up 7.21.0

Update Directory.Packages.props
Fix (#9171 )
2026-05-18 07:34:36 +03:00 · 2026-04-24 14:39:38 +08:00 · 2026-04-24 14:34:05 +08:00 · 2026-04-21 17:17:25 +08:00 · 2026-04-21 09:51:28 +08:00 · 2026-04-20 19:23:45 +08:00
173 changed files with 12298 additions and 6527 deletions
@@ -7,13 +7,16 @@ on:
        required: false
        type: string

+permissions: 
+  actions: write
+
 jobs:
  update:
    runs-on: ubuntu-latest
    steps:

      - name: Trigger build windows
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
        run: |
          curl -X POST \
            -H "Accept: application/vnd.github.v3+json" \
@@ -22,12 +25,12 @@ jobs:
            -d "{
              \"ref\": \"master\",
              \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
              }
            }"

      - name: Trigger build linux
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
        run: |
          curl -X POST \
            -H "Accept: application/vnd.github.v3+json" \
@@ -36,12 +39,12 @@ jobs:
            -d "{
              \"ref\": \"master\",
              \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
              }
            }"

      - name: Trigger build osx
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
        run: |
          curl -X POST \
            -H "Accept: application/vnd.github.v3+json" \
@@ -50,12 +53,12 @@ jobs:
            -d "{
              \"ref\": \"master\",
              \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
              }
            }"

      - name: Trigger build windows desktop
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
        run: |
          curl -X POST \
            -H "Accept: application/vnd.github.v3+json" \
@@ -64,6 +67,6 @@ jobs:
            -d "{
              \"ref\": \"master\",
              \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
              }
-            }"
+            }"
@@ -9,97 +9,85 @@ on:
  push:
    branches:
      - master
-    tags:
-      - 'v*'
-      - 'V*'

 permissions:
  contents: write

-env:
-  OutputArch: "linux-64"
-  OutputArchArm: "linux-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/linux-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/linux-arm64"
-
 jobs:
  build:
-    strategy:
-      matrix:
-        configuration: [Release]
+    uses: ./.github/workflows/build.yml
+    with:
+      target: linux
+
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: linux
+      release_tag: ${{ inputs.release_tag }}
+
+  deb:
+    name: build and release deb x64 & arm64
+    if: |
+      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
    runs-on: ubuntu-24.04
+    container: debian:13
+    env:
+      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}

    steps:
-    - name: Checkout
+    - name: Prepare tools (Debian)
+      shell: bash
+      run: |
+        set -euo pipefail
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update
+        apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file \
+                           ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev \
+                           libc6 libgcc-s1 libstdc++6 zlib1g libicu-dev libssl-dev
+
+    - name: Checkout repo (for scripts)
      uses: actions/checkout@v6.0.2
      with:
        submodules: 'recursive'
        fetch-depth: '0'

-    - name: Setup .NET
-      uses: actions/setup-dotnet@v5.0.1
-      with:
-        dotnet-version: '8.0.x'
+    - name: Ensure script permissions
+      run: chmod 755 package-debian.sh

-    - name: Build
+    - name: Package DEB (Debian-family)
+      run: ./package-debian.sh "${RELEASE_TAG}" --arch all
+
+    - name: Collect DEBs into workspace
      run: |
-        cd v2rayN
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r linux-x64   -p:SelfContained=true -o "$OutputPath64"
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r linux-arm64 -p:SelfContained=true -o "$OutputPathArm64"
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r linux-x64   -p:SelfContained=true -p:PublishTrimmed=true -o "$OutputPath64"
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r linux-arm64 -p:SelfContained=true -p:PublishTrimmed=true -o "$OutputPathArm64"
+        mkdir -p "$GITHUB_WORKSPACE/dist/deb"
+        rsync -av "$HOME/debbuild/" "$GITHUB_WORKSPACE/dist/deb/" || true
+        find "$GITHUB_WORKSPACE/dist/deb" -name "v2rayn_*_amd64.deb" \
+          -exec mv {} "$GITHUB_WORKSPACE/dist/deb/v2rayN-linux-64.deb" \; || true
+        find "$GITHUB_WORKSPACE/dist/deb" -name "v2rayn_*_arm64.deb" \
+          -exec mv {} "$GITHUB_WORKSPACE/dist/deb/v2rayN-linux-arm64.deb" \; || true
+        echo "==== Dist tree ===="
+        ls -R "$GITHUB_WORKSPACE/dist/deb" || true

-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v6.0.0
-      with:
-        name: v2rayN-linux
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/linux*
-
-    # release debian package
-    - name: Package debian
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-debian.sh
-        ./package-debian.sh "$OutputArch" "$OutputPath64" "${{ github.event.inputs.release_tag }}"
-        ./package-debian.sh "$OutputArchArm" "$OutputPathArm64" "${{ github.event.inputs.release_tag }}"
-
-    - name: Upload deb to release
+    - name: Upload DEBs to release
      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
      with:
-        file: ${{ github.workspace }}/v2rayN*.deb
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
-
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh "$OutputArch" "$OutputPath64"
-        ./package-release-zip.sh "$OutputArchArm" "$OutputPathArm64"
-    
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
+        file: dist/deb/**/*.deb
+        tag: ${{ env.RELEASE_TAG }}
        file_glob: true
        prerelease: true

  rpm:
-    needs: build
+    name: build and release rpm x64 & arm64
    if: |
-      (github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag != '') ||
+      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
    runs-on: ubuntu-24.04
-    container:
-      image: registry.access.redhat.com/ubi10/ubi
+    container: registry.access.redhat.com/ubi10/ubi
    env:
-      RELEASE_TAG: ${{ github.event.inputs.release_tag != '' && github.event.inputs.release_tag || github.ref_name }}
+      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}

    steps:
    - name: Prepare tools (Red Hat)
@@ -168,12 +156,6 @@ jobs:
        submodules: 'recursive'
        fetch-depth: '0'

-    - name: Restore build artifacts
-      uses: actions/download-artifact@v7
-      with:
-        name: v2rayN-linux
-        path: ${{ github.workspace }}/v2rayN/Release
-
    - name: Ensure script permissions
      run: chmod 755 package-rhel.sh

@@ -189,12 +171,6 @@ jobs:
        echo "==== Dist tree ===="
        ls -R "$GITHUB_WORKSPACE/dist/rpm" || true

-    - name: Upload RPM artifacts
-      uses: actions/upload-artifact@v6.0.0
-      with:
-        name: v2rayN-rpm
-        path: dist/rpm/**/*.rpm
-
    - name: Upload RPMs to release
      uses: svenstaro/upload-release-action@v2
      with:
@@ -202,3 +178,76 @@ jobs:
        tag: ${{ env.RELEASE_TAG }}
        file_glob: true
        prerelease: true
+
+  rpm-riscv64:
+    name: build and release rpm riscv64
+    if: |
+      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-24.04-riscv
+    container: rockylinux/rockylinux:10
+    env:
+      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
+
+    steps:
+    - name: Prepare tools (Red Hat)
+      shell: bash
+      run: |
+        set -euo pipefail
+        dnf -y makecache
+        dnf -y install \
+          sudo git rpm-build rpmdevtools dnf-plugins-core \
+          rsync findutils tar gzip unzip which jq
+
+    - name: Checkout repo (for scripts)
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        rm -rf ./*
+        git init .
+        git config --global --add safe.directory "$PWD"
+        git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+        git fetch --depth=1 origin "${GITHUB_SHA}"
+        git checkout FETCH_HEAD
+        git submodule update --init --recursive
+
+    - name: Ensure script permissions
+      run: chmod 755 package-rhel-riscv.sh
+
+    - name: Package RPM (RHEL-family)
+      run: ./package-rhel-riscv.sh "${RELEASE_TAG}"
+
+    - name: Collect RPMs into workspace
+      run: |
+        mkdir -p "$GITHUB_WORKSPACE/dist/rpm-riscv64"
+        rsync -av "$HOME/rpmbuild/RPMS/" "$GITHUB_WORKSPACE/dist/rpm-riscv64/" || true
+        find "$GITHUB_WORKSPACE/dist/rpm-riscv64" -name "*.riscv64.rpm" \
+          -exec mv {} "$GITHUB_WORKSPACE/dist/rpm-riscv64/v2rayN-linux-rhel-riscv64.rpm" \; || true
+        echo "==== Dist tree ===="
+        ls -R "$GITHUB_WORKSPACE/dist/rpm-riscv64" || true
+
+    - name: Upload RPMs to release
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        shopt -s globstar nullglob
+
+        files=(dist/rpm-riscv64/**/*.rpm)
+        (( ${#files[@]} )) || { echo "No RPMs found."; exit 1; }
+
+        api="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}"
+        upload_url="$(curl -fsSL -H "Authorization: Bearer ${GITHUB_TOKEN}" "$api" | jq -r '.upload_url // empty' | sed 's/{?name,label}//')"
+        [[ "$upload_url" ]] || { echo "Release upload URL not found: ${RELEASE_TAG}"; exit 1; }
+
+        for f in "${files[@]}"; do
+          echo "Uploading ${f##*/}"
+          curl -fsSL -X POST \
+            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$f" \
+            "${upload_url}?name=${f##*/}"
+        done
@@ -10,78 +10,65 @@ on:
    branches:
      - master

-env:
-  OutputArch: "macos-64"
-  OutputArchArm: "macos-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/macos-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/macos-arm64"
+permissions:
+  contents: write

 jobs:
  build:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: macos
+
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: macos
+      release_tag: ${{ inputs.release_tag }}
+    
+  dmg:
+    name: package and release macOS dmg
+    if: inputs.release_tag != ''
+    needs: build
    strategy:
      matrix:
-        configuration: [Release]
-
+        arch: [ x64, arm64 ]
    runs-on: macos-latest
-
+    env:
+      Arch: |-
+        ${{
+          case(
+            matrix.arch == 'x64', '64',
+            matrix.arch
+          ) 
+        }} 
    steps:
    - name: Checkout
      uses: actions/checkout@v6.0.2
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'

-    - name: Setup
-      uses: actions/setup-dotnet@v5.0.1
+    - name: Restore build artifacts
+      uses: actions/download-artifact@v8
      with:
-        dotnet-version: '8.0.x'
-
-    - name: Build
-      run: |
-        cd v2rayN 
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r osx-x64   -p:SelfContained=true -o $OutputPath64
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r osx-arm64 -p:SelfContained=true -o $OutputPathArm64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r osx-x64   -p:SelfContained=true -p:PublishTrimmed=true -o $OutputPath64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r osx-arm64 -p:SelfContained=true -p:PublishTrimmed=true -o $OutputPathArm64
-
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v6.0.0
-      with:
-        name: v2rayN-macos
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/macos*
+        name: ${{ matrix.arch }}
+        path: v2rayN-macos-${{ env.Arch }}
    
-    # release osx package
-    - name: Package osx
-      if: github.event.inputs.release_tag != ''
-      run: |
-        brew install create-dmg
-        chmod 755 package-osx.sh
-        ./package-osx.sh $OutputArch $OutputPath64 ${{ github.event.inputs.release_tag }}
-        ./package-osx.sh $OutputArchArm $OutputPathArm64 ${{ github.event.inputs.release_tag }}
+    - name: Setup create-dmg
+      run: brew install create-dmg
+
+    - name: Ensure script permissions
+      run: chmod 755 package-osx.sh
+
+    - name: Package dmg
+      run: ./package-osx.sh macos-$Arch v2rayN-macos-$Arch ${{ inputs.release_tag }}
+
+    - name: Sleep for race condition between matrix jobs
+      run: sleep $(awk 'BEGIN { srand(); printf "%.3f", rand()*2 }')
    
    - name: Upload dmg to release
      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
      with:
        file: ${{ github.workspace }}/v2rayN*.dmg
-        tag: ${{ github.event.inputs.release_tag }}
+        tag: ${{ inputs.release_tag }}
        file_glob: true
        prerelease: true
-
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh $OutputArch $OutputPath64
-        ./package-release-zip.sh $OutputArchArm $OutputPathArm64
-    
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
@@ -10,62 +10,19 @@ on:
    branches:
      - master

-env:
-  OutputArch: "windows-64"
-  OutputArchArm: "windows-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/windows-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/windows-arm64"
+permissions:
+  contents: write

 jobs:
  build:
-    strategy:
-      matrix:
-        configuration: [Release]
+    uses: ./.github/workflows/build.yml
+    with:
+      target: windows

-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v6.0.2
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'
-
-    - name: Setup
-      uses: actions/setup-dotnet@v5.0.1
-      with:
-        dotnet-version: '8.0.x'
-
-    - name: Build
-      run: |
-        cd v2rayN 
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPath64
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPathArm64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPath64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPathArm64
-
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v6.0.0
-      with:
-        name: v2rayN-windows-desktop
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/windows*
-
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh $OutputArch $OutputPath64
-        mv "v2rayN-${OutputArch}.zip" "v2rayN-${OutputArch}-desktop.zip"
-        ./package-release-zip.sh $OutputArchArm $OutputPathArm64
-        mv "v2rayN-${OutputArchArm}.zip" "v2rayN-${OutputArchArm}-desktop.zip"
-
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: windows-desktop
+      release_tag: ${{ inputs.release_tag }}
@@ -10,57 +10,20 @@ on:
    branches:
      - master

-env:
-  OutputArch: "windows-64"
-  OutputArchArm: "windows-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/windows-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/windows-arm64"
+permissions:
+  contents: write

 jobs:
  build:
-    strategy:
-      matrix:
-        configuration: [Release]
+    uses: ./.github/workflows/build.yml
+    with:
+      target: windows
+      project: ./v2rayN/v2rayN.csproj

-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v6.0.2
-
-    - name: Setup
-      uses: actions/setup-dotnet@v5.0.1
-      with:
-        dotnet-version: '8.0.x'
-
-    - name: Build
-      run: |
-        cd v2rayN 
-        dotnet publish ./v2rayN/v2rayN.csproj     -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPath64
-        dotnet publish ./v2rayN/v2rayN.csproj     -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPathArm64
-        dotnet publish ./AmazTool/AmazTool.csproj -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPath64
-        dotnet publish ./AmazTool/AmazTool.csproj -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPathArm64
-  
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v6.0.0
-      with:
-        name: v2rayN-windows
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/windows*
-    
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh $OutputArch $OutputPath64
-        ./package-release-zip.sh $OutputArchArm $OutputPathArm64
-    
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: windows
+      release_tag: ${{ inputs.release_tag }}
@@ -0,0 +1,71 @@
+name: build
+
+on:
+  workflow_call:
+    inputs:
+      target: # windows linux macos
+        required: true
+        type: string
+      project:
+        required: false
+        type: string
+        default: './v2rayN.Desktop/v2rayN.Desktop.csproj'
+
+jobs:
+  build:
+    name: build x64 arm64
+    strategy:
+      matrix:
+        arch: [ x64, arm64 ]
+    runs-on: |-
+      ${{
+        case(
+          inputs.target == 'macos', 'macos-latest',
+          inputs.target == 'linux', 'ubuntu-24.04',
+          'ubuntu-latest'
+        )
+      }}
+    env:
+      Output: "${{ github.workspace }}/${{ matrix.arch }}"
+      RID: |-
+        ${{
+          case(
+            inputs.target == 'macos', format('osx-{0}', matrix.arch),
+            inputs.target == 'windows', format('win-{0}', matrix.arch),
+            format('{0}-{1}', inputs.target, matrix.arch)
+          )
+        }}
+      Project: ${{ inputs.project }}
+      ExtOpt: |-
+        ${{
+          case(
+            inputs.target == 'windows', '-p:EnableWindowsTargeting=true',
+            ''
+          )
+        }}
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6.0.2
+      with:
+        submodules: 'recursive'
+        fetch-depth: '0'
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5.2.0
+      with:
+        dotnet-version: '8.0.x'
+
+    - name: Build v2rayN
+      working-directory: ./v2rayN
+      run: dotnet publish $Project -c Release -r $RID -p:SelfContained=true $ExtOpt -o $Output
+
+    - name: Build AmazTool
+      working-directory: ./v2rayN
+      run: dotnet publish ./AmazTool/AmazTool.csproj -c Release -r $RID -p:SelfContained=true -p:PublishTrimmed=true $ExtOpt -o $Output
+
+    - name: Upload build artifacts
+      uses: actions/upload-artifact@v7.0.1
+      with:
+        name: ${{ matrix.arch }}
+        path: ${{ matrix.arch }}
@@ -0,0 +1,67 @@
+name: package and release Zip
+
+on:
+  workflow_call:
+    inputs:
+      release_tag:
+        required: true
+        type: string
+      target: # windows linux macos windows-desktop
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  package:
+    name: package x64 arm64
+    strategy:
+      matrix:
+        arch: [ x64, arm64 ]
+    runs-on: ubuntu-latest
+    env:
+      Target: |- 
+        ${{
+          case(
+            inputs.target == 'windows-desktop', 'windows',
+            inputs.target
+          )
+        }}
+      Arch: |-
+        ${{
+          case(
+            matrix.arch == 'x64', '64',
+            matrix.arch
+          ) 
+        }}
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6.0.2
+
+    - name: Restore build artifacts
+      uses: actions/download-artifact@v8
+      with:
+        name: ${{ matrix.arch }}
+        path: v2rayN-${{ env.Target }}-${{ env.Arch }}
+    
+    - name: Get v2rayN-core-bin
+      run: wget -nv -O v2rayN-$Target-$Arch.zip "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/v2rayN-$Target-$Arch.zip"
+    
+    - name: Package zip archive
+      run: 7z a -tZip v2rayN-$Target-$Arch.zip v2rayN-$Target-$Arch -mx1
+
+    - name: Rename windows-desktop 
+      if: inputs.target == 'windows-desktop'
+      run: mv "v2rayN-$Target-$Arch.zip" "v2rayN-$Target-$Arch-desktop.zip"
+    
+    - name: Sleep for race condition between matrix jobs
+      run: sleep $(awk 'BEGIN { srand(); printf "%.3f", rand()*2 }')
+
+    - name: Upload zip archive to release
+      uses: svenstaro/upload-release-action@v2
+      with:
+        file: ${{ github.workspace }}/v2rayN*.zip
+        tag: ${{ inputs.release_tag }}
+        file_glob: true
+        prerelease: true
@@ -1,69 +1,612 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -euo pipefail

-Arch="$1"
-OutputPath="$2"
-Version="$3"
+# Require Debian base branch
+. /etc/os-release

-FileName="v2rayN-${Arch}.zip"
-wget -nv -O $FileName "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/$FileName"
-7z x $FileName
-cp -rf v2rayN-${Arch}/* $OutputPath
+case "${ID:-}" in
+  debian)
+    echo "Detected supported system: ${NAME:-$ID} ${VERSION_ID:-}"
+    ;;
+  *)
+    echo "Unsupported system: ${NAME:-unknown} (${ID:-unknown})."
+    echo "This script only supports: Debian."
+    exit 1
+    ;;
+esac

-PackagePath="v2rayN-Package-${Arch}"
-mkdir -p "${PackagePath}/DEBIAN"
-mkdir -p "${PackagePath}/opt"
-cp -rf $OutputPath "${PackagePath}/opt/v2rayN"
-echo "When this file exists, app will not store configs under this folder" > "${PackagePath}/opt/v2rayN/NotStoreConfigHere.txt"
+# Kernel version
+MIN_KERNEL="6.11"
+CURRENT_KERNEL="$(uname -r)"

-if [ $Arch = "linux-64" ]; then
-    Arch2="amd64" 
+lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$CURRENT_KERNEL" | sort -V | head -n1)"
+
+if [[ "$lowest" != "$MIN_KERNEL" ]]; then
+    echo "Kernel $CURRENT_KERNEL is below $MIN_KERNEL"
+    exit 1
+fi
+
+echo "[OK] Kernel $CURRENT_KERNEL verified."
+
+# Config & Parse arguments
+VERSION_ARG="${1:-}"     # Pass version number like 7.13.8, or leave empty
+WITH_CORE="both"         # Default: bundle both xray+sing-box
+FORCE_NETCORE=0          # --netcore => skip archive bundle, use separate downloads
+ARCH_OVERRIDE=""         # --arch x64|arm64|all (optional compile target)
+BUILD_FROM=""            # --buildfrom 1|2|3 to select channel non-interactively
+
+# If the first argument starts with --, do not treat it as a version number
+if [[ "${VERSION_ARG:-}" == --* ]]; then
+  VERSION_ARG=""
+fi
+# Take the first non --* argument as version, discard it
+if [[ -n "${VERSION_ARG:-}" ]]; then shift || true; fi
+
+# Parse remaining optional arguments
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --with-core)     WITH_CORE="${2:-both}"; shift 2;;
+    --xray-ver)      XRAY_VER="${2:-}"; shift 2;;
+    --singbox-ver)   SING_VER="${2:-}"; shift 2;;
+    --netcore)       FORCE_NETCORE=1; shift;;
+    --arch)          ARCH_OVERRIDE="${2:-}"; shift 2;;
+    --buildfrom)     BUILD_FROM="${2:-}"; shift 2;;
+    *)
+      if [[ -z "${VERSION_ARG:-}" ]]; then VERSION_ARG="$1"; fi
+      shift;;
+  esac
+done
+
+# Conflict: version number AND --buildfrom cannot be used together
+if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+  echo "You cannot specify both an explicit version and --buildfrom at the same time."
+  echo "        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  exit 1
+fi
+
+# Check and install dependencies
+host_arch="$(uname -m)"
+[[ "$host_arch" == "aarch64" || "$host_arch" == "x86_64" ]] || { echo "Only supports aarch64 / x86_64"; exit 1; }
+
+install_ok=0
+
+if command -v apt-get >/dev/null 2>&1; then
+  sudo apt-get update
+  sudo apt-get -y install \
+    curl unzip tar jq rsync ca-certificates git dpkg-dev fakeroot file \
+    desktop-file-utils xdg-utils wget
+
+  if [[ "$host_arch" == "aarch64" ]]; then
+    sudo dpkg --add-architecture amd64 || true
+    sudo apt-get update
+    sudo apt-get -y install \
+      libc6:amd64 libgcc-s1:amd64 libstdc++6:amd64 zlib1g:amd64 libfontconfig1:amd64
+  elif [[ "$host_arch" == "x86_64" ]]; then
+    sudo dpkg --add-architecture arm64 || true
+    sudo apt-get update
+    sudo apt-get -y install \
+      libc6:arm64 libgcc-s1:arm64 libstdc++6:arm64 zlib1g:arm64 libfontconfig1:arm64
+  fi
+
+  # Install .NET SDK 8 via official script
+  wget -q https://dot.net/v1/dotnet-install.sh
+  chmod +x dotnet-install.sh
+  ./dotnet-install.sh --channel 8.0 --install-dir "$HOME/.dotnet"
+
+  export PATH="$HOME/.dotnet:$PATH"
+  export DOTNET_ROOT="$HOME/.dotnet"
+
+  dotnet --info >/dev/null 2>&1 && install_ok=1
+fi
+
+if [[ "$install_ok" -ne 1 ]]; then
+  echo "Could not auto-install dependencies for '$ID'. Make sure these are available:"
+  echo "dotnet-sdk 8.x, curl, unzip, tar, rsync, git, dpkg-deb, desktop-file-utils, xdg-utils"
+  exit 1
+fi
+
+# Root directory
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+# Git submodules (best effort)
+if [[ -f .gitmodules ]]; then
+  git submodule sync --recursive || true
+  git submodule update --init --recursive || true
+fi
+
+# Locate project
+PROJECT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+if [[ ! -f "$PROJECT" ]]; then
+  PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+fi
+[[ -f "$PROJECT" ]] || { echo "v2rayN.Desktop.csproj not found"; exit 1; }
+
+choose_channel() {
+  # If --buildfrom provided, map it directly and skip interaction.
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0;;
+      2) echo "prerelease"; return 0;;
+      3) echo "keep"; return 0;;
+      *) echo "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." >&2; exit 1;;
+    esac
+  fi
+
+  # Print menu to stderr and read from /dev/tty so stdout only carries the token.
+  local ch="latest" sel=""
+
+  if [[ -t 0 ]]; then
+    echo "[?] Choose v2rayN release channel:" >&2
+    echo "    1) Latest (stable)  [default]" >&2
+    echo "    2) Pre-release (preview)" >&2
+    echo "    3) Keep current (do nothing)" >&2
+    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
+    if read -r sel </dev/tty; then
+      case "${sel:-}" in
+        2) ch="prerelease" ;;
+        3) ch="keep" ;;
+      esac
+    fi
+  fi
+
+  echo "$ch"
+}
+
+get_latest_tag_latest() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
+}
+
+get_latest_tag_prerelease() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
+}
+
+git_try_checkout() {
+  local want="$1" ref=""
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    git fetch --tags --force --prune --depth=1 || true
+    if git rev-parse "refs/tags/${want}" >/dev/null 2>&1; then
+      ref="${want}"
+    fi
+    if [[ -n "$ref" ]]; then
+      echo "[OK] Found ref '${ref}', checking out..."
+      git checkout -f "${ref}"
+      if [[ -f .gitmodules ]]; then
+        git submodule sync --recursive || true
+        git submodule update --init --recursive || true
+      fi
+      return 0
+    fi
+  fi
+  return 1
+}
+
+apply_channel_or_keep() {
+  local ch="$1" tag
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+  if [[ "$ch" == "prerelease" ]]; then
+    tag="$(get_latest_tag_prerelease || true)"
+  else
+    tag="$(get_latest_tag_latest || true)"
+  fi
+
+  [[ -n "$tag" ]] || { echo "Failed to resolve latest tag for channel '${ch}'."; exit 1; }
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || { echo "Failed to checkout '${tag}'."; exit 1; }
+  VERSION="${tag#v}"
+}
+
+if git rev-parse --git-dir >/dev/null 2>&1; then
+  if [[ -n "${VERSION_ARG:-}" ]]; then
+    clean_ver="${VERSION_ARG#v}"
+    if git_try_checkout "$clean_ver"; then
+      VERSION="$clean_ver"
+    else
+      echo "[WARN] Tag '${VERSION_ARG}' not found."
+      ch="$(choose_channel)"
+      apply_channel_or_keep "$ch"
+    fi
+  else
+    ch="$(choose_channel)"
+    apply_channel_or_keep "$ch"
+  fi
 else
-    Arch2="arm64"
+  echo "Current directory is not a git repo; proceeding on current tree."
+  VERSION="${VERSION_ARG:-0.0.0}"
 fi
-echo $Arch2

