host");
-                item.Path = GetQueryDecoded(query, "path", "/");
-                item.HeaderType = GetQueryDecoded(query, "mode");
-                var extraDecoded = GetQueryDecoded(query, "extra");
-                if (extraDecoded.IsNotEmpty())
+                var xhttpExtra = GetQueryDecoded(query, "extra");
+                if (xhttpExtra.IsNotEmpty())
                {
-                    var node = JsonUtils.ParseJson(extraDecoded);
+                    var node = JsonUtils.ParseJson(xhttpExtra);
                    if (node != null)
                    {
-                        extraDecoded = JsonUtils.Serialize(node, new JsonSerializerOptions
+                        xhttpExtra = JsonUtils.Serialize(node, new JsonSerializerOptions
                        {
                            WriteIndented = true,
                            DefaultIgnoreCondition = JsonIgnoreCondition.Never,
@@ -265,31 +318,32 @@ public class BaseFmt
                        });
                    }
                }
-                item.Extra = extraDecoded;
-                break;

-            case nameof(ETransport.http):
-            case nameof(ETransport.h2):
-                item.Network = nameof(ETransport.h2);
-                item.RequestHost = GetQueryDecoded(query, "host");
-                item.Path = GetQueryDecoded(query, "path", "/");
-                break;
-
-            case nameof(ETransport.quic):
-                item.HeaderType = GetQueryValue(query, "headerType", Global.None);
-                item.RequestHost = GetQueryValue(query, "quicSecurity", Global.None);
-                item.Path = GetQueryDecoded(query, "key");
+                transport = transport with
+                {
+                    Host = GetQueryDecoded(query, "host"),
+                    Path = GetQueryDecoded(query, "path", "/"),
+                    XhttpMode = GetQueryDecoded(query, "mode"),
+                    XhttpExtra = xhttpExtra,
+                };
                break;

            case nameof(ETransport.grpc):
-                item.RequestHost = GetQueryDecoded(query, "authority");
-                item.Path = GetQueryDecoded(query, "serviceName");
-                item.HeaderType = GetQueryDecoded(query, "mode", Global.GrpcGunMode);
+                transport = transport with
+                {
+                    GrpcAuthority = GetQueryDecoded(query, "authority"),
+                    GrpcServiceName = GetQueryDecoded(query, "serviceName"),
+                    GrpcMode = GetQueryDecoded(query, "mode", Global.GrpcGunMode),
+                };
                break;

            default:
+                item.Network = nameof(ETransport.raw);
                break;
        }
+
+        item.SetTransportExtra(transport);
+
        return 0;
    }

@@ -19,6 +19,7 @@ public class FmtHandler
                EConfigType.TUIC => TuicFmt.ToUri(item),
                EConfigType.WireGuard => WireguardFmt.ToUri(item),
                EConfigType.Anytls => AnytlsFmt.ToUri(item),
+                EConfigType.Naive => NaiveFmt.ToUri(item),
                _ => null,
            };

@@ -80,6 +81,12 @@ public class FmtHandler
            {
                return AnytlsFmt.Resolve(str, out msg);
            }
+            else if (str.StartsWith(Global.ProtocolShares[EConfigType.Naive])
+                     || str.StartsWith(Global.NaiveHttpsProtocolShare)
+                     || str.StartsWith(Global.NaiveQuicProtocolShare))
+            {
+                return NaiveFmt.Resolve(str, out msg);
+            }
            else
            {
                msg = ResUI.NonvmessOrssProtocol;
@@ -19,12 +19,19 @@ public class Hysteria2Fmt : BaseFmt
        item.Address = url.IdnHost;
        item.Port = url.Port;
        item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
-        item.Id = Utils.UrlDecode(url.UserInfo);
+        item.Password = Utils.UrlDecode(url.UserInfo);

        var query = Utils.ParseQueryString(url.Query);
        ResolveUriQuery(query, ref item);
-        item.Path = GetQueryDecoded(query, "obfs-password");
-        item.Ports = GetQueryDecoded(query, "mport");
+        if (item.CertSha.IsNullOrEmpty())
+        {
+            item.CertSha = GetQueryDecoded(query, "pinSHA256");
+        }
+        item.SetProtocolExtra(item.GetProtocolExtra() with
+        {
+            Ports = GetQueryDecoded(query, "mport"),
+            SalamanderPass = GetQueryDecoded(query, "obfs-password"),
+        });

        return item;
    }
@@ -45,18 +52,29 @@ public class Hysteria2Fmt : BaseFmt
        }
        var dicQuery = new Dictionary<string, string>();
        ToUriQueryLite(item, ref dicQuery);
+        var protocolExtraItem = item.GetProtocolExtra();

-        if (item.Path.IsNotEmpty())
+        if (!protocolExtraItem.SalamanderPass.IsNullOrEmpty())
        {
            dicQuery.Add("obfs", "salamander");
-            dicQuery.Add("obfs-password", Utils.UrlEncode(item.Path));
+            dicQuery.Add("obfs-password", Utils.UrlEncode(protocolExtraItem.SalamanderPass));
        }
-        if (item.Ports.IsNotEmpty())
+        if (!protocolExtraItem.Ports.IsNullOrEmpty())
        {
-            dicQuery.Add("mport", Utils.UrlEncode(item.Ports.Replace(':', '-')));
+            dicQuery.Add("mport", Utils.UrlEncode(protocolExtraItem.Ports.Replace(':', '-')));
+        }
+        if (!item.CertSha.IsNullOrEmpty())
+        {
+            var sha = item.CertSha;
+            var idx = sha.IndexOf(',');
+            if (idx > 0)
+            {
+                sha = sha[..idx];
+            }
+            dicQuery.Add("pinSHA256", Utils.UrlEncode(sha));
        }

-        return ToUri(EConfigType.Hysteria2, item.Address, item.Port, item.Id, dicQuery, remark);
+        return ToUri(EConfigType.Hysteria2, item.Address, item.Port, item.Password, dicQuery, remark);
    }

    public static ProfileItem? ResolveFull2(string strData, string? subRemarks)
@@ -0,0 +1,299 @@
+namespace ServiceLib.Handler.Fmt;
+
+public class InnerFmt
+{
+    private static readonly Lazy<string> SessionSalt = new(() => Utils.GetGuid(false));
+
+    public static List<ProfileItem>? Resolve(string strData, string subid)
+    {
+        var list = new List<ProfileItem>();
+        // Overwrite externally imported indexIds to avoid possible sources of attacks
+        var indexIdMap = new Dictionary<string, string>();
+        using (var reader = new StringReader(strData))
+        {
+            while (reader.ReadLine() is { } line)
+            {
+                if (line.IsNullOrEmpty())
+                {
+                    continue;
+                }
+                var trimmedLine = line.Trim();
+                if (!trimmedLine.StartsWith(Global.InnerUriProtocol, StringComparison.OrdinalIgnoreCase))
+                {
+                    continue;
+                }
+                var profileItem = ResolveSingle(trimmedLine);
+                if (profileItem is null)
+                {
+                    continue;
+                }
+                if (profileItem.ConfigType == EConfigType.Custom)
+                {
+                    // Unsupported, also to avoid possible sources of attacks, skip it
+                    continue;
+                }
+                // overwrite indexId
+                var newIndexId = Utils.GetGuid(false);
+                if (!profileItem.IndexId.IsNullOrEmpty())
+                {
+                    // Ignore duplicated indexId
+                    indexIdMap[profileItem.IndexId] = newIndexId;
+                }
+                profileItem.IndexId = newIndexId;
+                list.Add(profileItem);
+            }
+        }
+        // For group-type profile items, also overwrite the ChildItems and ChildSubId
+        var emptyGroupProfileList = new List<ProfileItem>();
+        foreach (var item in list.Where(i => i.ConfigType.IsGroupType()))
+        {
+            var protocolExtra = item.GetProtocolExtra();
+            // Only allow "self" as a special value for SubChildItems to avoid possible sources of attacks,
+            // which means it will be replaced with the subid, otherwise set it to null
+            //if (!protocolExtra.SubChildItems.IsNullOrEmpty())
+            if (protocolExtra.SubChildItems == "self")
+            {
+                protocolExtra = protocolExtra with
+                {
+                    SubChildItems = subid
+                };
+            }
+            else
+            {
+                protocolExtra = protocolExtra with
+                {
+                    SubChildItems = null
+                };
+            }
+            if (Utils.String2List(protocolExtra.ChildItems) is { Count: > 0 } childIndexIds)
+            {
+                var newChildIndexIds = childIndexIds
+                    .Select(id => indexIdMap.GetValueOrDefault(id, null))
+                    .Where(id => !id.IsNullOrEmpty())
+                    .ToList();
+                protocolExtra = protocolExtra with
+                {
+                    ChildItems = Utils.List2String(newChildIndexIds)
+                };
+            }
+            else
+            {
+                protocolExtra = protocolExtra with
+                {
+                    ChildItems = null
+                };
+            }
+            item.SetProtocolExtra(protocolExtra);
+            if (protocolExtra.SubChildItems.IsNullOrEmpty()
+                && protocolExtra.ChildItems.IsNullOrEmpty())
+            {
+                emptyGroupProfileList.Add(item);
+            }
+        }
+        // Remove empty group profile items
+        list.RemoveAll(emptyGroupProfileList.Contains);
+        return list;
+    }
+
+    public static string? ToUri(List<ProfileItem> items)
+    {
+        var sb = new StringBuilder();
+        foreach (var item in items)
+        {
+            if (item.ConfigType == EConfigType.Custom)
+            {
+                continue;
+            }
+            var itemClone = JsonUtils.DeepCopy(item);
+            if (itemClone is null)
+            {
+                continue;
+            }
+            // overwrite indexId
+            var originalIndexId = itemClone.IndexId;
+            var newIndexId = GetReproducibleExportId(originalIndexId);
+            itemClone.IndexId = newIndexId;
+            if (itemClone.ConfigType.IsGroupType())
+            {
+                var protocolExtra = itemClone.GetProtocolExtra();
+                if (!protocolExtra.SubChildItems.IsNullOrEmpty())
+                {
+                    protocolExtra = protocolExtra with
+                    {
+                        SubChildItems = "self"
+                    };
+                }
+                if (Utils.String2List(protocolExtra.ChildItems) is { Count: > 0 } childIndexIds)
+                {
+                    var newChildIndexIds = childIndexIds
+                        .Select(GetReproducibleExportId)
+                        .Where(id => !id.IsNullOrEmpty())
+                        .ToList();
+                    protocolExtra = protocolExtra with
+                    {
+                        ChildItems = Utils.List2String(newChildIndexIds)
+                    };
+                }
+                itemClone.SetProtocolExtra(protocolExtra);
+            }
+            var uri = ToUriSingle(itemClone);
+            if (!uri.IsNullOrEmpty())
+            {
+                sb.AppendLine(uri);
+            }
+        }
+        return sb.Length > 0 ? sb.ToString() : null;
+    }
+
+    private static ProfileItem? ResolveSingle(string str)
+    {
+        // format: v2rayn://vless/{url-safe base64 encoded_string}
+        var parsedUri = Utils.TryUri(str);
+        if (parsedUri is null)
+        {
+            return null;
+        }
+        var segment = parsedUri.AbsolutePath.TrimStart('/');
+        var decodedResult = Utils.Base64Decode(segment);
+        var jsonNode = JsonUtils.ParseJson(decodedResult);
+        if (jsonNode is not JsonObject jsonObj)
+        {
+            return null;
+        }
+        // flatten
+        // move jsonObj.ProtoExtraObj to jsonObj.ProtoExtra (string)
+        // move jsonObj.TransportExtraObj to jsonObj.TransportExtra (string)
+        if (jsonObj.TryGetPropertyValue("ProtoExtraObj", out var protoExtraNode)
+            && protoExtraNode is JsonObject protoExtraObj)
+        {
+            jsonObj["ProtoExtra"] = JsonUtils.Serialize(protoExtraObj, false);
+            jsonObj.Remove("ProtoExtraObj");
+        }
+        if (jsonObj.TryGetPropertyValue("TransportExtraObj", out var transportExtraNode)
+            && transportExtraNode is JsonObject transportExtraObj)
+        {
+            jsonObj["TransportExtra"] = JsonUtils.Serialize(transportExtraObj, false);
+            jsonObj.Remove("TransportExtraObj");
+        }
+        var profileItem = JsonUtils.Deserialize<ProfileItem>(JsonUtils.Serialize(jsonObj, false));
+        if (profileItem is null)
+        {
+            return null;
+        }
+        if (profileItem.ConfigVersion != 4)
+        {
+            return null;
+        }
+        // Check Enum.IsDefined
+        if (!Enum.IsDefined(typeof(EConfigType), profileItem.ConfigType))
+        {
+            return null;
+        }
+        if (profileItem.CoreType is not (null or ECoreType.Xray or ECoreType.sing_box))
+        {
+            return null;
+        }
+        var protocolExtra = profileItem.GetProtocolExtra();
+        var multipleLoad = protocolExtra.MultipleLoad;
+        if (multipleLoad is not null && !Enum.IsDefined(typeof(EMultipleLoad), multipleLoad))
+        {
+            return null;
+        }
+        return profileItem;
+    }
+
+    private static string? ToUriSingle(ProfileItem item)
+    {
+        var jsonNode = JsonUtils.ParseJson(JsonUtils.Serialize(item, false));
+        if (jsonNode is not JsonObject jsonObj)
+        {
+            return null;
+        }
+        // unflatten
+        // move jsonObj.ProtoExtra (string) to jsonObj.ProtoExtraObj
+        // move jsonObj.TransportExtra (string) to jsonObj.TransportExtraObj
+        if (jsonObj.TryGetPropertyValue("ProtoExtra", out var protoExtraNode)
+            && protoExtraNode is JsonValue protoExtraValue
+            && protoExtraValue.TryGetValue<string>(out var protoExtraStr)
+            && !protoExtraStr.IsNullOrEmpty()
+            && JsonUtils.ParseJson(protoExtraStr) is JsonObject protoExtraObj)
+        {
+            jsonObj["ProtoExtraObj"] = protoExtraObj;
+            jsonObj.Remove("ProtoExtra");
+        }
+        if (jsonObj.TryGetPropertyValue("TransportExtra", out var transportExtraNode)
+            && transportExtraNode is JsonValue transportExtraValue
+            && transportExtraValue.TryGetValue<string>(out var transportExtraStr)
+            && !transportExtraStr.IsNullOrEmpty()
+            && JsonUtils.ParseJson(transportExtraStr) is JsonObject transportExtraObj)
+        {
+            jsonObj["TransportExtraObj"] = transportExtraObj;
+            jsonObj.Remove("TransportExtra");
+        }
+        // Remove empty properties to reduce the length of the exported string
+        RemoveEmptyJson(jsonObj);
+        var jsonStr = JsonUtils.Serialize(jsonObj, false);
+        var encodedStr = Utils.Base64Encode(jsonStr).Replace('+', '-').Replace('/', '_').Replace("=", "");
+        return $"{Global.InnerUriProtocol}{item.ConfigType.ToString().ToLower()}/{encodedStr}";
+    }
+
+    private static string GetReproducibleExportId(string originalIndexId)
+    {
+        if (originalIndexId.IsNullOrEmpty())
+        {
+            return originalIndexId;
+        }
+
+        var hash = HashCode.Combine(SessionSalt.Value, originalIndexId) & 0x7FFFFFFF;
+        var bytes = BitConverter.GetBytes(hash);
+        return Convert.ToBase64String(bytes).Replace("=", "");
+    }
+
+    private static void RemoveEmptyJson(JsonNode? node)
+    {
+        // ReSharper disable once ConvertIfStatementToSwitchStatement
+        if (node is JsonObject jsonObject)
+        {
+            var propertiesToRemove = new List<string>();
+
+            foreach (var property in jsonObject)
+            {
+                RemoveEmptyJson(property.Value);
+
+                if (IsEmpty(property.Value))
+                {
+                    propertiesToRemove.Add(property.Key);
+                }
+            }
+
+            foreach (var key in propertiesToRemove)
+            {
+                jsonObject.Remove(key);
+            }
+        }
+        else if (node is JsonArray jsonArray)
+        {
+            for (var i = jsonArray.Count - 1; i >= 0; i--)
+            {
+                RemoveEmptyJson(jsonArray[i]);
+
+                if (IsEmpty(jsonArray[i]))
+                {
+                    jsonArray.RemoveAt(i);
+                }
+            }
+        }
+    }
+
+    private static bool IsEmpty(JsonNode? node)
+    {
+        return node switch
+        {
+            null => true,
+            JsonValue value when value.TryGetValue<string>(out var str) => string.IsNullOrEmpty(str),
+            JsonObject obj => obj.Count == 0,
+            JsonArray arr => arr.Count == 0,
+            _ => false
+        };
+    }
+}
@@ -0,0 +1,91 @@
+namespace ServiceLib.Handler.Fmt;
+
+public class NaiveFmt : BaseFmt
+{
+    public static ProfileItem? Resolve(string str, out string msg)
+    {
+        msg = ResUI.ConfigurationFormatIncorrect;
+
+        var parsedUrl = Utils.TryUri(str);
+        if (parsedUrl == null)
+        {
+            return null;
+        }
+
+        ProfileItem item = new()
+        {
+            ConfigType = EConfigType.Naive,
+            Remarks = parsedUrl.GetComponents(UriComponents.Fragment, UriFormat.Unescaped),
+            Address = parsedUrl.IdnHost,
+            Port = parsedUrl.Port,
+        };
+        var protocolExtra = item.GetProtocolExtra();
+        if (parsedUrl.Scheme.Contains("quic"))
+        {
+            protocolExtra = protocolExtra with
+            {
+                NaiveQuic = true,
+            };
+        }
+        var rawUserInfo = Utils.UrlDecode(parsedUrl.UserInfo);
+        if (rawUserInfo.Contains(':'))
+        {
+            var split = rawUserInfo.Split(':', 2);
+            item.Username = split[0];
+            item.Password = split[1];
+        }
+        else
+        {
+            item.Password = rawUserInfo;
+        }
+
+        var query = Utils.ParseQueryString(parsedUrl.Query);
+        ResolveUriQuery(query, ref item);
+        var insecureConcurrency = int.TryParse(GetQueryValue(query, "insecure-concurrency"), out var ic) ? ic : 0;
+        if (insecureConcurrency > 0)
+        {
+            protocolExtra = protocolExtra with
+            {
+                InsecureConcurrency = insecureConcurrency,
+            };
+        }
+
+        item.SetProtocolExtra(protocolExtra);
+        return item;
+    }
+
+    public static string? ToUri(ProfileItem? item)
+    {
+        if (item == null)
+        {
+            return null;
+        }
+        var remark = string.Empty;
+        if (item.Remarks.IsNotEmpty())
+        {
+            remark = "#" + Utils.UrlEncode(item.Remarks);
+        }
+        var userInfo = item.Username.IsNotEmpty() ? $"{Utils.UrlEncode(item.Username)}:{Utils.UrlEncode(item.Password)}" : Utils.UrlEncode(item.Password);
+        var dicQuery = new Dictionary<string, string>();
+        ToUriQuery(item, Global.None, ref dicQuery);
+        var protocolExtra = item.GetProtocolExtra();
+        if (protocolExtra.InsecureConcurrency > 0)
+        {
+            dicQuery.Add("insecure-concurrency", protocolExtra?.InsecureConcurrency.ToString());
+        }
+
+        var query = dicQuery.Count > 0
+            ? ("?" + string.Join("&", dicQuery.Select(x => x.Key + "=" + x.Value).ToArray()))
+            : string.Empty;
+        var url = $"{userInfo}@{GetIpv6(item.Address)}:{item.Port}";
+
+        if (protocolExtra.NaiveQuic == true)
+        {
+            return $"{Global.NaiveQuicProtocolShare}{url}{query}{remark}";
+        }
+        else
+        {
+            return $"{Global.NaiveHttpsProtocolShare}{url}{query}{remark}";
+        }
+    }
+}
@@ -12,7 +12,8 @@ public class ShadowsocksFmt : BaseFmt
        {
            return null;
        }
-        if (item.Address.Length == 0 || item.Port == 0 || item.Security.Length == 0 || item.Id.Length == 0)
+
+        if (item.Address.Length == 0 || item.Port == 0 || item.GetProtocolExtra().SsMethod.IsNullOrEmpty() || item.Password.Length == 0)
        {
            return null;
        }
@@ -40,32 +41,29 @@ public class ShadowsocksFmt : BaseFmt
        //    item.port);
        //url = Utile.Base64Encode(url);
        //new Sip002
-        var pw = Utils.Base64Encode($"{item.Security}:{item.Id}", true);
+        var pw = Utils.Base64Encode($"{item.GetProtocolExtra().SsMethod}:{item.Password}", true);
+        var transport = item.GetTransportExtra();

        // plugin
        var plugin = string.Empty;
        var pluginArgs = string.Empty;

-        if (item.Network == nameof(ETransport.tcp) && item.HeaderType == Global.TcpHeaderHttp)
+        if (item.Network == nameof(ETransport.raw) && transport.RawHeaderType == Global.RawHeaderHttp)
        {
            plugin = "obfs-local";
-            pluginArgs = $"obfs=http;obfs-host={item.RequestHost};";
+            pluginArgs = $"obfs=http;obfs-host={transport.Host};";
        }
        else
        {
            if (item.Network == nameof(ETransport.ws))
            {
                pluginArgs += "mode=websocket;";
-                pluginArgs += $"host={item.RequestHost};";
+                pluginArgs += $"host={transport.Host};";
                // https://github.com/shadowsocks/v2ray-plugin/blob/e9af1cdd2549d528deb20a4ab8d61c5fbe51f306/args.go#L172
                // Equal signs and commas [and backslashes] must be escaped with a backslash.
-                var path = item.Path.Replace("\\", "\\\\").Replace("=", "\\=").Replace(",", "\\,");
+                var path = (transport.Path ?? string.Empty).Replace("\\", "\\\\").Replace("=", "\\=").Replace(",", "\\,");
                pluginArgs += $"path={path};";
            }
-            else if (item.Network == nameof(ETransport.quic))
-            {
-                pluginArgs += "mode=quic;";
-            }
            if (item.StreamSecurity == Global.StreamSecurity)
            {
                pluginArgs += "tls;";
@@ -136,8 +134,8 @@ public class ShadowsocksFmt : BaseFmt
        {
            return null;
        }
-        item.Security = details.Groups["method"].Value;
-        item.Id = details.Groups["password"].Value;
+        item.SetProtocolExtra(item.GetProtocolExtra() with { SsMethod = details.Groups["method"].Value });
+        item.Password = details.Groups["password"].Value;
        item.Address = details.Groups["hostname"].Value;
        item.Port = details.Groups["port"].Value.ToInt();
        return item;
@@ -166,8 +164,8 @@ public class ShadowsocksFmt : BaseFmt
            {
                return null;
            }
-            item.Security = userInfoParts.First();
-            item.Id = Utils.UrlDecode(userInfoParts.Last());
+            item.SetProtocolExtra(item.GetProtocolExtra() with { SsMethod = userInfoParts.First() });
+            item.Password = Utils.UrlDecode(userInfoParts.Last());
        }
        else
        {
@@ -178,8 +176,8 @@ public class ShadowsocksFmt : BaseFmt
            {
                return null;
            }
-            item.Security = userInfoParts.First();
-            item.Id = userInfoParts.Last();
+            item.SetProtocolExtra(item.GetProtocolExtra() with { SsMethod = userInfoParts.First() });
+            item.Password = userInfoParts.Last();
        }

        var queryParameters = Utils.ParseQueryString(parsedUrl.Query);
@@ -212,8 +210,11 @@ public class ShadowsocksFmt : BaseFmt
                {
                    obfsHost = obfsHost.Replace("obfs-host=", "");
                    item.Network = Global.DefaultNetwork;
-                    item.HeaderType = Global.TcpHeaderHttp;
-                    item.RequestHost = obfsHost;
+                    item.SetTransportExtra(item.GetTransportExtra() with
+                    {
+                        RawHeaderType = Global.RawHeaderHttp,
+                        Host = obfsHost,
+                    });
                }
            }
            // Parse v2ray-plugin
@@ -230,21 +231,20 @@ public class ShadowsocksFmt : BaseFmt
                if (modeValue == "websocket")
                {
                    item.Network = nameof(ETransport.ws);
+                    var t = item.GetTransportExtra();
                    if (!host.IsNullOrEmpty())
                    {
-                        item.RequestHost = host.Replace("host=", "");
-                        item.Sni = item.RequestHost;
+                        var wsHost = host.Replace("host=", "");
+                        t = t with { Host = wsHost };
+                        item.Sni = wsHost;
                    }
                    if (!path.IsNullOrEmpty())
                    {
                        var pathValue = path.Replace("path=", "");
                        pathValue = pathValue.Replace("\\=", "=").Replace("\\,", ",").Replace("\\\\", "\\");
-                        item.Path = pathValue;
+                        t = t with { Path = pathValue };
                    }
-                }
-                else if (modeValue == "quic")
-                {
-                    item.Network = nameof(ETransport.quic);
+                    item.SetTransportExtra(t);
                }

                if (hasTls)
@@ -275,7 +275,6 @@ public class ShadowsocksFmt : BaseFmt
                }
            }
        }
-
        return item;
    }

@@ -300,11 +299,11 @@ public class ShadowsocksFmt : BaseFmt
                var ssItem = new ProfileItem()
                {
                    Remarks = it.remarks,
-                    Security = it.method,
-                    Id = it.password,
+                    Password = it.password,
                    Address = it.server,
                    Port = it.server_port.ToInt()
                };
+                ssItem.SetProtocolExtra(new ProtocolExtraItem() { SsMethod = it.method });
                lst.Add(ssItem);
            }
            return lst;
@@ -33,7 +33,7 @@ public class SocksFmt : BaseFmt
            remark = "#" + Utils.UrlEncode(item.Remarks);
        }
        //new
-        var pw = Utils.Base64Encode($"{item.Security}:{item.Id}", true);
+        var pw = Utils.Base64Encode($"{item.Username}:{item.Password}", true);
        return ToUri(EConfigType.SOCKS, item.Address, item.Port, pw, null, remark);
    }

@@ -78,9 +78,8 @@ public class SocksFmt : BaseFmt
        }
        item.Address = arr1[1][..indexPort];
        item.Port = arr1[1][(indexPort + 1)..].ToInt();
-        item.Security = arr21.First();
-        item.Id = arr21[1];
-
+        item.Username = arr21.First();
+        item.Password = arr21[1];
        return item;
    }

@@ -98,15 +97,14 @@ public class SocksFmt : BaseFmt
            Address = parsedUrl.IdnHost,
            Port = parsedUrl.Port,
        };
-
        // parse base64 UserInfo
        var rawUserInfo = Utils.UrlDecode(parsedUrl.UserInfo);
        var userInfo = Utils.Base64Decode(rawUserInfo);
        var userInfoParts = userInfo.Split([':'], 2);
        if (userInfoParts.Length == 2)
        {
-            item.Security = userInfoParts.First();
-            item.Id = userInfoParts[1];
+            item.Username = userInfoParts.First();
+            item.Password = userInfoParts[1];
        }

        return item;
@@ -20,9 +20,10 @@ public class TrojanFmt : BaseFmt
        item.Address = url.IdnHost;
        item.Port = url.Port;
        item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
-        item.Id = Utils.UrlDecode(url.UserInfo);
+        item.Password = Utils.UrlDecode(url.UserInfo);

        var query = Utils.ParseQueryString(url.Query);
+        item.SetProtocolExtra(item.GetProtocolExtra() with { Flow = GetQueryValue(query, "flow") });
        ResolveUriQuery(query, ref item);

        return item;
@@ -40,8 +41,12 @@ public class TrojanFmt : BaseFmt
            remark = "#" + Utils.UrlEncode(item.Remarks);
        }
        var dicQuery = new Dictionary<string, string>();
+        if (!item.GetProtocolExtra().Flow.IsNullOrEmpty())
+        {
+            dicQuery.Add("flow", item.GetProtocolExtra().Flow);
+        }
        ToUriQuery(item, null, ref dicQuery);

-        return ToUri(EConfigType.Trojan, item.Address, item.Port, item.Id, dicQuery, remark);
+        return ToUri(EConfigType.Trojan, item.Address, item.Port, item.Password, dicQuery, remark);
    }
 }
@@ -24,13 +24,16 @@ public class TuicFmt : BaseFmt
        var userInfoParts = rawUserInfo.Split(new[] { ':' }, 2);
        if (userInfoParts.Length == 2)
        {
-            item.Id = userInfoParts.First();
-            item.Security = userInfoParts.Last();
+            item.Username = userInfoParts.First();
+            item.Password = userInfoParts.Last();
        }

        var query = Utils.ParseQueryString(url.Query);
        ResolveUriQuery(query, ref item);
-        item.HeaderType = GetQueryValue(query, "congestion_control");
+        item.SetProtocolExtra(item.GetProtocolExtra() with
+        {
+            CongestionControl = GetQueryValue(query, "congestion_control")
+        });

        return item;
    }
@@ -51,8 +54,11 @@ public class TuicFmt : BaseFmt
        var dicQuery = new Dictionary<string, string>();
        ToUriQueryLite(item, ref dicQuery);

-        dicQuery.Add("congestion_control", item.HeaderType);
+        if (!item.GetProtocolExtra().CongestionControl.IsNullOrEmpty())
+        {
+            dicQuery.Add("congestion_control", item.GetProtocolExtra().CongestionControl);
+        }

-        return ToUri(EConfigType.TUIC, item.Address, item.Port, $"{item.Id}:{item.Security}", dicQuery, remark);
+        return ToUri(EConfigType.TUIC, item.Address, item.Port, $"{item.Username ?? ""}:{item.Password}", dicQuery, remark);
    }
 }
@@ -9,7 +9,6 @@ public class VLESSFmt : BaseFmt
        ProfileItem item = new()
        {
            ConfigType = EConfigType.VLESS,
-            Security = Global.None
        };

        var url = Utils.TryUri(str);
@@ -21,10 +20,14 @@ public class VLESSFmt : BaseFmt
        item.Address = url.IdnHost;
        item.Port = url.Port;
        item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
-        item.Id = Utils.UrlDecode(url.UserInfo);
+        item.Password = Utils.UrlDecode(url.UserInfo);

        var query = Utils.ParseQueryString(url.Query);
-        item.Security = GetQueryValue(query, "encryption", Global.None);
+        item.SetProtocolExtra(item.GetProtocolExtra() with
+        {
+            VlessEncryption = GetQueryValue(query, "encryption", Global.None),
+            Flow = GetQueryValue(query, "flow")
+        });
        item.StreamSecurity = GetQueryValue(query, "security");
        ResolveUriQuery(query, ref item);

@@ -44,16 +47,14 @@ public class VLESSFmt : BaseFmt
            remark = "#" + Utils.UrlEncode(item.Remarks);
        }
        var dicQuery = new Dictionary<string, string>();
-        if (item.Security.IsNotEmpty())
+        dicQuery.Add("encryption",
+            !item.GetProtocolExtra().VlessEncryption.IsNullOrEmpty() ? item.GetProtocolExtra().VlessEncryption : Global.None);
+        if (!item.GetProtocolExtra().Flow.IsNullOrEmpty())
        {
-            dicQuery.Add("encryption", item.Security);
-        }
-        else
-        {
-            dicQuery.Add("encryption", Global.None);
+            dicQuery.Add("flow", item.GetProtocolExtra().Flow);
        }
        ToUriQuery(item, Global.None, ref dicQuery);