-# basic
-cat >"${PackagePath}/DEBIAN/control" <<-EOF
-Package: v2rayN
-Version: $Version
-Architecture: $Arch2
-Maintainer: https://github.com/2dust/v2rayN
-Depends: libc6 (>= 2.34), fontconfig (>= 2.13.1), desktop-file-utils (>= 0.26), xdg-utils (>= 1.1.3), coreutils (>= 8.32), bash (>= 5.1), libfreetype6 (>= 2.11)
-Description: A GUI client for Windows and Linux, support Xray core and sing-box-core and others
+VERSION="${VERSION#v}"
+echo "[*] GUI version resolved as: ${VERSION}"
+
+download_xray() {
+  local outdir="$1" rid="$2" ver="${XRAY_VER:-}" url tmp zipname="xray.zip"
+  mkdir -p "$outdir"
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
+        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
+  fi
+  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
+  if [[ "$rid" == "linux-arm64" ]]; then
+    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-arm64-v8a.zip"
+  else
+    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-64.zip"
+  fi
+  echo "[+] Download xray: $url"
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/$zipname"
+  unzip -q "$tmp/$zipname" -d "$tmp"
+  install -m 755 "$tmp/xray" "$outdir/xray"
+  rm -rf "$tmp"
+}
+
+download_singbox() {
+  # Download sing-box
+  local outdir="$1" rid="$2" ver="${SING_VER:-}" url tmp tarname="singbox.tar.gz" bin cronet
+  mkdir -p "$outdir"
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
+  if [[ "$rid" == "linux-arm64" ]]; then
+    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-arm64.tar.gz"
+  else
+    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-amd64.tar.gz"
+  fi
+  echo "[+] Download sing-box: $url"
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/$tarname"
+  tar -C "$tmp" -xzf "$tmp/$tarname"
+  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+  install -m 755 "$bin" "$outdir/sing-box"
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so"
+  rm -rf "$tmp"
+}
+
+unify_geo_layout() {
+  local outroot="$1"
+  mkdir -p "$outroot/bin"
+  local names=(
+    "geosite.dat"
+    "geoip.dat"
+    "geoip-only-cn-private.dat"
+    "Country.mmdb"
+    "geoip.metadb"
+  )
+  for n in "${names[@]}"; do
+    if [[ -f "$outroot/bin/xray/$n" ]]; then
+      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
+    fi
+  done
+}
+
+download_geo_assets() {
+  local outroot="$1"
+  local bin_dir="$outroot/bin"
+  local srss_dir="$bin_dir/srss"
+  mkdir -p "$bin_dir" "$srss_dir"
+
+  echo "[+] Download Xray Geo to ${bin_dir}"
+  curl -fsSL -o "$bin_dir/geosite.dat" \
+    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" \
+    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" \
+    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" \
+    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+
+  echo "[+] Download sing-box rule DB & rule-sets"
+  curl -fsSL -o "$bin_dir/geoip.metadb" \
+    "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb" || true
+
+  for f in \
+    geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs \
+    geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" \
+      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geoip/$f" || true
+  done
+
+  for f in \
+    geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs \
+    geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" \
+      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geosite/$f" || true
+  done
+
+  unify_geo_layout "$outroot"
+}
+
+download_v2rayn_bundle() {
+  local outroot="$1" rid="$2"
+  local url=""
+  if [[ "$rid" == "linux-arm64" ]]; then
+    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-arm64.zip"
+  else
+    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-64.zip"
+  fi
+  echo "[+] Try v2rayN bundle archive: $url"
+  local tmp zipname
+  tmp="$(mktemp -d)"; zipname="$tmp/v2rayn.zip"
+  curl -fL "$url" -o "$zipname" || { echo "[!] Bundle download failed"; return 1; }
+  unzip -q "$zipname" -d "$tmp" || { echo "[!] Bundle unzip failed"; return 1; }
+
+  if [[ -d "$tmp/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$tmp/bin/" "$outroot/bin/"
+  else
+    rsync -a "$tmp/" "$outroot/"
+  fi
+
+  rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
+  find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
+
+  local nested_dir
+  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$nested_dir/bin/" "$outroot/bin/"
+    rm -rf "$nested_dir"
+  fi
+
+  # Unify to bin/
+  unify_geo_layout "$outroot"
+
+  echo "[+] Bundle extracted to $outroot"
+}
+
+BUILT_DEBS=()
+BUILT_ALL=0
+OUTPUT_DIR="$HOME/debbuild"
+mkdir -p "$OUTPUT_DIR"
+
+build_for_arch() {
+  local short="$1"
+  local rid deb_arch outdir_name
+  case "$short" in
+    x64)   rid="linux-x64";   deb_arch="amd64"; outdir_name="amd64" ;;
+    arm64) rid="linux-arm64"; deb_arch="arm64"; outdir_name="arm64" ;;
+    *) echo "Unknown arch '$short' (use x64|arm64)"; return 1 ;;
+  esac
+
+  echo "[*] Building for target: $short  (RID=$rid, DEB arch=$deb_arch)"
+
+  dotnet clean "$PROJECT" -c Release
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net8.0" || true
+
+  dotnet restore "$PROJECT"
+  dotnet publish "$PROJECT" \
+    -c Release -r "$rid" \
+    -p:PublishSingleFile=false \
+    -p:SelfContained=true
+
+  local RID_DIR="$rid"
+  local PUBDIR
+  PUBDIR="$(dirname "$PROJECT")/bin/Release/net8.0/${RID_DIR}/publish"
+  [[ -d "$PUBDIR" ]] || { echo "Publish directory not found: $PUBDIR"; return 1; }
+
+  local WORKDIR PKGROOT STAGE DEBIAN_DIR
+  WORKDIR="$(mktemp -d)"
+  PKGROOT="v2rayN-publish"
+  STAGE="$WORKDIR/${PKGROOT}_${VERSION}_${deb_arch}"
+  DEBIAN_DIR="$STAGE/DEBIAN"
+
+  mkdir -p "$STAGE/opt/v2rayN"
+  mkdir -p "$STAGE/usr/bin"
+  mkdir -p "$STAGE/usr/share/applications"
+  mkdir -p "$STAGE/usr/share/icons/hicolor/256x256/apps"
+  mkdir -p "$DEBIAN_DIR"
+
+  # Stage publish content from source build
+  cp -a "$PUBDIR/." "$STAGE/opt/v2rayN/"
+
+  local ICON_CANDIDATE
+  PROJECT_DIR="$(cd "$(dirname "$PROJECT")" && pwd)"
+  ICON_CANDIDATE="$PROJECT_DIR/v2rayN.png"
+  [[ -f "$ICON_CANDIDATE" ]] && cp "$ICON_CANDIDATE" "$STAGE/usr/share/icons/hicolor/256x256/apps/v2rayn.png" || true
+
+  mkdir -p "$STAGE/opt/v2rayN/bin/xray" "$STAGE/opt/v2rayN/bin/sing_box"
+
+  fetch_separate_cores_and_rules() {
+    local outroot="$1"
+
+    if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+      download_xray "$outroot/bin/xray" "$RID_DIR" || echo "[!] xray download failed (skipped)"
+    fi
+    if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+      download_singbox "$outroot/bin/sing_box" "$RID_DIR" || echo "[!] sing-box download failed (skipped)"
+    fi
+    download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+  }
+
+  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
+    if download_v2rayn_bundle "$STAGE/opt/v2rayN" "$RID_DIR"; then
+      echo "[*] Using v2rayN bundle bin assets."
+    else
+      echo "[*] Bundle failed, fallback to separate core + rules."
+      fetch_separate_cores_and_rules "$STAGE/opt/v2rayN"
+    fi
+  else
+    echo "[*] --netcore specified: use separate core + rules."
+    fetch_separate_cores_and_rules "$STAGE/opt/v2rayN"
+  fi
+
+  # Wrapper
+  install -m 755 /dev/stdin "$STAGE/usr/bin/v2rayn" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+DIR="/opt/v2rayN"
+cd "$DIR"
+
+if [[ -x "$DIR/v2rayN" ]]; then
+  exec "$DIR/v2rayN" "$@"
+fi
+
+for dll in v2rayN.Desktop.dll v2rayN.dll; do
+  if [[ -f "$DIR/$dll" ]]; then
+    exec /usr/bin/dotnet "$DIR/$dll" "$@"
+  fi
+done
+
+echo "v2rayN launcher: no executable found in $DIR" >&2
+ls -l "$DIR" >&2 || true
+exit 1
 EOF

-cat >"${PackagePath}/DEBIAN/postinst" <<-EOF
-if [ ! -s /usr/share/applications/v2rayN.desktop ]; then
-    cat >/usr/share/applications/v2rayN.desktop<<-END
+  SHLIBS_DEPENDS=""
+  EXTRA_DEPENDS="libc6 (>= 2.34), fontconfig (>= 2.13.1), desktop-file-utils (>= 0.26), xdg-utils (>= 1.1.3), coreutils (>= 8.32), bash (>= 5.1), libfreetype6 (>= 2.11)"
+
+  mkdir -p "$WORKDIR/debian"
+  cat > "$WORKDIR/debian/control" <<EOF
+Source: v2rayn
+Section: net
+Priority: optional
+Maintainer: 2dust <noreply@github.com>
+Standards-Version: 4.7.0
+
+Package: v2rayn
+Architecture: ${deb_arch}
+Description: v2rayN
+EOF
+
+  local SYS_LIBDIR=""
+  local SYS_USRLIBDIR=""
+  multiarch="$(dpkg-architecture -a"$deb_arch" -qDEB_HOST_MULTIARCH)"
+
+  SYS_LIBDIR="/lib/$multiarch"
+  SYS_USRLIBDIR="/usr/lib/$multiarch"
+
+  : > "$DEBIAN_DIR/substvars"
+  mapfile -t ELF_FILES < <(
+    find "$STAGE/opt/v2rayN" -type f \( -name "*.so*" -o -perm -111 \) ! -name 'libcoreclrtraceptprovider.so'
+  )
+  if [[ "${#ELF_FILES[@]}" -gt 0 ]]; then
+    (
+      cd "$WORKDIR"
+      dpkg-shlibdeps \
+        -l"$STAGE/opt/v2rayN" \
+        -l"$SYS_LIBDIR" \
+        -l"$SYS_USRLIBDIR" \
+        -T"$DEBIAN_DIR/substvars" \
+        "${ELF_FILES[@]}"
+    ) >/dev/null 2>&1 || true
+  fi
+
+  SHLIBS_DEPENDS="$(sed -n 's/^shlibs:Depends=//p' "$DEBIAN_DIR/substvars" | head -n1 || true)"
+
+  if [[ -n "$SHLIBS_DEPENDS" ]]; then
+    SHLIBS_DEPENDS="$(echo "$SHLIBS_DEPENDS" \
+      | sed -E 's/ *\([^)]*\)//g' \
+      | sed -E 's/ *, */, /g' \
+      | sed -E 's/^, *//; s/, *$//')"
+    FINAL_DEPENDS="${SHLIBS_DEPENDS}, ${EXTRA_DEPENDS}"
+  else
+    FINAL_DEPENDS="${EXTRA_DEPENDS}"
+  fi
+
+  # Desktop file
+  install -m 644 /dev/stdin "$STAGE/usr/share/applications/v2rayn.desktop" <<'EOF'
 [Desktop Entry]
-Name=v2rayN
-Comment=A GUI client for Windows and Linux, support Xray core and sing-box-core and others
-Exec=/opt/v2rayN/v2rayN
-Icon=/opt/v2rayN/v2rayN.png
-Terminal=false
 Type=Application
-Categories=Network;Application;
-END
-fi
-
-update-desktop-database
+Name=v2rayN
+Comment=v2rayN for Debian GNU Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
 EOF

-sudo chmod 0755 "${PackagePath}/DEBIAN/postinst"
-sudo chmod 0755 "${PackagePath}/opt/v2rayN/v2rayN"
-sudo chmod 0755 "${PackagePath}/opt/v2rayN/AmazTool"
+  # Control file
+  cat > "$DEBIAN_DIR/control" <<EOF
+Package: v2rayn
+Version: ${VERSION}
+Architecture: ${deb_arch}
+Maintainer: 2dust <noreply@github.com>
+Homepage: https://github.com/2dust/v2rayN
+Section: net
+Priority: optional
+Depends: ${FINAL_DEPENDS}
+Description: v2rayN (Avalonia) GUI client for Linux
+ Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 /
+ Shadowsocks / tuic / WireGuard.
+EOF

-# Patch
-# set owner to root:root
-sudo chown -R root:root "${PackagePath}"
-# set all directories to 755 (readable & traversable by all users)
-sudo find "${PackagePath}/opt/v2rayN" -type d -exec chmod 755 {} +
-# set all regular files to 644 (readable by all users)
-sudo find "${PackagePath}/opt/v2rayN" -type f -exec chmod 644 {} +
-# ensure main binaries are 755 (executable by all users)
-sudo chmod 755 "${PackagePath}/opt/v2rayN/v2rayN" 2>/dev/null || true
-sudo chmod 755 "${PackagePath}/opt/v2rayN/AmazTool" 2>/dev/null || true
+  # postinst
+  install -m 755 /dev/stdin "$DEBIAN_DIR/postinst" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF

-# build deb package
-sudo dpkg-deb -Zxz --build $PackagePath
-sudo mv "${PackagePath}.deb" "v2rayN-${Arch}.deb"
+  # postrm
+  install -m 755 /dev/stdin "$DEBIAN_DIR/postrm" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF
+
+  # Normalize permissions
+  find "$STAGE/opt/v2rayN" -type d -exec chmod 0755 {} +
+  find "$STAGE/opt/v2rayN" -type f -exec chmod 0644 {} +
+  [[ -f "$STAGE/opt/v2rayN/v2rayN" ]] && chmod 0755 "$STAGE/opt/v2rayN/v2rayN" || true
+  
+  local deb_out
+  deb_out="$OUTPUT_DIR/v2rayn_${VERSION}_${deb_arch}.deb"
+
+  dpkg-deb --root-owner-group --build "$STAGE" "$deb_out"
+
+  echo "Build done for $short. DEB at:"
+  echo "  $deb_out"
+  BUILT_DEBS+=("$deb_out")
+
+  rm -rf "$WORKDIR"
+}
+
+case "${ARCH_OVERRIDE:-}" in
+  all)           targets=(x64 arm64); BUILT_ALL=1 ;;
+  x64|amd64)     targets=(x64) ;;
+  arm64|aarch64) targets=(arm64) ;;
+  "")            targets=($([[ "$host_arch" == "aarch64" ]] && echo arm64 || echo x64)) ;;
+  *)             echo "Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all."; exit 1 ;;
+esac
+
+for arch in "${targets[@]}"; do
+  build_for_arch "$arch"
+done
+
+echo ""
+echo "================ Build Summary ================="
+if [[ "${#BUILT_DEBS[@]}" -gt 0 ]]; then
+  echo "Output directory: $OUTPUT_DIR"
+  for pkg in "${BUILT_DEBS[@]}"; do
+    echo "$pkg"
+  done
+else
+  echo "No DEBs detected in summary (check build logs above)."
+fi
+echo "==============================================="
@@ -1,15 +0,0 @@
-#!/bin/bash
-
-Arch="$1"
-OutputPath="$2"
-
-OutputArch="v2rayN-${Arch}"
-FileName="v2rayN-${Arch}.zip"
-
-wget -nv -O $FileName "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/$FileName"
-
-ZipPath64="./$OutputArch"
-mkdir $ZipPath64
-
-cp -rf $OutputPath "$ZipPath64/$OutputArch"
-7z a -tZip $FileName "$ZipPath64/$OutputArch" -mx1
@@ -0,0 +1,703 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Require Red Hat base branch
+. /etc/os-release
+
+case "${ID:-}" in
+  rhel|rocky|almalinux|fedora|centos)
+    echo "Detected supported system: ${NAME:-$ID} ${VERSION_ID:-}"
+    ;;
+  *)
+    echo "Unsupported system: ${NAME:-unknown} (${ID:-unknown})."
+    echo "This script only supports: RHEL / Rocky / AlmaLinux / Fedora / CentOS."
+    exit 1
+    ;;
+esac
+
+# Kernel version
+MIN_KERNEL="5.10"
+CURRENT_KERNEL="$(uname -r)"
+
+lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$CURRENT_KERNEL" | sort -V | head -n1)"
+
+if [[ "$lowest" != "$MIN_KERNEL" ]]; then
+    echo "Kernel $CURRENT_KERNEL is below $MIN_KERNEL"
+    exit 1
+fi
+
+echo "[OK] Kernel $CURRENT_KERNEL verified."
+
+# Config & Parse arguments
+VERSION_ARG="${1:-}"     # Pass version number like 7.13.8, or leave empty
+WITH_CORE="both"         # Default: bundle both xray+sing-box
+FORCE_NETCORE=0          # --netcore => skip archive bundle, use separate downloads
+BUILD_FROM=""            # --buildfrom 1|2|3 to select channel non-interactively
+DOTNET_RISCV_VERSION="10.0.105"
+DOTNET_RISCV_BASE="https://github.com/filipnavara/dotnet-riscv/releases/download"
+DOTNET_RISCV_FILE="dotnet-sdk-${DOTNET_RISCV_VERSION}-linux-riscv64.tar.gz"
+DOTNET_SDK_URL="${DOTNET_RISCV_BASE}/${DOTNET_RISCV_VERSION}/${DOTNET_RISCV_FILE}"
+SKIA_VER="${SKIA_VER:-3.119.2}"
+HARFBUZZ_VER="${HARFBUZZ_VER:-8.3.1.1}"
+
+# If the first argument starts with --, do not treat it as a version number
+if [[ "${VERSION_ARG:-}" == --* ]]; then
+  VERSION_ARG=""
+fi
+# Take the first non --* argument as version, discard it
+if [[ -n "${VERSION_ARG:-}" ]]; then shift || true; fi
+
+# Parse remaining optional arguments
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --with-core)     WITH_CORE="${2:-both}"; shift 2;;
+    --xray-ver)      XRAY_VER="${2:-}"; shift 2;;
+    --singbox-ver)   SING_VER="${2:-}"; shift 2;;
+    --netcore)       FORCE_NETCORE=1; shift;;
+    --buildfrom)     BUILD_FROM="${2:-}"; shift 2;;
+    *)
+      if [[ -z "${VERSION_ARG:-}" ]]; then VERSION_ARG="$1"; fi
+      shift;;
+  esac
+done
+
+# Conflict: version number AND --buildfrom cannot be used together
+if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+  echo "You cannot specify both an explicit version and --buildfrom at the same time."
+  echo "        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  exit 1
+fi
+
+apply_riscv_patch() {
+  # Upgrade net8.0 -> net10.0
+  find . -type f \( -name "*.csproj" -o -name "*.props" -o -name "*.targets" \) \
+    -exec sed -i 's/net8\.0/net10.0/g' {} +
+
+  # Patch all Directory.Packages.props for SkiaSharp/HarfBuzzSharp
+  while IFS= read -r -d '' f; do
+    # replace existing versions if present
+    sed -i \
+      -e "s#<PackageVersion Include=\"SkiaSharp\" Version=\"[^\"]*\" */>#<PackageVersion Include=\"SkiaSharp\" Version=\"$SKIA_VER\" />#g" \
+      -e "s#<PackageVersion Include=\"SkiaSharp.NativeAssets.Linux\" Version=\"[^\"]*\" */>#<PackageVersion Include=\"SkiaSharp.NativeAssets.Linux\" Version=\"$SKIA_VER\" />#g" \
+      -e "s#<PackageVersion Include=\"HarfBuzzSharp\" Version=\"[^\"]*\" */>#<PackageVersion Include=\"HarfBuzzSharp\" Version=\"$HARFBUZZ_VER\" />#g" \
+      -e "s#<PackageVersion Include=\"HarfBuzzSharp.NativeAssets.Linux\" Version=\"[^\"]*\" */>#<PackageVersion Include=\"HarfBuzzSharp.NativeAssets.Linux\" Version=\"$HARFBUZZ_VER\" />#g" \
+      "$f"
+
+    grep -q 'PackageVersion Include="SkiaSharp"' "$f" || \
+      sed -i "/<\/ItemGroup>/i\    <PackageVersion Include=\"SkiaSharp\" Version=\"$SKIA_VER\" />" "$f"
+
+    grep -q 'PackageVersion Include="SkiaSharp.NativeAssets.Linux"' "$f" || \
+      sed -i "/<\/ItemGroup>/i\    <PackageVersion Include=\"SkiaSharp.NativeAssets.Linux\" Version=\"$SKIA_VER\" />" "$f"
+
+    grep -q 'PackageVersion Include="HarfBuzzSharp"' "$f" || \
+      sed -i "/<\/ItemGroup>/i\    <PackageVersion Include=\"HarfBuzzSharp\" Version=\"$HARFBUZZ_VER\" />" "$f"
+
+    grep -q 'PackageVersion Include="HarfBuzzSharp.NativeAssets.Linux"' "$f" || \
+      sed -i "/<\/ItemGroup>/i\    <PackageVersion Include=\"HarfBuzzSharp.NativeAssets.Linux\" Version=\"$HARFBUZZ_VER\" />" "$f"
+  done < <(find . -type f -name 'Directory.Packages.props' -print0)
+
+  # Patch SDK bundled RIDs
+  f="$(find "$DOTNET_ROOT/sdk/$(dotnet --version)" -type f -name 'Microsoft.NETCoreSdk.BundledVersions.props' | head -n1 || true)"
+  [[ -f "$f" ]] && sed -i \
+    -e 's/linux-arm64/&;linux-riscv64/g' \
+    -e 's/linux-musl-arm64/&;linux-musl-riscv64/g' \
+    "$f"
+}
+
+build_sqlite_native_riscv64() {
+  local outdir="$1"
+  local workdir sqlite_year sqlite_ver sqlite_zip srcdir
+
+  mkdir -p "$outdir"
+  workdir="$(mktemp -d)"
+
+  # SQLite 3.51.3 amalgamation
+  sqlite_year="2026"
+  sqlite_ver="3510300"
+  sqlite_zip="sqlite-amalgamation-${sqlite_ver}.zip"
+
+  echo "[+] Download SQLite amalgamation: ${sqlite_zip}"
+  curl -fL "https://www.sqlite.org/${sqlite_year}/${sqlite_zip}" -o "${workdir}/${sqlite_zip}"
+
+  unzip -q "${workdir}/${sqlite_zip}" -d "$workdir"
+  srcdir="$(find "$workdir" -maxdepth 1 -type d -name 'sqlite-amalgamation-*' | head -n1 || true)"
+  [[ -n "$srcdir" ]] || { echo "[!] SQLite source unpack failed"; rm -rf "$workdir"; return 1; }
+
+  echo "[+] Build libe_sqlite3.so for riscv64"
+  gcc -shared -fPIC -O2 \
+    -DSQLITE_THREADSAFE=1 \
+    -DSQLITE_ENABLE_FTS5 \
+    -DSQLITE_ENABLE_RTREE \
+    -DSQLITE_ENABLE_JSON1 \
+    -o "${outdir}/libe_sqlite3.so" "${srcdir}/sqlite3.c" -ldl -lpthread
+
+  rm -rf "$workdir"
+}
+
+copy_skiasharp_native_riscv64() {
+  local outdir="$1"
+  local skia_so=""
+  local harfbuzz_so=""
+
+  mkdir -p "$outdir"
+
+  skia_so="$(find "$HOME/.nuget/packages" -path "*/skiasharp.nativeassets.linux/${SKIA_VER}/runtimes/linux-riscv64/native/libSkiaSharp.so" | head -n1 || true)"
+  if [[ -z "$skia_so" ]]; then
+    skia_so="$(find "$HOME/.nuget/packages" -path "*/runtimes/linux-riscv64/native/libSkiaSharp.so" | head -n1 || true)"
+  fi
+
+  harfbuzz_so="$(find "$HOME/.nuget/packages" -path "*/harfbuzzsharp.nativeassets.linux/${HARFBUZZ_VER}/runtimes/linux-riscv64/native/libHarfBuzzSharp.so" | head -n1 || true)"
+  if [[ -z "$harfbuzz_so" ]]; then
+    harfbuzz_so="$(find "$HOME/.nuget/packages" -path "*/runtimes/linux-riscv64/native/libHarfBuzzSharp.so" | head -n1 || true)"
+  fi
+
+  if [[ -n "$skia_so" && -f "$skia_so" ]]; then
+    echo "[+] Copy libSkiaSharp.so from NuGet cache"
+    install -m 755 "$skia_so" "$outdir/libSkiaSharp.so"
+  else
+    echo "[WARN] libSkiaSharp.so for linux-riscv64 not found in NuGet cache"
+  fi
+
+  if [[ -n "$harfbuzz_so" && -f "$harfbuzz_so" ]]; then
+    echo "[+] Copy libHarfBuzzSharp.so from NuGet cache"
+    install -m 755 "$harfbuzz_so" "$outdir/libHarfBuzzSharp.so"
+  else
+    echo "[WARN] libHarfBuzzSharp.so for linux-riscv64 not found in NuGet cache"
+  fi
+}
+
+# Check and install dependencies
+host_arch="$(uname -m)"
+[[ "$host_arch" == "riscv64" ]] || { echo "Only supports riscv64"; exit 1; }
+
+install_ok=0
+
+if command -v dnf >/dev/null 2>&1; then
+  sudo dnf -y install \
+    rpm-build rpmdevtools curl unzip tar jq rsync git python3 gcc make \
+    glibc-devel kernel-headers libatomic file ca-certificates libicu\
+    && install_ok=1
+
+  mkdir -p "$HOME/.dotnet"
+  tmp_dotnet="$(mktemp -d)"
+  curl -fL "$DOTNET_SDK_URL" -o "$tmp_dotnet/$DOTNET_RISCV_FILE"
+  tar -C "$HOME/.dotnet" -xzf "$tmp_dotnet/$DOTNET_RISCV_FILE"
+  rm -rf "$tmp_dotnet"
+
+  export PATH="$HOME/.dotnet:$PATH"
+  export DOTNET_ROOT="$HOME/.dotnet"
+
+  dotnet --info >/dev/null 2>&1 || install_ok=0
+fi
+
+if [[ "$install_ok" -ne 1 ]]; then
+  echo "Could not auto-install dependencies for '$ID'. Make sure these are available:"
+  echo "dotnet-riscv SDK, curl, unzip, tar, rsync, git, python3, gcc, rpm, rpmdevtools, rpm-build (on Red Hat branch)"
+  exit 1
+fi
+
+# Root directory
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+# Git submodules (best effort)
+if [[ -f .gitmodules ]]; then
+  git submodule sync --recursive || true
+  git submodule update --init --recursive || true
+fi
+
+# Locate project
+PROJECT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+if [[ ! -f "$PROJECT" ]]; then
+  PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+fi
+[[ -f "$PROJECT" ]] || { echo "v2rayN.Desktop.csproj not found"; exit 1; }
+
+choose_channel() {
+  # If --buildfrom provided, map it directly and skip interaction.
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0;;
+      2) echo "prerelease"; return 0;;
+      3) echo "keep"; return 0;;
+      *) echo "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." >&2; exit 1;;
+    esac
+  fi
+
+  # Print menu to stderr and read from /dev/tty so stdout only carries the token.
+  local ch="latest" sel=""
+
+  if [[ -t 0 ]]; then
+    echo "[?] Choose v2rayN release channel:" >&2
+    echo "    1) Latest (stable)  [default]" >&2
+    echo "    2) Pre-release (preview)" >&2
+    echo "    3) Keep current (do nothing)" >&2
+    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
+    if read -r sel </dev/tty; then
+      case "${sel:-}" in
+        2) ch="prerelease" ;;
+        3) ch="keep" ;;
+      esac
+    fi
+  fi
+
+  echo "$ch"
+}
+
+get_latest_tag_latest() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
+}
+
+get_latest_tag_prerelease() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
+}
+
+git_try_checkout() {
+  # Try a series of refs and checkout when found.
+  local want="$1" ref=""
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    git fetch --tags --force --prune --depth=1 || true
+    if git rev-parse "refs/tags/${want}" >/dev/null 2>&1; then
+      ref="${want}"
+    fi
+    if [[ -n "$ref" ]]; then
+      echo "[OK] Found ref '${ref}', checking out..."
+      git checkout -f "${ref}"
+      if [[ -f .gitmodules ]]; then
+        git submodule sync --recursive || true
+        git submodule update --init --recursive || true
+      fi
+      return 0
+    fi
+  fi
+  return 1
+}
+
+apply_channel_or_keep() {
+  local ch="$1" tag
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+  if [[ "$ch" == "prerelease" ]]; then
+    tag="$(get_latest_tag_prerelease || true)"
+  else
+    tag="$(get_latest_tag_latest || true)"
+  fi
+
+  [[ -n "$tag" ]] || { echo "Failed to resolve latest tag for channel '${ch}'."; exit 1; }
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || { echo "Failed to checkout '${tag}'."; exit 1; }
+  VERSION="${tag#v}"
+}
+
+if git rev-parse --git-dir >/dev/null 2>&1; then
+  if [[ -n "${VERSION_ARG:-}" ]]; then
+    clean_ver="${VERSION_ARG#v}"
+    if git_try_checkout "$clean_ver"; then
+      VERSION="$clean_ver"
+    else
+      echo "[WARN] Tag '${VERSION_ARG}' not found."
+      ch="$(choose_channel)"
+      apply_channel_or_keep "$ch"
+    fi
+  else
+    ch="$(choose_channel)"
+    apply_channel_or_keep "$ch"
+  fi
+else
+  echo "Current directory is not a git repo; proceeding on current tree."
+  VERSION="${VERSION_ARG:-0.0.0}"
+fi
+
+VERSION="${VERSION#v}"
+echo "[*] GUI version resolved as: ${VERSION}"
+
+# riscv64 patch
+apply_riscv_patch
+
+# Helpers for core
+download_xray() {
+  # Download Xray core
+  local outdir="$1" rid="$2" ver="${XRAY_VER:-}" url="" tmp zipname="xray.zip"
+  mkdir -p "$outdir"
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
+        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
+  fi
+  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
+  if [[ "$rid" == "linux-riscv64" ]]; then
+    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-riscv64.zip"
+  fi
+  [[ -n "$url" ]] || { echo "[xray] Unsupported RID: $rid"; return 1; }
+  echo "[+] Download xray: $url"
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/$zipname"
+  unzip -q "$tmp/$zipname" -d "$tmp"
+  install -m 755 "$tmp/xray" "$outdir/xray"
+  rm -rf "$tmp"
+}
+
+download_singbox() {
+  # Download sing-box
+  local outdir="$1" rid="$2" ver="${SING_VER:-}" url="" tmp tarname="singbox.tar.gz" bin cronet
+  mkdir -p "$outdir"
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
+  if [[ "$rid" == "linux-riscv64" ]]; then
+    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-riscv64.tar.gz"
+  fi
+  [[ -n "$url" ]] || { echo "[sing-box] Unsupported RID: $rid"; return 1; }
+  echo "[+] Download sing-box: $url"
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/$tarname"
+  tar -C "$tmp" -xzf "$tmp/$tarname"
+  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+  install -m 755 "$bin" "$outdir/sing-box"
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so"
+  rm -rf "$tmp"
+}
+
+# Move geo files to outroot/bin
+unify_geo_layout() {
+  local outroot="$1"
+  mkdir -p "$outroot/bin"
+  local names=( \
+    "geosite.dat" \
+    "geoip.dat" \
+    "geoip-only-cn-private.dat" \
+    "Country.mmdb" \
+    "geoip.metadb" \
+  )
+  for n in "${names[@]}"; do
+    if [[ -f "$outroot/bin/xray/$n" ]]; then
+      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
+    fi
+  done
+}
+
+# Download geo/rule assets
+download_geo_assets() {
+  local outroot="$1"
+  local bin_dir="$outroot/bin"
+  local srss_dir="$bin_dir/srss"
+  mkdir -p "$bin_dir" "$srss_dir"
+
+  echo "[+] Download Xray Geo to ${bin_dir}"
+  curl -fsSL -o "$bin_dir/geosite.dat" \
+    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" \
+    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" \
+    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" \
+    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+
+  echo "[+] Download sing-box rule DB & rule-sets"
+  curl -fsSL -o "$bin_dir/geoip.metadb" \
+    "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb" || true
+
+  for f in \
+    geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs \
+    geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" \
+      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geoip/$f" || true
+  done
+  for f in \
+    geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs \
+    geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" \
+      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geosite/$f" || true
+  done
+
+  # Unify to bin
+  unify_geo_layout "$outroot"
+}
+
+# Prefer the prebuilt v2rayN core bundle; then unify geo layout
+download_v2rayn_bundle() {
+  local outroot="$1" rid="$2"
+  local url=""
+  if [[ "$rid" == "linux-riscv64" ]]; then
+    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-riscv64.zip"
+  fi
+  [[ -n "$url" ]] || { echo "[!] Bundle unsupported RID: $rid"; return 1; }
+  echo "[+] Try v2rayN bundle archive: $url"
+  local tmp zipname
+  tmp="$(mktemp -d)"; zipname="$tmp/v2rayn.zip"
+  curl -fL "$url" -o "$zipname" || { echo "[!] Bundle download failed"; return 1; }
+  unzip -q "$zipname" -d "$tmp" || { echo "[!] Bundle unzip failed"; return 1; }
+
+  if [[ -d "$tmp/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$tmp/bin/" "$outroot/bin/"
+  else
+    rsync -a "$tmp/" "$outroot/"
+  fi
+
+  rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
+  find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
+
+  local nested_dir
+  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$nested_dir/bin/" "$outroot/bin/"
+    rm -rf "$nested_dir"
+  fi
+
+  # Unify to bin/
+  unify_geo_layout "$outroot"
+
+  echo "[+] Bundle extracted to $outroot"
+}
+
+# ===== Build results collection ========================================================
+BUILT_RPMS=()
+
+# ===== Build (single-arch) function ====================================================
+build_for_arch() {
+  # $1: target short arch: riscv64
+  local short="$1"
+  local rid rpm_target archdir
+  case "$short" in
+    riscv64) rid="linux-riscv64"; rpm_target="riscv64"; archdir="riscv64" ;;
+    *) echo "Unknown arch '$short' (use riscv64)"; return 1;;
+  esac
+
+  echo "[*] Building for target: $short  (RID=$rid, RPM --target $rpm_target)"
+
+  # .NET publish (self-contained) for this RID
+  dotnet clean "$PROJECT" -c Release -p:TargetFramework=net10.0
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net10.0" || true
+
+  dotnet restore "$PROJECT" -r "$rid" -p:TargetFramework=net10.0
+  dotnet publish "$PROJECT" \
+    -c Release -r "$rid" \
+    -p:TargetFramework=net10.0 \
+    -p:PublishSingleFile=false \
+    -p:SelfContained=true
+
+  # Per-arch variables (scoped)
+  local RID_DIR="$rid"
+  local PUBDIR
+  PUBDIR="$(dirname "$PROJECT")/bin/Release/net10.0/${RID_DIR}/publish"
+  [[ -d "$PUBDIR" ]] || { echo "Publish directory not found: $PUBDIR"; return 1; }
+
+  # Per-arch working area
+  local PKGROOT="v2rayN-publish"
+  local WORKDIR
+  WORKDIR="$(mktemp -d)"
+  trap '[[ -n "${WORKDIR:-}" ]] && rm -rf "$WORKDIR"' RETURN
+
+  # rpmbuild topdir selection
+  local TOPDIR SPECDIR SOURCEDIR PROJECT_DIR
+  rpmdev-setuptree
+  TOPDIR="${HOME}/rpmbuild"
+  SPECDIR="${TOPDIR}/SPECS"
+  SOURCEDIR="${TOPDIR}/SOURCES"
+
+  # Stage publish content
+  mkdir -p "$WORKDIR/$PKGROOT"
+  cp -a "$PUBDIR/." "$WORKDIR/$PKGROOT/"
+
+  copy_skiasharp_native_riscv64 "$WORKDIR/$PKGROOT" || echo "[!] SkiaSharp native copy failed (skipped)"
+  build_sqlite_native_riscv64 "$WORKDIR/$PKGROOT" || echo "[!] sqlite native build failed (skipped)"
+
+  # Required icon
+  local ICON_CANDIDATE
+  PROJECT_DIR="$(cd "$(dirname "$PROJECT")" && pwd)"
+  ICON_CANDIDATE="$PROJECT_DIR/v2rayN.png"
+  [[ -f "$ICON_CANDIDATE" ]] || { echo "Required icon not found: $ICON_CANDIDATE"; return 1; }
+  cp "$ICON_CANDIDATE" "$WORKDIR/$PKGROOT/v2rayn.png"
+
+  # Prepare bin structure
+  mkdir -p "$WORKDIR/$PKGROOT/bin/xray" "$WORKDIR/$PKGROOT/bin/sing_box"
+
+  # Bundle / cores per-arch
+  fetch_separate_cores_and_rules() {
+    local outroot="$1"
+
+    if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+      download_xray "$outroot/bin/xray" "$RID_DIR" || echo "[!] xray download failed (skipped)"
+    fi
+    if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+      download_singbox "$outroot/bin/sing_box" "$RID_DIR" || echo "[!] sing-box download failed (skipped)"
+    fi
+    download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+  }
+
+  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
+    if download_v2rayn_bundle "$WORKDIR/$PKGROOT" "$RID_DIR"; then
+      echo "[*] Using v2rayN bundle archive."
+    else
+      echo "[*] Bundle failed, fallback to separate core + rules."
+      fetch_separate_cores_and_rules "$WORKDIR/$PKGROOT"
+    fi
+  else
+    echo "[*] --netcore specified: use separate core + rules."
+    fetch_separate_cores_and_rules "$WORKDIR/$PKGROOT"
+  fi
+
+  # Tarball
+  mkdir -p "$SOURCEDIR"
+  tar -C "$WORKDIR" -czf "$SOURCEDIR/$PKGROOT.tar.gz" "$PKGROOT"
+
+  # SPEC
+  local SPECFILE="$SPECDIR/v2rayN.spec"
+  mkdir -p "$SPECDIR"
+  cat > "$SPECFILE" <<'SPEC'
+%global debug_package %{nil}
+%undefine _debuginfo_subpackages
+%undefine _debugsource_packages
+# Ignore outdated LTTng dependencies incorrectly reported by the .NET runtime (to avoid installation failures)
+%global __requires_exclude ^liblttng-ust\.so\..*$
+
+Name:           v2rayN
+Version:        __VERSION__
+Release:        1%{?dist}
+Summary:        v2rayN (Avalonia) GUI client for Linux (riscv64)
+License:        GPL-3.0-only
+URL:            https://github.com/2dust/v2rayN
+BugURL:         https://github.com/2dust/v2rayN/issues
+ExclusiveArch:  riscv64
+Source0:        __PKGROOT__.tar.gz
+
+# Runtime dependencies (Avalonia / X11 / Fonts / GL)
+Requires:       cairo, pango, openssl, mesa-libEGL, mesa-libGL
+Requires:       glibc >= 2.34
+Requires:       fontconfig >= 2.13.1
+Requires:       desktop-file-utils >= 0.26
+Requires:       xdg-utils >= 1.1.3
+Requires:       coreutils >= 8.32
+Requires:       bash >= 5.1
+Requires:       freetype >= 2.10
+
+%description
+v2rayN Linux for Red Hat Enterprise Linux
+Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 / Shadowsocks / tuic / WireGuard
+Support Red Hat Enterprise Linux / Fedora Linux / Rocky Linux / AlmaLinux / CentOS
+For more information, Please visit our website
+https://github.com/2dust/v2rayN
+
+%prep
+%setup -q -n __PKGROOT__
+
+%build
+# no build
+
+%install
+install -dm0755 %{buildroot}/opt/v2rayN
+cp -a * %{buildroot}/opt/v2rayN/
+
+# Normalize permissions
+find %{buildroot}/opt/v2rayN -type d -exec chmod 0755 {} +
+find %{buildroot}/opt/v2rayN -type f -exec chmod 0644 {} +
+[ -f %{buildroot}/opt/v2rayN/v2rayN ] && chmod 0755 %{buildroot}/opt/v2rayN/v2rayN || :
+[ -f %{buildroot}/opt/v2rayN/libSkiaSharp.so ] && chmod 0755 %{buildroot}/opt/v2rayN/libSkiaSharp.so || :
+[ -f %{buildroot}/opt/v2rayN/libHarfBuzzSharp.so ] && chmod 0755 %{buildroot}/opt/v2rayN/libHarfBuzzSharp.so || :
+[ -f %{buildroot}/opt/v2rayN/libe_sqlite3.so ] && chmod 0755 %{buildroot}/opt/v2rayN/libe_sqlite3.so || :
+
+# Launcher (prefer native ELF first, then DLL fallback)
+install -dm0755 %{buildroot}%{_bindir}
+install -m0755 /dev/stdin %{buildroot}%{_bindir}/v2rayn << 'EOF'
+#!/usr/bin/bash
+set -euo pipefail
+DIR="/opt/v2rayN"
+export LD_LIBRARY_PATH="$DIR:${LD_LIBRARY_PATH:-}"
+
+# Prefer native apphost
+if [[ -x "$DIR/v2rayN" ]]; then exec "$DIR/v2rayN" "$@"; fi
+
+# DLL fallback
+for dll in v2rayN.Desktop.dll v2rayN.dll; do
+  if [[ -f "$DIR/$dll" ]]; then exec /usr/bin/dotnet "$DIR/$dll" "$@"; fi
+done
+
+echo "v2rayN launcher: no executable found in $DIR" >&2
+ls -l "$DIR" >&2 || true
+exit 1
+EOF
+
+# Desktop file
+install -dm0755 %{buildroot}%{_datadir}/applications
+install -m0644 /dev/stdin %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
+[Desktop Entry]
+Type=Application
+Name=v2rayN
+Comment=v2rayN for Red Hat Enterprise Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
+EOF
+
+# Icon
+install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
+install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
+
+%post
+/usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
+/usr/bin/gtk-update-icon-cache -f %{_datadir}/icons/hicolor >/dev/null 2>&1 || true
+
+%postun
+/usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
+/usr/bin/gtk-update-icon-cache -f %{_datadir}/icons/hicolor >/dev/null 2>&1 || true
+
+%files
+%{_bindir}/v2rayn
+/opt/v2rayN
+%{_datadir}/applications/v2rayn.desktop
+%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
+SPEC
+
+  # Replace placeholders
+  sed -i "s/__VERSION__/${VERSION}/g" "$SPECFILE"
+  sed -i "s/__PKGROOT__/${PKGROOT}/g" "$SPECFILE"
+
+  # Build RPM for this arch
+  rpmbuild -ba "$SPECFILE" --target "$rpm_target"
+
+  echo "Build done for $short. RPM at:"
+  local f
+  for f in "${TOPDIR}/RPMS/${archdir}/v2rayN-${VERSION}-1"*.rpm; do
+    [[ -e "$f" ]] || continue
+    echo "  $f"
+    BUILT_RPMS+=("$f")
+  done
+}
+
+# ===== Arch selection and build orchestration =========================================
+targets=(riscv64)
+
+for arch in "${targets[@]}"; do
+  build_for_arch "$arch"
+done
+
+echo ""
+echo "================ Build Summary ================"
+if [[ "${#BUILT_RPMS[@]}" -gt 0 ]]; then
+  for rp in "${BUILT_RPMS[@]}"; do
+    echo "$rp"
+  done
+else
+  echo "No RPMs detected in summary (check build logs above)."
+fi
+echo "=============================================="
@@ -1,45 +1,36 @@
 #!/usr/bin/env bash
 set -euo pipefail

-# ====== Require Red Hat Enterprise Linux/FedoraLinux/RockyLinux/AlmaLinux/CentOS ======
-if [[ -r /etc/os-release ]]; then
-  . /etc/os-release
-  case "$ID" in
-    rhel|rocky|almalinux|fedora|centos)
-      echo "[OK] Detected supported system: $NAME $VERSION_ID"
-      ;;
-    *)
-      echo "[ERROR] Unsupported system: $NAME ($ID)."
-      echo "This script only supports Red Hat Enterprise Linux/RockyLinux/AlmaLinux/CentOS or Ubuntu/Debian."
-      exit 1
-      ;;
-  esac
-else
-  echo "[ERROR] Cannot detect system (missing /etc/os-release)."
-  exit 1
+# Require Red Hat base branch
+. /etc/os-release
+
+case "${ID:-}" in
+  rhel|rocky|almalinux|fedora|centos)
+    echo "Detected supported system: ${NAME:-$ID} ${VERSION_ID:-}"
+    ;;
+  *)
+    echo "Unsupported system: ${NAME:-unknown} (${ID:-unknown})."
+    echo "This script only supports: RHEL / Rocky / AlmaLinux / Fedora / CentOS."
+    exit 1
+    ;;
+esac
+
+# Kernel version
+MIN_KERNEL="6.11"
+CURRENT_KERNEL="$(uname -r)"
+
+lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$CURRENT_KERNEL" | sort -V | head -n1)"
+
+if [[ "$lowest" != "$MIN_KERNEL" ]]; then
+    echo "Kernel $CURRENT_KERNEL is below $MIN_KERNEL"
+    exit 1
 fi

-# ======================== Kernel version check (require >= 6.11) =======================
-MIN_KERNEL_MAJOR=6
-MIN_KERNEL_MINOR=11
-KERNEL_FULL=$(uname -r)
-KERNEL_MAJOR=$(echo "$KERNEL_FULL" | cut -d. -f1)
-KERNEL_MINOR=$(echo "$KERNEL_FULL" | cut -d. -f2)
+echo "[OK] Kernel $CURRENT_KERNEL verified."