-        return ToUri(EConfigType.VLESS, item.Address, item.Port, item.Id, dicQuery, remark);
+        return ToUri(EConfigType.VLESS, item.Address, item.Port, item.Password, dicQuery, remark);
    }
 }
@@ -23,19 +23,45 @@ public class VmessFmt : BaseFmt
        {
            return null;
        }
+
        var vmessQRCode = new VmessQRCode
        {
-            v = item.ConfigVersion,
+            // vmess link keeps shared transport keys; map from new transport model on export.
+            v = 2,
            ps = item.Remarks.TrimEx(),
            add = item.Address,
            port = item.Port,
-            id = item.Id,
-            aid = item.AlterId,
-            scy = item.Security,
-            net = item.Network,
-            type = item.HeaderType,
-            host = item.RequestHost,
-            path = item.Path,
+            id = item.Password,
+            aid = int.TryParse(item.GetProtocolExtra()?.AlterId, out var result) ? result : 0,
+            scy = item.GetProtocolExtra().VmessSecurity ?? "",
+            net = item.GetNetwork() == nameof(ETransport.raw) ? Global.RawNetworkAlias : item.Network,
+            type = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => item.GetTransportExtra().RawHeaderType,
+                nameof(ETransport.kcp) => item.GetTransportExtra().KcpHeaderType,
+                nameof(ETransport.xhttp) => item.GetTransportExtra().XhttpMode,
+                nameof(ETransport.grpc) => item.GetTransportExtra().GrpcMode,
+                _ => Global.None,
+            },
+            host = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => item.GetTransportExtra().Host,
+                nameof(ETransport.ws) => item.GetTransportExtra().Host,
+                nameof(ETransport.httpupgrade) => item.GetTransportExtra().Host,
+                nameof(ETransport.xhttp) => item.GetTransportExtra().Host,
+                nameof(ETransport.grpc) => item.GetTransportExtra().GrpcAuthority,
+                _ => null,
+            },
+            path = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => item.GetTransportExtra().Path,
+                nameof(ETransport.kcp) => item.GetTransportExtra().KcpSeed,
+                nameof(ETransport.ws) => item.GetTransportExtra().Path,
+                nameof(ETransport.httpupgrade) => item.GetTransportExtra().Path,
+                nameof(ETransport.xhttp) => item.GetTransportExtra().Path,
+                nameof(ETransport.grpc) => item.GetTransportExtra().GrpcServiceName,
+                _ => null,
+            },
            tls = item.StreamSecurity,
            sni = item.Sni,
            alpn = item.Alpn,
@@ -69,28 +95,47 @@ public class VmessFmt : BaseFmt
        }

        item.Network = Global.DefaultNetwork;
-        item.HeaderType = Global.None;
+        var transport = new TransportExtraItem
+        {
+            RawHeaderType = Global.None,
+        };

-        item.ConfigVersion = vmessQRCode.v;
+        //item.ConfigVersion = vmessQRCode.v;
        item.Remarks = Utils.ToString(vmessQRCode.ps);
        item.Address = Utils.ToString(vmessQRCode.add);
        item.Port = vmessQRCode.port;
-        item.Id = Utils.ToString(vmessQRCode.id);
-        item.AlterId = vmessQRCode.aid;
-        item.Security = Utils.ToString(vmessQRCode.scy);
-
-        item.Security = vmessQRCode.scy.IsNotEmpty() ? vmessQRCode.scy : Global.DefaultSecurity;
+        item.Password = Utils.ToString(vmessQRCode.id);
+        item.SetProtocolExtra(new ProtocolExtraItem
+        {
+            AlterId = vmessQRCode.aid.ToString(),
+            VmessSecurity = vmessQRCode.scy.IsNullOrEmpty() ? Global.DefaultSecurity : vmessQRCode.scy,
+        });
        if (vmessQRCode.net.IsNotEmpty())
        {
-            item.Network = vmessQRCode.net;
+            item.Network = vmessQRCode.net == Global.RawNetworkAlias ? nameof(ETransport.raw) : vmessQRCode.net;
        }
        if (vmessQRCode.type.IsNotEmpty())
        {
-            item.HeaderType = vmessQRCode.type;
+            transport = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => transport with { RawHeaderType = vmessQRCode.type },
+                nameof(ETransport.kcp) => transport with { KcpHeaderType = vmessQRCode.type },
+                nameof(ETransport.xhttp) => transport with { XhttpMode = vmessQRCode.type },
+                nameof(ETransport.grpc) => transport with { GrpcMode = vmessQRCode.type },
+                _ => transport,
+            };
        }
-
-        item.RequestHost = Utils.ToString(vmessQRCode.host);
-        item.Path = Utils.ToString(vmessQRCode.path);
+        transport = item.GetNetwork() switch
+        {
+            nameof(ETransport.raw) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.kcp) => transport with { KcpSeed = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.ws) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.httpupgrade) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.xhttp) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.grpc) => transport with { GrpcAuthority = Utils.ToString(vmessQRCode.host), GrpcServiceName = Utils.ToString(vmessQRCode.path) },
+            _ => transport,
+        };
+        item.SetTransportExtra(transport);
        item.StreamSecurity = Utils.ToString(vmessQRCode.tls);
        item.Sni = Utils.ToString(vmessQRCode.sni);
        item.Alpn = Utils.ToString(vmessQRCode.alpn);
@@ -105,7 +150,6 @@ public class VmessFmt : BaseFmt
        var item = new ProfileItem
        {
            ConfigType = EConfigType.VMess,
-            Security = "auto"
        };

        var url = Utils.TryUri(str);
@@ -117,7 +161,12 @@ public class VmessFmt : BaseFmt
        item.Address = url.IdnHost;
        item.Port = url.Port;
        item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
-        item.Id = Utils.UrlDecode(url.UserInfo);
+        item.Password = Utils.UrlDecode(url.UserInfo);
+
+        item.SetProtocolExtra(new ProtocolExtraItem
+        {
+            VmessSecurity = Global.DefaultSecurity,
+        });

        var query = Utils.ParseQueryString(url.Query);
        ResolveUriQuery(query, ref item);
@@ -20,14 +20,18 @@ public class WireguardFmt : BaseFmt
        item.Address = url.IdnHost;
        item.Port = url.Port;
        item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
-        item.Id = Utils.UrlDecode(url.UserInfo);
+        item.Password = Utils.UrlDecode(url.UserInfo);

        var query = Utils.ParseQueryString(url.Query);

-        item.PublicKey = GetQueryDecoded(query, "publickey");
-        item.Path = GetQueryDecoded(query, "reserved");
-        item.RequestHost = GetQueryDecoded(query, "address");
-        item.ShortId = GetQueryDecoded(query, "mtu");
+        item.SetProtocolExtra(item.GetProtocolExtra() with
+        {
+            WgPublicKey = GetQueryDecoded(query, "publickey"),
+            WgPresharedKey = GetQueryDecoded(query, "presharedkey"),
+            WgReserved = GetQueryDecoded(query, "reserved"),
+            WgInterfaceAddress = GetQueryDecoded(query, "address"),
+            WgMtu = int.TryParse(GetQueryDecoded(query, "mtu"), out var mtuVal) ? mtuVal : null,
+        });

        return item;
    }
@@ -45,23 +49,183 @@ public class WireguardFmt : BaseFmt
            remark = "#" + Utils.UrlEncode(item.Remarks);
        }

+        var protoExtra = item.GetProtocolExtra();
        var dicQuery = new Dictionary<string, string>();
-        if (item.PublicKey.IsNotEmpty())
+        if (!protoExtra.WgPublicKey.IsNullOrEmpty())
        {
-            dicQuery.Add("publickey", Utils.UrlEncode(item.PublicKey));
+            dicQuery.Add("publickey", Utils.UrlEncode(protoExtra.WgPublicKey));
        }
-        if (item.Path.IsNotEmpty())
+        if (!protoExtra.WgPresharedKey.IsNullOrEmpty())
        {
-            dicQuery.Add("reserved", Utils.UrlEncode(item.Path));
+            dicQuery.Add("presharedkey", Utils.UrlEncode(protoExtra.WgPresharedKey));
        }
-        if (item.RequestHost.IsNotEmpty())
+        if (!protoExtra.WgReserved.IsNullOrEmpty())
        {
-            dicQuery.Add("address", Utils.UrlEncode(item.RequestHost));
+            dicQuery.Add("reserved", Utils.UrlEncode(protoExtra.WgReserved));
        }
-        if (item.ShortId.IsNotEmpty())
+        if (!protoExtra.WgInterfaceAddress.IsNullOrEmpty())
        {
-            dicQuery.Add("mtu", Utils.UrlEncode(item.ShortId));
+            dicQuery.Add("address", Utils.UrlEncode(protoExtra.WgInterfaceAddress));
        }
-        return ToUri(EConfigType.WireGuard, item.Address, item.Port, item.Id, dicQuery, remark);
+        if (protoExtra.WgMtu > 0)
+        {
+            dicQuery.Add("mtu", protoExtra.WgMtu.ToString());
+        }
+        return ToUri(EConfigType.WireGuard, item.Address, item.Port, item.Password, dicQuery, remark);
+    }
+
+    public static List<ProfileItem>? ResolveConfig(string strData)
+    {
+        var interfaceDic = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+        var peerDicList = new List<Dictionary<string, string>>();
+        var currentDicRef = interfaceDic;
+        using (var reader = new StringReader(strData))
+        {
+            while (reader.ReadLine() is { } line)
+            {
+                if (line.IsNullOrEmpty())
+                {
+                    continue;
+                }
+
+                var trimmedLine = line.Trim();
+
+                if (trimmedLine.Equals("[Interface]", StringComparison.OrdinalIgnoreCase))
+                {
+                    currentDicRef = interfaceDic;
+                    continue;
+                }
+                if (trimmedLine.Equals("[Peer]", StringComparison.OrdinalIgnoreCase))
+                {
+                    var peerDic = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+                    peerDicList.Add(peerDic);
+                    currentDicRef = peerDic;
+                    continue;
+                }
+
+                if (trimmedLine.StartsWith('[') || trimmedLine.StartsWith('#') || trimmedLine.StartsWith(';'))
+                {
+                    continue;
+                }
+
+                var idx = line.IndexOf('=');
+                if (idx <= 0)
+                {
+                    continue;
+                }
+
+                var key = line[..idx].Trim();
+                var value = line[(idx + 1)..].Trim();
+                var commentPos = value.IndexOfAny(['#', ';']);
+                if (commentPos >= 0)
+                {
+                    value = value[..commentPos].TrimEnd();
+                }
+
+                currentDicRef[key] = value;
+            }
+        }
+
+        if (!interfaceDic.TryGetValue("PrivateKey", out var privateKey) || privateKey.IsNullOrEmpty())
+        {
+            return null;
+        }
+
+        var wgMtu = interfaceDic.TryGetValue("MTU", out var mtuStr) && int.TryParse(mtuStr, out var mtuVal) ? mtuVal : 0;
+        var wgInterfaceAddress = interfaceDic.TryGetValue("Address", out var interfaceAddress) ? interfaceAddress : string.Empty;
+
+        var index = 0;
+        var resultList = new List<ProfileItem>();
+
+        foreach (var peerDic in peerDicList)
+        {
+            if (!peerDic.TryGetValue("Endpoint", out var endpoint) || endpoint.IsNullOrEmpty())
+            {
+                continue;
+            }
+
+            if (!TryParseEndpoint(endpoint, out var peerAddress, out var peerPort))
+            {
+                continue;
+            }
+
+            var protoExtra = new ProtocolExtraItem
+            {
+                WgPublicKey = (peerDic.TryGetValue("PublicKey", out var publicKey) ? publicKey : string.Empty).NullIfEmpty(),
+                WgPresharedKey = (peerDic.TryGetValue("PresharedKey", out var presharedKey) ? presharedKey : string.Empty).NullIfEmpty(),
+                WgInterfaceAddress = wgInterfaceAddress,
+                WgReserved = (peerDic.TryGetValue("Reserved", out var reserved) ? reserved : string.Empty).NullIfEmpty(),
+                WgMtu = wgMtu > 0 ? wgMtu : null,
+            };
+
+            var item = new ProfileItem
+            {
+                Remarks = $"{nameof(EConfigType.WireGuard)} Peer {index + 1}",
+                ConfigType = EConfigType.WireGuard,
+                Address = peerAddress,
+                Port = peerPort,
+                Password = privateKey,
+            };
+            item.SetProtocolExtra(protoExtra);
+            resultList.Add(item);
+
+            index += 1;
+        }
+
+        return resultList;
+    }
+
+    private static bool TryParseEndpoint(string endpoint, out string address, out int port)
+    {
+        address = string.Empty;
+        port = 2408;
+
+        var trimmedEndpoint = endpoint.Trim();
+        if (trimmedEndpoint.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        if (trimmedEndpoint[0] == '[')
+        {
+            var closeIndex = trimmedEndpoint.IndexOf(']');
+            if (closeIndex <= 1)
+            {
+                return false;
+            }
+
+            address = trimmedEndpoint[1..closeIndex].Trim();
+            var portIndex = closeIndex + 1;
+            if (portIndex < trimmedEndpoint.Length && trimmedEndpoint[portIndex] == ':' &&
+                int.TryParse(trimmedEndpoint[(portIndex + 1)..].Trim(), out var bracketedPort) && bracketedPort is > 0 and <= 65535)
+            {
+                port = bracketedPort;
+            }
+
+            return address.IsNotEmpty();
+        }
+
+        var lastColonIndex = trimmedEndpoint.LastIndexOf(':');
+        if (lastColonIndex <= 0)
+        {
+            address = trimmedEndpoint;
+            return true;
+        }
+
+        address = trimmedEndpoint[..lastColonIndex].Trim();
+        var portText = trimmedEndpoint[(lastColonIndex + 1)..].Trim();
+        if (address.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        if (int.TryParse(portText, out var parsedPortValue) && parsedPortValue is > 0 and <= 65535)
+        {
+            port = parsedPortValue;
+            return true;
+        }
+
+        address = trimmedEndpoint;
+        return true;
    }
 }
@@ -24,13 +24,13 @@ public class DownloaderHelper

        var downloadOpt = new DownloadConfiguration()
        {
-            Timeout = timeout * 1000,
+            BlockTimeout = timeout * 1000,
            MaxTryAgainOnFailure = 2,
            RequestConfiguration =
                {
                    Headers = headers,
                    UserAgent = userAgent,
-                    Timeout = timeout * 1000,
+                    ConnectTimeout = timeout * 1000,
                    Proxy = webProxy
                }
        };
@@ -62,11 +62,11 @@ public class DownloaderHelper

        var downloadOpt = new DownloadConfiguration()
        {
-            Timeout = timeout * 1000,
+            BlockTimeout = timeout * 1000,
            MaxTryAgainOnFailure = 2,
            RequestConfiguration =
                {
-                    Timeout= timeout * 1000,
+                    ConnectTimeout= timeout * 1000,
                    Proxy = webProxy
                }
        };
@@ -85,7 +85,7 @@ public class DownloaderHelper
                {
                    maxSpeed = value.BytesPerSecondSpeed;
                }
-                
+
                var ts = DateTime.Now - lastUpdateTime;
                if (ts.TotalMilliseconds >= 1000)
                {
@@ -139,11 +139,11 @@ public class DownloaderHelper

        var downloadOpt = new DownloadConfiguration()
        {
-            Timeout = timeout * 1000,
+            BlockTimeout = timeout * 1000,
            MaxTryAgainOnFailure = 2,
            RequestConfiguration =
                {
-                    Timeout= timeout * 1000,
+                    ConnectTimeout= timeout * 1000,
                    Proxy = webProxy
                }
        };
@@ -1,362 +0,0 @@
-namespace ServiceLib.Manager;
-
-/// <summary>
-/// Centralized pre-checks before sensitive actions (set active profile, generate config, etc.).
-/// </summary>
-public class ActionPrecheckManager
-{
-    private static readonly Lazy<ActionPrecheckManager> _instance = new();
-    public static ActionPrecheckManager Instance => _instance.Value;
-
-    // sing-box supported transports for different protocol types
-    private static readonly HashSet<string> SingboxUnsupportedTransports = [nameof(ETransport.kcp), nameof(ETransport.xhttp)];
-
-    private static readonly HashSet<EConfigType> SingboxTransportSupportedProtocols =
-        [EConfigType.VMess, EConfigType.VLESS, EConfigType.Trojan, EConfigType.Shadowsocks];
-
-    private static readonly HashSet<string> SingboxShadowsocksAllowedTransports =
-        [nameof(ETransport.tcp), nameof(ETransport.ws), nameof(ETransport.quic)];
-
-    public async Task<List<string>> Check(string? indexId)
-    {
-        if (indexId.IsNullOrEmpty())
-        {
-            return [ResUI.PleaseSelectServer];
-        }
-
-        var item = await AppManager.Instance.GetProfileItem(indexId);
-        if (item is null)
-        {
-            return [ResUI.PleaseSelectServer];
-        }
-
-        return await Check(item);
-    }
-
-    public async Task<List<string>> Check(ProfileItem? item)
-    {
-        if (item is null)
-        {
-            return [ResUI.PleaseSelectServer];
-        }
-
-        var errors = new List<string>();
-
-        errors.AddRange(await ValidateCurrentNodeAndCoreSupport(item));
-        errors.AddRange(await ValidateRelatedNodesExistAndValid(item));
-
-        return errors;
-    }
-
-    private async Task<List<string>> ValidateCurrentNodeAndCoreSupport(ProfileItem item)
-    {
-        if (item.ConfigType == EConfigType.Custom)
-        {
-            return [];
-        }
-
-        var coreType = AppManager.Instance.GetCoreType(item, item.ConfigType);
-        return await ValidateNodeAndCoreSupport(item, coreType);
-    }
-
-    private async Task<List<string>> ValidateNodeAndCoreSupport(ProfileItem item, ECoreType? coreType = null)
-    {
-        var errors = new List<string>();
-
-        coreType ??= AppManager.Instance.GetCoreType(item, item.ConfigType);
-
-        if (item.ConfigType is EConfigType.Custom)
-        {
-            errors.Add(string.Format(ResUI.NotSupportProtocol, item.ConfigType.ToString()));
-            return errors;
-        }
-        else if (item.ConfigType.IsGroupType())
-        {
-            var groupErrors = await ValidateGroupNode(item, coreType);
-            errors.AddRange(groupErrors);
-            return errors;
-        }
-        else if (!item.IsComplex())
-        {
-            var normalErrors = await ValidateNormalNode(item, coreType);
-            errors.AddRange(normalErrors);
-            return errors;
-        }
-
-        return errors;
-    }
-
-    private async Task<List<string>> ValidateNormalNode(ProfileItem item, ECoreType? coreType = null)
-    {
-        var errors = new List<string>();
-
-        if (item.Address.IsNullOrEmpty())
-        {
-            errors.Add(string.Format(ResUI.InvalidProperty, "Address"));
-            return errors;
-        }
-
-        if (item.Port is <= 0 or > 65535)
-        {
-            errors.Add(string.Format(ResUI.InvalidProperty, "Port"));
-            return errors;
-        }
-
-        var net = item.GetNetwork();
-
-        if (coreType == ECoreType.sing_box)
-        {
-            var transportError = ValidateSingboxTransport(item.ConfigType, net);
-            if (transportError != null)
-            {
-                errors.Add(transportError);
-            }
-
-            if (!Global.SingboxSupportConfigType.Contains(item.ConfigType))
-            {
-                errors.Add(string.Format(ResUI.CoreNotSupportProtocol,
-                    nameof(ECoreType.sing_box), item.ConfigType.ToString()));
-            }
-        }
-        else if (coreType is ECoreType.Xray)
-        {
-            // Xray core does not support these protocols
-            if (!Global.XraySupportConfigType.Contains(item.ConfigType))
-            {
-                errors.Add(string.Format(ResUI.CoreNotSupportProtocol,
-                    nameof(ECoreType.Xray), item.ConfigType.ToString()));
-            }
-        }
-
-        switch (item.ConfigType)
-        {
-            case EConfigType.VMess:
-                if (item.Id.IsNullOrEmpty() || !Utils.IsGuidByParse(item.Id))
-                {
-                    errors.Add(string.Format(ResUI.InvalidProperty, "Id"));
-                }
-
-                break;
-
-            case EConfigType.VLESS:
-                if (item.Id.IsNullOrEmpty() || (!Utils.IsGuidByParse(item.Id) && item.Id.Length > 30))
-                {
-                    errors.Add(string.Format(ResUI.InvalidProperty, "Id"));
-                }
-
-                if (!Global.Flows.Contains(item.Flow))
-                {
-                    errors.Add(string.Format(ResUI.InvalidProperty, "Flow"));
-                }
-
-                break;
-
-            case EConfigType.Shadowsocks:
-                if (item.Id.IsNullOrEmpty())
-                {
-                    errors.Add(string.Format(ResUI.InvalidProperty, "Id"));
-                }
-
-                if (string.IsNullOrEmpty(item.Security) || !Global.SsSecuritiesInSingbox.Contains(item.Security))
-                {
-                    errors.Add(string.Format(ResUI.InvalidProperty, "Security"));
-                }
-
-                break;
-        }
-
-        if (item.StreamSecurity == Global.StreamSecurity)
-        {
-            // check certificate validity
-            if ((!item.Cert.IsNullOrEmpty()) && (CertPemManager.ParsePemChain(item.Cert).Count == 0))
-            {
-                errors.Add(string.Format(ResUI.InvalidProperty, "TLS Certificate"));
-            }
-        }
-
-        if (item.StreamSecurity == Global.StreamSecurityReality)
-        {
-            if (item.PublicKey.IsNullOrEmpty())
-            {
-                errors.Add(string.Format(ResUI.InvalidProperty, "PublicKey"));
-            }
-        }
-
-        if (item.Network == nameof(ETransport.xhttp)
-            && !item.Extra.IsNullOrEmpty())
-        {
-            // check xhttp extra json validity
-            var xhttpExtra = JsonUtils.ParseJson(item.Extra);
-            if (xhttpExtra is null)
-            {
-                errors.Add(string.Format(ResUI.InvalidProperty, "XHTTP Extra"));
-            }
-        }
-
-        return errors;
-    }
-
-    private async Task<List<string>> ValidateGroupNode(ProfileItem item, ECoreType? coreType = null)
-    {
-        var errors = new List<string>();
-
-        ProfileGroupItemManager.Instance.TryGet(item.IndexId, out var group);
-        if (group is null || group.NotHasChild())
-        {
-            errors.Add(string.Format(ResUI.GroupEmpty, item.Remarks));
-            return errors;
-        }
-
-        var hasCycle = ProfileGroupItemManager.HasCycle(item.IndexId);
-        if (hasCycle)
-        {
-            errors.Add(string.Format(ResUI.GroupSelfReference, item.Remarks));
-            return errors;
-        }
-
-        var childIds = Utils.String2List(group.ChildItems) ?? [];
-        var subItems = await ProfileGroupItemManager.GetSubChildProfileItems(group);
-        childIds.AddRange(subItems.Select(p => p.IndexId));
-
-        foreach (var child in childIds)
-        {
-            var childErrors = new List<string>();
-            if (child.IsNullOrEmpty())
-            {
-                continue;
-            }
-
-            var childItem = await AppManager.Instance.GetProfileItem(child);
-            if (childItem is null)
-            {
-                childErrors.Add(string.Format(ResUI.NodeTagNotExist, child));
-                continue;
-            }
-
-            if (childItem.ConfigType is EConfigType.Custom or EConfigType.ProxyChain)
-            {
-                childErrors.Add(string.Format(ResUI.InvalidProperty, childItem.Remarks));
-                continue;
-            }
-
-            childErrors.AddRange(await ValidateNodeAndCoreSupport(childItem, coreType));
-            errors.AddRange(childErrors.Select(s => s.Insert(0, $"{childItem.Remarks}: ")));
-        }
-        return errors;
-    }
-
-    private static string? ValidateSingboxTransport(EConfigType configType, string net)
-    {
-        // sing-box does not support xhttp / kcp transports
-        if (SingboxUnsupportedTransports.Contains(net))
-        {
-            return string.Format(ResUI.CoreNotSupportNetwork, nameof(ECoreType.sing_box), net);
-        }
-
-        // sing-box does not support non-tcp transports for protocols other than vmess/trojan/vless/shadowsocks
-        if (!SingboxTransportSupportedProtocols.Contains(configType) && net != nameof(ETransport.tcp))
-        {
-            return string.Format(ResUI.CoreNotSupportProtocolTransport,
-                nameof(ECoreType.sing_box), configType.ToString(), net);
-        }
-
-        // sing-box shadowsocks only supports tcp/ws/quic transports
-        if (configType == EConfigType.Shadowsocks && !SingboxShadowsocksAllowedTransports.Contains(net))
-        {
-            return string.Format(ResUI.CoreNotSupportProtocolTransport,
-                nameof(ECoreType.sing_box), configType.ToString(), net);
-        }
-
-        return null;
-    }
-
-    private async Task<List<string>> ValidateRelatedNodesExistAndValid(ProfileItem? item)
-    {
-        var errors = new List<string>();
-        errors.AddRange(await ValidateProxyChainedNodeExistAndValid(item));
-        errors.AddRange(await ValidateRoutingNodeExistAndValid(item));
-        return errors;
-    }
-
-    private async Task<List<string>> ValidateProxyChainedNodeExistAndValid(ProfileItem? item)
-    {
-        var errors = new List<string>();
-        if (item is null)
-        {
-            return errors;
-        }
-
-        // prev node and next node
-        var subItem = await AppManager.Instance.GetSubItem(item.Subid);
-        if (subItem is null)
-        {
-            return errors;
-        }
-
-        var prevNode = await AppManager.Instance.GetProfileItemViaRemarks(subItem.PrevProfile);
-        var nextNode = await AppManager.Instance.GetProfileItemViaRemarks(subItem.NextProfile);
-        var coreType = AppManager.Instance.GetCoreType(item, item.ConfigType);
-
-        await CollectProxyChainedNodeValidation(prevNode, subItem.PrevProfile, coreType, errors);
-        await CollectProxyChainedNodeValidation(nextNode, subItem.NextProfile, coreType, errors);
-
-        return errors;
-    }
-
-    private async Task CollectProxyChainedNodeValidation(ProfileItem? node, string tag, ECoreType coreType, List<string> errors)
-    {
-        if (node is not null)
-        {
-            var nodeErrors = await ValidateNodeAndCoreSupport(node, coreType);
-            errors.AddRange(nodeErrors.Select(s => ResUI.ProxyChainedPrefix + $"{node.Remarks}: " + s));
-        }
-        else if (tag.IsNotEmpty())
-        {
-            errors.Add(ResUI.ProxyChainedPrefix + string.Format(ResUI.NodeTagNotExist, tag));
-        }
-    }
-
-    private async Task<List<string>> ValidateRoutingNodeExistAndValid(ProfileItem? item)
-    {
-        var errors = new List<string>();
-
-        if (item is null)
-        {
-            return errors;
-        }
-
-        var coreType = AppManager.Instance.GetCoreType(item, item.ConfigType);
-        var routing = await ConfigHandler.GetDefaultRouting(AppManager.Instance.Config);
-        if (routing == null)
-        {
-            return errors;
-        }
-
-        var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet);
-        foreach (var ruleItem in rules ?? [])
-        {
-            if (!ruleItem.Enabled)
-            {
-                continue;
-            }
-
-            var outboundTag = ruleItem.OutboundTag;
-            if (outboundTag.IsNullOrEmpty() || Global.OutboundTags.Contains(outboundTag))
-            {
-                continue;
-            }
-
-            var tagItem = await AppManager.Instance.GetProfileItemViaRemarks(outboundTag);
-            if (tagItem is null)
-            {
-                errors.Add(ResUI.RoutingRuleOutboundPrefix + string.Format(ResUI.NodeTagNotExist, outboundTag));
-                continue;
-            }
-
-            var tagErrors = await ValidateNodeAndCoreSupport(tagItem, coreType);
-            errors.AddRange(tagErrors.Select(s => ResUI.RoutingRuleOutboundPrefix + $"{tagItem.Remarks}: " + s));
-        }
-
-        return errors;
-    }
-}
@@ -81,7 +81,9 @@ public sealed class AppManager
        SQLiteHelper.Instance.CreateTable<ProfileExItem>();
        SQLiteHelper.Instance.CreateTable<DNSItem>();
        SQLiteHelper.Instance.CreateTable<FullConfigTemplateItem>();
+#pragma warning disable CS0618
        SQLiteHelper.Instance.CreateTable<ProfileGroupItem>();
+#pragma warning restore CS0618
        return true;
    }

@@ -94,6 +96,11 @@ public sealed class AppManager
        _ = StatePort;
        _ = StatePort2;

+        Task.Run(async () =>
+        {
+            await MigrateProfileExtra();
+        }).Wait();
+
        return true;
    }

@@ -184,10 +191,17 @@ public sealed class AppManager
        return (await ProfileItems(subid))?.Select(t => t.IndexId)?.ToList();
    }

-    public async Task<List<ProfileItemModel>?> ProfileItems(string subid, string filter)
+    public async Task<List<ProfileItemModel>?> ProfileModels(string subid, string filter)
    {
-        var sql = @$"select a.*
-                           ,b.remarks subRemarks
+        var sql = @$"select a.IndexId
+                           ,a.ConfigType
+                           ,a.Remarks
+                           ,a.Address
+                           ,a.Port
+                           ,a.Network
+                           ,a.StreamSecurity
+                           ,a.Subid
+                           ,b.remarks as subRemarks
                        from ProfileItem a
                        left join SubItem b on a.subid = b.id
                        where 1=1 ";
@@ -216,6 +230,42 @@ public sealed class AppManager
        return await SQLiteHelper.Instance.TableAsync<ProfileItem>().FirstOrDefaultAsync(it => it.IndexId == indexId);
    }

+    public async Task<List<ProfileItem>> GetProfileItemsByIndexIds(IEnumerable<string> indexIds)
+    {
+        var ids = indexIds.Where(id => !id.IsNullOrEmpty()).Distinct().ToList();
+        if (ids.Count == 0)
+        {
+            return [];
+        }
+        return await SQLiteHelper.Instance.TableAsync<ProfileItem>()
+            .Where(it => ids.Contains(it.IndexId))
+            .ToListAsync();
+    }
+
+    public async Task<Dictionary<string, ProfileItem>> GetProfileItemsByIndexIdsAsMap(IEnumerable<string> indexIds)
+    {
+        var items = await GetProfileItemsByIndexIds(indexIds);
+        return items.ToDictionary(it => it.IndexId);
+    }
+
+    public async Task<List<ProfileItem>> GetProfileItemsOrderedByIndexIds(IEnumerable<string> indexIds)
+    {
+        var idList = indexIds.Where(id => !id.IsNullOrEmpty()).Distinct().ToList();
+        if (idList.Count == 0)
+        {
+            return [];
+        }
+
+        var items = await SQLiteHelper.Instance.TableAsync<ProfileItem>()
+            .Where(it => idList.Contains(it.IndexId))
+            .ToListAsync();
+        var itemMap = items.ToDictionary(it => it.IndexId);
+
+        return idList.Select(id => itemMap.GetValueOrDefault(id))
+            .Where(item => item != null)
+            .ToList();
+    }
+
    public async Task<ProfileItem?> GetProfileItemViaRemarks(string? remarks)
    {
        if (remarks.IsNullOrEmpty())
@@ -225,15 +275,6 @@ public sealed class AppManager
        return await SQLiteHelper.Instance.TableAsync<ProfileItem>().FirstOrDefaultAsync(it => it.Remarks == remarks);
    }

-    public async Task<ProfileGroupItem?> GetProfileGroupItem(string indexId)
-    {
-        if (indexId.IsNullOrEmpty())
-        {
-            return null;
-        }
-        return await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().FirstOrDefaultAsync(it => it.IndexId == indexId);
-    }
-
    public async Task<List<RoutingItem>?> RoutingItems()
    {
        return await SQLiteHelper.Instance.TableAsync<RoutingItem>().OrderBy(t => t.Sort).ToListAsync();
@@ -264,6 +305,325 @@ public sealed class AppManager
        return await SQLiteHelper.Instance.TableAsync<FullConfigTemplateItem>().FirstOrDefaultAsync(it => it.CoreType == eCoreType);
    }

+#pragma warning disable CS0618
+
+    public async Task MigrateProfileExtra()
+    {
+        await MigrateProfileExtraGroupV2ToV3();
+
+        await MigrateProfileExtraV2ToV3();
+
+        await MigrateProfileTransportV3ToV4();
+    }
+
+    private async Task MigrateProfileExtraV2ToV3()
+    {
+        const int pageSize = 100;
+        var offset = 0;
+
+        while (true)
+        {
+            var sql = $"SELECT * FROM ProfileItem " +
+                $"WHERE ConfigVersion < 3 " +
+                $"AND ConfigType NOT IN ({(int)EConfigType.PolicyGroup}, {(int)EConfigType.ProxyChain}) " +
+                $"LIMIT {pageSize} OFFSET {offset}";
+            var batch = await SQLiteHelper.Instance.QueryAsync<ProfileItem>(sql);
+            if (batch is null || batch.Count == 0)
+            {
+                break;
+            }
+
+            var batchSuccessCount = await MigrateProfileExtraV2ToV3Sub(batch);
+
+            // Only increment offset by the number of failed items that remain in the result set
+            // Successfully updated items are automatically excluded from future queries due to ConfigVersion = 3
+            offset += batch.Count - batchSuccessCount;
+        }
+
+        //await ProfileGroupItemManager.Instance.ClearAll();
+    }
+
+    private async Task MigrateProfileTransportV3ToV4()
+    {
+        const int pageSize = 100;
+        var offset = 0;
+
+        while (true)
+        {
+            var sql = $"SELECT * FROM ProfileItem WHERE ConfigVersion = 3 LIMIT {pageSize} OFFSET {offset}";
+            var batch = await SQLiteHelper.Instance.QueryAsync<ProfileItem>(sql);
+            if (batch is null || batch.Count == 0)
+            {
+                break;
+            }
+
+            var updateProfileItems = new List<ProfileItem>();
+            foreach (var item in batch)
+            {
+                try
+                {
+                    if (item.Network == Global.RawNetworkAlias)
+                    {
+                        item.Network = nameof(ETransport.raw);
+                    }
+                    var transport = item.GetTransportExtra();
+                    var network = item.GetNetwork();
+
+                    switch (network)
+                    {
+                        case nameof(ETransport.raw):
+                            transport = transport with
+                            {
+                                RawHeaderType = item.HeaderType.NullIfEmpty(),
+                                Host = item.RequestHost.NullIfEmpty(),
+                                Path = item.Path.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.ws):
+                        case nameof(ETransport.httpupgrade):
+                            transport = transport with
+                            {
+                                Host = item.RequestHost.NullIfEmpty(),
+                                Path = item.Path.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.xhttp):
+                            transport = transport with
+                            {
+                                Host = item.RequestHost.NullIfEmpty(),
+                                Path = item.Path.NullIfEmpty(),
+                                XhttpMode = item.HeaderType.NullIfEmpty(),
+                                XhttpExtra = item.Extra.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.grpc):
+                            transport = transport with
+                            {
+                                GrpcAuthority = item.RequestHost.NullIfEmpty(),
+                                GrpcServiceName = item.Path.NullIfEmpty(),
+                                GrpcMode = item.HeaderType.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.kcp):
+                            transport = transport with
+                            {
+                                KcpHeaderType = item.HeaderType.NullIfEmpty(),
+                                KcpSeed = item.Path.NullIfEmpty(),
+                            };
+                            break;
+
+                        default:
+                            item.Network = Global.DefaultNetwork;
+                            transport = transport with
+                            {
+                                RawHeaderType = item.HeaderType.NullIfEmpty(),
+                                Host = item.RequestHost.NullIfEmpty(),
+                            };
+                            break;
+                    }
+
+                    item.SetTransportExtra(transport);
+                    item.ConfigVersion = 4;
+                    updateProfileItems.Add(item);
+                }
+                catch (Exception ex)
+                {
+                    Logging.SaveLog($"MigrateProfileTransportV3ToV4 Error: {ex}");
+                }
+            }
+
+            if (updateProfileItems.Count > 0)
+            {
+                try
+                {
+                    var count = await SQLiteHelper.Instance.UpdateAllAsync(updateProfileItems);
+                    offset += batch.Count - count;
+                }
+                catch (Exception ex)
+                {
+                    Logging.SaveLog($"MigrateProfileTransportV3ToV4 update error: {ex}");
+                    offset += batch.Count;
+                }
+            }
+            else
+            {
+                offset += batch.Count;
+            }
+        }
+    }
+
+    private async Task<int> MigrateProfileExtraV2ToV3Sub(List<ProfileItem> batch)
+    {
+        var updateProfileItems = new List<ProfileItem>();
+
+        foreach (var item in batch)
+        {
+            try
+            {
+                var extra = item.GetProtocolExtra();
+                switch (item.ConfigType)
+                {
+                    case EConfigType.Shadowsocks:
+                        extra = extra with { SsMethod = item.Security.NullIfEmpty() };
+                        break;
+
+                    case EConfigType.VMess:
+                        extra = extra with
+                        {
+                            AlterId = item.AlterId.ToString(),
+                            VmessSecurity = item.Security.NullIfEmpty(),
+                        };
+                        break;
+
+                    case EConfigType.VLESS:
+                        extra = extra with
+                        {
+                            Flow = item.Flow.NullIfEmpty(),
+                            VlessEncryption = item.Security,
+                        };
+                        break;
+
+                    case EConfigType.Hysteria2:
+                        extra = extra with
+                        {
+                            SalamanderPass = item.Path.NullIfEmpty(),
+                            Ports = item.Ports.NullIfEmpty(),
+                            UpMbps = _config.HysteriaItem.UpMbps,
+                            DownMbps = _config.HysteriaItem.DownMbps,
+                            HopInterval = _config.HysteriaItem.HopInterval.ToString(),
+                        };
+                        break;
+
+                    case EConfigType.TUIC:
+                        extra = extra with { CongestionControl = item.HeaderType.NullIfEmpty(), };
+                        item.Username = item.Id;
+                        item.Id = item.Security;
+                        item.Password = item.Security;
+                        break;
+
+                    case EConfigType.HTTP:
+                    case EConfigType.SOCKS:
+                        item.Username = item.Security;
+                        break;
+
+                    case EConfigType.WireGuard:
+                        extra = extra with
+                        {
+                            WgPublicKey = item.PublicKey.NullIfEmpty(),
+                            WgInterfaceAddress = item.RequestHost.NullIfEmpty(),
+                            WgReserved = item.Path.NullIfEmpty(),
+                            WgMtu = int.TryParse(item.ShortId, out var mtu) ? mtu : 1280
+                        };
+                        break;
+                }
+
+                item.SetProtocolExtra(extra);
+
+                item.Password = item.Id;
+
+                item.ConfigVersion = 3;
+
+                updateProfileItems.Add(item);
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog($"MigrateProfileExtra Error: {ex}");
+            }
+        }
+
+        if (updateProfileItems.Count > 0)
+        {
+            try
+            {
+                var count = await SQLiteHelper.Instance.UpdateAllAsync(updateProfileItems);
+                return count;
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog($"MigrateProfileExtraGroup update error: {ex}");
+                return 0;
+            }
+        }
+        else
+        {
+            return 0;
+        }
+    }
+
+    private async Task<bool> MigrateProfileExtraGroupV2ToV3()
+    {
+        var list = await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().ToListAsync();
+        var groupItems = new ConcurrentDictionary<string, ProfileGroupItem>(list.Where(t => !string.IsNullOrEmpty(t.IndexId)).ToDictionary(t => t.IndexId!));
+
+        var sql = $"SELECT * FROM ProfileItem WHERE ConfigVersion < 3 AND ConfigType IN ({(int)EConfigType.PolicyGroup}, {(int)EConfigType.ProxyChain})";
+        var items = await SQLiteHelper.Instance.QueryAsync<ProfileItem>(sql);
+
+        if (items is null || items.Count == 0)
+        {
+            Logging.SaveLog("MigrateProfileExtraGroup: No items to migrate.");
+            return true;
+        }
+
+        Logging.SaveLog($"MigrateProfileExtraGroup: Found {items.Count} group items to migrate.");
+
+        var updateProfileItems = new List<ProfileItem>();
+
+        foreach (var item in items)
+        {
+            try
+            {
+                var extra = item.GetProtocolExtra();
+
+                extra = extra with { GroupType = nameof(item.ConfigType) };
+                groupItems.TryGetValue(item.IndexId, out var groupItem);
+                if (groupItem != null && !groupItem.NotHasChild())
+                {
+                    extra = extra with
+                    {
+                        ChildItems = groupItem.ChildItems,
+                        SubChildItems = groupItem.SubChildItems,
+                        Filter = groupItem.Filter,
+                        MultipleLoad = groupItem.MultipleLoad,
+                    };
+                }
+
+                item.SetProtocolExtra(extra);
+
+                item.ConfigVersion = 3;
+                updateProfileItems.Add(item);
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog($"MigrateProfileExtraGroup item error [{item.IndexId}]: {ex}");
+            }
+        }
+
+        if (updateProfileItems.Count > 0)
+        {
+            try
+            {
+                var count = await SQLiteHelper.Instance.UpdateAllAsync(updateProfileItems);
+                Logging.SaveLog($"MigrateProfileExtraGroup: Successfully updated {updateProfileItems.Count} items.");
+                return updateProfileItems.Count == count;
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog($"MigrateProfileExtraGroup update error: {ex}");
+                return false;
+            }
+        }
+
+        return true;
+
+        //await ProfileGroupItemManager.Instance.ClearAll();
+    }
+
+#pragma warning restore CS0618
+
    #endregion SqliteHelper

    #region Core Type
@@ -197,12 +197,13 @@ public class CertPemManager
        "D02A0F994A868C66395F2E7A880DF509BD0C29C96DE16015A0FD501EDA4F96A9", // OISTE Client Root RSA G1
        "EEC997C0C30F216F7E3B8B307D2BAE42412D753FC8219DAFD1520B2572850F49", // OISTE Server Root ECC G1
        "9AE36232A5189FFDDB353DFD26520C015395D22777DAC59DB57B98C089A651E6", // OISTE Server Root RSA G1
+        "B49141502D00663D740F2E7EC340C52800962666121A36D09CF7DD2B90384FB4", // e-Szigno TLS Root CA 2023
    };

    /// <summary>
    /// Get certificate in PEM format from a server with CA pinning validation
    /// </summary>
-    public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName, int timeout = 4)
+    public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName, int timeout = 4, bool allowInsecure = false)
    {
        try
        {
@@ -214,12 +215,14 @@ public class CertPemManager
            using var client = new TcpClient();
            await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);

-            using var ssl = new SslStream(client.GetStream(), false, ValidateServerCertificate);
+            var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) =>
+                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, allowInsecure));
+            await using var ssl = new SslStream(client.GetStream(), false, callback);

            var sslOptions = new SslClientAuthenticationOptions
            {
                TargetHost = serverName,
-                RemoteCertificateValidationCallback = ValidateServerCertificate
+                RemoteCertificateValidationCallback = callback
            };

            await ssl.AuthenticateAsClientAsync(sslOptions, cts.Token);
@@ -248,7 +251,7 @@ public class CertPemManager
    /// <summary>
    /// Get certificate chain in PEM format from a server with CA pinning validation
    /// </summary>
-    public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName, int timeout = 4)
+    public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName, int timeout = 4, bool allowInsecure = false)
    {
        var pemList = new List<string>();
        try
@@ -261,12 +264,14 @@ public class CertPemManager
            using var client = new TcpClient();
            await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);

-            using var ssl = new SslStream(client.GetStream(), false, ValidateServerCertificate);
+            var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) =>
+                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, allowInsecure));
+            await using var ssl = new SslStream(client.GetStream(), false, callback);

            var sslOptions = new SslClientAuthenticationOptions
            {
                TargetHost = serverName,
-                RemoteCertificateValidationCallback = ValidateServerCertificate
+                RemoteCertificateValidationCallback = callback
            };

            await ssl.AuthenticateAsClientAsync(sslOptions, cts.Token);
@@ -279,11 +284,7 @@ public class CertPemManager
            var chain = new X509Chain();
            chain.Build(certChain);

-            foreach (var element in chain.ChainElements)
-            {
-                var pem = ExportCertToPem(element.Certificate);
-                pemList.Add(pem);
-            }
+            pemList.AddRange(chain.ChainElements.Select(element => ExportCertToPem(element.Certificate)));

            return (pemList, null);
        }
@@ -303,16 +304,23 @@ public class CertPemManager
    /// Validate server certificate with CA pinning
    /// </summary>
    private bool ValidateServerCertificate(
-        object sender,
+        object _,
        X509Certificate? certificate,
        X509Chain? chain,
-        SslPolicyErrors sslPolicyErrors)
+        SslPolicyErrors sslPolicyErrors,
+        bool allowInsecure)
    {
        if (certificate == null)
        {
            return false;
        }

+        // In insecure mode, accept any certificate so self-signed certs can be fetched.
+        if (allowInsecure)
+        {
+            return true;
+        }
+
        // Check certificate name mismatch
        if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateNameMismatch))
        {
@@ -416,4 +424,22 @@ public class CertPemManager

        return string.Concat(pemList);
    }
+
+    public static string GetCertSha256Thumbprint(string pemCert, bool includeColon = false)
+    {
+        try
+        {
+            var cert = X509Certificate2.CreateFromPem(pemCert);
+            var thumbprint = cert.GetCertHashString(HashAlgorithmName.SHA256);
+            if (includeColon)
+            {
+                return string.Join(":", thumbprint.Chunk(2).Select(c => new string(c)));
+            }
+            return thumbprint;
+        }
+        catch
+        {
+            return string.Empty;
+        }
+    }
 }
@@ -68,6 +68,7 @@ public sealed class CoreInfoManager
                    DownloadUrlWinArm64 = urlN + "/download/{0}/v2rayN-windows-arm64.zip",
                    DownloadUrlLinux64 = urlN + "/download/{0}/v2rayN-linux-64.zip",
                    DownloadUrlLinuxArm64 = urlN + "/download/{0}/v2rayN-linux-arm64.zip",
+                    DownloadUrlLinuxRiscV64 = urlN + "/download/{0}/v2rayN-linux-riscv64.zip",
                    DownloadUrlOSX64 = urlN + "/download/{0}/v2rayN-macos-64.zip",
                    DownloadUrlOSXArm64 = urlN + "/download/{0}/v2rayN-macos-arm64.zip",
                },
@@ -111,6 +112,7 @@ public sealed class CoreInfoManager
                    DownloadUrlWinArm64 = urlXray + "/download/{0}/Xray-windows-arm64-v8a.zip",
                    DownloadUrlLinux64 = urlXray + "/download/{0}/Xray-linux-64.zip",
                    DownloadUrlLinuxArm64 = urlXray + "/download/{0}/Xray-linux-arm64-v8a.zip",
+                    DownloadUrlLinuxRiscV64 = urlXray + "/download/{0}/Xray-linux-riscv64.zip",
                    DownloadUrlOSX64 = urlXray + "/download/{0}/Xray-macos-64.zip",
                    DownloadUrlOSXArm64 = urlXray + "/download/{0}/Xray-macos-arm64-v8a.zip",
                    Match = "Xray",
@@ -133,6 +135,7 @@ public sealed class CoreInfoManager
                    DownloadUrlWinArm64 = urlMihomo + "/download/{0}/mihomo-windows-arm64-{0}.zip",
                    DownloadUrlLinux64 = urlMihomo + "/download/{0}/mihomo-linux-amd64-v1-{0}.gz",
                    DownloadUrlLinuxArm64 = urlMihomo + "/download/{0}/mihomo-linux-arm64-{0}.gz",
+                    DownloadUrlLinuxRiscV64 = urlMihomo + "/download/{0}/mihomo-linux-riscv64-{0}.gz",
                    DownloadUrlOSX64 = urlMihomo + "/download/{0}/mihomo-darwin-amd64-v1-{0}.gz",
                    DownloadUrlOSXArm64 = urlMihomo + "/download/{0}/mihomo-darwin-arm64-{0}.gz",
                    Match = "Mihomo",
@@ -175,6 +178,7 @@ public sealed class CoreInfoManager
                    DownloadUrlWinArm64 = urlSingbox + "/download/{0}/sing-box-{1}-windows-arm64.zip",
                    DownloadUrlLinux64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-amd64.tar.gz",
                    DownloadUrlLinuxArm64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-arm64.tar.gz",
+                    DownloadUrlLinuxRiscV64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-riscv64.tar.gz",
                    DownloadUrlOSX64 = urlSingbox + "/download/{0}/sing-box-{1}-darwin-amd64.tar.gz",
                    DownloadUrlOSXArm64 = urlSingbox + "/download/{0}/sing-box-{1}-darwin-arm64.tar.gz",
                    Match = "sing-box",
@@ -265,6 +269,7 @@ public sealed class CoreInfoManager
            names.Add("mihomo-linux-amd64-v1");
            names.Add("mihomo-linux-amd64");
            names.Add("mihomo-linux-arm64");
+            names.Add("mihomo-linux-riscv64");
        }
        else if (Utils.IsMacOS())
        {
@@ -57,16 +57,19 @@ public class CoreManager
        }
    }

-    public async Task LoadCore(ProfileItem? node)
+    /// <param name="mainContext">Resolved main context (with pre-socks ports already merged if applicable).</param>
+    /// <param name="preContext">Optional pre-socks context passed to <see cref="CoreStartPreService"/>.</param>
+    public async Task LoadCore(CoreConfigContext? mainContext, CoreConfigContext? preContext)
    {
-        if (node == null)
+        if (mainContext == null)
        {
            await UpdateFunc(false, ResUI.CheckServerSettings);
            return;
        }

+        var node = mainContext.Node;
        var fileName = Utils.GetBinConfigPath(Global.CoreConfigFileName);
-        var result = await CoreConfigHandler.GenerateClientConfig(node, fileName);
+        var result = await CoreConfigHandler.GenerateClientConfig(mainContext, fileName);
        if (result.Success != true)
        {
            await UpdateFunc(true, result.Msg);
@@ -85,8 +88,11 @@ public class CoreManager
            await WindowsUtils.RemoveTunDevice();
        }

-        await CoreStart(node);
-        await CoreStartPreService(node);
+        await CoreStart(mainContext);
+        await CoreStartPreService(preContext);
+
+        AppManager.Instance.RunningCoreType = preContext?.RunCoreType ?? mainContext.RunCoreType;
+
        if (_processService != null)
        {
            await UpdateFunc(true, $"{node.GetSummary()}");
@@ -95,7 +101,7 @@ public class CoreManager

    public async Task<ProcessService?> LoadCoreConfigSpeedtest(List<ServerTestItem> selecteds)
    {
-        var coreType = selecteds.Any(t => Global.SingboxOnlyConfigType.Contains(t.ConfigType)) ? ECoreType.sing_box : ECoreType.Xray;
+        var coreType = selecteds.FirstOrDefault()?.CoreType == ECoreType.sing_box ? ECoreType.sing_box : ECoreType.Xray;
        var fileName = string.Format(Global.CoreSpeedtestConfigFileName, Utils.GetGuid(false));
        var configPath = Utils.GetBinConfigPath(fileName);
        var result = await CoreConfigHandler.GenerateClientSpeedtestConfig(_config, configPath, selecteds, coreType);
@@ -122,13 +128,14 @@ public class CoreManager

        var fileName = string.Format(Global.CoreSpeedtestConfigFileName, Utils.GetGuid(false));
        var configPath = Utils.GetBinConfigPath(fileName);
-        var result = await CoreConfigHandler.GenerateClientSpeedtestConfig(_config, node, testItem, configPath);
+        var (context, _) = await CoreConfigContextBuilder.Build(_config, node);
+        var result = await CoreConfigHandler.GenerateClientSpeedtestConfig(_config, context, testItem, configPath);
        if (result.Success != true)
        {
            return null;
        }

-        var coreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
+        var coreType = context.RunCoreType;
        var coreInfo = CoreInfoManager.Instance.GetCoreInfo(coreType);
        return await RunProcess(coreInfo, fileName, true, false);
    }
@@ -165,9 +172,10 @@ public class CoreManager

    #region Private

-    private async Task CoreStart(ProfileItem node)
+    private async Task CoreStart(CoreConfigContext context)
    {
-        var coreType = AppManager.Instance.RunningCoreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
+        var node = context.Node;
+        var coreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
        var coreInfo = CoreInfoManager.Instance.GetCoreInfo(coreType);

        var displayLog = node.ConfigType != EConfigType.Custom || node.DisplayLog;
@@ -179,27 +187,22 @@ public class CoreManager
        _processService = proc;
    }

-    private async Task CoreStartPreService(ProfileItem node)
+    private async Task CoreStartPreService(CoreConfigContext? preContext)
    {
-        if (_processService != null && !_processService.HasExited)
+        if (_processService is { HasExited: false } && preContext != null)
        {
-            var coreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
-            var itemSocks = await ConfigHandler.GetPreSocksItem(_config, node, coreType);
-            if (itemSocks != null)
+            var preCoreType = preContext?.Node?.CoreType ?? ECoreType.sing_box;
+            var fileName = Utils.GetBinConfigPath(Global.CorePreConfigFileName);
+            var result = await CoreConfigHandler.GenerateClientConfig(preContext, fileName);
+            if (result.Success)
            {
-                var preCoreType = itemSocks.CoreType ?? ECoreType.sing_box;
-                var fileName = Utils.GetBinConfigPath(Global.CorePreConfigFileName);
-                var result = await CoreConfigHandler.GenerateClientConfig(itemSocks, fileName);
-                if (result.Success)
+                var coreInfo = CoreInfoManager.Instance.GetCoreInfo(preCoreType);
+                var proc = await RunProcess(coreInfo, Global.CorePreConfigFileName, true, true);
+                if (proc is null)
                {
-                    var coreInfo = CoreInfoManager.Instance.GetCoreInfo(preCoreType);
-                    var proc = await RunProcess(coreInfo, Global.CorePreConfigFileName, true, true);
-                    if (proc is null)
-                    {
-                        return;
-                    }
-                    _processPreService = proc;
+                    return;
                }
+                _processPreService = proc;
            }
        }
    }
@@ -226,7 +229,7 @@ public class CoreManager
        {
            if (mayNeedSudo
                && _config.TunModeItem.EnableTun
-                && coreInfo.CoreType == ECoreType.sing_box
+                && (coreInfo.CoreType is ECoreType.sing_box or ECoreType.mihomo)
                && Utils.IsNonWindows())
            {
                _linuxSudo = true;
@@ -0,0 +1,151 @@
+namespace ServiceLib.Manager;
+
+public class GroupProfileManager
+{
+    public static async Task<bool> HasCycle(ProfileItem item)
+    {
+        return await HasCycle(item.IndexId, item.GetProtocolExtra());
+    }
+
+    public static async Task<bool> HasCycle(string? indexId, ProtocolExtraItem? extraInfo)
+    {
+        return await HasCycle(indexId, extraInfo, new HashSet<string>(), new HashSet<string>());
+    }
+
+    private static async Task<bool> HasCycle(string? indexId, ProtocolExtraItem? extraInfo, HashSet<string> visited, HashSet<string> stack)
+    {
+        if (indexId.IsNullOrEmpty() || extraInfo == null)
+        {
+            return false;
+        }
+
+        if (stack.Contains(indexId))
+        {
+            return true;
+        }
+
+        if (visited.Contains(indexId))
+        {
+            return false;
+        }
+
+        visited.Add(indexId);
+        stack.Add(indexId);
+
+        try
+        {
+            if (extraInfo.GroupType.IsNullOrEmpty())
+            {
+                return false;
+            }
+
+            if (extraInfo.ChildItems.IsNullOrEmpty())
+            {
+                return false;
+            }
+
+            var childIds = Utils.String2List(extraInfo.ChildItems)
+                ?.Where(p => !string.IsNullOrEmpty(p))
+                .ToList();
+            if (childIds == null)
+            {
+                return false;
+            }
+
+            var childItems = await AppManager.Instance.GetProfileItemsByIndexIds(childIds);
+            foreach (var childItem in childItems)
+            {
+                if (await HasCycle(childItem.IndexId, childItem?.GetProtocolExtra(), visited, stack))
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+        finally
+        {
+            stack.Remove(indexId);
+        }
+    }
+
+    public static async Task<(List<ProfileItem> Items, ProtocolExtraItem? Extra)> GetChildProfileItems(ProfileItem profileItem)
+    {
+        var protocolExtra = profileItem?.GetProtocolExtra();
+        return (await GetChildProfileItemsByProtocolExtra(protocolExtra), protocolExtra);
+    }
+
+    public static async Task<List<ProfileItem>> GetChildProfileItemsByProtocolExtra(ProtocolExtraItem? protocolExtra)
+    {
+        if (protocolExtra == null)
+        {
+            return [];
+        }
+
+        var items = new List<ProfileItem>();
+        items.AddRange(await GetSubChildProfileItems(protocolExtra));
+        items.AddRange(await GetSelectedChildProfileItems(protocolExtra));
+
+        return items;
+    }
+
+    private static async Task<List<ProfileItem>> GetSelectedChildProfileItems(ProtocolExtraItem? extra)
+    {
+        if (extra == null || extra.ChildItems.IsNullOrEmpty())
+        {
+            return [];
+        }
+        var childProfileIds = Utils.String2List(extra.ChildItems)
+            ?.Where(p => !string.IsNullOrEmpty(p))
+            .ToList() ?? [];
+        if (childProfileIds.Count == 0)
+        {
+            return [];
+        }
+
+        var ordered = await AppManager.Instance.GetProfileItemsOrderedByIndexIds(childProfileIds);
+        return ordered;
+    }
+
+    private static async Task<List<ProfileItem>> GetSubChildProfileItems(ProtocolExtraItem? extra)
+    {
+        if (extra == null || extra.SubChildItems.IsNullOrEmpty())
+        {
+            return [];
+        }
+        var childProfiles = await AppManager.Instance.ProfileItems(extra.SubChildItems ?? string.Empty);
+
+        return childProfiles?.Where(p =>
+                p != null &&
+                p.IsValid() &&
+                !p.ConfigType.IsComplexType() &&
+                (extra.Filter.IsNullOrEmpty() || Regex.IsMatch(p.Remarks, extra.Filter))
+            )
+            .ToList() ?? [];
+    }
+
+    public static async Task<Dictionary<string, ProfileItem>> GetAllChildProfileItems(ProfileItem profileItem)
+    {
+        var itemMap = new Dictionary<string, ProfileItem>();
+        var visited = new HashSet<string>();
+
+        await CollectChildItems(profileItem, itemMap, visited);
+
+        return itemMap;
+    }
+
+    private static async Task CollectChildItems(ProfileItem profileItem, Dictionary<string, ProfileItem> itemMap,
+        HashSet<string> visited)
+    {
+        var (childItems, _) = await GetChildProfileItems(profileItem);
+        foreach (var child in childItems.Where(child => visited.Add(child.IndexId)))
+        {
+            itemMap[child.IndexId] = child;
+
+            if (child.ConfigType.IsGroupType())
+            {
+                await CollectChildItems(child, itemMap, visited);
+            }
+        }
+    }
+}
@@ -38,4 +38,25 @@ public class NoticeManager
        Enqueue(msg);
        SendMessage(msg);
    }
+
+    /// <summary>
+    /// Sends each error and warning in <paramref name="validatorResult"/> to the message panel
+    /// and enqueues a summary snack notification (capped at 10 messages).
+    /// Returns <c>true</c> when there were any messages so the caller can decide on early-return
+    /// based on <see cref="NodeValidatorResult.Success"/>.
+    /// </summary>
+    public bool NotifyValidatorResult(NodeValidatorResult validatorResult)
+    {
+        var msgs = new List<string>([.. validatorResult.Errors, .. validatorResult.Warnings]);
+        if (msgs.Count == 0)
+        {
+            return false;
+        }
+        foreach (var msg in msgs)
+        {
+            SendMessage(msg);
+        }
+        Enqueue(Utils.List2String(msgs.Take(10).ToList(), true));
+        return true;
+    }
 }
@@ -1,387 +0,0 @@
-namespace ServiceLib.Manager;
-
-public class ProfileGroupItemManager
-{
-    private static readonly Lazy<ProfileGroupItemManager> _instance = new(() => new());
-    private ConcurrentDictionary<string, ProfileGroupItem> _items = new();
-
-    public static ProfileGroupItemManager Instance => _instance.Value;
-    private static readonly string _tag = "ProfileGroupItemManager";
-
-    private ProfileGroupItemManager()
-    {
-    }
-
-    public async Task Init()
-    {
-        await InitData();
-    }
-
-    // Read-only getters: do not create or mark dirty
-    public bool TryGet(string indexId, out ProfileGroupItem? item)
-    {
-        item = null;
-        if (string.IsNullOrWhiteSpace(indexId))
-        {
-            return false;
-        }
-
-        return _items.TryGetValue(indexId, out item);
-    }
-
-    public ProfileGroupItem? GetOrDefault(string indexId)
-    {
-        return string.IsNullOrWhiteSpace(indexId) ? null : (_items.TryGetValue(indexId, out var v) ? v : null);
-    }
-
-    private async Task InitData()
-    {
-        await SQLiteHelper.Instance.ExecuteAsync($"delete from ProfileGroupItem where IndexId not in ( select indexId from ProfileItem )");
-
-        var list = await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().ToListAsync();
-        _items = new ConcurrentDictionary<string, ProfileGroupItem>(list.Where(t => !string.IsNullOrEmpty(t.IndexId)).ToDictionary(t => t.IndexId!));
-    }
-
-    private ProfileGroupItem AddProfileGroupItem(string indexId)
-    {
-        var profileGroupItem = new ProfileGroupItem()
-        {
-            IndexId = indexId,
-            ChildItems = string.Empty,
-            MultipleLoad = EMultipleLoad.LeastPing
-        };
-
-        _items[indexId] = profileGroupItem;
-        return profileGroupItem;
-    }
-
-    private ProfileGroupItem GetProfileGroupItem(string indexId)
-    {
-        if (string.IsNullOrEmpty(indexId))
-        {
-            indexId = Utils.GetGuid(false);
-        }
-
-        return _items.GetOrAdd(indexId, AddProfileGroupItem);
-    }
-
-    public async Task ClearAll()
-    {
-        await SQLiteHelper.Instance.ExecuteAsync($"delete from ProfileGroupItem ");
-        _items.Clear();
-    }
-
-    public async Task SaveTo()
-    {
-        try
-        {
-            var lstExists = await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().ToListAsync();
-            var existsMap = lstExists.Where(t => !string.IsNullOrEmpty(t.IndexId)).ToDictionary(t => t.IndexId!);
-
-            var lstInserts = new List<ProfileGroupItem>();
-            var lstUpdates = new List<ProfileGroupItem>();
-
-            foreach (var item in _items.Values)
-            {
-                if (string.IsNullOrEmpty(item.IndexId))
-                {
-                    continue;
-                }
-
-                if (existsMap.ContainsKey(item.IndexId))
-                {
-                    lstUpdates.Add(item);
-                }
-                else
-                {
-                    lstInserts.Add(item);
-                }
-            }
-
-            try
-            {
-                if (lstInserts.Count > 0)
-                {
-                    await SQLiteHelper.Instance.InsertAllAsync(lstInserts);
-                }
-
-                if (lstUpdates.Count > 0)
-                {
-                    await SQLiteHelper.Instance.UpdateAllAsync(lstUpdates);
-                }
-            }
-            catch (Exception ex)
-            {
-                Logging.SaveLog(_tag, ex);
-            }
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-        }
-    }
-
-    public ProfileGroupItem GetOrCreateAndMarkDirty(string indexId)
-    {
-        return GetProfileGroupItem(indexId);
-    }
-
-    public async ValueTask DisposeAsync()
-    {
-        await SaveTo();
-    }
-
-    public async Task SaveItemAsync(ProfileGroupItem item)
-    {
-        if (item is null)
-        {
-            throw new ArgumentNullException(nameof(item));
-        }
-
-        if (string.IsNullOrWhiteSpace(item.IndexId))
-        {
-            throw new ArgumentException("IndexId required", nameof(item));
-        }
-
-        _items[item.IndexId] = item;
-
-        try
-        {
-            var lst = await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().Where(t => t.IndexId == item.IndexId).ToListAsync();
-            if (lst != null && lst.Count > 0)
-            {
-                await SQLiteHelper.Instance.UpdateAllAsync(new List<ProfileGroupItem> { item });
-            }
-            else
-            {
-                await SQLiteHelper.Instance.InsertAllAsync(new List<ProfileGroupItem> { item });
-            }
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-        }
-    }
-
-    #region Helper
-
-    public static bool HasCycle(string? indexId)
-    {
-        return HasCycle(indexId, new HashSet<string>(), new HashSet<string>());
-    }
-
-    public static bool HasCycle(string? indexId, HashSet<string> visited, HashSet<string> stack)
-    {
-        if (indexId.IsNullOrEmpty())
-        {
-            return false;
-        }
-
-        if (stack.Contains(indexId))
-        {
-            return true;
-        }
-
-        if (visited.Contains(indexId))
-        {
-            return false;
-        }
-
-        visited.Add(indexId);
-        stack.Add(indexId);
-
-        try
-        {
-            Instance.TryGet(indexId, out var groupItem);
-
-            if (groupItem == null || groupItem.ChildItems.IsNullOrEmpty())
-            {
-                return false;
-            }
-
-            var childIds = Utils.String2List(groupItem.ChildItems)
-                .Where(p => !string.IsNullOrEmpty(p))
-                .ToList();
-            if (childIds == null)
-            {
-                return false;
-            }
-
-            foreach (var child in childIds)
-            {
-                if (HasCycle(child, visited, stack))
-                {
-                    return true;
-                }
-            }
-
-            return false;
-        }
-        finally
-        {
-            stack.Remove(indexId);
-        }
-    }
-
-    public static async Task<(List<ProfileItem> Items, ProfileGroupItem? Group)> GetChildProfileItems(string? indexId)
-    {
-        Instance.TryGet(indexId, out var profileGroupItem);
-        if (profileGroupItem == null || profileGroupItem.NotHasChild())
-        {
-            return (new List<ProfileItem>(), profileGroupItem);
-        }
-        var items = await GetChildProfileItems(profileGroupItem);
-        var subItems = await GetSubChildProfileItems(profileGroupItem);
-        items.AddRange(subItems);
-
-        return (items, profileGroupItem);
-    }
-
-    public static async Task<List<ProfileItem>> GetChildProfileItems(ProfileGroupItem? group)
-    {
-        if (group == null || group.ChildItems.IsNullOrEmpty())
-        {
-            return new();
-        }
-        var childProfiles = (await Task.WhenAll(
-                Utils.String2List(group.ChildItems)
-                    .Where(p => !p.IsNullOrEmpty())
-                    .Select(AppManager.Instance.GetProfileItem)
-            ))
-            .Where(p =>
-                p != null &&
-                p.IsValid() &&
-                p.ConfigType != EConfigType.Custom
-            )
-            .ToList();
-        return childProfiles;
-    }
-
-    public static async Task<List<ProfileItem>> GetSubChildProfileItems(ProfileGroupItem? group)
-    {
-        if (group == null || group.SubChildItems.IsNullOrEmpty())
-        {
-            return new();
-        }
-        var childProfiles = await AppManager.Instance.ProfileItems(group.SubChildItems);
-
-        return childProfiles.Where(p =>
-                p != null &&
-                p.IsValid() &&
-                !p.ConfigType.IsComplexType() &&
-                (group.Filter.IsNullOrEmpty() || Regex.IsMatch(p.Remarks, group.Filter))
-            )
-            .ToList();
-    }
-
-    public static async Task<HashSet<string>> GetAllChildDomainAddresses(string indexId)
-    {
-        // include grand children
-        var childAddresses = new HashSet<string>();
-        if (!Instance.TryGet(indexId, out var groupItem) || groupItem == null)
-        {
-            return childAddresses;
-        }
-
-        if (groupItem.SubChildItems.IsNotEmpty())
-        {
-            var subItems = await GetSubChildProfileItems(groupItem);
-            subItems.ForEach(p => childAddresses.Add(p.Address));
-        }
-
-        var childIds = Utils.String2List(groupItem.ChildItems) ?? [];
-
-        foreach (var childId in childIds)
-        {
-            var childNode = await AppManager.Instance.GetProfileItem(childId);
-            if (childNode == null)
-            {
-                continue;
-            }
-
-            if (!childNode.IsComplex())
-            {
-                childAddresses.Add(childNode.Address);
-            }
-            else if (childNode.ConfigType.IsGroupType())
-            {
-                var subAddresses = await GetAllChildDomainAddresses(childNode.IndexId);
-                foreach (var addr in subAddresses)
-                {
-                    childAddresses.Add(addr);
-                }
-            }
-        }
-
-        return childAddresses;
-    }
-
-    public static async Task<HashSet<string>> GetAllChildEchQuerySni(string indexId)
-    {
-        // include grand children
-        var childAddresses = new HashSet<string>();
-        if (!Instance.TryGet(indexId, out var groupItem) || groupItem == null)
-        {
-            return childAddresses;
-        }
-
-        if (groupItem.SubChildItems.IsNotEmpty())
-        {
-            var subItems = await GetSubChildProfileItems(groupItem);
-            foreach (var childNode in subItems)
-            {
-                if (childNode.EchConfigList.IsNullOrEmpty())
-                {
-                    continue;
-                }
-                if (childNode.StreamSecurity == Global.StreamSecurity
-                    && childNode.EchConfigList?.Contains("://") == true)
-                {
-                    var idx = childNode.EchConfigList.IndexOf('+');
-                    childAddresses.Add(idx > 0 ? childNode.EchConfigList[..idx] : childNode.Sni);
-                }
-                else
-                {
-                    childAddresses.Add(childNode.Sni);
-                }
-            }
-        }
-
-        var childIds = Utils.String2List(groupItem.ChildItems) ?? [];
-
-        foreach (var childId in childIds)
-        {
-            var childNode = await AppManager.Instance.GetProfileItem(childId);
-            if (childNode == null)
-            {
-                continue;
-            }
-
-            if (!childNode.IsComplex() && !childNode.EchConfigList.IsNullOrEmpty())
-            {
-                if (childNode.StreamSecurity == Global.StreamSecurity
-                    && childNode.EchConfigList?.Contains("://") == true)
-                {
-                    var idx = childNode.EchConfigList.IndexOf('+');
-                    childAddresses.Add(idx > 0 ? childNode.EchConfigList[..idx] : childNode.Sni);
-                }
-                else
-                {
-                    childAddresses.Add(childNode.Sni);
-                }
-            }
-            else if (childNode.ConfigType.IsGroupType())
-            {
-                var subAddresses = await GetAllChildDomainAddresses(childNode.IndexId);
-                foreach (var addr in subAddresses)
-                {
-                    childAddresses.Add(addr);
-                }
-            }
-        }
-
-        return childAddresses;
-    }
-
-    #endregion Helper
-}
@@ -43,9 +43,12 @@ public sealed class WebDavManager
                _webDir = _config.WebDavItem.DirName.TrimEx();
            }