-echo "[INFO] Detected kernel version: $KERNEL_FULL"
-
-if (( KERNEL_MAJOR < MIN_KERNEL_MAJOR )) || { (( KERNEL_MAJOR == MIN_KERNEL_MAJOR )) && (( KERNEL_MINOR < MIN_KERNEL_MINOR )); }; then
-  echo "[ERROR] Kernel $KERNEL_FULL is too old. Requires Linux >= ${MIN_KERNEL_MAJOR}.${MIN_KERNEL_MINOR}."
-  echo "Please upgrade your system or use a newer container (e.g. Fedora 42+, RHEL 10+)."
-  exit 1
-fi
-
-echo "[OK] Kernel version >= ${MIN_KERNEL_MAJOR}.${MIN_KERNEL_MINOR}."
-
-# ===== Config & Parse arguments =========================================================
+# Config & Parse arguments
 VERSION_ARG="${1:-}"     # Pass version number like 7.13.8, or leave empty
 WITH_CORE="both"         # Default: bundle both xray+sing-box
-AUTOSTART=0              # 1 = enable system-wide autostart (/etc/xdg/autostart)
 FORCE_NETCORE=0          # --netcore => skip archive bundle, use separate downloads
 ARCH_OVERRIDE=""         # --arch x64|arm64|all (optional compile target)
 BUILD_FROM=""            # --buildfrom 1|2|3 to select channel non-interactively
@@ -55,7 +46,6 @@ if [[ -n "${VERSION_ARG:-}" ]]; then shift || true; fi
 while [[ $# -gt 0 ]]; do
  case "$1" in
    --with-core)     WITH_CORE="${2:-both}"; shift 2;;
-    --autostart)     AUTOSTART=1; shift;;
    --xray-ver)      XRAY_VER="${2:-}"; shift 2;;
    --singbox-ver)   SING_VER="${2:-}"; shift 2;;
    --netcore)       FORCE_NETCORE=1; shift;;
@@ -69,38 +59,26 @@ done

 # Conflict: version number AND --buildfrom cannot be used together
 if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
-  echo "[ERROR] You cannot specify both an explicit version and --buildfrom at the same time."
+  echo "You cannot specify both an explicit version and --buildfrom at the same time."
  echo "        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
  exit 1
 fi

-# ===== Environment check + Dependencies ========================================
+# Check and install dependencies
 host_arch="$(uname -m)"
 [[ "$host_arch" == "aarch64" || "$host_arch" == "x86_64" ]] || { echo "Only supports aarch64 / x86_64"; exit 1; }

 install_ok=0
-case "$ID" in
-  rhel|rocky|almalinux|centos)
-    if command -v dnf >/dev/null 2>&1; then
-      sudo dnf -y install dotnet-sdk-8.0 rpm-build rpmdevtools curl unzip tar rsync || \
-      sudo dnf -y install dotnet-sdk rpm-build rpmdevtools curl unzip tar rsync
-      install_ok=1
-    elif command -v yum >/dev/null 2>&1; then
-      sudo yum -y install dotnet-sdk-8.0 rpm-build rpmdevtools curl unzip tar rsync || \
-      sudo yum -y install dotnet-sdk rpm-build rpmdevtools curl unzip tar rsync
-      install_ok=1
-    fi
-    ;;
-  *)
-    ;;
-esac

-if [[ "$install_ok" -ne 1 ]]; then
-  echo "[WARN] Could not auto-install dependencies for '$ID'. Make sure these are available:"
-  echo "       dotnet-sdk 8.x, curl, unzip, tar, rsync, rpm, rpmdevtools, rpm-build (on RPM-based distros)"
+if command -v dnf >/dev/null 2>&1; then
+  sudo dnf -y install rpm-build rpmdevtools curl unzip tar jq rsync dotnet-sdk-8.0 \
+    && install_ok=1
 fi

-command -v curl >/dev/null
+if [[ "$install_ok" -ne 1 ]]; then
+  echo "Could not auto-install dependencies for '$ID'. Make sure these are available:"
+  echo "dotnet-sdk 8.x, curl, unzip, tar, rsync, rpm, rpmdevtools, rpm-build (on Red Hat branch)"
+fi

 # Root directory
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
@@ -119,9 +97,6 @@ if [[ ! -f "$PROJECT" ]]; then
 fi
 [[ -f "$PROJECT" ]] || { echo "v2rayN.Desktop.csproj not found"; exit 1; }

-# Resolve GUI version & auto checkout
-VERSION=""
-
 choose_channel() {
  # If --buildfrom provided, map it directly and skip interaction.
  if [[ -n "${BUILD_FROM:-}" ]]; then
@@ -135,60 +110,35 @@ choose_channel() {

  # Print menu to stderr and read from /dev/tty so stdout only carries the token.
  local ch="latest" sel=""
+
  if [[ -t 0 ]]; then
    echo "[?] Choose v2rayN release channel:" >&2
    echo "    1) Latest (stable)  [default]" >&2
    echo "    2) Pre-release (preview)" >&2
    echo "    3) Keep current (do nothing)" >&2
    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
    if read -r sel </dev/tty; then
      case "${sel:-}" in
        2) ch="prerelease" ;;
        3) ch="keep" ;;
-        *) ch="latest" ;;
      esac
-    else
-      ch="latest"
    fi
-  else
-    ch="latest"
  fi
+
  echo "$ch"
 }

 get_latest_tag_latest() {
-  # Resolve /releases/latest → tag_name
  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
-    | grep -Eo '"tag_name":\s*"v?[^"]+"' \
-    | head -n1 \
-    | sed -E 's/.*"tag_name":\s*"v?([^"]+)".*/\1/'
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
 }

 get_latest_tag_prerelease() {
-  # Resolve newest prerelease=true tag; prefer jq, fallback to sed/grep (no awk)
-  local json tag
-  json="$(curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20")" || return 1
-
-  # 1) Use jq if present
-  if command -v jq >/dev/null 2>&1; then
-    tag="$(printf '%s' "$json" \
-      | jq -r '[.[] | select(.prerelease==true)][0].tag_name' 2>/dev/null \
-      | sed 's/^v//')" || true
-  fi
-
-  # 2) Fallback to sed/grep only
-  if [[ -z "${tag:-}" || "${tag:-}" == "null" ]]; then
-    tag="$(printf '%s' "$json" \
-      | tr '\n' ' ' \
-      | sed 's/},[[:space:]]*{/\n/g' \
-      | grep -m1 -E '"prerelease"[[:space:]]*:[[:space:]]*true' \
-      | grep -Eo '"tag_name"[[:space:]]*:[[:space:]]*"v?[^"]+"' \
-      | head -n1 \
-      | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"v?([^"]+)".*/\1/')" || true
-  fi
-
-  [[ -n "${tag:-}" && "${tag:-}" != "null" ]] || return 1
-  printf '%s\n' "$tag"
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
 }

 git_try_checkout() {
@@ -196,11 +146,7 @@ git_try_checkout() {
  local want="$1" ref=""
  if git rev-parse --git-dir >/dev/null 2>&1; then
    git fetch --tags --force --prune --depth=1 || true
-    if git rev-parse "refs/tags/v${want}" >/dev/null 2>&1; then
-      ref="v${want}"
-    elif git rev-parse "refs/tags/${want}" >/dev/null 2>&1; then
-      ref="${want}"
-    elif git rev-parse --verify "${want}" >/dev/null 2>&1; then
+    if git rev-parse "refs/tags/${want}" >/dev/null 2>&1; then
      ref="${want}"
    fi
    if [[ -n "$ref" ]]; then
@@ -216,130 +162,103 @@ git_try_checkout() {
  return 1
 }

+apply_channel_or_keep() {
+  local ch="$1" tag
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+  if [[ "$ch" == "prerelease" ]]; then
+    tag="$(get_latest_tag_prerelease || true)"
+  else
+    tag="$(get_latest_tag_latest || true)"
+  fi
+
+  [[ -n "$tag" ]] || { echo "Failed to resolve latest tag for channel '${ch}'."; exit 1; }
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || { echo "Failed to checkout '${tag}'."; exit 1; }
+  VERSION="${tag#v}"
+}
+
 if git rev-parse --git-dir >/dev/null 2>&1; then
  if [[ -n "${VERSION_ARG:-}" ]]; then
-    echo "[*] Trying to switch v2rayN repo to version: ${VERSION_ARG}"
-    if git_try_checkout "${VERSION_ARG#v}"; then
-      VERSION="${VERSION_ARG#v}"
+    clean_ver="${VERSION_ARG#v}"
+    if git_try_checkout "$clean_ver"; then
+      VERSION="$clean_ver"
    else
      echo "[WARN] Tag '${VERSION_ARG}' not found."
      ch="$(choose_channel)"
-      if [[ "$ch" == "keep" ]]; then
-        echo "[*] Keep current repository state (no checkout)."
-        if git describe --tags --abbrev=0 >/dev/null 2>&1; then
-          VERSION="$(git describe --tags --abbrev=0)"
-        else
-          VERSION="0.0.0+git"
-        fi
-        VERSION="${VERSION#v}"
-      else
-        echo "[*] Resolving ${ch} tag from GitHub releases..."
-        tag=""
-        if [[ "$ch" == "prerelease" ]]; then
-          tag="$(get_latest_tag_prerelease || true)"
-          if [[ -z "$tag" ]]; then
-            echo "[WARN] Failed to resolve prerelease tag, falling back to latest."
-            tag="$(get_latest_tag_latest || true)"
-          fi
-        else
-          tag="$(get_latest_tag_latest || true)"
-        fi
-        [[ -n "$tag" ]] || { echo "[ERROR] Failed to resolve latest tag for channel '${ch}'."; exit 1; }
-        echo "[*] Latest tag for '${ch}': ${tag}"
-        git_try_checkout "$tag" || { echo "[ERROR] Failed to checkout '${tag}'."; exit 1; }
-        VERSION="${tag#v}"
-      fi
+      apply_channel_or_keep "$ch"
    fi
  else
    ch="$(choose_channel)"
-    if [[ "$ch" == "keep" ]]; then
-      echo "[*] Keep current repository state (no checkout)."
-      if git describe --tags --abbrev=0 >/dev/null 2>&1; then
-        VERSION="$(git describe --tags --abbrev=0)"
-      else
-        VERSION="0.0.0+git"
-      fi
-      VERSION="${VERSION#v}"
-    else
-      echo "[*] Resolving ${ch} tag from GitHub releases..."
-      tag=""
-      if [[ "$ch" == "prerelease" ]]; then
-        tag="$(get_latest_tag_prerelease || true)"
-        if [[ -z "$tag" ]]; then
-          echo "[WARN] Failed to resolve prerelease tag, falling back to latest."
-          tag="$(get_latest_tag_latest || true)"
-        fi
-      else
-        tag="$(get_latest_tag_latest || true)"
-      fi
-      [[ -n "$tag" ]] || { echo "[ERROR] Failed to resolve latest tag for channel '${ch}'."; exit 1; }
-      echo "[*] Latest tag for '${ch}': ${tag}"
-      git_try_checkout "$tag" || { echo "[ERROR] Failed to checkout '${tag}'."; exit 1; }
-      VERSION="${tag#v}"
-    fi
+    apply_channel_or_keep "$ch"
  fi
 else
-  echo "[WARN] Current directory is not a git repo; cannot checkout version. Proceeding on current tree."
-  VERSION="${VERSION_ARG:-}"
-  if [[ -z "$VERSION" ]]; then
-    if git describe --tags --abbrev=0 >/dev/null 2>&1; then
-      VERSION="$(git describe --tags --abbrev=0)"
-    else
-      VERSION="0.0.0+git"
-    fi
-  fi
-  VERSION="${VERSION#v}"
+  echo "Current directory is not a git repo; proceeding on current tree."
+  VERSION="${VERSION_ARG:-0.0.0}"
 fi
+
+VERSION="${VERSION#v}"
 echo "[*] GUI version resolved as: ${VERSION}"

-# ===== Helpers for core/rules download (use RID_DIR for arch sync) =====================
+# Helpers for core
 download_xray() {
-  # Download Xray core and install to outdir/xray
-  local outdir="$1" ver="${XRAY_VER:-}" url tmp zipname="xray.zip"
+  # Download Xray core
+  local outdir="$1" rid="$2" ver="${XRAY_VER:-}" url tmp zipname="xray.zip"
  mkdir -p "$outdir"
-  if [[ -n "${XRAY_VER:-}" ]]; then ver="${XRAY_VER}"; fi
  if [[ -z "$ver" ]]; then
    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
  fi
  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
-  if [[ "$RID_DIR" == "linux-arm64" ]]; then
+  if [[ "$rid" == "linux-arm64" ]]; then
    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-arm64-v8a.zip"
  else
    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-64.zip"
  fi
  echo "[+] Download xray: $url"
-  tmp="$(mktemp -d)"; trap '[[ -n "${tmp:-}" ]] && rm -rf "$tmp"' RETURN
+  tmp="$(mktemp -d)"
  curl -fL "$url" -o "$tmp/$zipname"
  unzip -q "$tmp/$zipname" -d "$tmp"
-  install -Dm755 "$tmp/xray" "$outdir/xray"
+  install -m 755 "$tmp/xray" "$outdir/xray"
+  rm -rf "$tmp"
 }

 download_singbox() {
-  # Download sing-box core and install to outdir/sing-box
-  local outdir="$1" ver="${SING_VER:-}" url tmp tarname="singbox.tar.gz" bin
+  # Download sing-box
+  local outdir="$1" rid="$2" ver="${SING_VER:-}" url tmp tarname="singbox.tar.gz" bin cronet
  mkdir -p "$outdir"
-  if [[ -n "${SING_VER:-}" ]]; then ver="${SING_VER}"; fi
  if [[ -z "$ver" ]]; then
    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
-        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
  fi
  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
-  if [[ "$RID_DIR" == "linux-arm64" ]]; then
+  if [[ "$rid" == "linux-arm64" ]]; then
    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-arm64.tar.gz"
  else
    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-amd64.tar.gz"
  fi
  echo "[+] Download sing-box: $url"
-  tmp="$(mktemp -d)"; trap '[[ -n "${tmp:-}" ]] && rm -rf "$tmp"' RETURN
+  tmp="$(mktemp -d)"
  curl -fL "$url" -o "$tmp/$tarname"
  tar -C "$tmp" -xzf "$tmp/$tarname"
  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
-  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; return 1; }
-  install -Dm755 "$bin" "$outdir/sing-box"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+  install -m 755 "$bin" "$outdir/sing-box"
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so"
+  rm -rf "$tmp"
 }

-# Move geo files to a unified path: outroot/bin
+# Move geo files to outroot/bin
 unify_geo_layout() {
  local outroot="$1"
  mkdir -p "$outroot/bin"
@@ -351,18 +270,13 @@ unify_geo_layout() {
    "geoip.metadb" \
  )
  for n in "${names[@]}"; do
-    # If file exists under bin/xray/, move it up to bin/
    if [[ -f "$outroot/bin/xray/$n" ]]; then
      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
    fi
-    # If file already in bin/, leave it as-is
-    if [[ -f "$outroot/bin/$n" ]]; then
-      :
-    fi
  done
 }

-# Download geo/rule assets; then unify to bin/
+# Download geo/rule assets
 download_geo_assets() {
  local outroot="$1"
  local bin_dir="$outroot/bin"
@@ -396,15 +310,15 @@ download_geo_assets() {
      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geosite/$f" || true
  done

-  # Unify to bin/
+  # Unify to bin
  unify_geo_layout "$outroot"
 }

 # Prefer the prebuilt v2rayN core bundle; then unify geo layout
 download_v2rayn_bundle() {
-  local outroot="$1"
+  local outroot="$1" rid="$2"
  local url=""
-  if [[ "$RID_DIR" == "linux-arm64" ]]; then
+  if [[ "$rid" == "linux-arm64" ]]; then
    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-arm64.zip"
  else
    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-64.zip"
@@ -427,7 +341,7 @@ download_v2rayn_bundle() {

  local nested_dir
  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
-  if [[ -n "${nested_dir:-}" && -d "$nested_dir/bin" ]]; then
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
    mkdir -p "$outroot/bin"
    rsync -a "$nested_dir/bin/" "$outroot/bin/"
    rm -rf "$nested_dir"
@@ -451,7 +365,7 @@ build_for_arch() {
  case "$short" in
    x64)   rid="linux-x64";   rpm_target="x86_64"; archdir="x86_64" ;;
    arm64) rid="linux-arm64"; rpm_target="aarch64"; archdir="aarch64" ;;
-    *) echo "[ERROR] Unknown arch '$short' (use x64|arm64)"; return 1;;
+    *) echo "Unknown arch '$short' (use x64|arm64)"; return 1;;
  esac

  echo "[*] Building for target: $short  (RID=$rid, RPM --target $rpm_target)"
@@ -464,17 +378,13 @@ build_for_arch() {
  dotnet publish "$PROJECT" \
    -c Release -r "$rid" \
    -p:PublishSingleFile=false \
-    -p:SelfContained=true \
-    -p:IncludeNativeLibrariesForSelfExtract=true
+    -p:SelfContained=true

  # Per-arch variables (scoped)
  local RID_DIR="$rid"
  local PUBDIR
  PUBDIR="$(dirname "$PROJECT")/bin/Release/net8.0/${RID_DIR}/publish"
-  [[ -d "$PUBDIR" ]]
-
-  # Make RID_DIR visible to download helpers (they read this var)
-  export RID_DIR
+  [[ -d "$PUBDIR" ]] || { echo "Publish directory not found: $PUBDIR"; return 1; }

  # Per-arch working area
  local PKGROOT="v2rayN-publish"
@@ -483,58 +393,49 @@ build_for_arch() {
  trap '[[ -n "${WORKDIR:-}" ]] && rm -rf "$WORKDIR"' RETURN

  # rpmbuild topdir selection
-  local TOPDIR SPECDIR SOURCEDIR USE_TOPDIR_DEFINE
-  if [[ "$ID" =~ ^(rhel|rocky|almalinux|centos)$ ]]; then
-    rpmdev-setuptree
-    TOPDIR="${HOME}/rpmbuild"
-    SPECDIR="${TOPDIR}/SPECS"
-    SOURCEDIR="${TOPDIR}/SOURCES"
-    USE_TOPDIR_DEFINE=0
-  else
-    TOPDIR="${WORKDIR}/rpmbuild"
-    SPECDIR="${TOPDIR}/SPECS}"
-    SOURCEDIR="${TOPDIR}/SOURCES"
-    mkdir -p "${SPECDIR}" "${SOURCEDIR}" "${TOPDIR}/BUILD" "${TOPDIR}/RPMS" "${TOPDIR}/SRPMS"
-    USE_TOPDIR_DEFINE=1
-  fi
+  local TOPDIR SPECDIR SOURCEDIR
+  rpmdev-setuptree
+  TOPDIR="${HOME}/rpmbuild"
+  SPECDIR="${TOPDIR}/SPECS"
+  SOURCEDIR="${TOPDIR}/SOURCES"

  # Stage publish content
  mkdir -p "$WORKDIR/$PKGROOT"
  cp -a "$PUBDIR/." "$WORKDIR/$PKGROOT/"

-  # Optional icon
+  # Required icon
  local ICON_CANDIDATE
-  ICON_CANDIDATE="$(dirname "$PROJECT")/../v2rayN.Desktop/v2rayN.png"
-  [[ -f "$ICON_CANDIDATE" ]] && cp "$ICON_CANDIDATE" "$WORKDIR/$PKGROOT/v2rayn.png" || true
+  PROJECT_DIR="$(cd "$(dirname "$PROJECT")" && pwd)"
+  ICON_CANDIDATE="$PROJECT_DIR/v2rayN.png"
+  [[ -f "$ICON_CANDIDATE" ]] || { echo "Required icon not found: $ICON_CANDIDATE"; return 1; }
+  cp "$ICON_CANDIDATE" "$WORKDIR/$PKGROOT/v2rayn.png"

  # Prepare bin structure
  mkdir -p "$WORKDIR/$PKGROOT/bin/xray" "$WORKDIR/$PKGROOT/bin/sing_box"

  # Bundle / cores per-arch
+  fetch_separate_cores_and_rules() {
+    local outroot="$1"
+
+    if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+      download_xray "$outroot/bin/xray" "$RID_DIR" || echo "[!] xray download failed (skipped)"
+    fi
+    if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+      download_singbox "$outroot/bin/sing_box" "$RID_DIR" || echo "[!] sing-box download failed (skipped)"
+    fi
+    download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+  }
+
  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
-    if download_v2rayn_bundle "$WORKDIR/$PKGROOT"; then
+    if download_v2rayn_bundle "$WORKDIR/$PKGROOT" "$RID_DIR"; then
      echo "[*] Using v2rayN bundle archive."
    else
      echo "[*] Bundle failed, fallback to separate core + rules."
-      if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
-        download_xray "$WORKDIR/$PKGROOT/bin/xray" || echo "[!] xray download failed (skipped)"
-      fi
-      if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
-        download_singbox "$WORKDIR/$PKGROOT/bin/sing_box" || echo "[!] sing-box download failed (skipped)"
-      fi
-      download_geo_assets "$WORKDIR/$PKGROOT" || echo "[!] Geo rules download failed (skipped)"
+      fetch_separate_cores_and_rules "$WORKDIR/$PKGROOT"
    fi
  else
    echo "[*] --netcore specified: use separate core + rules."
-    if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
-      download_xray "$WORKDIR/$PKGROOT/bin/xray" || echo "[!] xray download failed (skipped)"
-    fi
-    if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
-      download_singbox "$WORKDIR/$PKGROOT/bin/sing_box" || echo "[!] sing-box download failed (skipped)"
-    fi
-    download_geo_assets "$WORKDIR/$PKGROOT" || echo "[!] Geo rules download failed (skipped)"
-    # ---- REQUIRED: always fetch mihomo in netcore mode, per-arch ----
-    # download_mihomo "$WORKDIR/$PKGROOT" || echo "[!] mihomo download failed (skipped)"
+    fetch_separate_cores_and_rules "$WORKDIR/$PKGROOT"
  fi