+            // Ensure BaseAddress URL ends with a trailing slash
+            var baseUrl = _config.WebDavItem.Url.Trim().TrimEnd('/') + "/";
+
            var clientParams = new WebDavClientParams
            {
-                BaseAddress = new Uri(_config.WebDavItem.Url),
+                BaseAddress = new Uri(baseUrl),
                Credentials = new NetworkCredential(_config.WebDavItem.UserName, _config.WebDavItem.Password)
            };
            _client = new WebDavClient(clientParams);
@@ -15,6 +15,10 @@ public class CoreBasicItem

    public string DefUserAgent { get; set; }

+    public string? SendThrough { get; set; }
+
+    public string? BindInterface { get; set; }
+
    public bool EnableFragment { get; set; }

    public bool EnableCacheFile4Sbox { get; set; } = true;
@@ -47,11 +51,9 @@ public class KcpItem

    public int DownlinkCapacity { get; set; }

-    public bool Congestion { get; set; }
+    public int CwndMultiplier { get; set; }

-    public int ReadBufferSize { get; set; }
-
-    public int WriteBufferSize { get; set; }
+    public int MaxSendingWindow { get; set; }
 }

 [Serializable]
@@ -87,7 +89,6 @@ public class MsgUIItem
 public class UIItem
 {
    public bool EnableAutoAdjustMainLvColWidth { get; set; }
-    public bool EnableUpdateSubOnlyRemarksExist { get; set; }
    public int MainGirdHeight1 { get; set; }
    public int MainGirdHeight2 { get; set; }
    public EGirdOrientation MainGirdOrientation { get; set; } = EGirdOrientation.Vertical;
@@ -99,7 +100,7 @@ public class UIItem
    public bool EnableDragDropSort { get; set; }
    public bool DoubleClick2Activate { get; set; }
    public bool AutoHideStartup { get; set; }
-    public bool Hide2TrayWhenClose { get; set; }    
+    public bool Hide2TrayWhenClose { get; set; }
    public bool MacOSShowInDock { get; set; }
    public List<ColumnItem> MainColumnItem { get; set; }
    public List<WindowSizeItem> WindowSizeItem { get; set; }
@@ -144,8 +145,9 @@ public class TunModeItem
    public bool StrictRoute { get; set; } = true;
    public string Stack { get; set; }
    public int Mtu { get; set; }
-    public bool EnableExInbound { get; set; }
    public bool EnableIPv6Address { get; set; }
+    public string IcmpRouting { get; set; }
+    public bool EnableLegacyProtect { get; set; }
 }

 [Serializable]
@@ -156,6 +158,7 @@ public class SpeedTestItem
    public string SpeedPingTestUrl { get; set; }
    public int MixedConcurrencyCount { get; set; }
    public string IPAPIUrl { get; set; }
+    public string UdpTestTarget { get; set; }
 }

 [Serializable]
@@ -195,7 +198,7 @@ public class HysteriaItem
 {
    public int UpMbps { get; set; }
    public int DownMbps { get; set; }
-    public int HopInterval { get; set; } = 30;
+    public int HopInterval { get; set; } = Global.Hysteria2DefaultHopInt;
 }

 [Serializable]
@@ -209,6 +212,7 @@ public class ClashUIItem
    public int ProxiesAutoDelayTestInterval { get; set; } = 10;
    public bool ConnectionsAutoRefresh { get; set; }
    public int ConnectionsRefreshInterval { get; set; } = 2;
+    public List<ColumnItem> ConnectionsColumnItem { get; set; }
 }

 [Serializable]
@@ -265,9 +269,10 @@ public class SimpleDNSItem
    public string? DirectDNS { get; set; }
    public string? RemoteDNS { get; set; }
    public string? BootstrapDNS { get; set; }
-    public string? RayStrategy4Freedom { get; set; }
-    public string? SingboxStrategy4Direct { get; set; }
-    public string? SingboxStrategy4Proxy { get; set; }
+    public string? Strategy4Freedom { get; set; }
+    public string? Strategy4Proxy { get; set; }
+    public bool? ServeStale { get; set; }
+    public bool? ParallelQuery { get; set; }
    public string? Hosts { get; set; }
    public string? DirectExpectedIPs { get; set; }
 }
@@ -0,0 +1,23 @@
+namespace ServiceLib.Models;
+
+public record CoreConfigContext
+{
+    public required ProfileItem Node { get; init; }
+    public required ECoreType RunCoreType { get; init; }
+    public RoutingItem? RoutingItem { get; init; }
+    public DNSItem? RawDnsItem { get; init; }
+    public SimpleDNSItem SimpleDnsItem { get; init; } = new();
+    public Dictionary<string, ProfileItem> AllProxiesMap { get; init; } = new();
+    public Config AppConfig { get; init; } = new();
+    public FullConfigTemplateItem? FullConfigTemplate { get; init; } = new();
+
+    // Test ServerTestItem Map
+    public Dictionary<string, string> ServerTestItemMap { get; init; } = new();
+
+    // TUN Compatibility
+    public bool IsTunEnabled { get; init; } = false;
+    public HashSet<string> ProtectDomainList { get; init; } = [];
+
+    public bool IsWindows { get; init; }
+    public bool IsMacOS { get; init; }
+}
@@ -12,6 +12,7 @@ public class CoreInfo
    public string? DownloadUrlWinArm64 { get; set; }
    public string? DownloadUrlLinux64 { get; set; }
    public string? DownloadUrlLinuxArm64 { get; set; }
+    public string? DownloadUrlLinuxRiscV64 { get; set; }
    public string? DownloadUrlOSX64 { get; set; }
    public string? DownloadUrlOSXArm64 { get; set; }
    public string? Match { get; set; }
@@ -1,5 +1,6 @@
 namespace ServiceLib.Models;

+[Obsolete("Use ProtocolExtraItem instead.")]
 [Serializable]
 public class ProfileGroupItem
 {
@@ -1,27 +1,25 @@
 namespace ServiceLib.Models;

 [Serializable]
-public class ProfileItem : ReactiveObject
+public class ProfileItem
 {
+    private ProtocolExtraItem? _protocolExtraCache;
+    private TransportExtraItem? _transportExtraCache;
+
    public ProfileItem()
    {
        IndexId = string.Empty;
        ConfigType = EConfigType.VMess;
-        ConfigVersion = 2;
+        ConfigVersion = 4;
+        Subid = string.Empty;
        Address = string.Empty;
        Port = 0;
-        Id = string.Empty;
-        AlterId = 0;
-        Security = string.Empty;
+        Password = string.Empty;
+        Username = string.Empty;
        Network = string.Empty;
        Remarks = string.Empty;
-        HeaderType = string.Empty;
-        RequestHost = string.Empty;
-        Path = string.Empty;
        StreamSecurity = string.Empty;
        AllowInsecure = string.Empty;
-        Subid = string.Empty;
-        Flow = string.Empty;
    }

    #region function
@@ -81,7 +79,7 @@ public class ProfileItem : ReactiveObject
        switch (ConfigType)
        {
            case EConfigType.VMess:
-                if (Id.IsNullOrEmpty() || !Utils.IsGuidByParse(Id))
+                if (Password.IsNullOrEmpty() || !Utils.IsGuidByParse(Password))
                {
                    return false;
                }
@@ -89,12 +87,12 @@ public class ProfileItem : ReactiveObject
                break;

            case EConfigType.VLESS:
-                if (Id.IsNullOrEmpty() || (!Utils.IsGuidByParse(Id) && Id.Length > 30))
+                if (Password.IsNullOrEmpty() || (!Utils.IsGuidByParse(Password) && Password.Length > 30))
                {
                    return false;
                }

-                if (!Global.Flows.Contains(Flow))
+                if (!Global.Flows.Contains(GetProtocolExtra().Flow ?? string.Empty))
                {
                    return false;
                }
@@ -102,12 +100,13 @@ public class ProfileItem : ReactiveObject
                break;

            case EConfigType.Shadowsocks:
-                if (Id.IsNullOrEmpty())
+                if (Password.IsNullOrEmpty())
                {
                    return false;
                }

-                if (string.IsNullOrEmpty(Security) || !Global.SsSecuritiesInSingbox.Contains(Security))
+                if (string.IsNullOrEmpty(GetProtocolExtra().SsMethod)
+                    || !Global.SsSecuritiesInSingbox.Contains(GetProtocolExtra().SsMethod))
                {
                    return false;
                }
@@ -125,42 +124,90 @@ public class ProfileItem : ReactiveObject
        return true;
    }

+    public ProtocolExtraItem GetProtocolExtra()
+    {
+        return _protocolExtraCache ??= JsonUtils.Deserialize<ProtocolExtraItem>(ProtoExtra) ?? new ProtocolExtraItem();
+    }
+
+    public void SetProtocolExtra(ProtocolExtraItem extraItem)
+    {
+        _protocolExtraCache = extraItem;
+        ProtoExtra = JsonUtils.Serialize(extraItem, false);
+    }
+
+    public TransportExtraItem GetTransportExtra()
+    {
+        return _transportExtraCache ??= JsonUtils.Deserialize<TransportExtraItem>(TransportExtra) ?? new TransportExtraItem();
+    }
+
+    public void SetTransportExtra(TransportExtraItem transportExtra)
+    {
+        _transportExtraCache = transportExtra;
+        TransportExtra = JsonUtils.Serialize(transportExtra, false);
+    }
+
    #endregion function

    [PrimaryKey]
    public string IndexId { get; set; }

    public EConfigType ConfigType { get; set; }
+    public ECoreType? CoreType { get; set; }
    public int ConfigVersion { get; set; }
-    public string Address { get; set; }
-    public int Port { get; set; }
-    public string Ports { get; set; }
-    public string Id { get; set; }
-    public int AlterId { get; set; }
-    public string Security { get; set; }
-    public string Network { get; set; }
-    public string Remarks { get; set; }
-    public string HeaderType { get; set; }
-    public string RequestHost { get; set; }
-    public string Path { get; set; }
-    public string StreamSecurity { get; set; }
-    public string AllowInsecure { get; set; }
    public string Subid { get; set; }
    public bool IsSub { get; set; } = true;
-    public string Flow { get; set; }
+    public int? PreSocksPort { get; set; }
+    public bool DisplayLog { get; set; } = true;
+    public string Remarks { get; set; }
+    public string Address { get; set; }
+    public int Port { get; set; }
+    public string Password { get; set; }
+    public string Username { get; set; }
+    public string Network { get; set; }
+
+    [Obsolete("Use TransportExtra.RawHeaderType/XhttpMode/GrpcMode/KcpHeaderType instead.")]
+    public string HeaderType { get; set; }
+
+    [Obsolete("Use TransportExtra.Host/GrpcAuthority instead.")]
+    public string RequestHost { get; set; }
+
+    [Obsolete("Use TransportExtra.Path/GrpcServiceName/KcpSeed instead.")]
+    public string Path { get; set; }
+
+    public string StreamSecurity { get; set; }
+    public string AllowInsecure { get; set; }
    public string Sni { get; set; }
    public string Alpn { get; set; } = string.Empty;
-    public ECoreType? CoreType { get; set; }
-    public int? PreSocksPort { get; set; }
    public string Fingerprint { get; set; }
-    public bool DisplayLog { get; set; } = true;
    public string PublicKey { get; set; }
    public string ShortId { get; set; }
    public string SpiderX { get; set; }
    public string Mldsa65Verify { get; set; }
+
+    [Obsolete("Use TransportExtra.XhttpExtra instead.")]
    public string Extra { get; set; }
+
    public bool? MuxEnabled { get; set; }
    public string Cert { get; set; }
+    public string CertSha { get; set; }
    public string EchConfigList { get; set; }
-    public string EchForceQuery { get; set; }
+    public string Finalmask { get; set; }
+
+    public string ProtoExtra { get; set; }
+    public string TransportExtra { get; set; }
+
+    [Obsolete("Use ProtocolExtraItem.Ports instead.")]
+    public string Ports { get; set; }
+
+    [Obsolete("Use ProtocolExtraItem.AlterId instead.")]
+    public int AlterId { get; set; }
+
+    [Obsolete("Use ProtocolExtraItem.Flow instead.")]
+    public string Flow { get; set; }
+
+    [Obsolete("Use ProfileItem.Password instead.")]
+    public string Id { get; set; }
+
+    [Obsolete("Use ProtocolExtraItem.xxx instead.")]
+    public string Security { get; set; }
 }
@@ -1,16 +1,24 @@
 namespace ServiceLib.Models;

 [Serializable]
-public class ProfileItemModel : ProfileItem
+public class ProfileItemModel : ReactiveObject
 {
    public bool IsActive { get; set; }
+    public string IndexId { get; set; }
+    public EConfigType ConfigType { get; set; }
+    public string Remarks { get; set; }
+    public string Address { get; set; }
+    public int Port { get; set; }
+    public string Network { get; set; }
+    public string StreamSecurity { get; set; }
+    public string Subid { get; set; }
    public string SubRemarks { get; set; }
+    public int Sort { get; set; }

    [Reactive]
    public int Delay { get; set; }

    public decimal Speed { get; set; }
-    public int Sort { get; set; }

    [Reactive]
    public string DelayVal { get; set; }
@@ -29,4 +37,15 @@ public class ProfileItemModel : ProfileItem

    [Reactive]
    public string TotalDown { get; set; }
+
+    public string GetSummary()
+    {
+        var summary = $"[{ConfigType}] {Remarks}";
+        if (!ConfigType.IsComplexType())
+        {
+            summary += $"({Address}:{Port})";
+        }
+
+        return summary;
+    }
 }
@@ -0,0 +1,45 @@
+namespace ServiceLib.Models;
+
+public record ProtocolExtraItem
+{
+    public bool? Uot { get; init; }
+    public string? CongestionControl { get; init; }
+
+    // vmess
+    public string? AlterId { get; init; }
+    public string? VmessSecurity { get; init; }
+
+    // vless
+    public string? Flow { get; init; }
+    public string? VlessEncryption { get; init; }
+    //public string? VisionSeed { get; init; }
+
+    // shadowsocks
+    //public string? PluginArgs { get; init; }
+    public string? SsMethod { get; init; }
+
+    // wireguard
+    public string? WgPublicKey { get; init; }
+    public string? WgPresharedKey { get; init; }
+    public string? WgInterfaceAddress { get; init; }
+    public string? WgReserved { get; init; }
+    public int? WgMtu { get; init; }
+
+    // hysteria2
+    public string? SalamanderPass { get; init; }
+    public int? UpMbps { get; init; }
+    public int? DownMbps { get; init; }
+    public string? Ports { get; init; }
+    public string? HopInterval { get; init; }
+
+    // naiveproxy
+    public int? InsecureConcurrency { get; init; }
+    public bool? NaiveQuic { get; init; }
+
+    // group profile
+    public string? GroupType { get; init; }
+    public string? ChildItems { get; init; }
+    public string? SubChildItems { get; init; }
+    public string? Filter { get; init; }
+    public EMultipleLoad? MultipleLoad { get; init; }
+}
@@ -9,4 +9,6 @@ public class ServerTestItem
    public EConfigType ConfigType { get; set; }
    public bool AllowTest { get; set; }
    public int QueueNum { get; set; }
+    public ProfileItem Profile { get; set; }
+    public ECoreType CoreType { get; set; }
 }
@@ -28,6 +28,7 @@ public class Dns4Sbox
    public bool? disable_cache { get; set; }
    public bool? disable_expire { get; set; }
    public bool? independent_cache { get; set; }
+    public int? cache_capacity { get; set; }
    public bool? reverse_mapping { get; set; }
    public string? client_subnet { get; set; }
 }
@@ -68,6 +69,7 @@ public class Rule4Sbox
    public List<string>? ip_cidr { get; set; }
    public List<string>? source_ip_cidr { get; set; }
    public List<string>? process_name { get; set; }
+    public List<string>? process_path { get; set; }
    public List<string>? rule_set { get; set; }
    public List<Rule4Sbox>? rules { get; set; }
    public string? action { get; set; }
@@ -132,10 +134,14 @@ public class Outbound4Sbox : BaseServer4Sbox
    public int? recv_window_conn { get; set; }
    public int? recv_window { get; set; }
    public bool? disable_mtu_discovery { get; set; }
+    public int? insecure_concurrency { get; set; }
+    public bool? udp_over_tcp { get; set; }
    public string? method { get; set; }
    public string? username { get; set; }
    public string? password { get; set; }
    public string? congestion_control { get; set; }
+    public bool? quic { get; set; }
+    public string? quic_congestion_control { get; set; }
    public string? version { get; set; }
    public string? network { get; set; }
    public string? packet_encoding { get; set; }
@@ -167,7 +173,7 @@ public class Peer4Sbox
    public string? pre_shared_key { get; set; }
    public List<string> allowed_ips { get; set; }
    public int? persistent_keepalive_interval { get; set; }
-    public List<int> reserved { get; set; }
+    public List<int>? reserved { get; set; }
 }

 public class Tls4Sbox
@@ -231,6 +237,9 @@ public class Transport4Sbox
 public class Headers4Sbox
 {
    public string? Host { get; set; }
+
+    [JsonPropertyName("User-Agent")]
+    public string UserAgent { get; set; }
 }

 public class HyObfs4Sbox
@@ -253,14 +262,6 @@ public class Server4Sbox : BaseServer4Sbox

    // public List<string>? path { get; set; } // hosts
    public Dictionary<string, List<string>>? predefined { get; set; }
-
-    // Deprecated
-    public string? address { get; set; }
-
-    public string? address_resolver { get; set; }
-    public string? address_strategy { get; set; }
-    public string? strategy { get; set; }
-    // Deprecated End
 }

 public class Experimental4Sbox
@@ -0,0 +1,19 @@
+namespace ServiceLib.Models;
+
+public record TransportExtraItem
+{
+    public string? RawHeaderType { get; init; }
+
+    public string? Host { get; init; }
+    public string? Path { get; init; }
+    public string? XhttpMode { get; init; }
+    public string? XhttpExtra { get; init; }
+
+    public string? GrpcAuthority { get; init; }
+    public string? GrpcServiceName { get; init; }
+    public string? GrpcMode { get; init; }
+
+    public string? KcpHeaderType { get; init; }
+    public string? KcpSeed { get; init; }
+    public int? KcpMtu { get; init; }
+}
@@ -3,7 +3,7 @@ namespace ServiceLib.Models;
 public class V2rayConfig
 {
    public Log4Ray log { get; set; }
-    public Dns4Ray dns { get; set; }
+    public object dns { get; set; }
    public List<Inbounds4Ray> inbounds { get; set; }
    public List<Outbounds4Ray> outbounds { get; set; }
    public Routing4Ray routing { get; set; }
@@ -47,9 +47,9 @@ public class Inbounds4Ray
 {
    public string tag { get; set; }

-    public int port { get; set; }
+    public int? port { get; set; }

-    public string listen { get; set; }
+    public string? listen { get; set; }

    public string protocol { get; set; }

@@ -75,6 +75,18 @@ public class Inboundsettings4Ray
    public bool? allowTransparent { get; set; }

    public List<AccountsItem4Ray>? accounts { get; set; }
+
+    public string? name { get; set; }
+
+    public int? MTU { get; set; }
+
+    public List<string>? gateway { get; set; }
+
+    public List<string>? autoSystemRoutingTable { get; set; }
+
+    public string? autoOutboundsInterface { get; set; }
+
+    // public List<string>? dns { get; set; }
 }

 public class UsersItem4Ray
@@ -105,6 +117,10 @@ public class Outbounds4Ray

    public string protocol { get; set; }

+    public string? sendThrough { get; set; }
+
+    public string? targetStrategy { get; set; }
+
    public Outboundsettings4Ray settings { get; set; }

    public StreamSettings4Ray streamSettings { get; set; }
@@ -124,11 +140,11 @@ public class Outboundsettings4Ray

    public int? userLevel { get; set; }

-    public FragmentItem4Ray? fragment { get; set; }
-
    public string? secretKey { get; set; }

-    public List<string>? address { get; set; }
+    public object? address { get; set; }
+
+    public int? port { get; set; }

    public List<WireguardPeer4Ray>? peers { get; set; }

@@ -139,12 +155,15 @@ public class Outboundsettings4Ray
    public List<int>? reserved { get; set; }

    public int? workers { get; set; }
+
+    public int? version { get; set; }
 }

 public class WireguardPeer4Ray
 {
    public string endpoint { get; set; }
    public string publicKey { get; set; }
+    public string? preSharedKey { get; set; }
 }

 public class VnextItem4Ray
@@ -174,6 +193,8 @@ public class ServersItem4Ray

    public string flow { get; set; }

+    public bool? uot { get; set; }
+
    public List<SocksUsersItem4Ray> users { get; set; }
 }

@@ -203,12 +224,8 @@ public class Dns4Ray
 {
    public Dictionary<string, object>? hosts { get; set; }
    public List<object> servers { get; set; }
-    public string? clientIp { get; set; }
-    public string? queryStrategy { get; set; }
-    public bool? disableCache { get; set; }
-    public bool? disableFallback { get; set; }
-    public bool? disableFallbackIfMatch { get; set; }
-    public bool? useSystemHosts { get; set; }
+    public bool? serveStale { get; set; }
+    public bool? enableParallelQuery { get; set; }
    public string? tag { get; set; }
 }

@@ -219,12 +236,6 @@ public class DnsServer4Ray
    public List<string>? domains { get; set; }
    public bool? skipFallback { get; set; }
    public List<string>? expectedIPs { get; set; }
-    public List<string>? unexpectedIPs { get; set; }
-    public string? clientIp { get; set; }
-    public string? queryStrategy { get; set; }
-    public int? timeoutMs { get; set; }
-    public bool? disableCache { get; set; }
-    public bool? finalQuery { get; set; }
    public string? tag { get; set; }
 }

@@ -256,6 +267,8 @@ public class RulesItem4Ray
    public List<string>? domain { get; set; }

    public List<string>? protocol { get; set; }
+
+    public List<string>? process { get; set; }
 }

 public class BalancersItem4Ray
@@ -318,7 +331,7 @@ public class StreamSettings4Ray

    public TlsSettings4Ray? tlsSettings { get; set; }

-    public TcpSettings4Ray? tcpSettings { get; set; }
+    public RawSettings4Ray? rawSettings { get; set; }

    public KcpSettings4Ray? kcpSettings { get; set; }

@@ -336,6 +349,10 @@ public class StreamSettings4Ray

    public GrpcSettings4Ray? grpcSettings { get; set; }

+    public HysteriaSettings4Ray? hysteriaSettings { get; set; }
+
+    public object? finalmask { get; set; }
+
    public Sockopt4Ray? sockopt { get; set; }
 }

@@ -355,9 +372,11 @@ public class TlsSettings4Ray
    public string? spiderX { get; set; }
    public string? mldsa65Verify { get; set; }
    public List<CertificateSettings4Ray>? certificates { get; set; }
+    public string? pinnedPeerCertSha256 { get; set; }
    public bool? disableSystemRoot { get; set; }
    public string? echConfigList { get; set; }
    public string? echForceQuery { get; set; }
+    public Sockopt4Ray? echSockopt { get; set; }
 }

 public class CertificateSettings4Ray
@@ -366,7 +385,7 @@ public class CertificateSettings4Ray
    public string? usage { get; set; }
 }

-public class TcpSettings4Ray
+public class RawSettings4Ray
 {
    public Header4Ray header { get; set; }
 }
@@ -378,8 +397,6 @@ public class Header4Ray
    public object request { get; set; }

    public object response { get; set; }
-
-    public string? domain { get; set; }
 }

 public class KcpSettings4Ray
@@ -392,15 +409,9 @@ public class KcpSettings4Ray

    public int downlinkCapacity { get; set; }

-    public bool congestion { get; set; }
+    public int cwndMultiplier { get; set; }

-    public int readBufferSize { get; set; }
-
-    public int writeBufferSize { get; set; }
-
-    public Header4Ray header { get; set; }
-
-    public string seed { get; set; }
+    public int maxSendingWindow { get; set; }
 }

 public class WsSettings4Ray
@@ -422,6 +433,8 @@ public class HttpupgradeSettings4Ray
    public string? path { get; set; }

    public string? host { get; set; }
+
+    public Headers4Ray headers { get; set; }
 }

 public class XhttpSettings4Ray
@@ -457,6 +470,62 @@ public class GrpcSettings4Ray
    public int? health_check_timeout { get; set; }
    public bool? permit_without_stream { get; set; }
    public int? initial_windows_size { get; set; }
+    public string? user_agent { get; set; }
+}
+
+public class HysteriaSettings4Ray
+{
+    public int version { get; set; }
+    public string? auth { get; set; }
+}
+
+public class UdpHop4Ray
+{
+    public string? ports { get; set; }
+    public string? interval { get; set; }
+}
+
+public class Finalmask4Ray
+{
+    public List<Mask4Ray>? udp { get; set; }
+    public QuicParams4Ray? quicParams { get; set; }
+}
+
+public class Mask4Ray
+{
+    public string type { get; set; }
+    public MaskSettings4Ray? settings { get; set; }
+}
+
+public class MaskSettings4Ray
+{
+    public string? password { get; set; }
+    public string? domain { get; set; }
+
+    // fragment
+    public string? packets { get; set; }
+
+    public string? length { get; set; }
+    public string? delay { get; set; }
+
+    // noise
+    public int? reset { get; set; }
+
+    public List<NoiseMask4Ray>? noise { get; set; }
+}
+
+public class NoiseMask4Ray
+{
+    public string? rand { get; set; }
+    public string? delay { get; set; }
+}
+
+public class QuicParams4Ray
+{
+    public string? congestion { get; set; }
+    public string? brutalUp { get; set; }
+    public string? brutalDown { get; set; }
+    public UdpHop4Ray? udpHop { get; set; }
 }

 public class AccountsItem4Ray
@@ -469,6 +538,9 @@ public class AccountsItem4Ray
 public class Sockopt4Ray
 {
    public string? dialerProxy { get; set; }
+
+    [JsonPropertyName("interface")]
+    public string? Interface { get; set; }
 }

 public class FragmentItem4Ray
@@ -343,7 +343,7 @@
    <value>*QUIC key/Kcp seed</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*grpc serviceName</value>
+    <value>gRPC serviceName</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*هاست http جدا شده با کاما (،)</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*QUIC securty</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*tcp camouflage type</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>raw camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*kcp camouflage type</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>kcp camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*QUIC camouflage type</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>QUIC camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*حالت grpc</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>حالت grpc</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>نام مستعار (ملاحظات)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>Camouflage domain(host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>روش رمزگذاری (امنیتی)</value>
  </data>
@@ -619,7 +616,7 @@
    <value>TLS</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*مقدار پیش فرض tcp</value>
+    <value>*مقدار پیش فرض raw</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>نوع هسته</value>
@@ -723,9 +720,6 @@
  <data name="TbSettingsPass" xml:space="preserve">
    <value>مجوز احراز هویت</value>
  </data>
-  <data name="TbSettingsRemoteDNS" xml:space="preserve">
-    <value>سفارشی DNS (multiple, separated by commas (,))</value>
-  </data>
  <data name="TbSettingsSetUWP" xml:space="preserve">
    <value>تنظیم کردن Win10 UWP Loopback</value>
  </data>
@@ -937,7 +931,7 @@
    <value>User-Agent</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>این پارامتر فقط برای tcp/http و ws معتبر است</value>
+    <value>This parameter is valid only for raw/http, ws, gRPC and xhttp</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>FontFamily (نیاز به راه اندازی مجدد)</value>
@@ -1027,7 +1021,7 @@
    <value>پروتکل sing-box Mux</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>نام کامل فرانید (حالت Tun)</value>
+    <value>Process (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP or IP CIDR</value>
@@ -1068,12 +1062,9 @@
  <data name="TbSettingsTunStack" xml:space="preserve">
    <value>پشته شبکه</value>
  </data>
-  <data name="TbSettingsTunMtu" xml:space="preserve">
+  <data name="TbMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>فعال سازی additional Inbound</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>فعال سازی آدرس IPv6</value>
  </data>
@@ -1084,7 +1075,7 @@
    <value>کلید خصوصی</value>
  </data>
  <data name="TbReserved" xml:space="preserve">
-    <value>Reserved (2,3,4)</value>
+    <value>Reserved</value>
  </data>
  <data name="TbLocalAddress" xml:space="preserve">
    <value>آدرس (IPv4, IPv6)</value>
@@ -1101,21 +1092,15 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>آدرس اینترنتی تست پینگ سرعت</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>اشتراک در حال به‌روزرسانی، فقط مشخص کنید که ملاحظاتی آیا وجود دارد!</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>پایان تست...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*grpc Authority</value>
+    <value>RPC Authority</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
    <value>افزودن سرور [HTTP]</value>
  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>which conflicts with the group previous proxy</value>
-  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>فعال کردن فرگمنت</value>
  </data>
@@ -1329,11 +1314,11 @@
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>The password will be validated via the command line. If a validation error causes the application to malfunction, please restart the application. The password will not be stored and must be entered again after each restart.</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*حالت xhttp</value>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>حالت xhttp</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>جیسون خام XHTTP Extra, فرمت: { XHTTPObject }</value>
+    <value>Raw JSON, format: { XHTTP Object }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>هنگام بستن پنجره در سینی پنهان شوید</value>
@@ -1377,24 +1362,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>مخفی و پورت می شود، با کاما (،) جدا می شود</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>Generate Policy Group from Multiple Profiles</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>چند سرور تصادفی توسط Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>چند سرور RoundRobin توسط Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>چند سرور LeastPing توسط Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>چند سرور LeastLoad توسط Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>LeastPing چند سرور توسط sing-box</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>صادر کردن سرور</value>
  </data>
@@ -1419,17 +1386,11 @@
  <data name="TbDomesticDNS" xml:space="preserve">
    <value>Domestic DNS</value>
  </data>
-  <data name="TbRemoteDNSTips" xml:space="preserve">
-    <value>Via proxy — please ensure remote availability</value>
+  <data name="TbDirectResolveStrategy" xml:space="preserve">
+    <value>Direct Target Resolution Strategy</value>
  </data>
-  <data name="TbXrayFreedomStrategy" xml:space="preserve">
-    <value>xray Freedom Resolution Strategy</value>
-  </data>
-  <data name="TbSBDirectResolveStrategy" xml:space="preserve">
-    <value>sing-box Direct Resolution Strategy</value>
-  </data>
-  <data name="TbSBRemoteResolveStrategy" xml:space="preserve">
-    <value>sing-box Remote Resolution Strategy</value>
+  <data name="TbRemoteResolveStrategy" xml:space="preserve">
+    <value>Proxy Target Resolution Strategy</value>
  </data>
  <data name="TbAddCommonDNSHosts" xml:space="preserve">
    <value>Add Common DNS Hosts</value>
@@ -1453,7 +1414,7 @@
    <value>Validate Regional Domain IPs</value>
  </data>
  <data name="TbValidateDirectExpectedIPsDesc" xml:space="preserve">
-    <value>When configured, validates IPs returned for regional domains (e.g., geosite:cn), returning only expected IPs</value>
+    <value>When configured, validates IPs returned for regional domains (e.g., geosite:cn - geoip:cn), returning only expected IPs</value>
  </data>
  <data name="TbCustomDNSEnable" xml:space="preserve">
    <value>Enable Custom DNS</value>
@@ -1545,44 +1506,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>Fallback</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>Multi-Configuration Fallback by sing-box</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>Core '{0}' does not support network type '{1}'</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>Multi-Configuration Fallback by Xray</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>Core '{0}' does not support network type '{1}'.</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}'</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'.</value>
+  <data name="MsgInvalidProperty" xml:space="preserve">
+    <value>The {0} property is invalid, please check</value>
  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}'.</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>Proxy chained: </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>Routing rule outbound: </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>Policy group: </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>Node alias '{0}' does not exist.</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>Group '{0}' is empty. Please add at least one node.</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
-    <value>The {0} property is invalid, please check.</value>
-  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>{0} Group cannot reference itself or have a circular reference</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>Not support protocol '{0}'.</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>Not support protocol '{0}'</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>If the system does not have a tray function, please do not enable it</value>
@@ -1644,7 +1581,154 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
  <data name="TbEchConfigList" xml:space="preserve">
    <value>EchConfigList</value>
  </data>
-  <data name="TbEchForceQuery" xml:space="preserve">
-    <value>EchForceQuery</value>
+  <data name="TbFullCertTips" xml:space="preserve">
+    <value>Full certificate (chain), PEM format</value>
+  </data>
+  <data name="TbCertSha256Tips" xml:space="preserve">
+    <value>Certificate fingerprint (SHA-256)</value>
+  </data>
+  <data name="TbServeStale" xml:space="preserve">
+    <value>Serve Stale</value>
+  </data>
+  <data name="TbParallelQuery" xml:space="preserve">
+    <value>Parallel Query</value>
+  </data>
+  <data name="TbDomesticDNSTips" xml:space="preserve">
+    <value>By default, invoked only during routing for resolution</value>
+  </data>
+  <data name="TbRemoteDNSTips" xml:space="preserve">
+    <value>By default, invoked only during routing for resolution; ensure the remote server can reach this DNS</value>
+  </data>
+  <data name="TbDirectResolveStrategyTips" xml:space="preserve">
+    <value>If unset or "AsIs", DNS resolution uses the system DNS; otherwise, the internal DNS module is used.</value>
+  </data>
+  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
+    <value>If unset or "AsIs", DNS resolution is performed by the remote server's DNS; otherwise, the internal DNS module is used.</value>
+  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>Port hopping interval</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>Configuration item preview</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} warning: {2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} error: {2}. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>Group {0} has a cycle dependency on child node {1}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>Group {0} child node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>Group {0} child node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>Group {0} child group node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>Group {0} child group node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>Group {0} has no valid child node.</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>Routing rule {0} has an empty outbound tag. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} not found. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>Subscription previous proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>Subscription next proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>Generate Policy Group</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>All configurations</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>Group by Region</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>کپی</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>انتخاب همه</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>Paste</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>Format</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>Add NaïveProxy</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>Insecure Concurrency</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>Username</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>ICMP routing policy</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>Legacy TUN Protect</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>Camouflage domain</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>Allow insecure cert fetch (self-signed)</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
+  </data>
+  <data name="menuUdpTestServer" xml:space="preserve">
+    <value>Test Configurations UDP Delay</value>
+  </data>
+  <data name="TbSettingsUdpTestUrl" xml:space="preserve">
+    <value>UDP Test Url</value>
+  </data>
+  <data name="TbSettingsSendThrough" xml:space="preserve">
+    <value>Local outbound address (SendThrough)</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>For multi-interface environments, enter the local machine's IPv4 address</value>
+  </data>
+  <data name="FillCorrectSendThroughIPv4" xml:space="preserve">
+    <value>Please fill in the correct IPv4 address for SendThrough.</value>
+  </data>
+  <data name="TbSettingsBindInterface" xml:space="preserve">
+    <value>Bind Interface</value>
+  </data>
+  <data name="TbSettingsBindInterfaceTip" xml:space="preserve">
+    <value>For multi-interface environments, enter the name of the interface to bind. Only effective on Windows systems and TUN mode</value>
+  </data>
+  <data name="TbPreSharedKey" xml:space="preserve">
+    <value>PreSharedKey</value>
+  </data>
+  <data name="menuExport2InnerUri" xml:space="preserve">
+    <value>Export v2rayN Internal Share Link to Clipboard</value>
  </data>
 </root>
@@ -343,7 +343,7 @@
    <value>*clé de chiffrement QUIC</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*nom de service gRPC</value>
+    <value>nom de service gRPC</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*hôte http, séparés par des virgules (,)</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*méthode de chiffrement QUIC</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*type de camouflage tcp</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>type de camouflage raw</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*type de camouflage kcp</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>type de camouflage kcp</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*type de camouflage QUIC</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>type de camouflage QUIC</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*mode gRPC</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>mode gRPC</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>Alias (remarks)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>Domaine de camouflage (host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>Méthode de chiffrement (security)</value>
  </data>
@@ -619,7 +616,7 @@
    <value>Sécurité couche transport (TLS)</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*tcp par défaut ; un mauvais choix bloque la connexion</value>
+    <value>*raw par défaut ; un mauvais choix bloque la connexion</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>Type de Core</value>
@@ -723,9 +720,6 @@
  <data name="TbSettingsPass" xml:space="preserve">
    <value>Mot de passe d’authentification</value>
  </data>
-  <data name="TbSettingsRemoteDNS" xml:space="preserve">
-    <value>DNS perso (plusieurs configurables, séparés par virgules)</value>
-  </data>
  <data name="TbSettingsSetUWP" xml:space="preserve">
    <value>Lever la restriction de proxy en boucle locale pour les applications Win10 UWP</value>
  </data>
@@ -937,7 +931,7 @@
    <value>Agent utilisateur (User-Agent)</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>Valable uniquement pour les protocoles tcp/http et ws</value>
+    <value>This parameter is valid only for raw/http, ws, gRPC and xhttp</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>Police actuelle (redémarrage requis)</value>
@@ -1024,7 +1018,7 @@
    <value>Protocole de multiplexage Mux (sing-box)</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>Nom complet du processus (mode Tun)</value>
+    <value>Process (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP ou IP CIDR</value>
@@ -1065,12 +1059,9 @@
  <data name="TbSettingsTunStack" xml:space="preserve">
    <value>Pile de protocoles</value>
  </data>
-  <data name="TbSettingsTunMtu" xml:space="preserve">
+  <data name="TbMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>Activer un port d’écoute supplémentaire</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>Activer IPv6</value>
  </data>
@@ -1081,7 +1072,7 @@
    <value>PrivateKey</value>
  </data>
  <data name="TbReserved" xml:space="preserve">
-    <value>Reserved (2,3,4)</value>
+    <value>Reserved</value>
  </data>
  <data name="TbLocalAddress" xml:space="preserve">
    <value>Address (IPv4,IPv6)</value>
@@ -1098,21 +1089,15 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>Adresse de test de connexion réelle</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>Ne vérifier l’existence de l’alias qu’à la maj. des abonnements</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>Arrêt du test en cours...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*Autorité gRPC</value>
+    <value>Autorité gRPC</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
    <value>Ajouter [HTTP]</value>
  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>En conflit avec le proxy amont de groupe</value>
-  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>Activer le fragmentation (Fragment)</value>
  </data>
@@ -1325,12 +1310,12 @@
  </data>
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>Le mot de passe sera vérifié en ligne de commande. En cas d’échec ou de dysfonctionnement, redémarrez l’application. Il n’est pas stocké et doit être saisi à chaque redémarrage.</value>
-  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*Mode XHTTP</value>
+    </data>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>Mode XHTTP</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>JSON brut XHTTP Extra, format : { XHTTPObject }</value>
+    <value>Raw JSON, format: { XHTTP Object }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>Masquer dans la barre d’état à la fermeture de la fenêtre</value>
@@ -1374,24 +1359,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>Écrase le port ; pour plusieurs groupes, séparer par virgules (,)</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>Générer un groupe de stratégie depuis plusieurs profils</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>Xray aléatoire (multi-sélection)</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>Xray équilibrage (tourniquet) multi-sélection</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>Xray latence minimale (multi-sélection)</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>Xray le plus stable (multi-sélection)</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>sing-box latence minimale (multi-sélection)</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>Exporter</value>
  </data>
@@ -1416,17 +1383,11 @@
  <data name="TbDomesticDNS" xml:space="preserve">
    <value>DNS direct</value>
  </data>
-  <data name="TbRemoteDNSTips" xml:space="preserve">
-    <value>Via le proxy ; assurez-vous que le serveur distant est disponible</value>
+  <data name="TbDirectResolveStrategy" xml:space="preserve">
+    <value>Direct Target Resolution Strategy</value>
  </data>
-  <data name="TbXrayFreedomStrategy" xml:space="preserve">
-    <value>Stratégie de résolution xray freedom</value>
-  </data>
-  <data name="TbSBDirectResolveStrategy" xml:space="preserve">
-    <value>Stratégie de résolution directe sing-box</value>
-  </data>
-  <data name="TbSBRemoteResolveStrategy" xml:space="preserve">
-    <value>Stratégie de résolution distante sing-box</value>
+  <data name="TbRemoteResolveStrategy" xml:space="preserve">
+    <value>Proxy Target Resolution Strategy</value>
  </data>
  <data name="TbAddCommonDNSHosts" xml:space="preserve">
    <value>Ajouter des hôtes DNS courants</value>
@@ -1450,7 +1411,7 @@
    <value>Valider les IP des domaines de la région concernée</value>
  </data>
  <data name="TbValidateDirectExpectedIPsDesc" xml:space="preserve">
-    <value>Après config, les IP renvoyées des domaines régionaux (ex. geosite:cn) seront vérifiées ; seules les IP attendues seront retournées.</value>
+    <value>Après config, les IP renvoyées des domaines régionaux (ex. geosite:cn - geoip:cn) seront vérifiées ; seules les IP attendues seront retournées.</value>
  </data>
  <data name="TbCustomDNSEnable" xml:space="preserve">
    <value>Activer le DNS personnalisé</value>
@@ -1542,44 +1503,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>Basculement (failover)</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>sing-box basculement (multi-sélection)</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>Le cœur « {0} » ne prend pas en charge le type de réseau « {1} »</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>Xray basculement (multi-sélection)</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>Le cœur « {0} » ne prend pas en charge le protocole « {1} » avec le mode de transport « {2} »</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>Le cœur « {0} » ne prend pas en charge le type de réseau « {1} ».</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>Le cœur « {0} » ne prend pas en charge le protocole « {1} »</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>Le cœur « {0} » ne prend pas en charge le protocole « {1} » avec le mode de transport « {2} ».</value>
-  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>Le cœur « {0} » ne prend pas en charge le protocole « {1} ».</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>Chaîne de proxy : </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>Règle de routage sortante : </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>Groupe de stratégie : </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>L’alias « {0} » n’existe pas.</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>Le groupe « {0} » est vide. Veuillez ajouter au moins une configuration.</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
+  <data name="MsgInvalidProperty" xml:space="preserve">
    <value>La propriété {0} est invalide, veuillez vérifier</value>
  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>Le groupe {0} ne peut pas se référencer lui-même ni créer de référence circulaire</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>Protocole « {0} » non pris en charge.</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>Protocole « {0} » non pris en charge</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>Si le système n’a pas de zone de notif., n’activez pas cette option</value>
@@ -1606,10 +1543,10 @@
    <value>Certificate Pinning</value>
  </data>
  <data name="TbCertPinningTips" xml:space="preserve">
-    <value>Certificat serveur (format PEM, facultatif)
-Si le certificat est défini, il est fixé et l’option « Ignorer la vérification » est désactivée.
+    <value>Pinned certificate (fill in either one)
+When specified, the certificate will be pinned, and "Allow Insecure" will be disabled.

-Si un certificat auto-signé est utilisé ou si le système contient une CA non fiable ou malveillante, l’action « Obtenir le certificat » peut échouer.</value>
+The "Get Certificate" action may fail if a self-signed certificate is used or if the system contains an untrusted or malicious CA.</value>
  </data>
  <data name="TbFetchCert" xml:space="preserve">
    <value>Obtenir le certificat</value>
@@ -1641,7 +1578,154 @@ Si un certificat auto-signé est utilisé ou si le système contient une CA non
  <data name="TbEchConfigList" xml:space="preserve">
    <value>EchConfigList</value>
  </data>
-  <data name="TbEchForceQuery" xml:space="preserve">
-    <value>EchForceQuery</value>
+  <data name="TbFullCertTips" xml:space="preserve">
+    <value>Certificat complet (chaîne), format PEM</value>
+  </data>
+  <data name="TbCertSha256Tips" xml:space="preserve">
+    <value>Empreinte du certificat (SHA-256)</value>
+  </data>
+  <data name="TbServeStale" xml:space="preserve">
+    <value>Cache optimiste</value>
+  </data>
+  <data name="TbParallelQuery" xml:space="preserve">
+    <value>Requête parallèle</value>
+  </data>
+  <data name="TbDomesticDNSTips" xml:space="preserve">
+    <value>Par défaut, utilisé uniquement lors du routage pour la résolution.</value>
+  </data>
+  <data name="TbRemoteDNSTips" xml:space="preserve">
+    <value>Par défaut, invoqué uniquement au routage pour la résolution. Vérifiez que le serveur distant peut joindre ce DNS.</value>
+  </data>
+  <data name="TbDirectResolveStrategyTips" xml:space="preserve">
+    <value>Si non défini ou « AsIs », le DNS système est utilisé ; sinon, le module DNS interne est utilisé.</value>
+  </data>
+  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
+    <value>Si non défini ou « AsIs », la résolution DNS est assurée par le serveur distant ; sinon, le module DNS interne est utilisé.</value>
+  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>Intervalle de saut de port</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>Aperçu des sous-config</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>Règle de routage {0} nœud sortant {1} avertissement: {2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>Règle {0} nœud VPN sortant {1} erreur : {2}. Repli nœud proxy uniquement.</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>Le groupe {0} a une dépendance cyclique avec le nœud enfant {1}. Nœud ignoré.</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>Groupe {0} nœud enfant {1} avertissement : {2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>Groupe {0} nœud enfant {1} erreur : {2}. Nœud ignoré.</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>Groupe {0} nœud enfant groupe {1} avertissement: {2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>Groupe {0} nœud groupe enfant {1} erreur: {2}. Nœud ignoré.</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>Groupe {0} n’a aucun nœud enfant valide.</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>Règle de routage {0} tag sortant vide. Replié sur le nœud proxy uniquement.</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>Règle de routage {0} nœud sortant {1} introuvable. Repli sur le seul nœud proxy.</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>Nœud proxy précédent de l’abonnement {0} introuvable. Ignoré.</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>Nœud proxy suivant de l’abonnement {0} introuvable. Ignoré.</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>Générer groupe de stratégie</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>Toutes configurations</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>Grouper par région</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>Copier</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>Tout sélect</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>Coller</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>Format</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>Ajouter [NaïveProxy]</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>Insecure Concurrency</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>Nom d’utilisateur</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>Politique de routage ICMP</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>Protection TUN héritée</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>Domaine de camouflage</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>Allow insecure cert fetch (self-signed)</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
+  </data>
+  <data name="TbSettingsSendThrough" xml:space="preserve">
+    <value>Adresse sortante locale (SendThrough)</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>Pour environnements multi-interfaces, entrez l'adresse IPv4 de la machine locale</value>
+  </data>
+  <data name="FillCorrectSendThroughIPv4" xml:space="preserve">
+    <value>Veuillez saisir l’adresse IPv4 correcte de SendThrough.</value>
+  </data>
+  <data name="TbSettingsBindInterface" xml:space="preserve">
+    <value>Lier l'interface</value>
+  </data>
+  <data name="TbSettingsBindInterfaceTip" xml:space="preserve">
+    <value>Pour les environnements multi-interfaces, entrez le nom de l'interface à lier. Ne fonctionne que sur les systèmes Windows et en mode TUN</value>
+  </data>
+  <data name="menuUdpTestServer" xml:space="preserve">
+    <value>Test Configurations UDP Delay</value>
+  </data>
+  <data name="TbSettingsUdpTestUrl" xml:space="preserve">
+    <value>UDP Test Url</value>
+  </data>
+  <data name="TbPreSharedKey" xml:space="preserve">
+    <value>PreSharedKey</value>
+  </data>
+  <data name="menuExport2InnerUri" xml:space="preserve">
+    <value>Export v2rayN Internal Share Link to Clipboard</value>
  </data>
 </root>
@@ -343,7 +343,7 @@
    <value>*QUIC kulcs/KCP seed</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*grpc szolgáltatásnév</value>
+    <value>gRPC szolgáltatásnév</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*http host vesszővel elválasztva (,)</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*QUIC biztonság</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*tcp álcázási típus</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>raw álcázási típus</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*kcp álcázási típus</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>kcp álcázási típus</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*QUIC álcázási típus</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>QUIC álcázási típus</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*grpc mód</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>gRPC mód</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>Alias (megjegyzések)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>Álcázási tartomány(host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>Titkosítási módszer (biztonság)</value>
  </data>
@@ -619,7 +616,7 @@
    <value>TLS</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*Alapértelmezett érték tcp</value>
+    <value>*Alapértelmezett érték raw</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>Core Típus</value>
@@ -723,9 +720,6 @@
  <data name="TbSettingsPass" xml:space="preserve">
    <value>Hitelesítési jelszó</value>
  </data>
-  <data name="TbSettingsRemoteDNS" xml:space="preserve">
-    <value>Egyéni DNS (több, vesszővel (,) elválasztva)</value>
-  </data>
  <data name="TbSettingsSetUWP" xml:space="preserve">
    <value>Win10 UWP Loopback beállítása</value>
  </data>
@@ -937,7 +931,7 @@
    <value>User-Agent</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>Ez a paraméter csak tcp/http és ws esetén érvényes</value>
+    <value>This parameter is valid only for raw/http, ws, gRPC and xhttp</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>Betűtípus (újraindítást igényel)</value>
@@ -1027,7 +1021,7 @@
    <value>sing-box Mux protokoll</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>Teljes folyamatnév (Tun mód)</value>
+    <value>Process (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP vagy IP CIDR</value>
@@ -1068,12 +1062,9 @@
  <data name="TbSettingsTunStack" xml:space="preserve">
    <value>Hálózati verem</value>
  </data>
-  <data name="TbSettingsTunMtu" xml:space="preserve">
+  <data name="TbMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>További bejövő engedélyezése</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>IPv6 cím engedélyezése</value>
  </data>
@@ -1084,7 +1075,7 @@
    <value>Privát kulcs</value>
  </data>
  <data name="TbReserved" xml:space="preserve">
-    <value>Fenntartott (2,3,4)</value>
+    <value>Fenntartott</value>
  </data>
  <data name="TbLocalAddress" xml:space="preserve">
    <value>Cím (IPv4, IPv6)</value>
@@ -1101,21 +1092,15 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>Sebesség Ping Teszt URL</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>Előfizetés frissítése, csak a megjegyzések létezésének ellenőrzése</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>Teszt megszakítása...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*grpc Authority</value>
+    <value>gRPC Authority</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
    <value>HTTP konfiguráció hozzáadása</value>
  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>which conflicts with the group previous proxy</value>
-  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>Fragment engedélyezése</value>
  </data>
@@ -1329,11 +1314,11 @@
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>A jelszót a parancssoron keresztül ellenőrizzük. Ha egy érvényesítési hiba miatt az alkalmazás hibásan működik, indítsa újra az alkalmazást. A jelszó nem kerül tárolásra, és minden újraindítás után újra meg kell adni.</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*xhttp mód</value>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>xhttp mód</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>XHTTP Extra nyers JSON, formátum: { XHTTP Objektum }</value>
+    <value>Raw JSON, format: { XHTTP Object }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>Ablak bezárásakor a tálcára rejtés</value>
@@ -1377,24 +1362,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>A portot lefedi, vesszővel (,) elválasztva</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>Generate Policy Group from Multiple Profiles</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>Több konfiguráció véletlenszerűen Xray szerint</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>Több konfiguráció RoundRobin Xray szerint</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>Több konfiguráció legkisebb pinggel Xray szerint</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>Több konfiguráció legkisebb terheléssel Xray szerint</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>Több konfiguráció legkisebb pinggel sing-box szerint</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>Konfiguráció exportálása</value>
  </data>
@@ -1419,17 +1386,11 @@
  <data name="TbDomesticDNS" xml:space="preserve">
    <value>Domestic DNS</value>
  </data>
-  <data name="TbRemoteDNSTips" xml:space="preserve">
-    <value>Via proxy — please ensure remote availability</value>
+  <data name="TbDirectResolveStrategy" xml:space="preserve">
+    <value>Direct Target Resolution Strategy</value>
  </data>
-  <data name="TbXrayFreedomStrategy" xml:space="preserve">
-    <value>xray Freedom Resolution Strategy</value>
-  </data>
-  <data name="TbSBDirectResolveStrategy" xml:space="preserve">
-    <value>sing-box Direct Resolution Strategy</value>
-  </data>
-  <data name="TbSBRemoteResolveStrategy" xml:space="preserve">
-    <value>sing-box Remote Resolution Strategy</value>
+  <data name="TbRemoteResolveStrategy" xml:space="preserve">
+    <value>Proxy Target Resolution Strategy</value>
  </data>
  <data name="TbAddCommonDNSHosts" xml:space="preserve">
    <value>Add Common DNS Hosts</value>
@@ -1453,7 +1414,7 @@
    <value>Validate Regional Domain IPs</value>
  </data>
  <data name="TbValidateDirectExpectedIPsDesc" xml:space="preserve">
-    <value>When configured, validates IPs returned for regional domains (e.g., geosite:cn), returning only expected IPs</value>
+    <value>When configured, validates IPs returned for regional domains (e.g., geosite:cn - geoip:cn), returning only expected IPs</value>
  </data>
  <data name="TbCustomDNSEnable" xml:space="preserve">
    <value>Enable Custom DNS</value>
@@ -1545,44 +1506,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>Fallback</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>Multi-Configuration Fallback by sing-box</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>Core '{0}' does not support network type '{1}'</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>Multi-Configuration Fallback by Xray</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>Core '{0}' does not support network type '{1}'.</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}'</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'.</value>
+  <data name="MsgInvalidProperty" xml:space="preserve">
+    <value>The {0} property is invalid, please check</value>
  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}'.</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>Proxy chained: </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>Routing rule outbound: </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>Policy group: </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>Node alias '{0}' does not exist.</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>Group '{0}' is empty. Please add at least one node.</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
-    <value>The {0} property is invalid, please check.</value>
-  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>{0} Group cannot reference itself or have a circular reference</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>Not support protocol '{0}'.</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>Not support protocol '{0}'</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>If the system does not have a tray function, please do not enable it</value>
@@ -1609,7 +1546,7 @@
    <value>Certificate Pinning</value>
  </data>
  <data name="TbCertPinningTips" xml:space="preserve">
-    <value>Server Certificate (PEM format, optional)
+    <value>Pinned certificate (fill in either one)
 When specified, the certificate will be pinned, and "Allow Insecure" will be disabled.