  # Tarball
@@ -588,9 +489,14 @@ https://github.com/2dust/v2rayN
 install -dm0755 %{buildroot}/opt/v2rayN
 cp -a * %{buildroot}/opt/v2rayN/

+# Normalize permissions
+find %{buildroot}/opt/v2rayN -type d -exec chmod 0755 {} +
+find %{buildroot}/opt/v2rayN -type f -exec chmod 0644 {} +
+[ -f %{buildroot}/opt/v2rayN/v2rayN ] && chmod 0755 %{buildroot}/opt/v2rayN/v2rayN || :
+
 # Launcher (prefer native ELF first, then DLL fallback)
 install -dm0755 %{buildroot}%{_bindir}
-cat > %{buildroot}%{_bindir}/v2rayn << 'EOF'
+install -m0755 /dev/stdin %{buildroot}%{_bindir}/v2rayn << 'EOF'
 #!/usr/bin/bash
 set -euo pipefail
 DIR="/opt/v2rayN"
@@ -607,11 +513,10 @@ echo "v2rayN launcher: no executable found in $DIR" >&2
 ls -l "$DIR" >&2 || true
 exit 1
 EOF
-chmod 0755 %{buildroot}%{_bindir}/v2rayn

 # Desktop file
 install -dm0755 %{buildroot}%{_datadir}/applications
-cat > %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
+install -m0644 /dev/stdin %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
 [Desktop Entry]
 Type=Application
 Name=v2rayN
@@ -623,10 +528,8 @@ Categories=Network;
 EOF

 # Icon
-if [ -f "%{_builddir}/__PKGROOT__/v2rayn.png" ]; then
-  install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
-  install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
-fi
+install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
+install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png

 %post
 /usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
@@ -643,72 +546,12 @@ fi
 %{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
 SPEC

-  # Autostart injection (inside %install) and %files entry
-  if [[ "$AUTOSTART" -eq 1 ]]; then
-    awk '
-      BEGIN{ins=0}
-      /^%post$/ && !ins {
-        print "# --- Autostart (.desktop) ---"
-        print "install -dm0755 %{buildroot}/etc/xdg/autostart"
-        print "cat > %{buildroot}/etc/xdg/autostart/v2rayn.desktop << '\''EOF'\''"
-        print "[Desktop Entry]"
-        print "Type=Application"
-        print "Name=v2rayN (Autostart)"
-        print "Exec=v2rayn"
-        print "X-GNOME-Autostart-enabled=true"
-        print "NoDisplay=false"
-        print "EOF"
-        ins=1
-      }
-      {print}
-    ' "$SPECFILE" > "${SPECFILE}.tmp" && mv "${SPECFILE}.tmp" "$SPECFILE"
-
-    awk '
-      BEGIN{infiles=0; done=0}
-      /^%files$/        {infiles=1}
-      infiles && done==0 && $0 ~ /%{_datadir}\/icons\/hicolor\/256x256\/apps\/v2rayn\.png/ {
-        print
-        print "%config(noreplace) /etc/xdg/autostart/v2rayn.desktop"
-        done=1
-        next
-      }
-      {print}
-    ' "$SPECFILE" > "${SPECFILE}.tmp" && mv "${SPECFILE}.tmp" "$SPECFILE"
-  fi
-
  # Replace placeholders
  sed -i "s/__VERSION__/${VERSION}/g" "$SPECFILE"
  sed -i "s/__PKGROOT__/${PKGROOT}/g" "$SPECFILE"

-  # ----- Select proper 'strip' per target arch on Ubuntu only (cross-binutils) -----
-  # NOTE: We define only __strip to point to the target-arch strip.
-  #       DO NOT override __brp_strip (it must stay the brp script path).
-  local STRIP_ARGS=()
-  if [[ "$ID" == "ubuntu" ]]; then
-    local STRIP_BIN=""
-    if [[ "$short" == "x64" ]]; then
-      STRIP_BIN="/usr/bin/x86_64-linux-gnu-strip"
-    else
-      STRIP_BIN="/usr/bin/aarch64-linux-gnu-strip"
-    fi
-    if [[ -x "$STRIP_BIN" ]]; then
-      STRIP_ARGS=( --define "__strip $STRIP_BIN" )
-    fi
-  fi
-
-  # Build RPM for this arch (force rpm --target to match compile arch)
-  if [[ "$USE_TOPDIR_DEFINE" -eq 1 ]]; then
-    rpmbuild -ba "$SPECFILE" --define "_topdir $TOPDIR" --target "$rpm_target" "${STRIP_ARGS[@]}"
-  else
-    rpmbuild -ba "$SPECFILE" --target "$rpm_target" "${STRIP_ARGS[@]}"
-  fi
-
-  # Copy temporary rpmbuild to ~/rpmbuild on Debian/Ubuntu path
-  if [[ "$USE_TOPDIR_DEFINE" -eq 1 ]]; then
-    mkdir -p "$HOME/rpmbuild"
-    rsync -a "$TOPDIR"/ "$HOME/rpmbuild"/
-    TOPDIR="$HOME/rpmbuild"
-  fi
+  # Build RPM for this arch
+  rpmbuild -ba "$SPECFILE" --target "$rpm_target"

  echo "Build done for $short. RPM at:"
  local f
@@ -721,33 +564,18 @@ SPEC

 # ===== Arch selection and build orchestration =========================================
 case "${ARCH_OVERRIDE:-}" in
-  "")
-    # No --arch: use host architecture
-    if [[ "$host_arch" == "aarch64" ]]; then
-      build_for_arch arm64
-    else
-      build_for_arch x64
-    fi
-    ;;
-  x64|amd64)
-    build_for_arch x64
-    ;;
-  arm64|aarch64)
-    build_for_arch arm64
-    ;;
-  all)
-    BUILT_ALL=1
-    # Build x64 and arm64 separately; each package contains its own arch-only binaries.
-    build_for_arch x64
-    build_for_arch arm64
-    ;;
-  *)
-    echo "[ERROR] Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all."
-    exit 1
-    ;;
+  all)           targets=(x64 arm64); BUILT_ALL=1 ;;
+  x64|amd64)     targets=(x64) ;;
+  arm64|aarch64) targets=(arm64) ;;
+  "")            targets=($([[ "$host_arch" == "aarch64" ]] && echo arm64 || echo x64)) ;;
+  *)             echo "Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all."; exit 1 ;;
 esac

-# ===== Final summary if building both arches ==========================================
+for arch in "${targets[@]}"; do
+  build_for_arch "$arch"
+done
+
+# Print Both arches information
 if [[ "$BUILT_ALL" -eq 1 ]]; then
  echo ""
  echo "================ Build Summary (both architectures) ================"
@@ -756,7 +584,7 @@ if [[ "$BUILT_ALL" -eq 1 ]]; then
      echo "$rp"
    done
  else
-    echo "[WARN] No RPMs detected in summary (check build logs above)."
+    echo "No RPMs detected in summary (check build logs above)."
  fi
-  echo "==================================================================="
+  echo "===================================================================="
 fi
@@ -1,7 +1,7 @@
 <Project>

    <PropertyGroup>
-        <Version>7.18.0</Version>
+        <Version>7.21.0</Version>
    </PropertyGroup>

    <PropertyGroup>
@@ -5,27 +5,31 @@
    <CentralPackageVersionOverrideEnabled>false</CentralPackageVersionOverrideEnabled>
  </PropertyGroup>
  <ItemGroup>
-    <PackageVersion Include="Avalonia.AvaloniaEdit" Version="11.4.0" />
-    <PackageVersion Include="Avalonia.Controls.DataGrid" Version="11.3.11" />
-    <PackageVersion Include="Avalonia.Desktop" Version="11.3.11" />
-    <PackageVersion Include="Avalonia.Diagnostics" Version="11.3.11" />
-    <PackageVersion Include="ReactiveUI.Avalonia" Version="11.3.8" />
-    <PackageVersion Include="CliWrap" Version="3.10.0" />
-    <PackageVersion Include="Downloader" Version="4.0.3" />
+    <PackageVersion Include="Avalonia.AvaloniaEdit" Version="11.4.1" />
+    <PackageVersion Include="Avalonia.Controls.DataGrid" Version="11.3.13" />
+    <PackageVersion Include="Avalonia.Desktop" Version="11.3.13" />
+    <PackageVersion Include="Avalonia.Diagnostics" Version="11.3.13" />
+    <PackageVersion Include="AwesomeAssertions" Version="9.4.0" />
+    <PackageVersion Include="DialogHost.Avalonia" Version="0.11.0" />
+    <PackageVersion Include="ReactiveUI.Avalonia" Version="11.4.12" />
+    <PackageVersion Include="CliWrap" Version="3.10.1" />
+    <PackageVersion Include="Downloader" Version="5.2.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.4.0" />
    <PackageVersion Include="H.NotifyIcon.Wpf" Version="2.4.1" />
-    <PackageVersion Include="MaterialDesignThemes" Version="5.3.0" />
-    <PackageVersion Include="MessageBox.Avalonia" Version="3.3.1.1" />
-    <PackageVersion Include="QRCoder" Version="1.7.0" />
-    <PackageVersion Include="ReactiveUI" Version="22.3.1" />
+    <PackageVersion Include="MaterialDesignThemes" Version="5.3.1" />
+    <PackageVersion Include="QRCoder" Version="1.8.0" />
+    <PackageVersion Include="ReactiveUI" Version="23.2.1" />
    <PackageVersion Include="ReactiveUI.Fody" Version="19.5.41" />
-    <PackageVersion Include="ReactiveUI.WPF" Version="22.3.1" />
-    <PackageVersion Include="Semi.Avalonia" Version="11.3.7.2" />
-    <PackageVersion Include="Semi.Avalonia.AvaloniaEdit" Version="11.2.0.1" />
-    <PackageVersion Include="Semi.Avalonia.DataGrid" Version="11.3.7.2" />
-    <PackageVersion Include="NLog" Version="6.1.0" />
+    <PackageVersion Include="ReactiveUI.WPF" Version="23.2.1" />
+    <PackageVersion Include="Semi.Avalonia" Version="11.3.7.3" />
+    <PackageVersion Include="Semi.Avalonia.AvaloniaEdit" Version="11.2.0.2" />
+    <PackageVersion Include="Semi.Avalonia.DataGrid" Version="11.3.7.3" />
+    <PackageVersion Include="NLog" Version="6.1.2" />
    <PackageVersion Include="sqlite-net-pcl" Version="1.9.172" />
    <PackageVersion Include="TaskScheduler" Version="2.12.2" />
    <PackageVersion Include="WebDav.Client" Version="2.9.0" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
+    <PackageVersion Include="xunit.v3" Version="3.2.2" />
    <PackageVersion Include="YamlDotNet" Version="16.3.0" />
    <PackageVersion Include="ZXing.Net.Bindings.SkiaSharp" Version="0.16.14" />
  </ItemGroup>
@@ -0,0 +1,113 @@
+using AwesomeAssertions;
+using ServiceLib.Enums;
+using ServiceLib.Handler.Builder;
+using ServiceLib.Helper;
+using ServiceLib.Models;
+using Xunit;
+
+namespace ServiceLib.Tests.CoreConfig.Context;
+
+public class CoreConfigContextBuilderTests
+{
+	[Fact]
+	public async Task ResolveNodeAsync_DirectCycleDependency_ShouldFailWithCycleError()
+	{
+		var config = CoreConfigTestFactory.CreateConfig();
+		CoreConfigTestFactory.BindAppManagerConfig(config);
+
+		var groupAId = NewId("group-a");
+		var groupBId = NewId("group-b");
+		var groupA = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupAId, "group-a", [groupBId]);
+		var groupB = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupBId, "group-b", [groupAId]);
+
+		await UpsertProfilesAsync(groupA, groupB);
+
+		var context = CoreConfigTestFactory.CreateContext(config, groupA, ECoreType.Xray);
+		context.AllProxiesMap.Clear();
+
+		var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
+
+		validatorResult.Success.Should().BeFalse();
+		validatorResult.Errors.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+		context.AllProxiesMap.Should().NotContainKey(groupA.IndexId);
+		context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+	}
+
+	[Fact]
+	public async Task ResolveNodeAsync_IndirectCycleDependency_ShouldFailWithCycleError()
+	{
+		var config = CoreConfigTestFactory.CreateConfig();
+		CoreConfigTestFactory.BindAppManagerConfig(config);
+
+		var groupAId = NewId("group-a");
+		var groupBId = NewId("group-b");
+		var groupCId = NewId("group-c");
+		var groupA = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupAId, "group-a", [groupBId]);
+		var groupB = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupBId, "group-b", [groupCId]);
+		var groupC = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupCId, "group-c", [groupAId]);
+
+		await UpsertProfilesAsync(groupA, groupB, groupC);
+
+		var context = CoreConfigTestFactory.CreateContext(config, groupA, ECoreType.Xray);
+		context.AllProxiesMap.Clear();
+
+		var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
+
+		validatorResult.Success.Should().BeFalse();
+		validatorResult.Errors.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+		context.AllProxiesMap.Should().NotContainKey(groupA.IndexId);
+		context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+		context.AllProxiesMap.Should().NotContainKey(groupC.IndexId);
+	}
+
+	[Fact]
+	public async Task ResolveNodeAsync_CycleWithValidBranch_ShouldSkipCycleAndKeepValidChild()
+	{
+		var config = CoreConfigTestFactory.CreateConfig();
+		CoreConfigTestFactory.BindAppManagerConfig(config);
+
+		var groupAId = NewId("group-a");
+		var groupBId = NewId("group-b");
+		var leafId = NewId("leaf");
+		var groupA = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupAId, "group-a", [groupBId, leafId]);
+		var groupB = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupBId, "group-b", [groupAId]);
+		var leaf = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, leafId, "leaf");
+
+		await UpsertProfilesAsync(groupA, groupB, leaf);
+
+		var context = CoreConfigTestFactory.CreateContext(config, groupA, ECoreType.Xray);
+		context.AllProxiesMap.Clear();
+
+		var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
+
+		validatorResult.Success.Should().BeTrue();
+		validatorResult.Errors.Should().BeEmpty();
+		validatorResult.Warnings.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+
+		context.AllProxiesMap.Should().ContainKey(leaf.IndexId);
+		context.AllProxiesMap.Should().ContainKey(groupA.IndexId);
+		context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+		groupA.GetProtocolExtra().ChildItems.Should().Be(leaf.IndexId);
+	}
+
+	private static string NewId(string prefix)
+	{
+		return $"{prefix}-{Guid.NewGuid():N}";
+	}
+
+	private static bool ContainsCycleDependencyMessage(string message)
+	{
+		return message.Contains("cycle dependency", StringComparison.OrdinalIgnoreCase)
+			   || message.Contains("循环依赖", StringComparison.Ordinal)
+			   || message.Contains("循環依賴", StringComparison.Ordinal);
+	}
+
+	private static async Task UpsertProfilesAsync(params ProfileItem[] profiles)
+	{
+		SQLiteHelper.Instance.CreateTable<ProfileItem>();
+		foreach (var profile in profiles)
+		{
+			await SQLiteHelper.Instance.ReplaceAsync(profile);
+		}
+	}
+}
@@ -0,0 +1,197 @@
+using ServiceLib.Enums;
+using ServiceLib.Manager;
+using ServiceLib.Models;
+using System.Reflection;
+
+namespace ServiceLib.Tests.CoreConfig;
+
+internal static class CoreConfigTestFactory
+{
+    public static void BindAppManagerConfig(Config config)
+    {
+        var field = typeof(AppManager).GetField("_config", BindingFlags.Instance | BindingFlags.NonPublic);
+        field?.SetValue(AppManager.Instance, config);
+    }
+
+    public static Config CreateConfig(ECoreType vmessCoreType = ECoreType.Xray)
+    {
+        return new Config
+        {
+            CoreBasicItem = new CoreBasicItem { Loglevel = "warning", MuxEnabled = false },
+            TunModeItem = new TunModeItem { EnableTun = false, IcmpRouting = "default" },
+            KcpItem = new KcpItem(),
+            GrpcItem = new GrpcItem(),
+            RoutingBasicItem =
+                new RoutingBasicItem
+                {
+                    DomainStrategy = Global.AsIs,
+                    DomainStrategy4Singbox = string.Empty,
+                    RoutingIndexId = string.Empty,
+                },
+            GuiItem = new GUIItem { EnableStatistics = false, DisplayRealTimeSpeed = false, EnableLog = false },
+            MsgUIItem = new MsgUIItem(),
+            UiItem =
+                new UIItem
+                {
+                    CurrentLanguage = "en", CurrentFontFamily = "sans", MainColumnItem = [], WindowSizeItem = []
+                },
+            ConstItem = new ConstItem(),
+            SpeedTestItem = new SpeedTestItem
+            {
+                SpeedPingTestUrl = Global.SpeedPingTestUrls.First(),
+                SpeedTestUrl = Global.SpeedTestUrls.First(),
+                SpeedTestTimeout = 10,
+                MixedConcurrencyCount = 1,
+                IPAPIUrl = string.Empty,
+            },
+            Mux4RayItem = new Mux4RayItem { Concurrency = 8, XudpConcurrency = 16, XudpProxyUDP443 = "reject" },
+            Mux4SboxItem = new Mux4SboxItem { Protocol = Global.SingboxMuxs.First(), MaxConnections = 8 },
+            HysteriaItem = new HysteriaItem { UpMbps = 100, DownMbps = 100 },
+            ClashUIItem = new ClashUIItem { ConnectionsColumnItem = [] },
+            SystemProxyItem =
+                new SystemProxyItem
+                {
+                    SystemProxyExceptions = string.Empty, SystemProxyAdvancedProtocol = string.Empty
+                },
+            WebDavItem = new WebDavItem(),
+            CheckUpdateItem = new CheckUpdateItem(),
+            Fragment4RayItem = new Fragment4RayItem { Packets = "tlshello", Length = "100-200", Interval = "10-20" },
+            Inbound =
+            [
+                new InItem
+                {
+                    Protocol = nameof(EInboundProtocol.socks),
+                    LocalPort = 10808,
+                    UdpEnabled = true,
+                    SniffingEnabled = true,
+                    RouteOnly = false,
+                    DestOverride = ["http", "tls"],
+                }
+            ],
+            GlobalHotkeys = [],
+            CoreTypeItem =
+            [
+                new CoreTypeItem { ConfigType = EConfigType.VMess, CoreType = vmessCoreType }
+            ],
+            SimpleDNSItem = new SimpleDNSItem
+            {
+                BootstrapDNS = Global.DomainPureIPDNSAddress.FirstOrDefault(),
+                ServeStale = false,
+                ParallelQuery = false,
+                Strategy4Freedom = Global.AsIs,
+                Strategy4Proxy = Global.AsIs,
+            },
+            IndexId = string.Empty,
+            SubIndexId = string.Empty,
+        };
+    }
+
+    public static ProfileItem CreateVmessNode(ECoreType coreType, string indexId = "node-1", string remarks = "demo")
+    {
+        var node = new ProfileItem
+        {
+            IndexId = indexId,
+            ConfigType = EConfigType.VMess,
+            CoreType = coreType,
+            Remarks = remarks,
+            Address = "example.com",
+            Port = 443,
+            Password = Guid.NewGuid().ToString(),
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+            Subid = string.Empty,
+        };
+
+        node.SetProtocolExtra(node.GetProtocolExtra() with { AlterId = "0", VmessSecurity = Global.DefaultSecurity, });
+
+        return node;
+    }
+
+    public static ProfileItem CreateSocksNode(ECoreType coreType, string indexId = "node-socks-1",
+        string remarks = "demo-socks")
+    {
+        return new ProfileItem
+        {
+            IndexId = indexId,
+            ConfigType = EConfigType.SOCKS,
+            CoreType = coreType,
+            Remarks = remarks,
+            Address = "127.0.0.1",
+            Port = 1080,
+            Password = "pass",
+            Username = "user",
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+            Subid = string.Empty,
+        };
+    }
+
+    public static ProfileItem CreatePolicyGroupNode(ECoreType coreType, string indexId, string remarks,
+        IEnumerable<string> childIndexIds)
+    {
+        var node = new ProfileItem
+        {
+            IndexId = indexId, ConfigType = EConfigType.PolicyGroup, CoreType = coreType, Remarks = remarks,
+        };
+        node.SetProtocolExtra(node.GetProtocolExtra() with
+        {
+            GroupType = nameof(EConfigType.PolicyGroup), ChildItems = string.Join(",", childIndexIds),
+        });
+
+        return node;
+    }
+
+    public static ProfileItem CreateProxyChainNode(ECoreType coreType, string indexId, string remarks,
+        IEnumerable<string> childIndexIds)
+    {
+        var node = new ProfileItem
+        {
+            IndexId = indexId, ConfigType = EConfigType.ProxyChain, CoreType = coreType, Remarks = remarks,
+        };
+        node.SetProtocolExtra(node.GetProtocolExtra() with
+        {
+            GroupType = nameof(EConfigType.ProxyChain), ChildItems = string.Join(",", childIndexIds),
+        });
+
+        return node;
+    }
+
+    public static CoreConfigContext CreateContext(Config config, ProfileItem node, ECoreType runCoreType)
+    {
+        return new CoreConfigContext
+        {
+            Node = node,
+            RunCoreType = runCoreType,
+            AppConfig = config,
+            RoutingItem = new RoutingItem
+            {
+                Id = "r1",
+                Remarks = "default",
+                RuleSet = "[]",
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            },
+            RawDnsItem = null,
+            SimpleDnsItem = config.SimpleDNSItem,
+            AllProxiesMap = new Dictionary<string, ProfileItem> { [node.IndexId] = node },
+            FullConfigTemplate = null,
+            IsTunEnabled = false,
+            ProtectDomainList = [],
+        };
+    }
+
+    public static Config CreateConfigWithDirectExpectedIPs(ECoreType coreType,
+        string directExpectedIPs = "192.168.0.0/16,geoip:cn")
+    {
+        var config = CreateConfig(coreType);
+        config.SimpleDNSItem.DirectExpectedIPs = directExpectedIPs;
+        return config;
+    }
+
+    public static Config CreateConfigWithBootstrapDNS(ECoreType coreType, string bootstrapDns = "8.8.8.8")
+    {
+        var config = CreateConfig(coreType);
+        config.SimpleDNSItem.BootstrapDNS = bootstrapDns;
+        return config;
+    }
+}
@@ -0,0 +1,511 @@
+using AwesomeAssertions;
+using ServiceLib.Common;
+using ServiceLib.Enums;
+using ServiceLib.Models;
+using ServiceLib.Services.CoreConfig;
+using Xunit;
+
+namespace ServiceLib.Tests.CoreConfig.Singbox;
+
+public class CoreConfigSingboxServiceTests
+{
+    [Fact]
+    public void GenerateClientConfigContent_ShouldGenerateBasicProxyConfig()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box);
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        result.Data.Should().NotBeNull();
+
+        var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString());
+        singboxConfig.Should().NotBeNull();
+        singboxConfig!.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "socks");
+        singboxConfig.inbounds.Should().Contain(i => i.type == nameof(EInboundProtocol.mixed));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroup_ShouldExpandChildrenAndBuildSelector()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.sing_box, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChain_ShouldBuildDetourChain()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.sing_box, "c1", "chain",
+            [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "socks");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o =>
+            o.tag == Global.ProxyTag &&
+            (o.detour ?? string.Empty).StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroupWithProxyChain_ShouldBuildCombinedOutbounds()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n3", "node-3");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.sing_box, "c1", "chain",
+            [n1.IndexId, n2.IndexId]);
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.sing_box, "g1", "group",
+            [chain.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[chain.IndexId] = chain;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChainWithPolicyGroup_ShouldBuildClonedChainBranches()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n3", "node-3");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.sing_box, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.sing_box, "c1", "chain",
+            [group.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[group.IndexId] = group;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-2-", StringComparison.Ordinal));
+
+        var proxyCloneCount = cfg.outbounds.Count(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal));
+        proxyCloneCount.Should().Be(2);
+
+        var allCloneDetoursPointToGroupBranches = cfg.outbounds
+            .Where(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal))
+            .All(o => (o.detour ?? string.Empty).StartsWith("chain-proxy-1-group-", StringComparison.Ordinal));
+        allCloneDetoursPointToGroupBranches.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_DirectAndBlock_ShouldApplyRules()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-1",
+                Remarks = "split-direct-block",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["full:direct.example.com"],
+                    },
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.BlockTag,
+                        Domain = ["full:block.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasDirectRule = cfg.route.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("direct.example.com")
+            && r.outbound == Global.DirectTag);
+        hasDirectRule.Should().BeTrue();
+
+        var hasBlockRule = cfg.route.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("block.example.com")
+            && r.action == "reject");
+        hasBlockRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_ByRemark_ShouldGenerateTargetOutbound()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var routeNode = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-route", "route-node");
+
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-2",
+                Remarks = "split-remark",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = routeNode.Remarks,
+                        Domain = ["full:route.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+        context.AllProxiesMap[$"remark:{routeNode.Remarks}"] = routeNode;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var expectedPrefix = $"{routeNode.IndexId}-{Global.ProxyTag}-{routeNode.Remarks}";
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith(expectedPrefix, StringComparison.Ordinal));
+
+        var hasRouteRule = cfg.route.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("route.example.com")
+            && (r.outbound ?? string.Empty).StartsWith(expectedPrefix, StringComparison.Ordinal));
+        hasRouteRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_ShouldApplyGeoipAndCidrToDirectDnsRule()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(
+            ECoreType.sing_box,
+            "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-expected",
+                Remarks = "dns-direct-expected",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:cn"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasExpectedRule = cfg.dns.rules?.Any(r =>
+            r.server == Global.SingboxDirectDNSTag
+            && r.ip_cidr?.Contains("192.168.0.0/16") == true
+            && r.rule_set?.Contains("geosite-cn") == true
+            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
+
+        hasExpectedRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_BootstrapDNS_ShouldConfigurePureIPResolver()
+    {
+        var bootstrapDns = "8.8.8.8";
+        var config = CoreConfigTestFactory.CreateConfigWithBootstrapDNS(ECoreType.sing_box, bootstrapDns);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box);
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        config.SimpleDNSItem.BootstrapDNS.Should().Be(bootstrapDns);
+
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var bootstrapServer = cfg.dns.servers?.FirstOrDefault(s => s.tag == Global.SingboxLocalDNSTag);
+        bootstrapServer.Should().NotBeNull();
+        (bootstrapServer?.server ?? string.Empty).Should().Contain(bootstrapDns);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DnsFallback_LastRuleDirect_ShouldUseDirectFinalDns()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.SimpleDNSItem.DirectDNS = "1.1.1.1";
+        config.SimpleDNSItem.RemoteDNS = "9.9.9.9";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-direct-final",
+                Remarks = "direct-final",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Ip = ["0.0.0.0/0"],
+                        Port = "0-65535",
+                        Network = "tcp,udp",
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.dns.final.Should().Be(Global.SingboxDirectDNSTag);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_NonMatchingRegion_ShouldNotApplyExpectedRule()
+    {
+        var config =
+            CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.sing_box, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-unmatched",
+                Remarks = "dns-direct-unmatched",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:us"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasExpectedRule = cfg.dns.rules?.Any(r =>
+            r.server == Global.SingboxDirectDNSTag
+            && r.ip_cidr?.Contains("192.168.0.0/16") == true
+            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
+        hasExpectedRule.Should().BeFalse();
+    }
+
+    [Theory]
+    [InlineData("geosite:cn", "geosite-cn")]
+    [InlineData("geosite:geolocation-cn", "geosite-geolocation-cn")]
+    [InlineData("geosite:tld-cn", "geosite-tld-cn")]
+    public void GenerateClientConfigContent_DirectExpectedIPs_RegionVariant_ShouldApplyExpectedRule(string domainTag,
+        string expectedRuleSetTag)
+    {
+        var config =
+            CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.sing_box, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-variant",
+                Remarks = "dns-direct-variant",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true, RuleType = ERuleType.DNS, OutboundTag = Global.DirectTag, Domain = [domainTag],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasExpectedRule = cfg.dns.rules?.Any(r =>
+            r.server == Global.SingboxDirectDNSTag
+            && r.ip_cidr?.Contains("192.168.0.0/16") == true
+            && r.rule_set?.Contains(expectedRuleSetTag) == true
+            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
+        hasExpectedRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_Hosts_ShouldPopulateHostsServerAndDomainResolver()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.SimpleDNSItem.Hosts = "resolver.example 1.1.1.1";
+        config.SimpleDNSItem.DirectDNS = "https://resolver.example/dns-query";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box);
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hostsServer = cfg.dns.servers.FirstOrDefault(s => s.tag == Global.SingboxHostsDNSTag);
+        hostsServer.Should().NotBeNull();
+        hostsServer!.predefined.Should().ContainKey("resolver.example");
+        hostsServer.predefined!["resolver.example"].Should().Contain("1.1.1.1");
+
+        var directServer = cfg.dns.servers.FirstOrDefault(s => s.tag == Global.SingboxDirectDNSTag);
+        directServer.Should().NotBeNull();
+        directServer!.domain_resolver.Should().Be(Global.SingboxHostsDNSTag);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RawDnsEnabled_ShouldUseCustomDnsAndInjectLocalResolver()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var rawDns = new Dns4Sbox
+        {
+            servers =
+            [
+                new Server4Sbox { tag = "remote", type = "udp", server = "8.8.8.8", detour = Global.ProxyTag, }
+            ],
+            rules = [],
+        };
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RawDnsItem = new DNSItem
+            {
+                Id = "dns-raw-1",
+                Remarks = "raw",
+                Enabled = true,
+                CoreType = ECoreType.sing_box,
+                NormalDNS = JsonUtils.Serialize(rawDns),
+                DomainDNSAddress = "1.1.1.1",
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.dns.servers.Should().Contain(s => s.tag == "remote" && s.type == "udp" && s.server == "8.8.8.8");
+        cfg.dns.servers.Should().Contain(s => s.tag == Global.SingboxLocalDNSTag);
+        cfg.dns.rules.Should().Contain(r => r.clash_mode == ERuleMode.Global.ToString());
+        cfg.dns.rules.Should().Contain(r => r.clash_mode == ERuleMode.Direct.ToString());
+    }
+}
@@ -0,0 +1,539 @@
+using AwesomeAssertions;
+using ServiceLib.Common;
+using ServiceLib.Enums;
+using ServiceLib.Models;
+using ServiceLib.Services.CoreConfig;
+using Xunit;
+
+namespace ServiceLib.Tests.CoreConfig.V2ray;
+
+public class CoreConfigV2rayServiceTests
+{
+    [Fact]
+    public void GenerateClientConfigContent_ShouldGenerateBasicProxyConfig()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        result.Data.Should().NotBeNull();
+
+        var v2rayConfig = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString());
+        v2rayConfig.Should().NotBeNull();
+        v2rayConfig!.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.protocol == "vmess");
+        v2rayConfig.inbounds.Should().Contain(i => i.protocol == nameof(EInboundProtocol.mixed));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroup_ShouldExpandChildrenAndBuildBalancer()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+        cfg.routing.balancers.Should().NotBeNull();
+        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChain_ShouldBuildDialerProxyChain()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.Xray, "c1", "chain", [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        var hasDialerChain = cfg.outbounds.Any(o =>
+            o.tag == Global.ProxyTag
+            && o.streamSettings is not null
+            && o.streamSettings.sockopt is not null
+            && (o.streamSettings.sockopt.dialerProxy ?? string.Empty).StartsWith("chain-proxy-1-",
+                StringComparison.Ordinal));
+        hasDialerChain.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroupWithProxyChain_ShouldBuildCombinedOutbounds()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n3", "node-3");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.Xray, "c1", "chain", [n1.IndexId, n2.IndexId]);
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "g1", "group",
+            [chain.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[chain.IndexId] = chain;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+        cfg.routing.balancers.Should().NotBeNull();
+        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChainWithPolicyGroup_ShouldBuildClonedChainBranches()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n3", "node-3");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.Xray, "c1", "chain",
+            [group.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[group.IndexId] = group;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-2-", StringComparison.Ordinal));
+
+        var proxyCloneCount = cfg.outbounds.Count(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal));
+        proxyCloneCount.Should().Be(2);
+
+        var allCloneDialersPointToGroupBranches = cfg.outbounds
+            .Where(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal))
+            .All(o => (o.streamSettings?.sockopt?.dialerProxy ?? string.Empty).StartsWith("chain-proxy-1-group-",
+                StringComparison.Ordinal));
+        allCloneDialersPointToGroupBranches.Should().BeTrue();
+
+        cfg.routing.balancers.Should().NotBeNull();
+        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_DirectAndBlock_ShouldApplyRules()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-1",
+                Remarks = "split-direct-block",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["full:direct.example.com"],
+                    },
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.BlockTag,
+                        Domain = ["full:block.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        var hasDirectRule = cfg.routing.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("full:direct.example.com")
+            && r.outboundTag == Global.DirectTag);
+        hasDirectRule.Should().BeTrue();
+
+        var hasBlockRule = cfg.routing.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("full:block.example.com")
+            && r.outboundTag == Global.BlockTag);
+        hasBlockRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_ByRemark_ShouldGenerateTargetOutbound()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var routeNode = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n-route", "route-node");
+
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-2",
+                Remarks = "split-remark",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = routeNode.Remarks,
+                        Domain = ["full:route.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+        context.AllProxiesMap[$"remark:{routeNode.Remarks}"] = routeNode;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var expectedPrefix = $"{routeNode.IndexId}-{Global.ProxyTag}-{routeNode.Remarks}";
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith(expectedPrefix, StringComparison.Ordinal));
+        var hasRouteRule = cfg.routing.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("full:route.example.com")
+            && (r.outboundTag ?? string.Empty).StartsWith(expectedPrefix, StringComparison.Ordinal));
+        hasRouteRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_ShouldApplyExpectedIPsToDirectDnsServer()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-expected",
+                Remarks = "dns-direct-expected",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:cn"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasExpectedServer = dnsServers.Any(s =>
+            (s.tag ?? string.Empty).StartsWith(Global.DirectDnsTag, StringComparison.Ordinal)
+            && s.domains?.Contains("geosite:cn") == true
+            && s.expectedIPs?.Contains("192.168.0.0/16") == true
+            && s.expectedIPs?.Contains("geoip:cn") == true);
+        hasExpectedServer.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_BootstrapDNS_ShouldApplyToDnsServerDomains()
+    {
+        var bootstrapDns = "8.8.8.8";
+        var config = CoreConfigTestFactory.CreateConfigWithBootstrapDNS(ECoreType.Xray, bootstrapDns);
+        config.SimpleDNSItem.DirectDNS = "https://dns-direct.example/dns-query";
+        config.SimpleDNSItem.RemoteDNS = "https://dns-remote.example/dns-query";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasBootstrapServer = dnsServers.Any(s =>
+            s.address == bootstrapDns
+            && s.domains?.Contains("full:dns-direct.example") == true
+            && s.domains?.Contains("full:dns-remote.example") == true);
+        hasBootstrapServer.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DnsFallback_LastRuleDirect_ShouldUseDirectDnsServers()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        config.SimpleDNSItem.DirectDNS = "1.1.1.1";
+        config.SimpleDNSItem.RemoteDNS = "9.9.9.9";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-direct-final",
+                Remarks = "direct-final",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Ip = ["0.0.0.0/0"],
+                        Port = "0-65535",
+                        Network = "tcp,udp",
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasDirectFallback = dnsServers.Any(s =>
+            (s.tag ?? string.Empty).StartsWith(Global.DirectDnsTag, StringComparison.Ordinal)
+            && s.address == "1.1.1.1");
+        hasDirectFallback.Should().BeTrue();
+
+        var hasRemoteFallback = dnsServers.Any(s => s.address == "9.9.9.9");
+        hasRemoteFallback.Should().BeFalse();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_NonMatchingRegion_ShouldNotApplyExpectedIPs()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-unmatched",
+                Remarks = "dns-direct-unmatched",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:us"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasExpectedIPs = dnsServers.Any(s =>
+            s.expectedIPs?.Contains("192.168.0.0/16") == true
+            || s.expectedIPs?.Contains("geoip:cn") == true);
+        hasExpectedIPs.Should().BeFalse();
+    }
+
+    [Theory]
+    [InlineData("geosite:cn")]
+    [InlineData("geosite:geolocation-cn")]
+    [InlineData("geosite:tld-cn")]
+    public void GenerateClientConfigContent_DirectExpectedIPs_RegionVariant_ShouldApplyExpectedIPs(string domainTag)
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-variant",
+                Remarks = "dns-direct-variant",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true, RuleType = ERuleType.DNS, OutboundTag = Global.DirectTag, Domain = [domainTag],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasExpectedServer = dnsServers.Any(s =>
+            (s.tag ?? string.Empty).StartsWith(Global.DirectDnsTag, StringComparison.Ordinal)
+            && s.domains?.Contains(domainTag) == true
+            && s.expectedIPs?.Contains("192.168.0.0/16") == true
+            && s.expectedIPs?.Contains("geoip:cn") == true);
+        hasExpectedServer.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_Hosts_ShouldPopulateDnsHosts()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        config.SimpleDNSItem.Hosts = "resolver.example 1.1.1.1";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        dns.hosts.Should().NotBeNull();
+        dns.hosts!.Should().ContainKey("resolver.example");
+        JsonUtils.Serialize(dns.hosts!["resolver.example"]).Should().Contain("1.1.1.1");
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RawDnsEnabled_ShouldUseCustomDnsConfig()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RawDnsItem = new DNSItem
+            {
+                Id = "dns-raw-1",
+                Remarks = "raw",
+                Enabled = true,
+                CoreType = ECoreType.Xray,
+                NormalDNS = "{\"servers\":[\"8.8.8.8\"],\"hosts\":{\"raw.example\":\"1.1.1.1\"}}",
+                DomainStrategy4Freedom = "UseIPv4",
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        JsonUtils.Serialize(dns.servers).Should().Contain("8.8.8.8");
+        dns.hosts.Should().NotBeNull();
+        dns.hosts!.Should().ContainKey("raw.example");
+        JsonUtils.Serialize(dns.hosts!["raw.example"]).Should().Contain("1.1.1.1");
+
+        var directOutbound = cfg.outbounds.FirstOrDefault(o => o.tag == Global.DirectTag && o.protocol == "freedom");
+        directOutbound.Should().NotBeNull();
+        directOutbound!.settings.domainStrategy.Should().Be("UseIPv4");
+    }
+}
@@ -0,0 +1,173 @@
+using AwesomeAssertions;
+using ServiceLib.Handler.Fmt;
+using ServiceLib.Models;
+using ServiceLib.Enums;
+using Xunit;
+
+namespace ServiceLib.Tests.Fmt;
+
+public class FmtHandlerTests
+{
+    [Fact]
+    public void GetShareUriAndResolveConfig_Vmess_ShouldRoundTripBasicFields()
+    {
+        var source = CreateVmessProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.VMess);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Password.Should().Be(source.Password);
+        resolved.GetProtocolExtra().AlterId.Should().Be(source.GetProtocolExtra().AlterId);
+    }
+
+    [Fact]
+    public void GetShareUriAndResolveConfig_Vless_ShouldRoundTripBasicFields()
+    {
+        var source = CreateVlessProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.VLESS);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Password.Should().Be(source.Password);
+        resolved.GetProtocolExtra().VlessEncryption.Should().Be(Global.None);
+    }
+
+    [Fact]
+    public void GetShareUriAndResolveConfig_Shadowsocks_ShouldRoundTripBasicFields()
+    {
+        var source = CreateShadowsocksProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.Shadowsocks);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Password.Should().Be(source.Password);
+        resolved.GetProtocolExtra().SsMethod.Should().Be(source.GetProtocolExtra().SsMethod);
+    }
+
+    [Fact]
+    public void GetShareUriAndResolveConfig_Socks_ShouldRoundTripBasicFields()
+    {
+        var source = CreateSocksProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.SOCKS);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Username.Should().Be(source.Username);
+        resolved.Password.Should().Be(source.Password);
+    }
+
+    [Fact]
+    public void ResolveConfig_UnsupportedProtocol_ShouldReturnNull()
+    {
+        var resolved = FmtHandler.ResolveConfig("not-a-share-uri", out var msg);
+
+        resolved.Should().BeNull();
+        msg.Should().NotBeNullOrWhiteSpace();
+    }
+
+    [Fact]
+    public void GetShareUri_UnsupportedConfigType_ShouldReturnNull()
+    {
+        var item = new ProfileItem { ConfigType = EConfigType.PolicyGroup, Remarks = "group", };
+
+        var uri = FmtHandler.GetShareUri(item);
+
+        uri.Should().BeNull();
+    }
+
+    private static ProfileItem ExportThenImport(ProfileItem source)
+    {
+        var uri = FmtHandler.GetShareUri(source);
+
+        uri.Should().NotBeNullOrWhiteSpace();
+        (uri!.StartsWith(Global.ProtocolShares[source.ConfigType], StringComparison.OrdinalIgnoreCase)).Should()
+            .BeTrue();
+
+        var resolved = FmtHandler.ResolveConfig(uri, out var msg);
+
+        resolved.Should().NotBeNull($"uri: {uri}, msg: {msg}");
+        return resolved!;
+    }
+
+    private static ProfileItem CreateVmessProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.VMess,
+            Remarks = "vmess demo",
+            Address = "example.com",
+            Port = 443,
+            Password = Guid.NewGuid().ToString(),
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { AlterId = "0", VmessSecurity = Global.DefaultSecurity, });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateVlessProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.VLESS,
+            Remarks = "vless demo",
+            Address = "vless.example",
+            Port = 8443,
+            Password = Guid.NewGuid().ToString(),
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { VlessEncryption = Global.None, });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateShadowsocksProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.Shadowsocks,
+            Remarks = "ss demo",
+            Address = "1.2.3.4",
+            Port = 8388,
+            Password = "pass123",
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { SsMethod = "aes-128-gcm", });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateSocksProfile()
+    {
+        return new ProfileItem
+        {
+            ConfigType = EConfigType.SOCKS,
+            Remarks = "socks demo",
+            Address = "127.0.0.1",
+            Port = 1080,
+            Username = "user",
+            Password = "pass",
+        };
+    }
+}
@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="AwesomeAssertions" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="xunit.runner.visualstudio">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+    <PackageReference Include="xunit.v3" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\ServiceLib\ServiceLib.csproj" />
+  </ItemGroup>
+
+</Project>
@@ -46,7 +46,7 @@ public static class ProcUtils
        return null;
    }

-    public static void RebootAsAdmin(bool blAdmin = true)
+    public static bool RebootAsAdmin(bool blAdmin = true)
    {
        try
        {
@@ -58,11 +58,12 @@ public static class ProcUtils
                FileName = Utils.GetExePath().AppendQuotes(),
                Verb = blAdmin ? "runas" : null,
            };
-            _ = Process.Start(startInfo);
+            return Process.Start(startInfo) != null;
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
+            return false;
        }
    }
 }
@@ -332,19 +332,17 @@ public class Utils
            .ToList();
    }

-    public static Dictionary<string, List<string>> ParseHostsToDictionary(string hostsContent)
+    public static Dictionary<string, List<string>> ParseHostsToDictionary(string? hostsContent)
    {
+        if (hostsContent.IsNullOrEmpty())
+        {
+            return new();
+        }
        var userHostsMap = hostsContent
            .Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries)
            .Select(line => line.Trim())
            // skip full-line comments
-            .Where(line => !string.IsNullOrWhiteSpace(line) && !line.StartsWith("#"))
-            // strip inline comments (truncate at '#')
-            .Select(line =>
-            {
-                var index = line.IndexOf('#');
-                return index >= 0 ? line.Substring(0, index).Trim() : line;
-            })
+            .Where(line => !string.IsNullOrWhiteSpace(line) && !line.StartsWith('#'))
            // ensure line still contains valid parts
            .Where(line => !string.IsNullOrWhiteSpace(line) && line.Contains(' '))
            .Select(line => line.Split(new[] { ' ', '\t' }, StringSplitOptions.RemoveEmptyEntries))
@@ -499,6 +497,13 @@ public class Utils
            return false;
        }

+        var ext = Path.GetExtension(domain);
+        if (ext.IsNotEmpty()
+            && ext[1..].ToLowerInvariant() is "json" or "txt" or "xml" or "cfg" or "ini" or "log" or "yaml" or "yml" or "toml")
+        {
+            return false;
+        }
+
        return Uri.CheckHostName(domain) == UriHostNameType.Dns;
    }

@@ -517,6 +522,23 @@ public class Utils
        return false;
    }

+    public static bool IsIpv4(string? ip)
+    {
+        if (ip.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        ip = ip.Trim();
+        if (!IPAddress.TryParse(ip, out var address))
+        {
+            return false;
+        }
+
+        return address.AddressFamily == AddressFamily.InterNetwork
+               && ip.Count(c => c == '.') == 3;
+    }
+
    public static bool IsIpAddress(string? ip)
    {
        if (ip.IsNullOrEmpty())
@@ -631,12 +653,7 @@ public class Utils
    {
        try
        {
-            List<IPEndPoint> lstIpEndPoints = new();
-            List<TcpConnectionInformation> lstTcpConns = new();
-
-            lstIpEndPoints.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpListeners());
-            lstIpEndPoints.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveUdpListeners());
-            lstTcpConns.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpConnections());
+            var (lstIpEndPoints, lstTcpConns) = GetActiveNetworkInfo();

            if (lstIpEndPoints?.FindIndex(it => it.Port == port) >= 0)
            {
@@ -678,6 +695,27 @@ public class Utils
        return 59090;
    }

+    public static (List<IPEndPoint> endpoints, List<TcpConnectionInformation> connections) GetActiveNetworkInfo()
+    {
+        var endpoints = new List<IPEndPoint>();
+        var connections = new List<TcpConnectionInformation>();
+
+        try
+        {
+            var ipGlobalProperties = IPGlobalProperties.GetIPGlobalProperties();
+
+            endpoints.AddRange(ipGlobalProperties.GetActiveTcpListeners());
+            endpoints.AddRange(ipGlobalProperties.GetActiveUdpListeners());
+            connections.AddRange(ipGlobalProperties.GetActiveTcpConnections());
+        }
+        catch (Exception ex)
+        {
+            Logging.SaveLog(_tag, ex);
+        }
+
+        return (endpoints, connections);
+    }
+
    #endregion Speed Test