 The "Get Certificate" action may fail if a self-signed certificate is used or if the system contains an untrusted or malicious CA.</value>
@@ -1644,7 +1581,154 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
  <data name="TbEchConfigList" xml:space="preserve">
    <value>EchConfigList</value>
  </data>
-  <data name="TbEchForceQuery" xml:space="preserve">
-    <value>EchForceQuery</value>
+  <data name="TbFullCertTips" xml:space="preserve">
+    <value>Full certificate (chain), PEM format</value>
+  </data>
+  <data name="TbCertSha256Tips" xml:space="preserve">
+    <value>Certificate fingerprint (SHA-256)</value>
+  </data>
+  <data name="TbServeStale" xml:space="preserve">
+    <value>Serve Stale</value>
+  </data>
+  <data name="TbParallelQuery" xml:space="preserve">
+    <value>Parallel Query</value>
+  </data>
+  <data name="TbDomesticDNSTips" xml:space="preserve">
+    <value>By default, invoked only during routing for resolution</value>
+  </data>
+  <data name="TbRemoteDNSTips" xml:space="preserve">
+    <value>By default, invoked only during routing for resolution; ensure the remote server can reach this DNS</value>
+  </data>
+  <data name="TbDirectResolveStrategyTips" xml:space="preserve">
+    <value>If unset or "AsIs", DNS resolution uses the system DNS; otherwise, the internal DNS module is used.</value>
+  </data>
+  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
+    <value>If unset or "AsIs", DNS resolution is performed by the remote server's DNS; otherwise, the internal DNS module is used.</value>
+  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>Port hopping interval</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>Configuration item preview</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} warning: {2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} error: {2}. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>Group {0} has a cycle dependency on child node {1}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>Group {0} child node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>Group {0} child node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>Group {0} child group node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>Group {0} child group node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>Group {0} has no valid child node.</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>Routing rule {0} has an empty outbound tag. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} not found. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>Subscription previous proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>Subscription next proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>Generate Policy Group</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>All configurations</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>Group by Region</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>Másolás</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>Összes kijelölése</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>Paste</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>Format</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>[NaïveProxy] konfiguráció hozzáadása</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>Insecure Concurrency</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>Username</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>ICMP routing policy</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>Legacy TUN Protect</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>Álcázási tartomány</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>Allow insecure cert fetch (self-signed)</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
+  </data>
+  <data name="menuUdpTestServer" xml:space="preserve">
+    <value>Test Configurations UDP Delay</value>
+  </data>
+  <data name="TbSettingsUdpTestUrl" xml:space="preserve">
+    <value>UDP Test Url</value>
+  </data>
+  <data name="TbSettingsSendThrough" xml:space="preserve">
+    <value>Local outbound address (SendThrough)</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>For multi-interface environments, enter the local machine's IPv4 address</value>
+  </data>
+  <data name="FillCorrectSendThroughIPv4" xml:space="preserve">
+    <value>Please fill in the correct IPv4 address for SendThrough.</value>
+  </data>
+  <data name="TbSettingsBindInterface" xml:space="preserve">
+    <value>Bind Interface</value>
+  </data>
+  <data name="TbSettingsBindInterfaceTip" xml:space="preserve">
+    <value>For multi-interface environments, enter the name of the interface to bind. Only effective on Windows systems and TUN mode</value>
+  </data>
+  <data name="TbPreSharedKey" xml:space="preserve">
+    <value>PreSharedKey</value>
+  </data>
+  <data name="menuExport2InnerUri" xml:space="preserve">
+    <value>Export v2rayN Internal Share Link to Clipboard</value>
  </data>
 </root>
@@ -121,7 +121,7 @@
    <value>Export share link to clipboard successfully</value>
  </data>
  <data name="CheckServerSettings" xml:space="preserve">
-    <value>Please check the Configuration settings first.</value>
+    <value>Invalid configuration, please check or reselect</value>
  </data>
  <data name="ConfigurationFormatIncorrect" xml:space="preserve">
    <value>Invalid configuration format.</value>
@@ -343,7 +343,7 @@
    <value>*QUIC key/KCP seed</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*grpc service name</value>
+    <value>gRPC service name</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*http host separated by commas (,)</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*QUIC security</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*tcp camouflage type</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>raw camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*kcp camouflage type</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>kcp camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*QUIC camouflage type</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>QUIC camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*grpc mode</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>gRPC mode</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -514,19 +514,19 @@
    <value>Add a custom configuration</value>
  </data>
  <data name="menuAddShadowsocksServer" xml:space="preserve">
-    <value>Add [Shadowsocks] </value>
+    <value>Add [Shadowsocks]</value>
  </data>
  <data name="menuAddSocksServer" xml:space="preserve">
-    <value>Add [SOCKS] </value>
+    <value>Add [SOCKS]</value>
  </data>
  <data name="menuAddTrojanServer" xml:space="preserve">
-    <value>Add [Trojan] </value>
+    <value>Add [Trojan]</value>
  </data>
  <data name="menuAddVlessServer" xml:space="preserve">
-    <value>Add [VLESS] </value>
+    <value>Add [VLESS]</value>
  </data>
  <data name="menuAddVmessServer" xml:space="preserve">
-    <value>Add [VMess] </value>
+    <value>Add [VMess]</value>
  </data>
  <data name="menuSelectAll" xml:space="preserve">
    <value>Select all</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>Alias (remarks)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>Camouflage domain(host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>Encryption method (security)</value>
  </data>
@@ -619,7 +616,7 @@
    <value>TLS</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*Default value tcp</value>
+    <value>*Default value raw</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>Core Type</value>
@@ -723,9 +720,6 @@
  <data name="TbSettingsPass" xml:space="preserve">
    <value>Auth pass</value>
  </data>
-  <data name="TbSettingsRemoteDNS" xml:space="preserve">
-    <value>Custom DNS (multiple, separated by commas (,))</value>
-  </data>
  <data name="TbSettingsSetUWP" xml:space="preserve">
    <value>Set Win10 UWP Loopback</value>
  </data>
@@ -865,7 +859,7 @@
    <value>Rule object Doc</value>
  </data>
  <data name="TbDnsObjectDoc" xml:space="preserve">
-    <value>Supports DNS Object; Click to view documentation</value>
+    <value>Please fill in DNS Object; Click to view documentation</value>
  </data>
  <data name="SubUrlTips" xml:space="preserve">
    <value>For group please leave blank here</value>
@@ -937,7 +931,7 @@
    <value>User-Agent</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>This parameter is valid only for tcp/http and ws</value>
+    <value>This parameter is valid only for raw/http, ws, gRPC and xhttp</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>Font family (requires restart)</value>
@@ -1027,7 +1021,7 @@
    <value>sing-box Mux Protocol</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>Full process name (Tun mode)</value>
+    <value>Process (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP or IP CIDR</value>
@@ -1036,7 +1030,7 @@
    <value>Domain</value>
  </data>
  <data name="menuAddHysteria2Server" xml:space="preserve">
-    <value>Add [Hysteria2] </value>
+    <value>Add [Hysteria2]</value>
  </data>
  <data name="TbSettingsHysteriaBandwidth" xml:space="preserve">
    <value>Hysteria Max bandwidth (Up/Down)</value>
@@ -1045,7 +1039,7 @@
    <value>Use System Hosts</value>
  </data>
  <data name="menuAddTuicServer" xml:space="preserve">
-    <value>Add [TUIC] </value>
+    <value>Add [TUIC]</value>
  </data>
  <data name="TbHeaderType8" xml:space="preserve">
    <value>Congestion control</value>
@@ -1068,23 +1062,20 @@
  <data name="TbSettingsTunStack" xml:space="preserve">
    <value>Stack</value>
  </data>
-  <data name="TbSettingsTunMtu" xml:space="preserve">
+  <data name="TbMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>Enable additional Inbound</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>Enable IPv6 Address</value>
  </data>
  <data name="menuAddWireguardServer" xml:space="preserve">
-    <value>Add [WireGuard] </value>
+    <value>Add [WireGuard]</value>
  </data>
  <data name="TbPrivateKey" xml:space="preserve">
    <value>Private Key</value>
  </data>
  <data name="TbReserved" xml:space="preserve">
-    <value>Reserved (2,3,4)</value>
+    <value>Reserved</value>
  </data>
  <data name="TbLocalAddress" xml:space="preserve">
    <value>Address (IPv4, IPv6)</value>
@@ -1101,21 +1092,15 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>Speed Ping Test URL</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>Updating subscription, only determining if remarks exist</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>Test terminating...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*grpc Authority</value>
+    <value>gRPC Authority</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
    <value>Add [HTTP]</value>
  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>which conflicts with the group previous proxy</value>
-  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>Enable fragment</value>
  </data>
@@ -1329,11 +1314,11 @@
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>The password will be validated via the command line. If a validation error causes the application to malfunction, please restart the application. The password will not be stored and must be entered again after each restart.</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*xhttp mode</value>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>xhttp mode</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>XHTTP Extra raw JSON, format: { XHTTP Object }</value>
+    <value>Raw JSON, format: { XHTTP Object }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>Hide to tray when closing the window</value>
@@ -1377,24 +1362,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>Will cover the port, separate with commas (,)</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>Generate Policy Group from Multiple Profiles</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>Random by Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>RoundRobin by Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>LeastPing by Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>LeastLoad by Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>LeastPing by sing-box</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>Export</value>
  </data>
@@ -1419,17 +1386,11 @@
  <data name="TbDomesticDNS" xml:space="preserve">
    <value>Domestic DNS</value>
  </data>
-  <data name="TbRemoteDNSTips" xml:space="preserve">
-    <value>Via proxy — please ensure remote availability</value>
+  <data name="TbDirectResolveStrategy" xml:space="preserve">
+    <value>Direct Target Resolution Strategy</value>
  </data>
-  <data name="TbXrayFreedomStrategy" xml:space="preserve">
-    <value>xray Freedom Resolution Strategy</value>
-  </data>
-  <data name="TbSBDirectResolveStrategy" xml:space="preserve">
-    <value>sing-box Direct Resolution Strategy</value>
-  </data>
-  <data name="TbSBRemoteResolveStrategy" xml:space="preserve">
-    <value>sing-box Remote Resolution Strategy</value>
+  <data name="TbRemoteResolveStrategy" xml:space="preserve">
+    <value>Proxy Target Resolution Strategy</value>
  </data>
  <data name="TbAddCommonDNSHosts" xml:space="preserve">
    <value>Add Common DNS Hosts</value>
@@ -1453,7 +1414,7 @@
    <value>Validate Regional Domain IPs</value>
  </data>
  <data name="TbValidateDirectExpectedIPsDesc" xml:space="preserve">
-    <value>When configured, validates IPs returned for regional domains (e.g., geosite:cn), returning only expected IPs</value>
+    <value>When configured, validates IPs returned for regional domains (e.g., geosite:cn - geoip:cn), returning only expected IPs</value>
  </data>
  <data name="TbCustomDNSEnable" xml:space="preserve">
    <value>Enable Custom DNS</value>
@@ -1528,13 +1489,13 @@
    <value>Policy Group Type</value>
  </data>
  <data name="menuAddPolicyGroupServer" xml:space="preserve">
-    <value>Add Policy Group </value>
+    <value>Add Policy Group</value>
  </data>
  <data name="menuAddProxyChainServer" xml:space="preserve">
    <value>Add Proxy Chain</value>
  </data>
  <data name="menuAddChildServer" xml:space="preserve">
-    <value>Add Child </value>
+    <value>Add Child</value>
  </data>
  <data name="menuRemoveChildServer" xml:space="preserve">
    <value>Remove Child </value>
@@ -1545,44 +1506,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>Fallback</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>Fallback by sing-box</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>Core '{0}' does not support network type '{1}'</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>Fallback by Xray</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>Core '{0}' does not support network type '{1}'.</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}'</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'.</value>
+  <data name="MsgInvalidProperty" xml:space="preserve">
+    <value>The {0} property is invalid, please check</value>
  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}'.</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>Proxy chained: </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>Routing rule outbound: </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>Policy group: </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>Node alias '{0}' does not exist.</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>Group '{0}' is empty. Please add at least one node.</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
-    <value>The {0} property is invalid, please check.</value>
-  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>{0} Group cannot reference itself or have a circular reference</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>Not support protocol '{0}'.</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>Not support protocol '{0}'</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>If the system does not have a tray function, please do not enable it</value>
@@ -1609,7 +1546,7 @@
    <value>Certificate Pinning</value>
  </data>
  <data name="TbCertPinningTips" xml:space="preserve">
-    <value>Server Certificate (PEM format, optional)
+    <value>Pinned certificate (fill in either one)
 When specified, the certificate will be pinned, and "Allow Insecure" will be disabled.

 The "Get Certificate" action may fail if a self-signed certificate is used or if the system contains an untrusted or malicious CA.</value>
@@ -1644,7 +1581,154 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
  <data name="TbEchConfigList" xml:space="preserve">
    <value>EchConfigList</value>
  </data>
-  <data name="TbEchForceQuery" xml:space="preserve">
-    <value>EchForceQuery</value>
+  <data name="TbFullCertTips" xml:space="preserve">
+    <value>Full certificate (chain), PEM format</value>
+  </data>
+  <data name="TbCertSha256Tips" xml:space="preserve">
+    <value>Certificate fingerprint (SHA-256)</value>
+  </data>
+  <data name="TbServeStale" xml:space="preserve">
+    <value>Serve Stale</value>
+  </data>
+  <data name="TbParallelQuery" xml:space="preserve">
+    <value>Parallel Query</value>
+  </data>
+  <data name="TbDomesticDNSTips" xml:space="preserve">
+    <value>By default, invoked only during routing for resolution</value>
+  </data>
+  <data name="TbRemoteDNSTips" xml:space="preserve">
+    <value>By default, invoked only during routing for resolution; ensure the remote server can reach this DNS</value>
+  </data>
+  <data name="TbDirectResolveStrategyTips" xml:space="preserve">
+    <value>If unset or "AsIs", DNS resolution uses the system DNS; otherwise, the internal DNS module is used.</value>
+  </data>
+  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
+    <value>If unset or "AsIs", DNS resolution is performed by the remote server's DNS; otherwise, the internal DNS module is used.</value>
+  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>Port hopping interval</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>Configuration item preview</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} warning: {2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} error: {2}. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>Group {0} has a cycle dependency on child node {1}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>Group {0} child node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>Group {0} child node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>Group {0} child group node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>Group {0} child group node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>Group {0} has no valid child node.</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>Routing rule {0} has an empty outbound tag. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} not found. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>Subscription previous proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>Subscription next proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>Generate Policy Group</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>All configurations</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>Group by Region</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>Copy</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>Select all</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>Paste</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>Format</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>Add [NaïveProxy]</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>Insecure Concurrency</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>Username</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>ICMP routing policy</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>Legacy TUN Protect</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>Camouflage domain</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>Allow insecure cert fetch (self-signed)</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
+  </data>
+  <data name="menuUdpTestServer" xml:space="preserve">
+    <value>Test Configurations UDP Delay</value>
+  </data>
+  <data name="TbSettingsUdpTestUrl" xml:space="preserve">
+    <value>UDP Test Url</value>
+  </data>
+  <data name="TbSettingsSendThrough" xml:space="preserve">
+    <value>Local outbound address (SendThrough)</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>For multi-interface environments, enter the local machine's IPv4 address</value>
+  </data>
+  <data name="FillCorrectSendThroughIPv4" xml:space="preserve">
+    <value>Please fill in the correct IPv4 address for SendThrough.</value>
+  </data>
+  <data name="TbSettingsBindInterface" xml:space="preserve">
+    <value>Bind Interface</value>
+  </data>
+  <data name="TbSettingsBindInterfaceTip" xml:space="preserve">
+    <value>For multi-interface environments, enter the name of the interface to bind. Only effective on Windows systems and TUN mode</value>
+  </data>
+  <data name="TbPreSharedKey" xml:space="preserve">
+    <value>PreSharedKey</value>
+  </data>
+  <data name="menuExport2InnerUri" xml:space="preserve">
+    <value>Export v2rayN Internal Share Link to Clipboard</value>
  </data>
 </root>
@@ -121,7 +121,7 @@
    <value>导出分享链接至剪贴板成功</value>
  </data>
  <data name="CheckServerSettings" xml:space="preserve">
-    <value>请先检查设置</value>
+    <value>配置项无效，请检查或重新选择</value>
  </data>
  <data name="ConfigurationFormatIncorrect" xml:space="preserve">
    <value>配置格式不正确</value>
@@ -343,7 +343,7 @@
    <value>*QUIC 加密密钥</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*grpc serviceName</value>
+    <value>gRPC serviceName</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*http host 中间逗号 (,) 分隔</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*QUIC 加密方式</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*tcp 伪装类型</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>raw 伪装类型</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*kcp 伪装类型</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>kcp 伪装类型</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*QUIC 伪装类型</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>QUIC 伪装类型</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*grpc 模式</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>gRPC 模式</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -517,16 +517,16 @@
    <value>添加 [Shadowsocks]</value>
  </data>
  <data name="menuAddSocksServer" xml:space="preserve">
-    <value>添加 [SOCKS] </value>
+    <value>添加 [SOCKS]</value>
  </data>
  <data name="menuAddTrojanServer" xml:space="preserve">
-    <value>添加 [Trojan] </value>
+    <value>添加 [Trojan]</value>
  </data>
  <data name="menuAddVlessServer" xml:space="preserve">
-    <value>添加 [VLESS] </value>
+    <value>添加 [VLESS]</value>
  </data>
  <data name="menuAddVmessServer" xml:space="preserve">
-    <value>添加 [VMess] </value>
+    <value>添加 [VMess]</value>
  </data>
  <data name="menuSelectAll" xml:space="preserve">
    <value>全选</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>别名 (remarks)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>伪装域名 (host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>加密方式 (security)</value>
  </data>
@@ -619,7 +616,7 @@
    <value>传输层安全 (TLS)</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*默认 tcp，选错会无法连接</value>
+    <value>*默认 raw，选错会无法连接</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>Core 类型</value>
@@ -723,9 +720,6 @@
  <data name="TbSettingsPass" xml:space="preserve">
    <value>认证密码</value>
  </data>
-  <data name="TbSettingsRemoteDNS" xml:space="preserve">
-    <value>自定义 DNS (可多个，用逗号 (,) 分隔)</value>
-  </data>
  <data name="TbSettingsSetUWP" xml:space="preserve">
    <value>解除 Win10 UWP 应用回环代理限制</value>
  </data>
@@ -865,7 +859,7 @@
    <value>规则详细说明文档</value>
  </data>
  <data name="TbDnsObjectDoc" xml:space="preserve">
-    <value>支持填写 DnsObject，JSON 格式，点击查看文档</value>
+    <value>请填写 DnsObject，JSON 格式，点击查看文档</value>
  </data>
  <data name="SubUrlTips" xml:space="preserve">
    <value>普通分组此处请留空</value>
@@ -937,7 +931,7 @@
    <value>用户代理 (User-Agent)</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>仅对 tcp/http、ws 协议生效</value>
+    <value>仅对 raw/http、ws、gRPC、xhttp 生效</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>当前字体 (需重启)</value>
@@ -1024,7 +1018,7 @@
    <value>sing-box Mux 多路复用协议</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>进程名全称 (Tun 模式)</value>
+    <value>进程 (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP 或 IP CIDR</value>
@@ -1033,7 +1027,7 @@
    <value>Domain</value>
  </data>
  <data name="menuAddHysteria2Server" xml:space="preserve">
-    <value>添加 [Hysteria2] </value>
+    <value>添加 [Hysteria2]</value>
  </data>
  <data name="TbSettingsHysteriaBandwidth" xml:space="preserve">
    <value>Hysteria 最大带宽 (Up/Dw)</value>
@@ -1042,7 +1036,7 @@
    <value>使用系统 hosts</value>
  </data>
  <data name="menuAddTuicServer" xml:space="preserve">
-    <value>添加 [TUIC] </value>
+    <value>添加 [TUIC]</value>
  </data>
  <data name="TbHeaderType8" xml:space="preserve">
    <value>拥塞控制算法</value>
@@ -1065,23 +1059,20 @@
  <data name="TbSettingsTunStack" xml:space="preserve">
    <value>协议栈</value>
  </data>
-  <data name="TbSettingsTunMtu" xml:space="preserve">
+  <data name="TbMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>启用额外监听端口</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>启用 IPv6</value>
  </data>
  <data name="menuAddWireguardServer" xml:space="preserve">
-    <value>添加 [WireGuard] </value>
+    <value>添加 [WireGuard]</value>
  </data>
  <data name="TbPrivateKey" xml:space="preserve">
    <value>PrivateKey</value>
  </data>
  <data name="TbReserved" xml:space="preserve">
-    <value>Reserved (2,3,4)</value>
+    <value>Reserved</value>
  </data>
  <data name="TbLocalAddress" xml:space="preserve">
    <value>Address (IPv4,IPv6)</value>
@@ -1098,20 +1089,14 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>真连接测试地址</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>更新订阅时只判断别名已存在否</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>测试终止中...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*grpc Authority</value>
+    <value>gRPC Authority</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
-    <value>添加 [HTTP] </value>
-  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>和分组前置代理冲突</value>
+    <value>添加 [HTTP]</value>
  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>启用分片 (Fragment)</value>
@@ -1326,11 +1311,11 @@
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>密码将调用命令行校验，如果因为校验错误导致无法正常运行时，请重启本应用。 密码不会存储，每次重启后都需要再次输入。</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*XHTTP 模式</value>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>XHTTP 模式</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>XHTTP Extra 原始 JSON，格式： { XHTTPObject }</value>
+    <value>原始 JSON，格式： { XHTTPObject }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>关闭窗口时隐藏至托盘</value>
@@ -1374,24 +1359,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>会覆盖端口，多组时用逗号 (,) 隔开</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>多选生成策略组</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>多选随机 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>多选负载均衡 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>多选最低延迟 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>多选最稳定 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>多选最低延迟 sing-box</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>导出</value>
  </data>
@@ -1408,7 +1375,7 @@
    <value>Mldsa65Verify</value>
  </data>
  <data name="menuAddAnytlsServer" xml:space="preserve">
-    <value>添加 [Anytls] </value>
+    <value>添加 [Anytls]</value>
  </data>
  <data name="TbRemoteDNS" xml:space="preserve">
    <value>远程 DNS</value>
@@ -1416,17 +1383,11 @@
  <data name="TbDomesticDNS" xml:space="preserve">
    <value>直连 DNS</value>
  </data>
-  <data name="TbRemoteDNSTips" xml:space="preserve">
-    <value>通过代理，请确保远程可用</value>
+  <data name="TbDirectResolveStrategy" xml:space="preserve">
+    <value>直连目标解析策略</value>
  </data>
-  <data name="TbXrayFreedomStrategy" xml:space="preserve">
-    <value>xray freedom 解析策略</value>
-  </data>
-  <data name="TbSBDirectResolveStrategy" xml:space="preserve">
-    <value>sing-box 直连解析策略</value>
-  </data>
-  <data name="TbSBRemoteResolveStrategy" xml:space="preserve">
-    <value>sing-box 远程解析策略</value>
+  <data name="TbRemoteResolveStrategy" xml:space="preserve">
+    <value>代理目标解析策略</value>
  </data>
  <data name="TbAddCommonDNSHosts" xml:space="preserve">
    <value>添加常用 DNS Hosts</value>
@@ -1450,7 +1411,7 @@
    <value>校验相应地区域名 IP</value>
  </data>
  <data name="TbValidateDirectExpectedIPsDesc" xml:space="preserve">
-    <value>配置后，会对相应地区域名（如 geosite:cn）的返回 IP 进行校验，仅返回期望 IP</value>
+    <value>配置后，会对相应地区域名（如 geosite:cn - geoip:cn）的返回 IP 进行校验，仅返回期望 IP</value>
  </data>
  <data name="TbCustomDNSEnable" xml:space="preserve">
    <value>启用自定义 DNS</value>
@@ -1542,44 +1503,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>故障转移</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>多选故障转移 sing-box</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>核心 '{0}' 不支持网络类型 '{1}'</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>多选故障转移 Xray</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>核心 '{0}' 在使用传输方式 '{2}' 时不支持协议 '{1}'</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>核心 '{0}' 不支持网络类型 '{1}'。</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>核心 '{0}' 不支持协议 '{1}'</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>核心 '{0}' 在使用传输方式 '{2}' 时不支持协议 '{1}'。</value>
+  <data name="MsgInvalidProperty" xml:space="preserve">
+    <value>{0} 属性无效，请检查</value>
  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>核心 '{0}' 不支持协议 '{1}'。</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>代理链： </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>路由规则出站： </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>策略组： </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>别名 '{0}' 不存在。</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>组“{0}”为空。请至少添加一个配置。</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
-    <value>{0}属性无效，请检查</value>
-  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>{0} 分组不能引用自身或循环引用</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>不支持协议 '{0}'。</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>不支持协议 '{0}'</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>如果系统没有托盘功能，请不要开启</value>
@@ -1606,10 +1543,10 @@
    <value>固定证书</value>
  </data>
  <data name="TbCertPinningTips" xml:space="preserve">
-    <value>服务器证书（PEM 格式，可选）
+    <value>固定证书（二选一填写即可）
 当指定此证书后，将固定该证书，并禁用“跳过证书验证”选项。

-“获取证书”操作可能失败，原因可能是使用了自签证书，或系统中存在不受信任或恶意的 CA。</value>
+“获取证书”操作可能失败，原因包括使用了自签名证书，或系统中存在不受信任甚至恶意的 CA。</value>
  </data>
  <data name="TbFetchCert" xml:space="preserve">
    <value>获取证书</value>
@@ -1641,7 +1578,154 @@
  <data name="TbEchConfigList" xml:space="preserve">
    <value>EchConfigList</value>
  </data>
-  <data name="TbEchForceQuery" xml:space="preserve">
-    <value>EchForceQuery</value>
+  <data name="TbFullCertTips" xml:space="preserve">
+    <value>完整证书（链），PEM 格式</value>
+  </data>
+  <data name="TbCertSha256Tips" xml:space="preserve">
+    <value>证书指纹（SHA-256）</value>
+  </data>
+  <data name="TbServeStale" xml:space="preserve">
+    <value>乐观缓存</value>
+  </data>
+  <data name="TbParallelQuery" xml:space="preserve">
+    <value>并行查询</value>
+  </data>
+  <data name="TbDomesticDNSTips" xml:space="preserve">
+    <value>默认仅在路由阶段被调用解析</value>
+  </data>
+  <data name="TbRemoteDNSTips" xml:space="preserve">
+    <value>默认仅在路由阶段被调用解析；请确保远程服务器可访问该 DNS</value>
+  </data>
+  <data name="TbDirectResolveStrategyTips" xml:space="preserve">
+    <value>当未选择或 "AsIs" 时，使用系统 DNS 进行解析；否则，使用内部 DNS 模块解析。</value>
+  </data>
+  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
+    <value>当未选择或 "AsIs" 时，由远程服务器端 DNS 解析；否则，使用内部 DNS 模块解析。</value>
+  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>端口跳跃间隔</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>子配置项预览</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>路由规则 {0} 出站节点 {1} 警告：{2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>路由规则 {0} 出站节点 {1} 错误：{2}。已回退为仅使用代理节点。</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>节点组 {0} 与子节点 {1} 存在循环依赖，已跳过该节点。</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>节点组 {0} 子节点 {1} 警告：{2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>节点组 {0} 子节点 {1} 错误：{2}。已跳过该节点。</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>节点组 {0} 子节点组 {1} 警告：{2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>节点组 {0} 子节点组 {1} 错误：{2}。已跳过该节点。</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>节点组 {0} 下没有有效的子节点。</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>路由规则 {0} 的出站标签为空，已回退为仅使用代理节点。</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>路由规则 {0} 的出站节点 {1} 未找到，已回退为仅使用代理节点。</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>订阅前置节点 {0} 未找到，已跳过。</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>订阅后置节点 {0} 未找到，已跳过。</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>一键生成策略组</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>全部配置项</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>按地区分组</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>复制</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>全选</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>粘贴</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>格式化</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>添加 [NaïveProxy]</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>不安全并发</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>用户名</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>ICMP 路由策略</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>旧版 TUN 保护</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>伪装域名</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>允许不安全获取证书（自签名）</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>仅用于抓取自签证书，存在中间人风险。</value>
+  </data>
+  <data name="menuUdpTestServer" xml:space="preserve">
+    <value>测试 UDP 延迟 (多选)</value>
+  </data>
+  <data name="TbSettingsUdpTestUrl" xml:space="preserve">
+    <value>UDP 测试地址</value>
+  </data>
+  <data name="TbSettingsSendThrough" xml:space="preserve">
+    <value>本地出站地址 (SendThrough)</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>用于多网口环境，请填写本机 IPv4 地址</value>
+  </data>
+  <data name="FillCorrectSendThroughIPv4" xml:space="preserve">
+    <value>请填写正确的 SendThrough IPv4 地址。</value>
+  </data>
+  <data name="TbSettingsBindInterface" xml:space="preserve">
+    <value>绑定网口</value>
+  </data>
+  <data name="TbSettingsBindInterfaceTip" xml:space="preserve">
+    <value>用于多网口环境，填写要绑定的网口名称，仅生效于 Windows 系统和 TUN 模式</value>
+  </data>
+  <data name="TbPreSharedKey" xml:space="preserve">
+    <value>PreSharedKey</value>
+  </data>
+  <data name="menuExport2InnerUri" xml:space="preserve">
+    <value>导出 v2rayN 内部分享链接至剪贴板 (多选)</value>
  </data>
 </root>
@@ -121,13 +121,13 @@
    <value>匯出分享連結至剪貼簿成功</value>
  </data>
  <data name="CheckServerSettings" xml:space="preserve">
-    <value>請先檢查設定</value>
+    <value>配置項目無效，請檢查或重新選擇</value>
  </data>
  <data name="ConfigurationFormatIncorrect" xml:space="preserve">
    <value>設定格式不正確</value>
  </data>
  <data name="CustomServerTips" xml:space="preserve">
-    <value>注意，自訂設定完全依賴您自己的設定，不能使用所有設定功能。如需使用系統代理請手動修改偵聽埠。</value>
+    <value>注意，自訂設定完全依賴您自行輸入的內容，部分功能可能無法使用。如需啟用系統代理，請手動調整監聽埠。</value>
  </data>
  <data name="Downloading" xml:space="preserve">
    <value>下載開始...</value>
@@ -139,7 +139,7 @@
    <value>生成預設設定檔失敗</value>
  </data>
  <data name="FailedGetDefaultConfiguration" xml:space="preserve">
-    <value>獲取預設設定失敗</value>
+    <value>取得預設設定失敗</value>
  </data>
  <data name="FailedImportedCustomServer" xml:space="preserve">
    <value>匯入自訂設定失敗</value>
@@ -148,7 +148,7 @@
    <value>讀取設定失敗</value>
  </data>
  <data name="FillCorrectServerPort" xml:space="preserve">
-    <value>請填寫正確格式的埠</value>
+    <value>請填寫有效的埠號</value>
  </data>
  <data name="FillLocalListeningPort" xml:space="preserve">
    <value>請填寫本機偵聽埠</value>
@@ -247,7 +247,7 @@
    <value>非 VMess 或 SS 協定</value>
  </data>
  <data name="NotFoundCore" xml:space="preserve">
-    <value>在資料夾 ({0}) 下未找到 Core 檔案 (檔案名: {1})，請下載後放入資料夾，下載網址: {2}</value>
+    <value>在資料夾 ({0}) 中找不到 Core 檔案（檔名：{1}）。請下載後放入該資料夾。下載網址：{2}</value>
  </data>
  <data name="NoValidQRcodeFound" xml:space="preserve">
    <value>掃描完成，未發現有效二維碼</value>
@@ -304,7 +304,7 @@
    <value>是否確定移除規則？</value>
  </data>
  <data name="RoutingRuleDetailRequiredTips" xml:space="preserve">
-    <value>{0}，必填其中一項.</value>
+    <value>{0}，至少需填寫其中一項。</value>
  </data>
  <data name="LvRemarks" xml:space="preserve">
    <value>別名</value>
@@ -343,7 +343,7 @@
    <value>*QUIC 加密金鑰</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*grpc serviceName</value>
+    <value>gRPC serviceName</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*http host 中間逗號 (,) 分隔</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*QUIC 加密方式</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*TCP 偽裝類型</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>raw 偽裝類型</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*KCP 偽裝類型</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>KCP 偽裝類型</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*QUIC 偽裝類型</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>QUIC 偽裝類型</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*GRPC 模式</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>gRPC 模式</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -385,7 +385,7 @@
    <value>所有</value>
  </data>
  <data name="FillServerAddressCustom" xml:space="preserve">
-    <value>請瀏覽匯入設定</value>
+    <value>請選擇要匯入的設定檔</value>
  </data>
  <data name="Speedtesting" xml:space="preserve">
    <value>測試中...</value>
@@ -472,7 +472,7 @@
    <value>語言 (需重啟)</value>
  </data>
  <data name="menuAddServerViaClipboard" xml:space="preserve">
-    <value>從剪貼簿導入分享連結</value>
+    <value>從剪貼簿匯入分享連結</value>
  </data>
  <data name="menuAddServerViaScan" xml:space="preserve">
    <value>掃描螢幕上的二維碼</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>別名 (remarks)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>偽裝域名 (host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>加密方式 (security)</value>
  </data>
@@ -616,10 +613,10 @@
    <value>SNI</value>
  </data>
  <data name="TbStreamSecurity" xml:space="preserve">
-    <value>傳輸層安全 (TLS)</value>
+    <value>傳輸層安全性 (TLS)</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*預設 TCP，選錯會無法連接</value>
+    <value>*預設 raw，選錯會無法連線</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>Core 類型</value>
@@ -652,7 +649,7 @@
    <value>SOCKS 埠</value>
  </data>
  <data name="TipPreSocksPort" xml:space="preserve">
-    <value>*自訂設定的 Socks 埠值，可不設定；當設定此值後，將使用 Xray/sing-box (Tun) 額外啟動一個前置 Socks 服務，提供分流和速度顯示等功能</value>
+    <value>*自訂設定的 Socks 埠值，可留空；當設定此值後，將使用 Xray/sing-box (Tun) 額外啟動一個前置 Socks 服務，提供分流和速度顯示等功能</value>
  </data>
  <data name="TbBrowse" xml:space="preserve">
    <value>瀏覽</value>
@@ -723,9 +720,6 @@
  <data name="TbSettingsPass" xml:space="preserve">
    <value>認證密碼</value>
  </data>
-  <data name="TbSettingsRemoteDNS" xml:space="preserve">
-    <value>自訂 DNS (可多個，用逗號 (,) 分隔)</value>
-  </data>
  <data name="TbSettingsSetUWP" xml:space="preserve">
    <value>解除 Win10 UWP 應用回環代理限制</value>
  </data>
@@ -865,7 +859,7 @@
    <value>規則詳細說明檔案</value>
  </data>
  <data name="TbDnsObjectDoc" xml:space="preserve">
-    <value>支援填寫 DnsObject，JSON 格式，點擊查看說明</value>
+    <value>請填寫 DnsObject，JSON 格式，點擊查看說明</value>
  </data>
  <data name="SubUrlTips" xml:space="preserve">
    <value>普通分組此處請留空</value>
@@ -937,7 +931,7 @@
    <value>使用者代理 (User-Agent)</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>僅對 TCP/HTTP、WS 協定生效</value>
+    <value>僅對 raw/HTTP、WS、gRPC、XHTTP 生效</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>目前字型 (需重啟)</value>
@@ -1024,7 +1018,7 @@
    <value>sing-box Mux 多路復用協定</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>行程名全稱 (Tun 模式)</value>
+    <value>行程 (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP 或 IP CIDR</value>
@@ -1065,12 +1059,9 @@
  <data name="TbSettingsTunStack" xml:space="preserve">
    <value>協定堆疊</value>
  </data>
-  <data name="TbSettingsTunMtu" xml:space="preserve">
+  <data name="TbMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>啟用額外偵聽連接埠</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>啟用 IPv6</value>
  </data>
@@ -1081,7 +1072,7 @@
    <value>PrivateKey</value>
  </data>
  <data name="TbReserved" xml:space="preserve">
-    <value>Reserved (2,3,4)</value>
+    <value>Reserved</value>
  </data>
  <data name="TbLocalAddress" xml:space="preserve">
    <value>Address (Ipv4,Ipv6)</value>
@@ -1098,21 +1089,15 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>真連線測試位址</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>更新訂閱時只判斷別名是否存在</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>測試終止中...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*grpc Authority</value>
+    <value>gRPC Authority</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
    <value>新增 [HTTP] 節點</value>
  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>和分組前置代理衝突</value>
-  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>啟用分片（Fragment）</value>
  </data>
@@ -1315,7 +1300,7 @@
    <value>安裝字體到系統中，選擇或填入字體名稱，重新啟動後生效</value>
  </data>
  <data name="menuExitTips" xml:space="preserve">
-    <value>是否確定退出？</value>
+    <value>確定要退出嗎？</value>
  </data>
  <data name="LvMemo" xml:space="preserve">
    <value>備註備忘</value>
@@ -1326,11 +1311,11 @@
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>密碼將調用命令行校驗，如果因為校驗錯誤導致無法正常運行時，請重啟本應用。密碼不會存儲，每次重啟後都需要再次輸入。</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*xhttp 模式</value>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>xhttp 模式</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>XHTTP Extra 原始 JSON，格式： { XHTTPObject }</value>
+    <value>原始 JSON，格式： { XHTTPObject }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>關閉視窗時隱藏至托盤</value>
@@ -1374,24 +1359,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>會覆蓋埠，多組時用逗號 (,) 隔開</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>多選生成策略組</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>多選隨機 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>多選負載平衡 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>多選最低延遲 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>多選最穩定 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>多選最低延遲 sing-box</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>匯出</value>
  </data>
@@ -1416,17 +1383,11 @@
  <data name="TbDomesticDNS" xml:space="preserve">
    <value>直連 DNS</value>
  </data>
-  <data name="TbRemoteDNSTips" xml:space="preserve">
-   <value>通过代理，请确保远程可用</value>
+  <data name="TbDirectResolveStrategy" xml:space="preserve">
+    <value>直連目標解析策略</value>
  </data>
-  <data name="TbXrayFreedomStrategy" xml:space="preserve">
-    <value>xray freedom 解析策略</value>
-  </data>
-  <data name="TbSBDirectResolveStrategy" xml:space="preserve">
-    <value>sing-box 直連解析策略</value>
-  </data>
-  <data name="TbSBRemoteResolveStrategy" xml:space="preserve">
-    <value>sing-box 遠程解析策略</value>
+  <data name="TbRemoteResolveStrategy" xml:space="preserve">
+    <value>代理目標解析策略</value>
  </data>
  <data name="TbAddCommonDNSHosts" xml:space="preserve">
    <value>新增常用 DNS Hosts</value>
@@ -1450,7 +1411,7 @@
    <value>校驗相應地區域名 IP</value>
  </data>
  <data name="TbValidateDirectExpectedIPsDesc" xml:space="preserve">
-    <value>配置後，會對相應地區域名（如 geosite:cn）的返回 IP 進行校驗，僅返回期望 IP</value>
+    <value>配置後，會對相應地區域名（如 geosite:cn - geoip:cn）的返回 IP 進行校驗，僅返回期望 IP</value>
  </data>
  <data name="TbCustomDNSEnable" xml:space="preserve">
    <value>啟用自訂 DNS</value>
@@ -1525,13 +1486,13 @@
    <value>策略組類型</value>
  </data>
  <data name="menuAddPolicyGroupServer" xml:space="preserve">
-    <value>添加策略組</value>
+    <value>新增策略組</value>
  </data>
  <data name="menuAddProxyChainServer" xml:space="preserve">
-    <value>添加鏈式代理</value>
+    <value>新增鏈式代理</value>
  </data>
  <data name="menuAddChildServer" xml:space="preserve">
-    <value>添加子配置</value>
+    <value>新增子配置</value>
  </data>
  <data name="menuRemoveChildServer" xml:space="preserve">
    <value>刪除子配置</value>
@@ -1542,44 +1503,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>容錯移轉</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>多選容錯移轉 sing-box</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>核心 '{0}' 不支援網路類型 '{1}'</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>多選容錯移轉 Xray</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>核心 '{0}' 在使用傳輸方式 '{2}' 時不支援協定 '{1}'</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>核心 '{0}' 不支援網路類型 '{1}'.</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>核心 '{0}' 不支援協定 '{1}'</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>核心 '{0}' 在使用傳輸方式 '{2}' 時不支援協定 '{1}'.</value>
+  <data name="MsgInvalidProperty" xml:space="preserve">
+    <value>{0} 屬性無效，請檢查</value>
  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>核心 '{0}' 不支援協定 '{1}'.</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>代理鏈： </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>路由規則出站： </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>策略組： </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>別名 '{0}' 不存在。</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>組“{0}”為空.請至少添加一個配置。</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
-    <value>{0}屬性無效，請檢查</value>
-  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>{0} 分組不能引用自身或循環引用</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>不支援協定 '{0}'.</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>不支援協定 '{0}'</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>如果系統沒有託盤功能，請不要開啟</value>
@@ -1606,7 +1543,7 @@
    <value>憑證綁定</value>
  </data>
  <data name="TbCertPinningTips" xml:space="preserve">
-    <value>伺服器憑證（PEM 格式，可選）
+    <value>固定憑證（二選一填寫即可）
 若已指定，憑證將會被綁定，並且「跳過憑證驗證」將被停用。

 若使用自簽憑證，或系統中存在不受信任或惡意的 CA，「取得憑證」動作可能會失敗。</value>
@@ -1641,7 +1578,154 @@
  <data name="TbEchConfigList" xml:space="preserve">
    <value>EchConfigList</value>
  </data>
-  <data name="TbEchForceQuery" xml:space="preserve">
-    <value>EchForceQuery</value>
+  <data name="TbFullCertTips" xml:space="preserve">
+    <value>完整憑證（鏈），PEM 格式</value>
  </data>
-</root>
+  <data name="TbCertSha256Tips" xml:space="preserve">
+    <value>憑證指紋（SHA-256）</value>
+  </data>
+  <data name="TbServeStale" xml:space="preserve">
+    <value>提供過期快取（Serve Stale）</value>
+  </data>
+  <data name="TbParallelQuery" xml:space="preserve">
+    <value>并行查詢</value>
+  </data>
+  <data name="TbDomesticDNSTips" xml:space="preserve">
+    <value>預設僅在路由期間進行解析時調用</value>
+  </data>
+  <data name="TbRemoteDNSTips" xml:space="preserve">
+    <value>預設僅在路由期間進行解析時調用；請確保遠端伺服器能連線至此 DNS</value>
+  </data>
+  <data name="TbDirectResolveStrategyTips" xml:space="preserve">
+    <value>若未設定或為 "AsIs"，使用系統 DNS 解析；否則將使用內建 DNS 模組。</value>
+  </data>
+  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
+    <value>若未設定或為 "AsIs"，由遠端伺服器的 DNS 解析；否則將使用內建 DNS 模組。</value>
+  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>連接埠跳轉間隔</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>子配置項預覽</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>路由規則 {0} 的出站節點 {1} 發出警告：{2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>路由規則 {0} 的出站節點 {1} 發生錯誤：{2}。已回退為僅使用代理節點。</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>節點組 {0} 與子節點 {1} 存在循環依賴。已跳過此節點。</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>節點組 {0} 的子節點 {1} 發出警告：{2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>節點組 {0} 的子節點 {1} 發生錯誤：{2}。已跳過此節點。</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>節點組 {0} 的子節點組 {1} 發出警告：{2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>節點組 {0} 的子節點組 {1} 發生錯誤：{2}。已跳過此節點。</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>節點組 {0} 沒有可用的有效子節點。</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>路由規則 {0} 的出站標籤為空。已回退為僅使用代理節點。</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>找不到路由規則 {0} 的出站節點 {1}。已回退為僅使用代理節點。</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>找不到訂閱的前一個代理 {0}。已跳過。</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>找不到訂閱的下一個代理 {0}。已跳過。</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>生成策略組</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>所有配置項</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>按區域分組</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>複製</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>全選</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>貼上</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>格式化</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>新增 [NaïveProxy] 節點</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>不安全的並行處理</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>使用者名稱</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>ICMP 路由策略</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>舊版 TUN 保護</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>偽裝域名</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>允許不安全獲取證書（自簽名）</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>僅用於抓取自簽證書，存在中間人風險。</value>
+  </data>
+  <data name="menuUdpTestServer" xml:space="preserve">
+    <value>測試 UDP 延遲（多選）</value>
+  </data>
+  <data name="TbSettingsUdpTestUrl" xml:space="preserve">
+    <value>UDP 測試網址</value>
+  </data>
+  <data name="TbSettingsSendThrough" xml:space="preserve">
+    <value>本機出站位址 (SendThrough)</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>適用於多網路介面環境，請填寫本機 IPv4 位址</value>
+  </data>
+  <data name="FillCorrectSendThroughIPv4" xml:space="preserve">
+    <value>請填寫正確的 SendThrough IPv4 位址。</value>
+  </data>
+  <data name="TbSettingsBindInterface" xml:space="preserve">
+    <value>綁定網路介面</value>
+  </data>
+  <data name="TbSettingsBindInterfaceTip" xml:space="preserve">
+    <value>適用於多網路介面環境，請填寫要綁定的介面名稱；Windows 系統有效，其他系統僅在 TUN 模式下生效。</value>
+  </data>
+  <data name="TbPreSharedKey" xml:space="preserve">
+    <value>PreSharedKey</value>
+  </data>
+  <data name="menuExport2InnerUri" xml:space="preserve">
+    <value>匯出 v2rayN 內部分享連結至剪貼簿（多選）</value>
+  </data>
+</root>
@@ -1,4 +1,4 @@
-{
+{
 	"log": {
 		"access": "Vaccess.log",
 		"error": "Verror.log",
@@ -6,34 +6,6 @@
 	},
 	"inbounds": [],
 	"outbounds": [
-		{
-			"tag": "proxy",
-			"protocol": "vmess",
-			"settings": {
-				"vnext": [{
-					"address": "",
-					"port": 0,
-					"users": [{
-						"id": "",
-						"security": "auto"
-					}]
-				}],
-				"servers": [{
-					"address": "",
-					"method": "",
-					"ota": false,
-					"password": "",
-					"port": 0,
-					"level": 1
-				}]
-			},
-			"streamSettings": {
-				"network": "tcp"
-			},
-			"mux": {
-				"enabled": false
-			}
-		},
 		{
 			"protocol": "freedom",
 			"tag": "direct"
@@ -0,0 +1,24 @@
+{
+  "tag": "tun",
+  "protocol": "tun",
+  "settings": {
+    "name": "xray_tun",
+    "MTU": 9000,
+    "gateway": [
+      "172.18.0.1/30",
+      "fdfe:dcba:9876::1/126"
+    ],
+    "autoSystemRoutingTable": [
+      "0.0.0.0/0",
+      "::/0"
+    ],
+    "autoOutboundsInterface": "auto"
+  },
+  "sniffing": {
+    "enabled": true,
+    "destOverride": [
+      "http",
+      "tls"
+    ]
+  }
+}
@@ -0,0 +1,14 @@
+[
+  {
+    "network": "udp",
+    "port": "135,137-139,5353",
+    "outboundTag": "block"
+  },
+  {
+    "ip": [
+      "224.0.0.0/3",
+      "ff00::/8"
+    ],
+    "outboundTag": "block"
+  }
+]
@@ -5,19 +5,12 @@
 	},
 	"inbounds": [],
 	"outbounds": [
-		{
-			"type": "vless",
-			"tag": "proxy",
-			"server": "",
-			"server_port": 443
-		},
 		{
 			"type": "direct",
 			"tag": "direct"
 		}
 	],
 	"route": {
-		"rules": [
-		]
+		"rules": []
 	}
 }
@@ -1,5 +1,24 @@
 #!/bin/bash

+trim() {
+    local -n ref=$1
+    ref="${ref#"${ref%%[![:space:]]*}"}"
+    ref="${ref%"${ref##*[![:space:]]}"}"
+}
+
+build_gsettings_array() {
+    [[ -z "$1" ]] && echo "[]" && return
+    local host joined hosts=()
+    IFS=',' read -ra parts <<< "$1"
+    for host in "${parts[@]}"; do
+        trim host
+        [[ -n "$host" ]] && hosts+=("$host")
+    done
+    [[ ${#hosts[@]} -eq 0 ]] && echo "[]" && return
+    printf -v joined "'%s'," "${hosts[@]}"
+    echo "[${joined%,}]"
+}
+
 # Function to set proxy for GNOME
 set_gnome_proxy() {
    local MODE=$1
@@ -21,7 +40,7 @@ set_gnome_proxy() {
        done

        # Set ignored hosts
-        gsettings set org.gnome.system.proxy ignore-hosts "['$IGNORE_HOSTS']"
+        gsettings set org.gnome.system.proxy ignore-hosts "$(build_gsettings_array "$IGNORE_HOSTS")"

        echo "GNOME: Manual proxy settings applied."
        echo "Proxy IP: $PROXY_IP"
@@ -38,6 +38,8 @@
 		<EmbeddedResource Include="Sample\SampleHttpResponse" />
 		<EmbeddedResource Include="Sample\SampleInbound" />
 		<EmbeddedResource Include="Sample\SampleOutbound" />
+		<EmbeddedResource Include="Sample\SampleTunInbound" />
+		<EmbeddedResource Include="Sample\SampleTunRules" />
 		<EmbeddedResource Include="Sample\SingboxSampleClientConfig" />
 		<EmbeddedResource Include="Sample\SingboxSampleOutbound" />
 		<EmbeddedResource Include="Sample\tun_singbox_dns" />
@@ -82,4 +84,8 @@
 		</EmbeddedResource>
 	</ItemGroup>

+    <ItemGroup>
+        <ProjectReference Include="..\ServiceLib.UdpTest\ServiceLib.UdpTest.csproj" />
+    </ItemGroup>
+
 </Project>
@@ -1,43 +1,34 @@
 namespace ServiceLib.Services.CoreConfig;

-public partial class CoreConfigSingboxService(Config config)
+public partial class CoreConfigSingboxService(CoreConfigContext context)
 {
-    private readonly Config _config = config;
    private static readonly string _tag = "CoreConfigSingboxService";
+    private readonly Config _config = context.AppConfig;
+    private readonly ProfileItem _node = context.Node;
+
+    private SingboxConfig _coreConfig = new();

    #region public gen function

-    public async Task<RetResult> GenerateClientConfigContent(ProfileItem node)
+    public RetResult GenerateClientConfigContent()
    {
        var ret = new RetResult();
        try
        {
-            if (node == null
-                || !node.IsValid())
+            if (_node == null
+                || !_node.IsValid())
            {
                ret.Msg = ResUI.CheckServerSettings;
                return ret;
            }
-            if (node.GetNetwork() is nameof(ETransport.kcp) or nameof(ETransport.xhttp))
+            if (_node.GetNetwork() is nameof(ETransport.kcp) or nameof(ETransport.xhttp))
            {
-                ret.Msg = ResUI.Incorrectconfiguration + $" - {node.GetNetwork()}";
+                ret.Msg = ResUI.Incorrectconfiguration + $" - {_node.GetNetwork()}";
                return ret;
            }

            ret.Msg = ResUI.InitialConfiguration;

-            if (node.ConfigType.IsGroupType())
-            {
-                switch (node.ConfigType)
-                {
-                    case EConfigType.PolicyGroup:
-                        return await GenerateClientMultipleLoadConfig(node);
-
-                    case EConfigType.ProxyChain:
-                        return await GenerateClientChainConfig(node);
-                }
-            }
-
            var result = EmbedUtils.GetEmbedText(Global.SingboxSampleClient);
            if (result.IsNullOrEmpty())
            {
@@ -45,44 +36,34 @@ public partial class CoreConfigSingboxService(Config config)
                return ret;
            }

-            var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result);
-            if (singboxConfig == null)
+            _coreConfig = JsonUtils.Deserialize<SingboxConfig>(result);
+            if (_coreConfig == null)
            {
                ret.Msg = ResUI.FailedGenDefaultConfiguration;
                return ret;
            }

-            await GenLog(singboxConfig);
+            GenLog();

-            await GenInbounds(singboxConfig);
+            GenInbounds();

-            if (node.ConfigType == EConfigType.WireGuard)
-            {
-                singboxConfig.outbounds.RemoveAt(0);
-                var endpoints = new Endpoints4Sbox();
-                await GenEndpoint(node, endpoints);
-                endpoints.tag = Global.ProxyTag;
-                singboxConfig.endpoints = new() { endpoints };
-            }
-            else
-            {
-                await GenOutbound(node, singboxConfig.outbounds.First());
-            }
+            GenOutbounds();

-            await GenMoreOutbounds(node, singboxConfig);
+            GenRouting();

-            await GenRouting(singboxConfig);
+            GenDns();

-            await GenDns(node, singboxConfig);
+            GenExperimental();

-            await GenExperimental(singboxConfig);
+            ConvertGeo2Ruleset();

-            await ConvertGeo2Ruleset(singboxConfig);
+            ApplyOutboundBindInterface();
+            ApplyOutboundSendThrough();

            ret.Msg = string.Format(ResUI.SuccessfulConfiguration, "");
            ret.Success = true;

-            ret.Data = await ApplyFullConfigTemplate(singboxConfig);
+            ret.Data = ApplyFullConfigTemplate();
            return ret;
        }
        catch (Exception ex)
@@ -93,17 +74,11 @@ public partial class CoreConfigSingboxService(Config config)
        }
    }

-    public async Task<RetResult> GenerateClientSpeedtestConfig(List<ServerTestItem> selecteds)
+    public RetResult GenerateClientSpeedtestConfig(List<ServerTestItem> selecteds)
    {
        var ret = new RetResult();
        try
        {
-            if (_config == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
            ret.Msg = ResUI.InitialConfiguration;

            var result = EmbedUtils.GetEmbedText(Global.SingboxSampleClient);
@@ -114,44 +89,35 @@ public partial class CoreConfigSingboxService(Config config)
                return ret;
            }

-            var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result);
-            if (singboxConfig == null)
+            _coreConfig = JsonUtils.Deserialize<SingboxConfig>(result);
+            if (_coreConfig == null)
            {
                ret.Msg = ResUI.FailedGenDefaultConfiguration;
                return ret;
            }
-            List<IPEndPoint> lstIpEndPoints = new();
-            List<TcpConnectionInformation> lstTcpConns = new();
-            try
-            {
-                lstIpEndPoints.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpListeners());
-                lstIpEndPoints.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveUdpListeners());
-                lstTcpConns.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpConnections());
-            }
-            catch (Exception ex)
-            {
-                Logging.SaveLog(_tag, ex);
-            }

-            await GenLog(singboxConfig);
-            //GenDns(new(), singboxConfig);
-            singboxConfig.inbounds.Clear();
-            singboxConfig.outbounds.RemoveAt(0);
+            var (lstIpEndPoints, lstTcpConns) = Utils.GetActiveNetworkInfo();
+
+            GenLog();
+            GenMinimizedDns();
+            _coreConfig.inbounds.Clear();
+            _coreConfig.outbounds.RemoveAt(0);

            var initPort = AppManager.Instance.GetLocalPort(EInboundProtocol.speedtest);

            foreach (var it in selecteds)
            {
-                if (!Global.SingboxSupportConfigType.Contains(it.ConfigType))
+                if (!(Global.SingboxSupportConfigType.Contains(it.ConfigType) || it.ConfigType.IsGroupType()))
                {
                    continue;
                }
-                if (it.Port <= 0)
+                if (!it.ConfigType.IsComplexType() && it.Port <= 0)
                {
                    continue;
                }
-                var item = await AppManager.Instance.GetProfileItem(it.IndexId);
-                if (item is null || item.IsComplex() || !item.IsValid())
+                var actIndexId = context.ServerTestItemMap.GetValueOrDefault(it.IndexId, it.IndexId);
+                var item = context.AllProxiesMap.GetValueOrDefault(actIndexId);
+                if (item is null || item.ConfigType is EConfigType.Custom || !item.IsValid())
                {
                    continue;
                }
@@ -190,26 +156,11 @@ public partial class CoreConfigSingboxService(Config config)
                    type = EInboundProtocol.mixed.ToString(),
                };
                inbound.tag = inbound.type + inbound.listen_port.ToString();
-                singboxConfig.inbounds.Add(inbound);
+                _coreConfig.inbounds.Add(inbound);

-                //outbound
-                var server = await GenServer(item);
-                if (server is null)
-                {
-                    ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                    return ret;
-                }
                var tag = Global.ProxyTag + inbound.listen_port.ToString();
-                server.tag = tag;
-                if (server is Endpoints4Sbox endpoint)
-                {
-                    singboxConfig.endpoints ??= new();
-                    singboxConfig.endpoints.Add(endpoint);
-                }
-                else if (server is Outbound4Sbox outbound)
-                {
-                    singboxConfig.outbounds.Add(outbound);
-                }
+                var serverList = new CoreConfigSingboxService(context with { Node = item }).BuildAllProxyOutbounds(tag);
+                FillRangeProxy(serverList, _coreConfig, false);

                //rule
                Rule4Sbox rule = new()
@@ -217,25 +168,13 @@ public partial class CoreConfigSingboxService(Config config)
                    inbound = new List<string> { inbound.tag },
                    outbound = tag
                };
-                singboxConfig.route.rules.Add(rule);
+                _coreConfig.route.rules.Add(rule);
            }

-            var rawDNSItem = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
-            if (rawDNSItem != null && rawDNSItem.Enabled == true)
-            {
-                await GenDnsDomainsCompatible(singboxConfig, rawDNSItem);
-            }
-            else
-            {
-                await GenDnsDomains(singboxConfig, _config.SimpleDNSItem);
-            }
-            singboxConfig.route.default_domain_resolver = new()
-            {
-                server = Global.SingboxLocalDNSTag,
-            };
-
+            ApplyOutboundBindInterface();
+            ApplyOutboundSendThrough();
            ret.Success = true;
-            ret.Data = JsonUtils.Serialize(singboxConfig);
+            ret.Data = JsonUtils.Serialize(_coreConfig);
            return ret;
        }
        catch (Exception ex)
@@ -246,20 +185,20 @@ public partial class CoreConfigSingboxService(Config config)
        }
    }

-    public async Task<RetResult> GenerateClientSpeedtestConfig(ProfileItem node, int port)
+    public RetResult GenerateClientSpeedtestConfig(int port)
    {
        var ret = new RetResult();
        try
        {
-            if (node == null
-                || !node.IsValid())
+            if (_node == null
+                || !_node.IsValid())
            {
                ret.Msg = ResUI.CheckServerSettings;
                return ret;
            }
-            if (node.GetNetwork() is nameof(ETransport.kcp) or nameof(ETransport.xhttp))
+            if (_node.GetNetwork() is nameof(ETransport.kcp) or nameof(ETransport.xhttp))
            {
-                ret.Msg = ResUI.Incorrectconfiguration + $" - {node.GetNetwork()}";
+                ret.Msg = ResUI.Incorrectconfiguration + $" - {_node.GetNetwork()}";
                return ret;
            }

@@ -272,249 +211,32 @@ public partial class CoreConfigSingboxService(Config config)
                return ret;
            }

-            var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result);
-            if (singboxConfig == null)
+            _coreConfig = JsonUtils.Deserialize<SingboxConfig>(result);
+            if (_coreConfig == null)
            {
                ret.Msg = ResUI.FailedGenDefaultConfiguration;
                return ret;
            }

-            await GenLog(singboxConfig);
-            if (node.ConfigType == EConfigType.WireGuard)
-            {
-                singboxConfig.outbounds.RemoveAt(0);
-                var endpoints = new Endpoints4Sbox();
-                await GenEndpoint(node, endpoints);
-                endpoints.tag = Global.ProxyTag;
-                singboxConfig.endpoints = new() { endpoints };
-            }
-            else
-            {
-                await GenOutbound(node, singboxConfig.outbounds.First());
-            }
-            await GenMoreOutbounds(node, singboxConfig);
-            var item = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
-            if (item != null && item.Enabled == true)
-            {
-                await GenDnsDomainsCompatible(singboxConfig, item);
-            }
-            else
-            {
-                await GenDnsDomains(singboxConfig, _config.SimpleDNSItem);
-            }
-            singboxConfig.route.default_domain_resolver = new()
-            {
-                server = Global.SingboxLocalDNSTag,
-            };
+            GenLog();
+            GenOutbounds();
+            GenMinimizedDns();

-            singboxConfig.route.rules.Clear();
-            singboxConfig.inbounds.Clear();
-            singboxConfig.inbounds.Add(new()
+            _coreConfig.route.rules.Clear();
+            _coreConfig.inbounds.Clear();
+            _coreConfig.inbounds.Add(new()
            {
                tag = $"{EInboundProtocol.mixed}{port}",
                listen = Global.Loopback,
                listen_port = port,
                type = EInboundProtocol.mixed.ToString(),
            });
+            ApplyOutboundBindInterface();
+            ApplyOutboundSendThrough();

            ret.Msg = string.Format(ResUI.SuccessfulConfiguration, "");
            ret.Success = true;
-            ret.Data = JsonUtils.Serialize(singboxConfig);
-            return ret;
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-            ret.Msg = ResUI.FailedGenDefaultConfiguration;
-            return ret;
-        }
-    }
-
-    public async Task<RetResult> GenerateClientMultipleLoadConfig(ProfileItem parentNode)
-    {
-        var ret = new RetResult();
-        try
-        {
-            if (_config == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
-            ret.Msg = ResUI.InitialConfiguration;
-
-            var result = EmbedUtils.GetEmbedText(Global.SingboxSampleClient);
-            var txtOutbound = EmbedUtils.GetEmbedText(Global.SingboxSampleOutbound);
-            if (result.IsNullOrEmpty() || txtOutbound.IsNullOrEmpty())
-            {
-                ret.Msg = ResUI.FailedGetDefaultConfiguration;
-                return ret;
-            }
-
-            var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result);
-            if (singboxConfig == null)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-            singboxConfig.outbounds.RemoveAt(0);
-
-            await GenLog(singboxConfig);
-            await GenInbounds(singboxConfig);
-
-            var groupRet = await GenGroupOutbound(parentNode, singboxConfig);
-            if (groupRet != 0)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-
-            await GenRouting(singboxConfig);
-            await GenExperimental(singboxConfig);
-            await GenDns(parentNode, singboxConfig);
-            await ConvertGeo2Ruleset(singboxConfig);
-
-            ret.Success = true;
-
-            ret.Data = await ApplyFullConfigTemplate(singboxConfig);
-            return ret;
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-            ret.Msg = ResUI.FailedGenDefaultConfiguration;
-            return ret;
-        }
-    }
-
-    public async Task<RetResult> GenerateClientChainConfig(ProfileItem parentNode)
-    {
-        var ret = new RetResult();
-        try
-        {
-            if (_config == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
-            ret.Msg = ResUI.InitialConfiguration;
-
-            var result = EmbedUtils.GetEmbedText(Global.SingboxSampleClient);
-            var txtOutbound = EmbedUtils.GetEmbedText(Global.SingboxSampleOutbound);
-            if (result.IsNullOrEmpty() || txtOutbound.IsNullOrEmpty())
-            {
-                ret.Msg = ResUI.FailedGetDefaultConfiguration;
-                return ret;
-            }
-
-            var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result);
-            if (singboxConfig == null)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-            singboxConfig.outbounds.RemoveAt(0);
-
-            await GenLog(singboxConfig);
-            await GenInbounds(singboxConfig);
-
-            var groupRet = await GenGroupOutbound(parentNode, singboxConfig);
-            if (groupRet != 0)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-
-            await GenRouting(singboxConfig);
-            await GenExperimental(singboxConfig);
-            await GenDns(parentNode, singboxConfig);
-            await ConvertGeo2Ruleset(singboxConfig);
-
-            ret.Success = true;
-
-            ret.Data = await ApplyFullConfigTemplate(singboxConfig);
-            return ret;
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-            ret.Msg = ResUI.FailedGenDefaultConfiguration;
-            return ret;
-        }
-    }
-
-    public async Task<RetResult> GenerateClientCustomConfig(ProfileItem node, string? fileName)
-    {
-        var ret = new RetResult();
-        if (node == null || fileName is null)
-        {
-            ret.Msg = ResUI.CheckServerSettings;
-            return ret;
-        }
-
-        ret.Msg = ResUI.InitialConfiguration;
-
-        try
-        {
-            if (node == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
-            if (File.Exists(fileName))
-            {
-                File.Delete(fileName);
-            }
-
-            var addressFileName = node.Address;
-            if (addressFileName.IsNullOrEmpty())
-            {
-                ret.Msg = ResUI.FailedGetDefaultConfiguration;
-                return ret;
-            }
-            if (!File.Exists(addressFileName))
-            {
-                addressFileName = Path.Combine(Utils.GetConfigPath(), addressFileName);
-            }
-            if (!File.Exists(addressFileName))
-            {
-                ret.Msg = ResUI.FailedReadConfiguration + "1";
-                return ret;
-            }
-
-            if (node.Address == Global.CoreMultipleLoadConfigFileName)
-            {
-                var txtFile = File.ReadAllText(addressFileName);
-                var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(txtFile);
-                if (singboxConfig == null)
-                {
-                    File.Copy(addressFileName, fileName);
-                }
-                else
-                {
-                    await GenInbounds(singboxConfig);
-                    await GenExperimental(singboxConfig);
-
-                    var content = JsonUtils.Serialize(singboxConfig, true);
-                    await File.WriteAllTextAsync(fileName, content);
-                }
-            }
-            else
-            {
-                File.Copy(addressFileName, fileName);
-            }
-
-            //check again
-            if (!File.Exists(fileName))
-            {
-                ret.Msg = ResUI.FailedReadConfiguration + "2";
-                return ret;
-            }
-
-            ret.Msg = string.Format(ResUI.SuccessfulConfiguration, "");
-            ret.Success = true;
+            ret.Data = JsonUtils.Serialize(_coreConfig);
            return ret;
        }
        catch (Exception ex)
@@ -2,29 +2,29 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<string> ApplyFullConfigTemplate(SingboxConfig singboxConfig)
+    private string ApplyFullConfigTemplate()
    {
-        var fullConfigTemplate = await AppManager.Instance.GetFullConfigTemplateItem(ECoreType.sing_box);
-        if (fullConfigTemplate == null || !fullConfigTemplate.Enabled)
+        var fullConfigTemplate = context.FullConfigTemplate;
+        if (fullConfigTemplate is not { Enabled: true })
        {
-            return JsonUtils.Serialize(singboxConfig);
+            return JsonUtils.Serialize(_coreConfig);
        }

-        var fullConfigTemplateItem = _config.TunModeItem.EnableTun ? fullConfigTemplate.TunConfig : fullConfigTemplate.Config;
+        var fullConfigTemplateItem = context.IsTunEnabled ? fullConfigTemplate.TunConfig : fullConfigTemplate.Config;
        if (fullConfigTemplateItem.IsNullOrEmpty())
        {
-            return JsonUtils.Serialize(singboxConfig);
+            return JsonUtils.Serialize(_coreConfig);
        }

        var fullConfigTemplateNode = JsonNode.Parse(fullConfigTemplateItem);
        if (fullConfigTemplateNode == null)
        {
-            return JsonUtils.Serialize(singboxConfig);
+            return JsonUtils.Serialize(_coreConfig);
        }

        // Process outbounds
-        var customOutboundsNode = fullConfigTemplateNode["outbounds"] is JsonArray outbounds ? outbounds : new JsonArray();
-        foreach (var outbound in singboxConfig.outbounds)
+        var customOutboundsNode = fullConfigTemplateNode["outbounds"] is JsonArray outbounds ? outbounds : [];
+        foreach (var outbound in _coreConfig.outbounds)
        {
            if (outbound.type.ToLower() is "direct" or "block")
            {
@@ -42,10 +42,10 @@ public partial class CoreConfigSingboxService
        fullConfigTemplateNode["outbounds"] = customOutboundsNode;

        // Process endpoints
-        if (singboxConfig.endpoints != null && singboxConfig.endpoints.Count > 0)
+        if (_coreConfig.endpoints != null && _coreConfig.endpoints.Count > 0)
        {
-            var customEndpointsNode = fullConfigTemplateNode["endpoints"] is JsonArray endpoints ? endpoints : new JsonArray();
-            foreach (var endpoint in singboxConfig.endpoints)
+            var customEndpointsNode = fullConfigTemplateNode["endpoints"] is JsonArray endpoints ? endpoints : [];
+            foreach (var endpoint in _coreConfig.endpoints)
            {
                if (endpoint.detour.IsNullOrEmpty() && !fullConfigTemplate.ProxyDetour.IsNullOrEmpty())
                {
@@ -56,6 +56,58 @@ public partial class CoreConfigSingboxService
            fullConfigTemplateNode["endpoints"] = customEndpointsNode;
        }