    #region Miscellaneous
@@ -1086,7 +1124,19 @@ public class Utils

    public static string GetExeName(string name)
    {
-        return IsWindows() ? $"{name}.exe" : name;
+        if (name.IsNullOrEmpty() || IsNonWindows())
+        {
+            return name;
+        }
+
+        if (name.EndsWith(".exe", StringComparison.OrdinalIgnoreCase))
+        {
+            return name;
+        }
+        else
+        {
+            return $"{name}.exe";
+        }
    }

    public static bool IsAdministrator()
@@ -53,19 +53,23 @@ internal static class WindowsUtils

    public static async Task RemoveTunDevice()
    {
-        try
+        var tunNameList = new List<string> { "wintunsingbox_tun", "xray_tun" };
+        foreach (var tunName in tunNameList)
        {
-            var sum = MD5.HashData(Encoding.UTF8.GetBytes("wintunsingbox_tun"));
-            var guid = new Guid(sum);
-            var pnpUtilPath = @"C:\Windows\System32\pnputil.exe";
-            var arg = $$""" /remove-device  "SWD\Wintun\{{{guid}}}" """;
+            try
+            {
+                var sum = MD5.HashData(Encoding.UTF8.GetBytes(tunName));
+                var guid = new Guid(sum);
+                var pnpUtilPath = @"C:\Windows\System32\pnputil.exe";
+                var arg = $$""" /remove-device  "SWD\Wintun\{{{guid}}}" """;

-            // Try to remove the device
-            _ = await Utils.GetCliWrapOutput(pnpUtilPath, arg);
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
+                // Try to remove the device
+                _ = await Utils.GetCliWrapOutput(pnpUtilPath, arg);
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog(_tag, ex);
+            }
        }
    }
 }
@@ -13,6 +13,7 @@ public enum EConfigType
    WireGuard = 9,
    HTTP = 10,
    Anytls = 11,
+    Naive = 12,
    PolicyGroup = 101,
    ProxyChain = 102,
 }
@@ -2,7 +2,7 @@ namespace ServiceLib.Enums;

 public enum ETransport
 {
-    tcp,
+    raw,
    kcp,
    ws,
    httpupgrade,
@@ -15,7 +15,6 @@ public class Global
    public const string CoreConfigFileName = "config.json";
    public const string CorePreConfigFileName = "configPre.json";
    public const string CoreSpeedtestConfigFileName = "configTest{0}.json";
-    public const string CoreMultipleLoadConfigFileName = "configMultipleLoad.json";
    public const string ClashMixinConfigFileName = "Mixin.yaml";

    public const string NamespaceSample = "ServiceLib.Sample.";
@@ -25,6 +24,8 @@ public class Global
    public const string V2raySampleHttpResponseFileName = NamespaceSample + "SampleHttpResponse";
    public const string V2raySampleInbound = NamespaceSample + "SampleInbound";
    public const string V2raySampleOutbound = NamespaceSample + "SampleOutbound";
+    public const string V2raySampleTunInbound = NamespaceSample + "SampleTunInbound";
+    public const string V2raySampleTunRules = NamespaceSample + "SampleTunRules";
    public const string SingboxSampleOutbound = NamespaceSample + "SingboxSampleOutbound";
    public const string CustomRoutingFileName = NamespaceSample + "custom_routing_";
    public const string TunSingboxDNSFileName = NamespaceSample + "tun_singbox_dns";
@@ -43,13 +44,17 @@ public class Global
    public const string SingboxFakeIPFilterFileName = NamespaceSample + "singbox_fakeip_filter";

    public const string DefaultSecurity = "auto";
-    public const string DefaultNetwork = "tcp";
-    public const string TcpHeaderHttp = "http";
+    public const string DefaultNetwork = "raw";
+    public const string RawHeaderHttp = "http";
    public const string None = "none";
+    public const string RawNetworkAlias = "tcp";
+    public const string DefaultXhttpMode = "auto";
    public const string ProxyTag = "proxy";
    public const string DirectTag = "direct";
    public const string BlockTag = "block";
+    public const string DnsOutboundTag = "dns";
    public const string DnsTag = "dns-module";
+    public const string DirectDnsTag = "direct-dns";
    public const string BalancerTagSuffix = "-round";
    public const string StreamSecurity = "tls";
    public const string StreamSecurityReality = "reality";
@@ -88,7 +93,24 @@ public class Global
    public const string SingboxLocalDNSTag = "local_local";
    public const string SingboxHostsDNSTag = "hosts_dns";
    public const string SingboxFakeDNSTag = "fake_dns";
-    public const string SingboxEchDNSTag = "ech_dns";
+
+    public const int Hysteria2DefaultHopInt = 30;
+
+    public const string PolicyGroupExcludeKeywords = @"剩余|过期|到期|重置|[Rr]emaining|[Ee]xpir|[Rr]eset";
+
+    public const string PolicyGroupDefaultAllFilter = $"^(?!.*(?:{PolicyGroupExcludeKeywords})).*$";
+
+    public static readonly List<string> PolicyGroupDefaultFilterList =
+    [
+        // All nodes (exclude traffic/expiry info)
+        PolicyGroupDefaultAllFilter,
+        // Low multiplier nodes, e.g. ×0.1, 0.5x, 0.1倍
+        @"^.*(?:[×xX✕*]\s*0\.[0-9]+|0\.[0-9]+\s*[×xX✕*倍]).*$",
+        // Dedicated line nodes, e.g. IPLC, IEPL
+        $@"^(?!.*(?:{PolicyGroupExcludeKeywords})).*(?:专线|IPLC|IEPL|中转).*$",
+        // Japan nodes
+        $@"^(?!.*(?:{PolicyGroupExcludeKeywords})).*(?:日本|\\b[Jj][Pp]\\b|🇯🇵|[Jj]apan).*$",
+    ];

    public static readonly List<string> IEProxyProtocols =
    [
@@ -126,7 +148,7 @@ public class Global
        @"https://cachefly.cachefly.net/50mb.test",
        @"https://speed.cloudflare.com/__down?bytes=10000000",
        @"https://speed.cloudflare.com/__down?bytes=50000000",
-        @"https://speed.cloudflare.com/__down?bytes=100000000",
+        @"https://speed.cloudflare.com/__down?bytes=99999999",
    ];

    public static readonly List<string> SpeedPingTestUrls =
@@ -165,17 +187,23 @@ public class Global
        @"https://raw.githubusercontent.com/Chocolate4U/Iran-v2ray-rules/main/v2rayN/"
    ];

-    public static readonly Dictionary<string, string> UserAgentTexts = new()
+    public static readonly Dictionary<string, string> RawHttpUserAgentTexts = new()
    {
        {"chrome","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36" },
        {"firefox","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0" },
        {"safari","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15" },
        {"edge","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.70" },
-        {"none",""}
+        {"none",""},
+        {"golang","Go-http-client/1.1"},
+        {"curl","curl/7.68.0"},
    };

    public const string Hysteria2ProtocolShare = "hy2://";

+    public const string NaiveHttpsProtocolShare = "naive+https://";
+
+    public const string NaiveQuicProtocolShare = "naive+quic://";
+
    public static readonly Dictionary<EConfigType, string> ProtocolShares = new()
    {
        { EConfigType.VMess, "vmess://" },
@@ -186,7 +214,8 @@ public class Global
        { EConfigType.Hysteria2, "hysteria2://" },
        { EConfigType.TUIC, "tuic://" },
        { EConfigType.WireGuard, "wireguard://" },
-        { EConfigType.Anytls, "anytls://" }
+        { EConfigType.Anytls, "anytls://" },
+        { EConfigType.Naive, "naive://" }
    };

    public static readonly Dictionary<EConfigType, string> ProtocolTypes = new()
@@ -200,7 +229,8 @@ public class Global
        { EConfigType.Hysteria2, "hysteria2" },
        { EConfigType.TUIC, "tuic" },
        { EConfigType.WireGuard, "wireguard" },
-        { EConfigType.Anytls, "anytls" }
+        { EConfigType.Anytls, "anytls" },
+        { EConfigType.Naive, "naive" }
    };

    public static readonly List<string> VmessSecurities =
@@ -268,14 +298,12 @@ public class Global

    public static readonly List<string> Networks =
    [
-        "tcp",
-        "kcp",
-        "ws",
-        "httpupgrade",
+        "raw",
        "xhttp",
-        "h2",
-        "quic",
-        "grpc"
+        "kcp",
+        "grpc",
+        "ws",
+        "httpupgrade"
    ];

    public static readonly List<string> KcpHeaderTypes =
@@ -325,6 +353,7 @@ public class Global
        EConfigType.Hysteria2,
        EConfigType.TUIC,
        EConfigType.Anytls,
+        EConfigType.Naive,
        EConfigType.WireGuard,
        EConfigType.SOCKS,
        EConfigType.HTTP,
@@ -367,9 +396,9 @@ public class Global
    [
        "chrome",
        "firefox",
-        "safari",
        "edge",
-        "none"
+        "curl",
+        "golang",
    ];

    public static readonly List<string> XhttpMode =
@@ -400,11 +429,12 @@ public class Global

    public static readonly List<string> DomainDirectDNSAddress =
    [
-        "https://dns.alidns.com/dns-query",
-        "https://doh.pub/dns-query",
-        "https://dns.alidns.com/dns-query,https://doh.pub/dns-query",
-        "223.5.5.5",
        "119.29.29.29",
+        "223.5.5.5",
+        "119.29.29.29,223.5.5.5,https://doh.pub/dns-query",
+        "https://doh.pub/dns-query",
+        "https://dns.alidns.com/dns-query",
+        "https://doh.pub/dns-query,https://dns.alidns.com/dns-query",
        "localhost"
    ];

@@ -416,7 +446,7 @@ public class Global
        "https://dns.cloudflare.com/dns-query",
        "https://doh.dns.sb/dns-query",
        "https://doh.opendns.com/dns-query",
-        "https://common.dot.dns.yandex.net",
+        "https://common.dot.dns.yandex.net/dns-query",
        "8.8.8.8",
        "1.1.1.1",
        "185.222.222.222",
@@ -426,8 +456,8 @@ public class Global

    public static readonly List<string> DomainPureIPDNSAddress =
    [
-        "223.5.5.5",
        "119.29.29.29",
+        "223.5.5.5",
        "localhost"
    ];

@@ -481,6 +511,7 @@ public class Global
    [
        "http",
        "tls",
+        "quic",
        "bittorrent"
    ];

@@ -498,7 +529,6 @@ public class Global
        "tls",
        "quic",
        "fakedns",
-        "fakedns+others"
    ];

    public static readonly List<int> TunMtus =
@@ -541,6 +571,14 @@ public class Global
        "bbr"
    ];

+    public static readonly List<string> NaiveCongestionControls =
+    [
+        "bbr",
+        "bbr2",
+        "cubic",
+        "reno"
+    ];
+
    public static readonly List<string> allowSelectType =
    [
        "selector",
@@ -643,5 +681,14 @@ public class Global
        ""
    ];

+    public static readonly List<string> TunIcmpRoutingPolicies =
+    [
+        "rule",
+        "direct",
+        "unreachable",
+        "drop",
+        "reply",
+    ];
+
    #endregion const
 }
@@ -24,6 +24,7 @@ global using ServiceLib.Common;
 global using ServiceLib.Enums;
 global using ServiceLib.Events;
 global using ServiceLib.Handler;
+global using ServiceLib.Handler.Builder;
 global using ServiceLib.Handler.Fmt;
 global using ServiceLib.Handler.SysProxy;
 global using ServiceLib.Helper;
@@ -0,0 +1,427 @@
+namespace ServiceLib.Handler.Builder;
+
+public record CoreConfigContextBuilderResult(CoreConfigContext Context, NodeValidatorResult ValidatorResult)
+{
+    public bool Success => ValidatorResult.Success;
+}
+
+/// <summary>
+/// Holds the results of a full context build, including the main context and an optional
+/// pre-socks context (e.g. for TUN protection or pre-socks chaining).
+/// </summary>
+public record CoreConfigContextBuilderAllResult(
+    CoreConfigContextBuilderResult MainResult,
+    CoreConfigContextBuilderResult? PreSocksResult)
+{
+    /// <summary>True only when both the main result and (if present) the pre-socks result succeeded.</summary>
+    public bool Success => MainResult.Success && (PreSocksResult?.Success ?? true);
+
+    /// <summary>
+    /// Merges all errors and warnings from the main result and the optional pre-socks result
+    /// into a single <see cref="NodeValidatorResult"/> for unified notification.
+    /// </summary>
+    public NodeValidatorResult CombinedValidatorResult => new(
+        [.. MainResult.ValidatorResult.Errors, .. PreSocksResult?.ValidatorResult.Errors ?? []],
+        [.. MainResult.ValidatorResult.Warnings, .. PreSocksResult?.ValidatorResult.Warnings ?? []]);
+}
+
+public class CoreConfigContextBuilder
+{
+    /// <summary>
+    /// Builds a <see cref="CoreConfigContext"/> for the given node, resolves its proxy map,
+    /// and processes outbound nodes referenced by routing rules.
+    /// </summary>
+    public static async Task<CoreConfigContextBuilderResult> Build(Config config, ProfileItem node)
+    {
+        var runCoreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
+        var coreType = runCoreType == ECoreType.sing_box ? ECoreType.sing_box : ECoreType.Xray;
+        var context = new CoreConfigContext()
+        {
+            Node = node,
+            RunCoreType = runCoreType,
+            AllProxiesMap = [],
+            AppConfig = config,
+            FullConfigTemplate = await AppManager.Instance.GetFullConfigTemplateItem(coreType),
+            IsTunEnabled = config.TunModeItem.EnableTun,
+            SimpleDnsItem = config.SimpleDNSItem,
+            ProtectDomainList = [],
+            RawDnsItem = await AppManager.Instance.GetDNSItem(coreType),
+            RoutingItem = await ConfigHandler.GetDefaultRouting(config),
+        };
+        var validatorResult = NodeValidatorResult.Empty();
+        var (actNode, nodeValidatorResult) = await ResolveNodeAsync(context, node);
+        if (!nodeValidatorResult.Success)
+        {
+            return new CoreConfigContextBuilderResult(context, nodeValidatorResult);
+        }
+        context = context with { Node = actNode };
+        validatorResult.Warnings.AddRange(nodeValidatorResult.Warnings);
+        if (!(context.RoutingItem?.RuleSet.IsNullOrEmpty() ?? true))
+        {
+            var rules = JsonUtils.Deserialize<List<RulesItem>>(context.RoutingItem?.RuleSet) ?? [];
+            foreach (var ruleItem in rules.Where(ruleItem => ruleItem.Enabled && !Global.OutboundTags.Contains(ruleItem.OutboundTag)))
+            {
+                if (ruleItem.OutboundTag.IsNullOrEmpty())
+                {
+                    validatorResult.Warnings.Add(string.Format(ResUI.MsgRoutingRuleEmptyOutboundTag, ruleItem.Remarks));
+                    ruleItem.OutboundTag = Global.ProxyTag;
+                    continue;
+                }
+                var ruleOutboundNode = await AppManager.Instance.GetProfileItemViaRemarks(ruleItem.OutboundTag);
+                if (ruleOutboundNode == null)
+                {
+                    validatorResult.Warnings.Add(string.Format(ResUI.MsgRoutingRuleOutboundNodeNotFound, ruleItem.Remarks, ruleItem.OutboundTag));
+                    ruleItem.OutboundTag = Global.ProxyTag;
+                    continue;
+                }
+
+                var (actRuleNode, ruleNodeValidatorResult) = await ResolveNodeAsync(context, ruleOutboundNode, false);
+                validatorResult.Warnings.AddRange(ruleNodeValidatorResult.Warnings.Select(w =>
+                    string.Format(ResUI.MsgRoutingRuleOutboundNodeWarning, ruleItem.Remarks, ruleItem.OutboundTag, w)));
+                if (!ruleNodeValidatorResult.Success)
+                {
+                    validatorResult.Warnings.AddRange(ruleNodeValidatorResult.Errors.Select(e =>
+                        string.Format(ResUI.MsgRoutingRuleOutboundNodeError, ruleItem.Remarks, ruleItem.OutboundTag, e)));
+                    ruleItem.OutboundTag = Global.ProxyTag;
+                    continue;
+                }
+
+                context.AllProxiesMap[$"remark:{ruleItem.OutboundTag}"] = actRuleNode;
+            }
+        }
+
+        return new CoreConfigContextBuilderResult(context, validatorResult);
+    }
+
+    /// <summary>
+    /// Builds the main <see cref="CoreConfigContext"/> for <paramref name="node"/> and, when
+    /// the main build succeeds, also builds the optional pre-socks context required for TUN
+    /// protection or pre-socks proxy chaining.
+    /// </summary>
+    public static async Task<CoreConfigContextBuilderAllResult> BuildAll(Config config, ProfileItem node)
+    {
+        var mainResult = await Build(config, node);
+        if (!mainResult.Success)
+        {
+            return new CoreConfigContextBuilderAllResult(mainResult, null);
+        }
+
+        var preResult = await BuildPreSocksIfNeeded(mainResult.Context);
+        if (preResult is null)
+        {
+            return new CoreConfigContextBuilderAllResult(mainResult, null);
+        }
+
+        var resolvedMainResult = mainResult with
+        {
+            Context = mainResult.Context with
+            {
+                IsTunEnabled = false, // main core doesn't handle tun directly when pre-socks is used
+                ProtectDomainList = [.. mainResult.Context.ProtectDomainList, .. preResult.Context.ProtectDomainList],
+            }
+        };
+        return new CoreConfigContextBuilderAllResult(resolvedMainResult, preResult);
+    }
+
+    /// <summary>
+    /// Determines whether a pre-socks context is required for <paramref name="nodeContext"/>
+    /// and, if so, builds and returns it. Returns <c>null</c> when no pre-socks core is needed.
+    /// </summary>
+    private static async Task<CoreConfigContextBuilderResult?> BuildPreSocksIfNeeded(CoreConfigContext nodeContext)
+    {
+        var config = nodeContext.AppConfig;
+        var node = nodeContext.Node;
+        var coreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
+
+        var preSocksItem = ConfigHandler.GetPreSocksItem(config, node, coreType);
+        if (preSocksItem != null)
+        {
+            var preSocksResult = await Build(nodeContext.AppConfig, preSocksItem);
+            return preSocksResult with
+            {
+                Context = preSocksResult.Context with
+                {
+                    ProtectDomainList = [.. nodeContext.ProtectDomainList ?? [], .. preSocksResult.Context.ProtectDomainList ?? []],
+                }
+            };
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// Resolves a node into the context, optionally wrapping it in a subscription-level proxy chain.
+    /// Returns the effective (possibly replaced) node and the validation result.
+    /// </summary>
+    public static async Task<(ProfileItem, NodeValidatorResult)> ResolveNodeAsync(CoreConfigContext context,
+        ProfileItem node,
+        bool includeSubChain = true)
+    {
+        if (node.IndexId.IsNullOrEmpty())
+        {
+            return (node, NodeValidatorResult.Empty());
+        }
+
+        if (includeSubChain)
+        {
+            var (virtualChainNode, chainValidatorResult) = await BuildSubscriptionChainNodeAsync(node);
+            if (virtualChainNode != null)
+            {
+                context.AllProxiesMap[virtualChainNode.IndexId] = virtualChainNode;
+                var (resolvedNode, resolvedResult) = await ResolveNodeAsync(context, virtualChainNode, false);
+                resolvedResult.Warnings.InsertRange(0, chainValidatorResult.Warnings);
+                return (resolvedNode, resolvedResult);
+            }
+            // Chain not built but warnings may still exist (e.g. missing profiles)
+            if (chainValidatorResult.Warnings.Count > 0)
+            {
+                var fillResult = await RegisterNodeAsync(context, node);
+                fillResult.Warnings.InsertRange(0, chainValidatorResult.Warnings);
+                return (node, fillResult);
+            }
+        }
+
+        var registerResult = await RegisterNodeAsync(context, node);
+        return (node, registerResult);
+    }
+
+    /// <summary>
+    /// If the node's subscription defines prev/next profiles, creates a virtual
+    /// <see cref="EConfigType.ProxyChain"/> node that wraps them together.
+    /// Returns <c>null</c> as the chain item when no chain is needed.
+    /// Any warnings (e.g. missing prev/next profile) are returned in the validator result.
+    /// </summary>
+    private static async Task<(ProfileItem? ChainNode, NodeValidatorResult ValidatorResult)> BuildSubscriptionChainNodeAsync(ProfileItem node)
+    {
+        var result = NodeValidatorResult.Empty();
+
+        if (node.Subid.IsNullOrEmpty() || node.ConfigType == EConfigType.Custom)
+        {
+            return (null, result);
+        }
+
+        var subItem = await AppManager.Instance.GetSubItem(node.Subid);
+        if (subItem == null)
+        {
+            return (null, result);
+        }
+
+        ProfileItem? prevNode = null;
+        ProfileItem? nextNode = null;
+
+        if (!subItem.PrevProfile.IsNullOrEmpty())
+        {
+            prevNode = await AppManager.Instance.GetProfileItemViaRemarks(subItem.PrevProfile);
+            if (prevNode == null)
+            {
+                result.Warnings.Add(string.Format(ResUI.MsgSubscriptionPrevProfileNotFound, subItem.PrevProfile));
+            }
+        }
+        if (!subItem.NextProfile.IsNullOrEmpty())
+        {
+            nextNode = await AppManager.Instance.GetProfileItemViaRemarks(subItem.NextProfile);
+            if (nextNode == null)
+            {
+                result.Warnings.Add(string.Format(ResUI.MsgSubscriptionNextProfileNotFound, subItem.NextProfile));
+            }
+        }
+
+        if (prevNode is null && nextNode is null)
+        {
+            return (null, result);
+        }
+
+        // Build new proxy chain node
+        var chainNode = new ProfileItem()
+        {
+            IndexId = $"inner-{Utils.GetGuid(false)}",
+            ConfigType = EConfigType.ProxyChain,
+            CoreType = AppManager.Instance.GetCoreType(node, node.ConfigType),
+            Remarks = node.Remarks,
+        };
+        List<string?> childItems = [prevNode?.IndexId, node.IndexId, nextNode?.IndexId];
+        var chainExtraItem = chainNode.GetProtocolExtra() with
+        {
+            GroupType = chainNode.ConfigType.ToString(),
+            ChildItems = string.Join(",", childItems.Where(x => !x.IsNullOrEmpty())),
+        };
+        chainNode.SetProtocolExtra(chainExtraItem);
+        return (chainNode, result);
+    }
+
+    /// <summary>
+    /// Dispatches registration to either <see cref="RegisterGroupNodeAsync"/> or
+    /// <see cref="RegisterSingleNodeAsync"/> based on the node's config type.
+    /// </summary>
+    private static async Task<NodeValidatorResult> RegisterNodeAsync(CoreConfigContext context, ProfileItem node)
+    {
+        if (node.ConfigType.IsGroupType())
+        {
+            return await RegisterGroupNodeAsync(context, node);
+        }
+        else
+        {
+            return RegisterSingleNodeAsync(context, node);
+        }
+    }
+
+    /// <summary>
+    /// Validates a single (non-group) node and, on success, adds it to the proxy map
+    /// and records any domain addresses that should bypass the proxy.
+    /// </summary>
+    private static NodeValidatorResult RegisterSingleNodeAsync(CoreConfigContext context, ProfileItem node)
+    {
+        if (node.ConfigType.IsGroupType())
+        {
+            return NodeValidatorResult.Empty();
+        }
+
+        var nodeValidatorResult = NodeValidator.Validate(node, context.RunCoreType);
+        var msgs = new List<string>([.. nodeValidatorResult.Errors, .. nodeValidatorResult.Warnings]);
+        if (msgs.Count > 0)
+        {
+            Logging.SaveLog($"{node.Remarks}: {string.Join("; ", msgs)}");
+        }
+        if (!nodeValidatorResult.Success)
+        {
+            return nodeValidatorResult;
+        }
+
+        context.AllProxiesMap[node.IndexId] = node;
+
+        var address = node.Address;
+        if (Utils.IsDomain(address))
+        {
+            context.ProtectDomainList.Add(address);
+        }
+
+        // ech query server name protect
+        if (!node.EchConfigList.IsNullOrEmpty())
+        {
+            var echQuerySni = node.Sni;
+            if (node.StreamSecurity == Global.StreamSecurity
+                && node.EchConfigList?.Contains("://") == true)
+            {
+                var idx = node.EchConfigList.IndexOf('+');
+                echQuerySni = idx > 0 ? node.EchConfigList[..idx] : node.Sni;
+            }
+
+            if (Utils.IsDomain(echQuerySni))
+            {
+                context.ProtectDomainList.Add(echQuerySni);
+            }
+        }
+
+        // xhttp downloadSettings address protect
+        var xhttpExtra = node.GetTransportExtra().XhttpExtra;
+        if (!string.IsNullOrEmpty(xhttpExtra)
+            && JsonUtils.ParseJson(xhttpExtra) is JsonObject extra
+            && extra.TryGetPropertyValue("downloadSettings", out var dsNode)
+            && dsNode is JsonObject downloadSettings
+            && downloadSettings.TryGetPropertyValue("address", out var dAddrNode)
+            && dAddrNode is JsonValue dAddrValue
+            && dAddrValue.TryGetValue(out string? dAddr)
+            && !string.IsNullOrEmpty(dAddr)
+            && Utils.IsDomain(dAddr))
+        {
+            context.ProtectDomainList.Add(dAddr);
+        }
+
+        return nodeValidatorResult;
+    }
+
+    /// <summary>
+    /// Entry point for registering a group node. Initialises the visited/ancestor sets
+    /// and delegates to <see cref="TraverseGroupNodeAsync"/>.
+    /// </summary>
+    private static async Task<NodeValidatorResult> RegisterGroupNodeAsync(CoreConfigContext context,
+        ProfileItem node)
+    {
+        if (!node.ConfigType.IsGroupType())
+        {
+            return NodeValidatorResult.Empty();
+        }
+
+        HashSet<string> ancestors = [node.IndexId];
+        HashSet<string> globalVisited = [node.IndexId];
+        return await TraverseGroupNodeAsync(context, node, globalVisited, ancestors);
+    }
+
+    /// <summary>
+    /// Recursively walks the children of a group node, registering valid leaf nodes
+    /// and nested groups. Detects cycles via <paramref name="ancestorsGroup"/> and
+    /// deduplicates shared nodes via <paramref name="globalVisitedGroup"/>.
+    /// </summary>
+    private static async Task<NodeValidatorResult> TraverseGroupNodeAsync(
+        CoreConfigContext context,
+        ProfileItem node,
+        HashSet<string> globalVisitedGroup,
+        HashSet<string> ancestorsGroup)
+    {
+        var (groupChildList, _) = await GroupProfileManager.GetChildProfileItems(node);
+        List<string> childIndexIdList = [];
+        var childNodeValidatorResult = NodeValidatorResult.Empty();
+        foreach (var childNode in groupChildList)
+        {
+            if (ancestorsGroup.Contains(childNode.IndexId))
+            {
+                childNodeValidatorResult.Errors.Add(
+                    string.Format(ResUI.MsgGroupCycleDependency, node.Remarks, childNode.Remarks));
+                continue;
+            }
+
+            if (globalVisitedGroup.Contains(childNode.IndexId))
+            {
+                childIndexIdList.Add(childNode.IndexId);
+                continue;
+            }
+
+            if (!childNode.ConfigType.IsGroupType())
+            {
+                var childNodeResult = RegisterSingleNodeAsync(context, childNode);
+                childNodeValidatorResult.Warnings.AddRange(childNodeResult.Warnings.Select(w =>
+                    string.Format(ResUI.MsgGroupChildNodeWarning, node.Remarks, childNode.Remarks, w)));
+                childNodeValidatorResult.Errors.AddRange(childNodeResult.Errors.Select(e =>
+                    string.Format(ResUI.MsgGroupChildNodeError, node.Remarks, childNode.Remarks, e)));
+                if (!childNodeResult.Success)
+                {
+                    continue;
+                }
+
+                globalVisitedGroup.Add(childNode.IndexId);
+                childIndexIdList.Add(childNode.IndexId);
+                continue;
+            }
+
+            var newAncestorsGroup = new HashSet<string>(ancestorsGroup) { childNode.IndexId };
+            var childGroupResult =
+                await TraverseGroupNodeAsync(context, childNode, globalVisitedGroup, newAncestorsGroup);
+            childNodeValidatorResult.Warnings.AddRange(childGroupResult.Warnings.Select(w =>
+                string.Format(ResUI.MsgGroupChildGroupNodeWarning, node.Remarks, childNode.Remarks, w)));
+            childNodeValidatorResult.Errors.AddRange(childGroupResult.Errors.Select(e =>
+                string.Format(ResUI.MsgGroupChildGroupNodeError, node.Remarks, childNode.Remarks, e)));
+            if (!childGroupResult.Success)
+            {
+                continue;
+            }
+
+            globalVisitedGroup.Add(childNode.IndexId);
+            childIndexIdList.Add(childNode.IndexId);
+        }
+
+        if (childIndexIdList.Count == 0)
+        {
+            childNodeValidatorResult.Errors.Add(string.Format(ResUI.MsgGroupNoValidChildNode, node.Remarks));
+            return childNodeValidatorResult;
+        }
+        else
+        {
+            childNodeValidatorResult.Warnings.AddRange(childNodeValidatorResult.Errors);
+            childNodeValidatorResult.Errors.Clear();
+        }
+
+        node.SetProtocolExtra(node.GetProtocolExtra() with { ChildItems = Utils.List2String(childIndexIdList), });
+        context.AllProxiesMap[node.IndexId] = node;
+        return childNodeValidatorResult;
+    }
+}
@@ -0,0 +1,186 @@
+namespace ServiceLib.Handler.Builder;
+
+public record NodeValidatorResult(List<string> Errors, List<string> Warnings)
+{
+    public bool Success => Errors.Count == 0;
+
+    public static NodeValidatorResult Empty()
+    {
+        return new NodeValidatorResult([], []);
+    }
+}
+
+public class NodeValidator
+{
+    // Static validator rules
+    private static readonly HashSet<string> SingboxUnsupportedTransports =
+        [nameof(ETransport.kcp), nameof(ETransport.xhttp)];
+
+    private static readonly HashSet<EConfigType> SingboxTransportSupportedProtocols =
+        [EConfigType.VMess, EConfigType.VLESS, EConfigType.Trojan, EConfigType.Shadowsocks];
+
+    private static readonly HashSet<string> SingboxShadowsocksAllowedTransports =
+        [nameof(ETransport.raw), nameof(ETransport.ws)];
+
+    public static NodeValidatorResult Validate(ProfileItem item, ECoreType coreType)
+    {
+        var v = new ValidationContext();
+        ValidateNodeAndCoreSupport(item, coreType, v);
+        return v.ToResult();
+    }
+
+    private class ValidationContext
+    {
+        public List<string> Errors { get; } = [];
+        public List<string> Warnings { get; } = [];
+
+        public void Error(string message)
+        {
+            Errors.Add(message);
+        }
+
+        public void Warning(string message)
+        {
+            Warnings.Add(message);
+        }
+
+        public void Assert(bool condition, string errorMsg)
+        {
+            if (!condition)
+            {
+                Error(errorMsg);
+            }
+        }
+
+        public NodeValidatorResult ToResult()
+        {
+            return new NodeValidatorResult(Errors, Warnings);
+        }
+    }
+
+    private static void ValidateNodeAndCoreSupport(ProfileItem item, ECoreType coreType, ValidationContext v)
+    {
+        if (item.ConfigType is EConfigType.Custom)
+        {
+            return;
+        }
+
+        if (item.ConfigType.IsGroupType())
+        {
+            // Group logic is handled in ValidateGroupNode
+            return;
+        }
+
+        // Basic Property Validation
+        v.Assert(!item.Address.IsNullOrEmpty(), string.Format(ResUI.MsgInvalidProperty, "Address"));
+        v.Assert(item.Port is > 0 and <= 65535, string.Format(ResUI.MsgInvalidProperty, "Port"));
+
+        // Network & Core Logic
+        var net = item.GetNetwork();
+        if (coreType == ECoreType.sing_box)
+        {
+            var transportError = ValidateSingboxTransport(item.ConfigType, net);
+            if (transportError != null)
+            {
+                v.Error(transportError);
+            }
+
+            if (!Global.SingboxSupportConfigType.Contains(item.ConfigType))
+            {
+                v.Error(string.Format(ResUI.MsgCoreNotSupportProtocol, nameof(ECoreType.sing_box), item.ConfigType));
+            }
+        }
+        else if (coreType is ECoreType.Xray)
+        {
+            if (!Global.XraySupportConfigType.Contains(item.ConfigType))
+            {
+                v.Error(string.Format(ResUI.MsgCoreNotSupportProtocol, nameof(ECoreType.Xray), item.ConfigType));
+            }
+        }
+
+        // Protocol Specifics
+        var protocolExtra = item.GetProtocolExtra();
+        switch (item.ConfigType)
+        {
+            case EConfigType.VMess:
+                v.Assert(!item.Password.IsNullOrEmpty() && Utils.IsGuidByParse(item.Password),
+                    string.Format(ResUI.MsgInvalidProperty, "Password"));
+                break;
+
+            case EConfigType.VLESS:
+                v.Assert(
+                    !item.Password.IsNullOrEmpty()
+                    && (Utils.IsGuidByParse(item.Password) || item.Password.Length <= 30),
+                    string.Format(ResUI.MsgInvalidProperty, "Password")
+                );
+                v.Assert(Global.Flows.Contains(protocolExtra.Flow ?? string.Empty),
+                    string.Format(ResUI.MsgInvalidProperty, "Flow"));
+                break;
+
+            case EConfigType.Shadowsocks:
+                v.Assert(!item.Password.IsNullOrEmpty(), string.Format(ResUI.MsgInvalidProperty, "Password"));
+                v.Assert(
+                    !string.IsNullOrEmpty(protocolExtra.SsMethod) &&
+                    Global.SsSecuritiesInSingbox.Contains(protocolExtra.SsMethod),
+                    string.Format(ResUI.MsgInvalidProperty, "SsMethod"));
+                break;
+        }
+
+        // TLS & Security
+        if (item.StreamSecurity == Global.StreamSecurity)
+        {
+            if (!item.Cert.IsNullOrEmpty() && CertPemManager.ParsePemChain(item.Cert).Count == 0 &&
+                !item.CertSha.IsNullOrEmpty())
+            {
+                v.Error(string.Format(ResUI.MsgInvalidProperty, "TLS Certificate"));
+            }
+        }
+
+        if (item.StreamSecurity == Global.StreamSecurityReality)
+        {
+            v.Assert(!item.PublicKey.IsNullOrEmpty(), string.Format(ResUI.MsgInvalidProperty, "PublicKey"));
+        }
+
+        var transport = item.GetTransportExtra();
+        if (item.Network == nameof(ETransport.xhttp) && !transport.XhttpExtra.IsNullOrEmpty())
+        {
+            if (JsonUtils.ParseJson(transport.XhttpExtra) is not JsonObject)
+            {
+                v.Error(string.Format(ResUI.MsgInvalidProperty, "XHTTP Extra"));
+            }
+        }
+
+        if (!item.Finalmask.IsNullOrEmpty())
+        {
+            if (JsonUtils.ParseJson(item.Finalmask) is not JsonObject)
+            {
+                v.Error(string.Format(ResUI.MsgInvalidProperty, "Finalmask"));
+            }
+        }
+    }
+
+    private static string? ValidateSingboxTransport(EConfigType configType, string net)
+    {
+        // sing-box does not support xhttp / kcp transports
+        if (SingboxUnsupportedTransports.Contains(net))
+        {
+            return string.Format(ResUI.MsgCoreNotSupportNetwork, nameof(ECoreType.sing_box), net);
+        }
+
+        // sing-box does not support non-tcp transports for protocols other than vmess/trojan/vless/shadowsocks
+        if (!SingboxTransportSupportedProtocols.Contains(configType) && net != nameof(ETransport.raw))
+        {
+            return string.Format(ResUI.MsgCoreNotSupportProtocolTransport,
+                nameof(ECoreType.sing_box), configType.ToString(), net);
+        }
+
+        // sing-box shadowsocks only supports tcp/ws/quic transports
+        if (configType == EConfigType.Shadowsocks && !SingboxShadowsocksAllowedTransports.Contains(net))
+        {
+            return string.Format(ResUI.MsgCoreNotSupportProtocolTransport,
+                nameof(ECoreType.sing_box), configType.ToString(), net);
+        }
+
+        return null;
+    }
+}
@@ -41,6 +41,7 @@ public static class ConfigHandler
            Loglevel = "warning",
            MuxEnabled = false,
        };
+        config.CoreBasicItem.SendThrough = config.CoreBasicItem.SendThrough?.TrimEx();