-        return await Task.FromResult(JsonUtils.Serialize(fullConfigTemplateNode));
+        return JsonUtils.Serialize(fullConfigTemplateNode);
+    }
+
+    private void ApplyOutboundBindInterface()
+    {
+        var bindInterface = _config.CoreBasicItem.BindInterface?.TrimEx();
+        if (bindInterface.IsNullOrEmpty())
+        {
+            return;
+        }
+        if (!(context.IsTunEnabled || context.IsWindows))
+        {
+            return;
+        }
+        foreach (var outbound in _coreConfig.outbounds ?? [])
+        {
+            outbound.bind_interface = ShouldBindNet(outbound) ? bindInterface : null;
+        }
+    }
+
+    private void ApplyOutboundSendThrough()
+    {
+        var sendThrough = _config.CoreBasicItem.SendThrough?.TrimEx();
+        if (sendThrough.IsNullOrEmpty())
+        {
+            return;
+        }
+        foreach (var outbound in _coreConfig.outbounds ?? [])
+        {
+            outbound.inet4_bind_address = ShouldBindNet(outbound) ? sendThrough : null;
+        }
+    }
+
+    private static bool ShouldBindNet(Outbound4Sbox outbound)
+    {
+        if (outbound.type is "direct" or "block" or "dns" or "selector" or "urltest")
+        {
+            return false;
+        }
+
+        if (!outbound.detour.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        var outboundAddress = outbound.server ?? string.Empty;
+
+        if (outboundAddress.Equals("localhost", StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        return !IPAddress.TryParse(outboundAddress, out var address) || !IPAddress.IsLoopback(address);
    }
 }
@@ -2,65 +2,68 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<int> GenDns(ProfileItem? node, SingboxConfig singboxConfig)
+    private void GenDns()
    {
        try
        {
-            var item = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
-            if (item != null && item.Enabled == true)
+            var item = context.RawDnsItem;
+            if (item is { Enabled: true })
            {
-                return await GenDnsCompatible(node, singboxConfig);
+                GenDnsCustom();
+                return;
            }

-            var simpleDNSItem = _config.SimpleDNSItem;
-            await GenDnsServers(node, singboxConfig, simpleDNSItem);
-            await GenDnsRules(node, singboxConfig, simpleDNSItem);
+            GenDnsServers();
+            GenDnsRules();

-            singboxConfig.dns ??= new Dns4Sbox();
-            singboxConfig.dns.independent_cache = true;
+            _coreConfig.dns ??= new Dns4Sbox();
+            _coreConfig.dns.independent_cache = true;

            // final dns
-            var routing = await ConfigHandler.GetDefaultRouting(_config);
+            var routing = context.RoutingItem;
            var useDirectDns = false;
            if (routing != null)
            {
                var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet) ?? [];

-                useDirectDns = rules?.LastOrDefault() is { } lastRule &&
-                                  lastRule.OutboundTag == Global.DirectTag &&
-                                  (lastRule.Port == "0-65535" ||
-                                   lastRule.Network == "tcp,udp" ||
-                                   lastRule.Ip?.Contains("0.0.0.0/0") == true);
+                if (rules?.LastOrDefault() is { } lastRule && lastRule.OutboundTag == Global.DirectTag)
+                {
+                    var noDomain = lastRule.Domain == null || lastRule.Domain.Count == 0;
+                    var noProcess = lastRule.Process == null || lastRule.Process.Count == 0;
+                    var isAnyIp = lastRule.Ip == null || lastRule.Ip.Count == 0 || lastRule.Ip.Contains("0.0.0.0/0");
+                    var isAnyPort = string.IsNullOrEmpty(lastRule.Port) || lastRule.Port == "0-65535";
+                    var isAnyNetwork = string.IsNullOrEmpty(lastRule.Network) || lastRule.Network == "tcp,udp";
+                    useDirectDns = noDomain && noProcess && isAnyIp && isAnyPort && isAnyNetwork;
+                }
            }
-            singboxConfig.dns.final = useDirectDns ? Global.SingboxDirectDNSTag : Global.SingboxRemoteDNSTag;
-            if ((!useDirectDns) && simpleDNSItem.FakeIP == true && simpleDNSItem.GlobalFakeIp == false)
+            _coreConfig.dns.final = useDirectDns ? Global.SingboxDirectDNSTag : Global.SingboxRemoteDNSTag;
+            var simpleDnsItem = context.SimpleDnsItem;
+            if ((!useDirectDns) && simpleDnsItem.FakeIP == true && simpleDnsItem.GlobalFakeIp == false)
            {
-                singboxConfig.dns.rules.Add(new()
+                _coreConfig.dns.rules.Add(new()
                {
                    server = Global.SingboxFakeDNSTag,
                    query_type = new List<int> { 1, 28 }, // A and AAAA
                    rewrite_ttl = 1,
                });
            }
-
-            await GenOutboundDnsRule(node, singboxConfig);
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return 0;
    }

-    private async Task<int> GenDnsServers(ProfileItem? node, SingboxConfig singboxConfig, SimpleDNSItem simpleDNSItem)
+    private void GenDnsServers()
    {
-        var finalDns = await GenDnsDomains(singboxConfig, simpleDNSItem);
+        var simpleDnsItem = context.SimpleDnsItem;
+        var finalDns = GenBootstrapDns();

-        var directDns = ParseDnsAddress(simpleDNSItem.DirectDNS);
+        var directDns = ParseDnsAddress(simpleDnsItem.DirectDNS ?? Global.DomainDirectDNSAddress.First());
        directDns.tag = Global.SingboxDirectDNSTag;
        directDns.domain_resolver = Global.SingboxLocalDNSTag;

-        var remoteDns = ParseDnsAddress(simpleDNSItem.RemoteDNS);
+        var remoteDns = ParseDnsAddress(simpleDnsItem.RemoteDNS ?? Global.DomainRemoteDNSAddress.First());
        remoteDns.tag = Global.SingboxRemoteDNSTag;
        remoteDns.detour = Global.ProxyTag;
        remoteDns.domain_resolver = Global.SingboxLocalDNSTag;
@@ -71,12 +74,12 @@ public partial class CoreConfigSingboxService
            type = "hosts",
            predefined = new(),
        };
-        if (simpleDNSItem.AddCommonHosts == true)
+        if (simpleDnsItem.AddCommonHosts == true)
        {
            hostsDns.predefined = Global.PredefinedHosts;
        }

-        if (simpleDNSItem.UseSystemHosts == true)
+        if (simpleDnsItem.UseSystemHosts == true)
        {
            var systemHosts = Utils.GetSystemHosts();
            if (systemHosts != null && systemHosts.Count > 0)
@@ -88,13 +91,24 @@ public partial class CoreConfigSingboxService
            }
        }

-        if (!simpleDNSItem.Hosts.IsNullOrEmpty())
+        foreach (var kvp in Utils.ParseHostsToDictionary(simpleDnsItem.Hosts))
        {
-            var userHostsMap = Utils.ParseHostsToDictionary(simpleDNSItem.Hosts);
-
-            foreach (var kvp in userHostsMap)
+            // only allow full match
+            // like example.com and full:example.com,
+            // but not domain:example.com, keyword:example.com or regex:example.com etc.
+            var testRule = new Rule4Sbox();
+            if (!ParseV2Domain(kvp.Key, testRule))
            {
-                hostsDns.predefined[kvp.Key] = kvp.Value;
+                continue;
+            }
+            if (testRule.domain_keyword?.Count > 0 && !kvp.Key.Contains(':'))
+            {
+                testRule.domain = testRule.domain_keyword;
+                testRule.domain_keyword = null;
+            }
+            if (testRule.domain?.Count == 1)
+            {
+                hostsDns.predefined[testRule.domain.First()] = kvp.Value.Where(Utils.IsIpAddress).ToList();
            }
        }

@@ -114,14 +128,14 @@ public partial class CoreConfigSingboxService
            }
        }

-        singboxConfig.dns ??= new Dns4Sbox();
-        singboxConfig.dns.servers ??= new List<Server4Sbox>();
-        singboxConfig.dns.servers.Add(remoteDns);
-        singboxConfig.dns.servers.Add(directDns);
-        singboxConfig.dns.servers.Add(hostsDns);
+        _coreConfig.dns ??= new Dns4Sbox();
+        _coreConfig.dns.servers ??= [];
+        _coreConfig.dns.servers.Add(remoteDns);
+        _coreConfig.dns.servers.Add(directDns);
+        _coreConfig.dns.servers.Add(hostsDns);

        // fake ip
-        if (simpleDNSItem.FakeIP == true)
+        if (simpleDnsItem.FakeIP == true)
        {
            var fakeip = new Server4Sbox
            {
@@ -130,103 +144,129 @@ public partial class CoreConfigSingboxService
                inet4_range = "198.18.0.0/15",
                inet6_range = "fc00::/18",
            };
-            singboxConfig.dns.servers.Add(fakeip);
+            _coreConfig.dns.servers.Add(fakeip);
        }
-
-        // ech
-        var (_, dnsServer) = ParseEchParam(node?.EchConfigList);
-        if (dnsServer is not null)
-        {
-            dnsServer.tag = Global.SingboxEchDNSTag;
-            if (dnsServer.server is not null
-                && hostsDns.predefined.ContainsKey(dnsServer.server))
-            {
-                dnsServer.domain_resolver = Global.SingboxHostsDNSTag;
-            }
-            else
-            {
-                dnsServer.domain_resolver = Global.SingboxLocalDNSTag;
-            }
-            singboxConfig.dns.servers.Add(dnsServer);
-        }
-        else if (node?.ConfigType.IsGroupType() == true)
-        {
-            var echDnsObject = JsonUtils.DeepCopy(directDns);
-            echDnsObject.tag = Global.SingboxEchDNSTag;
-            singboxConfig.dns.servers.Add(echDnsObject);
-        }
-
-        return await Task.FromResult(0);
    }

-    private async Task<Server4Sbox> GenDnsDomains(SingboxConfig singboxConfig, SimpleDNSItem? simpleDNSItem)
+    private Server4Sbox GenBootstrapDns()
    {
-        var finalDns = ParseDnsAddress(simpleDNSItem.BootstrapDNS);
+        var finalDns = ParseDnsAddress(context.SimpleDnsItem?.BootstrapDNS ?? Global.DomainPureIPDNSAddress.First());
        finalDns.tag = Global.SingboxLocalDNSTag;
-        singboxConfig.dns ??= new Dns4Sbox();
-        singboxConfig.dns.servers ??= new List<Server4Sbox>();
-        singboxConfig.dns.servers.Add(finalDns);
-        return await Task.FromResult(finalDns);
+        _coreConfig.dns ??= new Dns4Sbox();
+        _coreConfig.dns.servers ??= [];
+        _coreConfig.dns.servers.Add(finalDns);
+        return finalDns;
    }

-    private async Task<int> GenDnsRules(ProfileItem? node, SingboxConfig singboxConfig, SimpleDNSItem simpleDNSItem)
+    private void GenDnsRules()
    {
-        singboxConfig.dns ??= new Dns4Sbox();
-        singboxConfig.dns.rules ??= new List<Rule4Sbox>();
+        var simpleDnsItem = context.SimpleDnsItem;
+        _coreConfig.dns ??= new Dns4Sbox();
+        _coreConfig.dns.rules ??= [];

-        singboxConfig.dns.rules.AddRange(new[]
+        _coreConfig.dns.rules.Add(new() { ip_accept_any = true, server = Global.SingboxHostsDNSTag });
+
+        if (context.ProtectDomainList.Count > 0)
+        {
+            _coreConfig.dns.rules.Add(new()
            {
-            new Rule4Sbox { ip_accept_any = true, server = Global.SingboxHostsDNSTag },
+                server = Global.SingboxDirectDNSTag,
+                strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Freedom),
+                domain = context.ProtectDomainList.ToList(),
+            });
+        }
+
+        _coreConfig.dns.rules.AddRange(new[]
+        {
            new Rule4Sbox
            {
                server = Global.SingboxRemoteDNSTag,
-                strategy = simpleDNSItem.SingboxStrategy4Proxy.NullIfEmpty(),
+                strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Proxy),
                clash_mode = ERuleMode.Global.ToString()
            },
            new Rule4Sbox
            {
                server = Global.SingboxDirectDNSTag,
-                strategy = simpleDNSItem.SingboxStrategy4Direct.NullIfEmpty(),
+                strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Freedom),
                clash_mode = ERuleMode.Direct.ToString()
            }
        });

-        var (ech, _) = ParseEchParam(node?.EchConfigList);
-        if (ech is not null)
+        foreach (var kvp in Utils.ParseHostsToDictionary(simpleDnsItem.Hosts))
        {
-            var echDomain = ech.query_server_name ?? node?.Sni;
-            singboxConfig.dns.rules.Add(new()
+            var predefined = kvp.Value.First();
+            if (predefined.IsNullOrEmpty())
            {
-                query_type = new List<int> { 64, 65 },
-                server = Global.SingboxEchDNSTag,
-                domain = echDomain is not null ? new List<string> { echDomain } : null,
-            });
-        }
-        else if (node?.ConfigType.IsGroupType() == true)
-        {
-            var queryServerNames = (await ProfileGroupItemManager.GetAllChildEchQuerySni(node.IndexId)).ToList();
-            if (queryServerNames.Count > 0)
-            {
-                singboxConfig.dns.rules.Add(new()
-                {
-                    query_type = new List<int> { 64, 65 },
-                    server = Global.SingboxEchDNSTag,
-                    domain = queryServerNames,
-                });
+                continue;
            }
+            var rule = new Rule4Sbox()
+            {
+                query_type = [1, 5, 28], // A, CNAME and AAAA
+                action = "predefined",
+                rcode = "NOERROR",
+            };
+            if (!ParseV2Domain(kvp.Key, rule))
+            {
+                continue;
+            }
+            // see: https://xtls.github.io/en/config/dns.html#dnsobject
+            // The matching format (domain:, full:, etc.) is the same as the domain
+            // in the commonly used Routing System. The difference is that without a prefix,
+            // it defaults to using the full: prefix (similar to the common hosts file syntax).
+            if (rule.domain_keyword?.Count > 0 && !kvp.Key.Contains(':'))
+            {
+                rule.domain = rule.domain_keyword;
+                rule.domain_keyword = null;
+            }
+            // example.com #0 -> example.com with NOERROR
+            if (predefined.StartsWith('#') && int.TryParse(predefined.AsSpan(1), out var rcode))
+            {
+                rule.rcode = rcode switch
+                {
+                    0 => "NOERROR",
+                    1 => "FORMERR",
+                    2 => "SERVFAIL",
+                    3 => "NXDOMAIN",
+                    4 => "NOTIMP",
+                    5 => "REFUSED",
+                    _ => "NOERROR",
+                };
+            }
+            else if (Utils.IsDomain(predefined))
+            {
+                // example.com CNAME target.com -> example.com with CNAME target.com
+                rule.answer = new List<string> { $"*. IN CNAME {predefined}." };
+            }
+            else if (Utils.IsIpAddress(predefined) && (rule.domain?.Count ?? 0) == 0)
+            {
+                // not full match, but an IP address, treat it as predefined answer
+                if (Utils.IsIpv6(predefined))
+                {
+                    rule.answer = new List<string> { $"*. IN AAAA {predefined}" };
+                }
+                else
+                {
+                    rule.answer = new List<string> { $"*. IN A {predefined}" };
+                }
+            }
+            else
+            {
+                continue;
+            }
+            _coreConfig.dns.rules.Add(rule);
        }

-        if (simpleDNSItem.BlockBindingQuery == true)
+        if (simpleDnsItem.BlockBindingQuery == true)
        {
-            singboxConfig.dns.rules.Add(new()
+            _coreConfig.dns.rules.Add(new()
            {
-                query_type = new List<int> { 64, 65 },
+                query_type = [64, 65],
                action = "predefined",
-                rcode = "NOTIMP"
+                rcode = "NOERROR"
            });
        }

-        if (simpleDNSItem.FakeIP == true && simpleDNSItem.GlobalFakeIp == true)
+        if (simpleDnsItem.FakeIP == true && simpleDnsItem.GlobalFakeIp == true)
        {
            var fakeipFilterRule = JsonUtils.Deserialize<Rule4Sbox>(EmbedUtils.GetEmbedText(Global.SingboxFakeIPFilterFileName));
            fakeipFilterRule.invert = true;
@@ -236,32 +276,33 @@ public partial class CoreConfigSingboxService
                type = "logical",
                mode = "and",
                rewrite_ttl = 1,
-                rules = new List<Rule4Sbox>
-                {
-                    new() {
-                        query_type = new List<int> { 1, 28 }, // A and AAAA
+                rules =
+                [
+                    new()
+                    {
+                        query_type = [1, 28], // A and AAAA
                    },
-                    fakeipFilterRule,
-                }
+                    fakeipFilterRule
+                ]
            };

-            singboxConfig.dns.rules.Add(rule4Fake);
+            _coreConfig.dns.rules.Add(rule4Fake);
        }

-        var routing = await ConfigHandler.GetDefaultRouting(_config);
+        var routing = context.RoutingItem;
        if (routing == null)
        {
-            return 0;
+            return;
        }

        var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet) ?? [];
        var expectedIPCidr = new List<string>();
        var expectedIPsRegions = new List<string>();
-        var regionNames = new HashSet<string>();
+        var regionName = string.Empty;

-        if (!string.IsNullOrEmpty(simpleDNSItem?.DirectExpectedIPs))
+        if (!string.IsNullOrEmpty(simpleDnsItem?.DirectExpectedIPs))
        {
-            var ipItems = simpleDNSItem.DirectExpectedIPs
+            var ipItems = simpleDnsItem.DirectExpectedIPs
                .Split(new[] { ',', ';' }, StringSplitOptions.RemoveEmptyEntries)
                .Select(s => s.Trim())
                .Where(s => !string.IsNullOrEmpty(s))
@@ -269,16 +310,16 @@ public partial class CoreConfigSingboxService

            foreach (var ip in ipItems)
            {
-                if (ip.StartsWith("geoip:", StringComparison.OrdinalIgnoreCase))
+                if (ip.StartsWith(Global.GeoIPPrefix, StringComparison.OrdinalIgnoreCase))
                {
-                    var region = ip["geoip:".Length..];
-                    if (!string.IsNullOrEmpty(region))
+                    var region = ip[Global.GeoIPPrefix.Length..];
+                    if (string.IsNullOrEmpty(region))
                    {
-                        expectedIPsRegions.Add(region);
-                        regionNames.Add(region);
-                        regionNames.Add($"geolocation-{region}");
-                        regionNames.Add($"tld-{region}");
+                        continue;
                    }
+
+                    expectedIPsRegions.Add(region);
+                    regionName = region;
                }
                else
                {
@@ -309,21 +350,27 @@ public partial class CoreConfigSingboxService
            if (item.OutboundTag == Global.DirectTag)
            {
                rule.server = Global.SingboxDirectDNSTag;
-                rule.strategy = string.IsNullOrEmpty(simpleDNSItem.SingboxStrategy4Direct) ? null : simpleDNSItem.SingboxStrategy4Direct;
+                rule.strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Freedom);

-                if (expectedIPsRegions.Count > 0 && rule.geosite?.Count > 0)
+                if (expectedIPsRegions.Count > 0 && rule.geosite?.Count > 0 && !regionName.IsNullOrEmpty())
                {
-                    var geositeSet = new HashSet<string>(rule.geosite);
-                    if (regionNames.Intersect(geositeSet).Any())
+                    var regionGeosite = rule.geosite.Where(g => g.EndsWith($"-{regionName}", StringComparison.OrdinalIgnoreCase)
+                                                     || g.EndsWith($"@{regionName}", StringComparison.OrdinalIgnoreCase)
+                                                     || g == regionName).ToList();
+                    if (regionGeosite.Count > 0)
                    {
+                        rule.geosite.RemoveAll(regionGeosite.Contains);
+                        var rule4ExpectedIPs = JsonUtils.DeepCopy(rule);
+                        rule4ExpectedIPs.geosite = regionGeosite;
                        if (expectedIPsRegions.Count > 0)
                        {
-                            rule.geoip = expectedIPsRegions;
+                            rule4ExpectedIPs.geoip = expectedIPsRegions;
                        }
                        if (expectedIPCidr.Count > 0)
                        {
-                            rule.ip_cidr = expectedIPCidr;
+                            rule4ExpectedIPs.ip_cidr = expectedIPCidr;
                        }
+                        _coreConfig.dns.rules.Add(rule4ExpectedIPs);
                    }
                }
            }
@@ -334,31 +381,46 @@ public partial class CoreConfigSingboxService
            }
            else
            {
-                if (simpleDNSItem.FakeIP == true && simpleDNSItem.GlobalFakeIp == false)
+                if (simpleDnsItem.FakeIP == true && simpleDnsItem.GlobalFakeIp == false)
                {
                    var rule4Fake = JsonUtils.DeepCopy(rule);
                    rule4Fake.server = Global.SingboxFakeDNSTag;
                    rule4Fake.query_type = new List<int> { 1, 28 }; // A and AAAA
                    rule4Fake.rewrite_ttl = 1;
-                    singboxConfig.dns.rules.Add(rule4Fake);
+                    _coreConfig.dns.rules.Add(rule4Fake);
                }
                rule.server = Global.SingboxRemoteDNSTag;
-                rule.strategy = string.IsNullOrEmpty(simpleDNSItem.SingboxStrategy4Proxy) ? null : simpleDNSItem.SingboxStrategy4Proxy;
+                rule.strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Proxy);
            }

-            singboxConfig.dns.rules.Add(rule);
+            _coreConfig.dns.rules.Add(rule);
        }
-
-        return 0;
    }

-    private async Task<int> GenDnsCompatible(ProfileItem? node, SingboxConfig singboxConfig)
+    private void GenMinimizedDns()
+    {
+        GenDnsServers();
+        foreach (var server in _coreConfig.dns!.servers.Where(s => !string.IsNullOrEmpty(s.detour)).ToList())
+        {
+            _coreConfig.dns.servers.Remove(server);
+        }
+        _coreConfig.dns ??= new();
+        _coreConfig.dns.rules ??= [];
+        _coreConfig.dns.rules.Clear();
+        _coreConfig.dns.final = Global.SingboxDirectDNSTag;
+        _coreConfig.route.default_domain_resolver = new()
+        {
+            server = Global.SingboxDirectDNSTag,
+        };
+    }
+
+    private void GenDnsCustom()
    {
        try
        {
-            var item = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
+            var item = context.RawDnsItem;
            var strDNS = string.Empty;
-            if (_config.TunModeItem.EnableTun)
+            if (context.IsTunEnabled)
            {
                strDNS = string.IsNullOrEmpty(item?.TunDNS) ? EmbedUtils.GetEmbedText(Global.TunSingboxDNSFileName) : item?.TunDNS;
            }
@@ -370,61 +432,25 @@ public partial class CoreConfigSingboxService
            var dns4Sbox = JsonUtils.Deserialize<Dns4Sbox>(strDNS);
            if (dns4Sbox is null)
            {
-                return 0;
+                return;
            }
-            singboxConfig.dns = dns4Sbox;
-
-            if (dns4Sbox.servers != null && dns4Sbox.servers.Count > 0 && dns4Sbox.servers.First().address.IsNullOrEmpty())
-            {
-                await GenDnsDomainsCompatible(singboxConfig, item);
-            }
-            else
-            {
-                await GenDnsDomainsLegacyCompatible(singboxConfig, item);
-            }
-
-            await GenOutboundDnsRule(node, singboxConfig);
+            _coreConfig.dns = dns4Sbox;
+            GenDnsProtectCustom();
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return 0;
    }

-    private async Task<int> GenDnsDomainsCompatible(SingboxConfig singboxConfig, DNSItem? dnsItem)
+    private void GenDnsProtectCustom()
    {
-        var dns4Sbox = singboxConfig.dns ?? new();
+        var dnsItem = context.RawDnsItem;
+        var dns4Sbox = _coreConfig.dns ?? new();
        dns4Sbox.servers ??= [];
        dns4Sbox.rules ??= [];

        var tag = Global.SingboxLocalDNSTag;
-
-        var finalDnsAddress = string.IsNullOrEmpty(dnsItem?.DomainDNSAddress) ? Global.DomainPureIPDNSAddress.FirstOrDefault() : dnsItem?.DomainDNSAddress;
-
-        var localDnsServer = ParseDnsAddress(finalDnsAddress);
-        localDnsServer.tag = tag;
-
-        dns4Sbox.servers.Add(localDnsServer);
-
-        singboxConfig.dns = dns4Sbox;
-        return await Task.FromResult(0);
-    }
-
-    private async Task<int> GenDnsDomainsLegacyCompatible(SingboxConfig singboxConfig, DNSItem? dnsItem)
-    {
-        var dns4Sbox = singboxConfig.dns ?? new();
-        dns4Sbox.servers ??= [];
-        dns4Sbox.rules ??= [];
-
-        var tag = Global.SingboxLocalDNSTag;
-        dns4Sbox.servers.Add(new()
-        {
-            tag = tag,
-            address = string.IsNullOrEmpty(dnsItem?.DomainDNSAddress) ? Global.DomainPureIPDNSAddress.FirstOrDefault() : dnsItem?.DomainDNSAddress,
-            detour = Global.DirectTag,
-            strategy = string.IsNullOrEmpty(dnsItem?.DomainStrategy4Freedom) ? null : dnsItem?.DomainStrategy4Freedom,
-        });
        dns4Sbox.rules.Insert(0, new()
        {
            server = tag,
@@ -436,56 +462,32 @@ public partial class CoreConfigSingboxService
            clash_mode = ERuleMode.Global.ToString()
        });

-        var lstDomain = singboxConfig.outbounds
-                       .Where(t => t.server.IsNotEmpty() && Utils.IsDomain(t.server))
-                       .Select(t => t.server)
-                       .Distinct()
-                       .ToList();
-        if (lstDomain != null && lstDomain.Count > 0)
+        var finalDnsAddress = string.IsNullOrEmpty(dnsItem?.DomainDNSAddress) ? Global.DomainPureIPDNSAddress.FirstOrDefault() : dnsItem?.DomainDNSAddress;
+
+        var localDnsServer = ParseDnsAddress(finalDnsAddress);
+        localDnsServer.tag = tag;
+
+        dns4Sbox.servers.Add(localDnsServer);
+        var protectDomainRule = BuildProtectDomainRule();
+        if (protectDomainRule != null)
        {
-            dns4Sbox.rules.Insert(0, new()
-            {
-                server = tag,
-                domain = lstDomain
-            });
+            dns4Sbox.rules.Insert(0, protectDomainRule);
        }

-        singboxConfig.dns = dns4Sbox;
-        return await Task.FromResult(0);
+        _coreConfig.dns = dns4Sbox;
    }

-    private async Task<int> GenOutboundDnsRule(ProfileItem? node, SingboxConfig singboxConfig)
+    private Rule4Sbox? BuildProtectDomainRule()
    {
-        if (node == null)
+        if (context.ProtectDomainList.Count == 0)
        {
-            return 0;
+            return null;
        }
-
-        List<string> domain = new();
-        if (Utils.IsDomain(node.Address)) // normal outbound
-        {
-            domain.Add(node.Address);
-        }
-        if (node.Address == Global.Loopback && node.SpiderX.IsNotEmpty()) // Tun2SocksAddress
-        {
-            domain.AddRange(Utils.String2List(node.SpiderX)
-                .Where(Utils.IsDomain)
-                .Distinct()
-                .ToList());
-        }
-        if (domain.Count == 0)
-        {
-            return 0;
-        }
-
-        singboxConfig.dns.rules ??= new List<Rule4Sbox>();
-        singboxConfig.dns.rules.Insert(0, new Rule4Sbox
+        return new()
        {
            server = Global.SingboxLocalDNSTag,
-            domain = domain,
-        });
-
-        return await Task.FromResult(0);
+            domain = context.ProtectDomainList.ToList(),
+        };
    }

    private static Server4Sbox? ParseDnsAddress(string address)
@@ -2,15 +2,16 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<int> GenInbounds(SingboxConfig singboxConfig)
+    private void GenInbounds()
    {
        try
        {
            var listen = "0.0.0.0";
-            singboxConfig.inbounds = [];
+            var listenPort = AppManager.Instance.GetLocalPort(EInboundProtocol.socks);
+            var isUsingLocalMixedPort = _node.Address == Global.Loopback && _node.Port == listenPort;
+            _coreConfig.inbounds = [];

-            if (!_config.TunModeItem.EnableTun
-                || (_config.TunModeItem.EnableTun && _config.TunModeItem.EnableExInbound && AppManager.Instance.RunningCoreType == ECoreType.sing_box))
+            if (!context.IsTunEnabled || !isUsingLocalMixedPort)
            {
                var inbound = new Inbound4Sbox()
                {
@@ -18,23 +19,23 @@ public partial class CoreConfigSingboxService
                    tag = EInboundProtocol.socks.ToString(),
                    listen = Global.Loopback,
                };
-                singboxConfig.inbounds.Add(inbound);
+                _coreConfig.inbounds.Add(inbound);

-                inbound.listen_port = AppManager.Instance.GetLocalPort(EInboundProtocol.socks);
+                inbound.listen_port = listenPort;

                if (_config.Inbound.First().SecondLocalPortEnabled)
                {
-                    var inbound2 = GetInbound(inbound, EInboundProtocol.socks2, true);
-                    singboxConfig.inbounds.Add(inbound2);
+                    var inbound2 = BuildInbound(inbound, EInboundProtocol.socks2, true);
+                    _coreConfig.inbounds.Add(inbound2);
                }

                if (_config.Inbound.First().AllowLANConn)
                {
                    if (_config.Inbound.First().NewPort4LAN)
                    {
-                        var inbound3 = GetInbound(inbound, EInboundProtocol.socks3, true);
+                        var inbound3 = BuildInbound(inbound, EInboundProtocol.socks3, true);
                        inbound3.listen = listen;
-                        singboxConfig.inbounds.Add(inbound3);
+                        _coreConfig.inbounds.Add(inbound3);

                        //auth
                        if (_config.Inbound.First().User.IsNotEmpty() && _config.Inbound.First().Pass.IsNotEmpty())
@@ -49,7 +50,7 @@ public partial class CoreConfigSingboxService
                }
            }

-            if (_config.TunModeItem.EnableTun)
+            if (context.IsTunEnabled)
            {
                if (_config.TunModeItem.Mtu <= 0)
                {
@@ -61,7 +62,7 @@ public partial class CoreConfigSingboxService
                }

                var tunInbound = JsonUtils.Deserialize<Inbound4Sbox>(EmbedUtils.GetEmbedText(Global.TunSingboxInboundFileName)) ?? new Inbound4Sbox { };
-                tunInbound.interface_name = Utils.IsMacOS() ? $"utun{new Random().Next(99)}" : "singbox_tun";
+                tunInbound.interface_name = context.IsMacOS ? $"utun{new Random().Next(99)}" : "singbox_tun";
                tunInbound.mtu = _config.TunModeItem.Mtu;
                tunInbound.auto_route = _config.TunModeItem.AutoRoute;
                tunInbound.strict_route = _config.TunModeItem.StrictRoute;
@@ -71,17 +72,16 @@ public partial class CoreConfigSingboxService
                    tunInbound.address = ["172.18.0.1/30"];
                }

-                singboxConfig.inbounds.Add(tunInbound);
+                _coreConfig.inbounds.Add(tunInbound);
            }
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return await Task.FromResult(0);
    }

-    private Inbound4Sbox GetInbound(Inbound4Sbox inItem, EInboundProtocol protocol, bool bSocks)
+    private Inbound4Sbox BuildInbound(Inbound4Sbox inItem, EInboundProtocol protocol, bool bSocks)
    {
        var inbound = JsonUtils.DeepCopy(inItem);
        inbound.tag = protocol.ToString();
@@ -2,7 +2,7 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<int> GenLog(SingboxConfig singboxConfig)
+    private void GenLog()
    {
        try
        {
@@ -11,11 +11,11 @@ public partial class CoreConfigSingboxService
                case "debug":
                case "info":
                case "error":
-                    singboxConfig.log.level = _config.CoreBasicItem.Loglevel;
+                    _coreConfig.log.level = _config.CoreBasicItem.Loglevel;
                    break;

                case "warning":
-                    singboxConfig.log.level = "warn";
+                    _coreConfig.log.level = "warn";
                    break;

                default:
@@ -23,18 +23,17 @@ public partial class CoreConfigSingboxService
            }
            if (_config.CoreBasicItem.Loglevel == Global.None)
            {
-                singboxConfig.log.disabled = true;
+                _coreConfig.log.disabled = true;
            }
            if (_config.CoreBasicItem.LogEnabled)
            {
                var dtNow = DateTime.Now;
-                singboxConfig.log.output = Utils.GetLogPath($"sbox_{dtNow:yyyy-MM-dd}.txt");
+                _coreConfig.log.output = Utils.GetLogPath($"sbox_{dtNow:yyyy-MM-dd}.txt");
            }
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return await Task.FromResult(0);
    }
 }
--- a/Show More
+++ b/Show More