        if (config.Inbound == null)
        {
@@ -76,10 +77,11 @@ public static class ConfigHandler
            Tti = 50,
            UplinkCapacity = 12,
            DownlinkCapacity = 100,
-            ReadBufferSize = 2,
-            WriteBufferSize = 2,
-            Congestion = false
+            CwndMultiplier = 1,
+            MaxSendingWindow = 2 * 1024 * 1024,
        };
+        config.KcpItem.CwndMultiplier = config.KcpItem.CwndMultiplier <= 0 ? 1 : config.KcpItem.CwndMultiplier;
+        config.KcpItem.MaxSendingWindow = config.KcpItem.MaxSendingWindow <= 0 ? (2 * 1024 * 1024) : config.KcpItem.MaxSendingWindow;
        config.GrpcItem ??= new GrpcItem
        {
            IdleTimeout = 60,
@@ -91,14 +93,13 @@ public static class ConfigHandler
        {
            EnableTun = false,
            Mtu = 9000,
+            IcmpRouting = Global.TunIcmpRoutingPolicies.First(),
+            EnableLegacyProtect = false,
        };
        config.GuiItem ??= new();
        config.MsgUIItem ??= new();

-        config.UiItem ??= new UIItem()
-        {
-            EnableUpdateSubOnlyRemarksExist = true
-        };
+        config.UiItem ??= new();
        config.UiItem.MainColumnItem ??= new();
        config.UiItem.WindowSizeItem ??= new();

@@ -154,13 +155,14 @@ public static class ConfigHandler
            DownMbps = 100
        };
        config.ClashUIItem ??= new();
+        config.ClashUIItem.ConnectionsColumnItem ??= new();
        config.SystemProxyItem ??= new();
        config.WebDavItem ??= new();
        config.CheckUpdateItem ??= new();
        config.Fragment4RayItem ??= new()
        {
            Packets = "tlshello",
-            Length = "100-200",
+            Length = "50-100",
            Interval = "10-20"
        };
        config.GlobalHotkeys ??= new();
@@ -230,17 +232,11 @@ public static class ConfigHandler
            item.Remarks = profileItem.Remarks;
            item.Address = profileItem.Address;
            item.Port = profileItem.Port;
-            item.Ports = profileItem.Ports;

-            item.Id = profileItem.Id;
-            item.AlterId = profileItem.AlterId;
-            item.Security = profileItem.Security;
-            item.Flow = profileItem.Flow;
+            item.Username = profileItem.Username;
+            item.Password = profileItem.Password;

            item.Network = profileItem.Network;
-            item.HeaderType = profileItem.HeaderType;
-            item.RequestHost = profileItem.RequestHost;
-            item.Path = profileItem.Path;

            item.StreamSecurity = profileItem.StreamSecurity;
            item.Sni = profileItem.Sni;
@@ -252,12 +248,14 @@ public static class ConfigHandler
            item.ShortId = profileItem.ShortId;
            item.SpiderX = profileItem.SpiderX;
            item.Mldsa65Verify = profileItem.Mldsa65Verify;
-            item.Extra = profileItem.Extra;
            item.MuxEnabled = profileItem.MuxEnabled;
            item.Cert = profileItem.Cert;
            item.CertSha = profileItem.CertSha;
            item.EchConfigList = profileItem.EchConfigList;
            item.EchForceQuery = profileItem.EchForceQuery;
+            item.Finalmask = profileItem.Finalmask;
+            item.ProtoExtra = profileItem.ProtoExtra;
+            item.TransportExtra = profileItem.TransportExtra;
        }

        var ret = item.ConfigType switch
@@ -272,6 +270,7 @@ public static class ConfigHandler
            EConfigType.TUIC => await AddTuicServer(config, item),
            EConfigType.WireGuard => await AddWireguardServer(config, item),
            EConfigType.Anytls => await AddAnytlsServer(config, item),
+            EConfigType.Naive => await AddNaiveServer(config, item),
            _ => -1,
        };
        return ret;
@@ -290,19 +289,19 @@ public static class ConfigHandler
        profileItem.ConfigType = EConfigType.VMess;

        profileItem.Address = profileItem.Address.TrimEx();
-        profileItem.Id = profileItem.Id.TrimEx();
-        profileItem.Security = profileItem.Security.TrimEx();
+        profileItem.Password = profileItem.Password.TrimEx();
+        profileItem.SetProtocolExtra(profileItem.GetProtocolExtra() with
+        {
+            VmessSecurity = profileItem.GetProtocolExtra().VmessSecurity?.TrimEx()
+        });
        profileItem.Network = profileItem.Network.TrimEx();
-        profileItem.HeaderType = profileItem.HeaderType.TrimEx();
-        profileItem.RequestHost = profileItem.RequestHost.TrimEx();
-        profileItem.Path = profileItem.Path.TrimEx();
        profileItem.StreamSecurity = profileItem.StreamSecurity.TrimEx();

-        if (!Global.VmessSecurities.Contains(profileItem.Security))
+        if (!Global.VmessSecurities.Contains(profileItem.GetProtocolExtra().VmessSecurity))
        {
            return -1;
        }
-        if (profileItem.Id.IsNullOrEmpty())
+        if (profileItem.Password.IsNullOrEmpty())
        {
            return -1;
        }
@@ -360,11 +359,6 @@ public static class ConfigHandler
                {
                }
            }
-            else if (profileItem.ConfigType.IsGroupType())
-            {
-                var profileGroupItem = await AppManager.Instance.GetProfileGroupItem(it.IndexId);
-                await AddGroupServerCommon(config, profileItem, profileGroupItem, true);
-            }
            else
            {
                await AddServerCommon(config, profileItem, true);
@@ -610,14 +604,17 @@ public static class ConfigHandler
        profileItem.ConfigType = EConfigType.Shadowsocks;

        profileItem.Address = profileItem.Address.TrimEx();
-        profileItem.Id = profileItem.Id.TrimEx();
-        profileItem.Security = profileItem.Security.TrimEx();
+        profileItem.Password = profileItem.Password.TrimEx();
+        profileItem.SetProtocolExtra(profileItem.GetProtocolExtra() with
+        {
+            SsMethod = profileItem.GetProtocolExtra().SsMethod?.TrimEx()
+        });

-        if (!AppManager.Instance.GetShadowsocksSecurities(profileItem).Contains(profileItem.Security))
+        if (!AppManager.Instance.GetShadowsocksSecurities(profileItem).Contains(profileItem.GetProtocolExtra().SsMethod))
        {
            return -1;
        }
-        if (profileItem.Id.IsNullOrEmpty())
+        if (profileItem.Password.IsNullOrEmpty())
        {
            return -1;
        }
@@ -678,12 +675,12 @@ public static class ConfigHandler
        profileItem.ConfigType = EConfigType.Trojan;

        profileItem.Address = profileItem.Address.TrimEx();
-        profileItem.Id = profileItem.Id.TrimEx();
+        profileItem.Password = profileItem.Password.TrimEx();
        if (profileItem.StreamSecurity.IsNullOrEmpty())
        {
            profileItem.StreamSecurity = Global.StreamSecurity;
        }
-        if (profileItem.Id.IsNullOrEmpty())
+        if (profileItem.Password.IsNullOrEmpty())
        {
            return -1;
        }
@@ -708,18 +705,22 @@ public static class ConfigHandler
        //profileItem.CoreType = ECoreType.sing_box;

        profileItem.Address = profileItem.Address.TrimEx();
-        profileItem.Id = profileItem.Id.TrimEx();
-        profileItem.Path = profileItem.Path.TrimEx();
+        profileItem.Password = profileItem.Password.TrimEx();
        profileItem.Network = string.Empty;

        if (profileItem.StreamSecurity.IsNullOrEmpty())
        {
            profileItem.StreamSecurity = Global.StreamSecurity;
        }
-        if (profileItem.Id.IsNullOrEmpty())
+        if (profileItem.Password.IsNullOrEmpty())
        {
            return -1;
        }
+        profileItem.SetProtocolExtra(profileItem.GetProtocolExtra() with
+        {
+            SalamanderPass = profileItem.GetProtocolExtra().SalamanderPass?.TrimEx(),
+            HopInterval = profileItem.GetProtocolExtra().HopInterval?.TrimEx(),
+        });

        await AddServerCommon(config, profileItem, toFile);

@@ -741,14 +742,16 @@ public static class ConfigHandler
        profileItem.CoreType = ECoreType.sing_box;

        profileItem.Address = profileItem.Address.TrimEx();
-        profileItem.Id = profileItem.Id.TrimEx();
-        profileItem.Security = profileItem.Security.TrimEx();
+        profileItem.Username = profileItem.Username.TrimEx();
+        profileItem.Password = profileItem.Password.TrimEx();
        profileItem.Network = string.Empty;

-        if (!Global.TuicCongestionControls.Contains(profileItem.HeaderType))
+        var congestionControl = profileItem.GetProtocolExtra().CongestionControl;
+        if (!Global.TuicCongestionControls.Contains(congestionControl))
        {
-            profileItem.HeaderType = Global.TuicCongestionControls.FirstOrDefault()!;
+            congestionControl = Global.TuicCongestionControls.FirstOrDefault()!;
        }
+        profileItem.SetProtocolExtra(profileItem.GetProtocolExtra() with { CongestionControl = congestionControl });

        if (profileItem.StreamSecurity.IsNullOrEmpty())
        {
@@ -758,7 +761,7 @@ public static class ConfigHandler
        {
            profileItem.Alpn = "h3";
        }
-        if (profileItem.Id.IsNullOrEmpty())
+        if (profileItem.Password.IsNullOrEmpty())
        {
            return -1;
        }
@@ -781,17 +784,17 @@ public static class ConfigHandler
        profileItem.ConfigType = EConfigType.WireGuard;

        profileItem.Address = profileItem.Address.TrimEx();
-        profileItem.Id = profileItem.Id.TrimEx();
-        profileItem.PublicKey = profileItem.PublicKey.TrimEx();
-        profileItem.Path = profileItem.Path.TrimEx();
-        profileItem.RequestHost = profileItem.RequestHost.TrimEx();
-        profileItem.Network = string.Empty;
-        if (profileItem.ShortId.IsNullOrEmpty())
+        profileItem.Password = profileItem.Password.TrimEx();
+        profileItem.SetProtocolExtra(profileItem.GetProtocolExtra() with
        {
-            profileItem.ShortId = Global.TunMtus.First().ToString();
-        }
+            WgPublicKey = profileItem.GetProtocolExtra().WgPublicKey?.TrimEx(),
+            WgPresharedKey = profileItem.GetProtocolExtra().WgPresharedKey?.TrimEx(),
+            WgInterfaceAddress = profileItem.GetProtocolExtra().WgInterfaceAddress?.TrimEx(),
+            WgReserved = profileItem.GetProtocolExtra().WgReserved?.TrimEx(),
+            WgMtu = profileItem.GetProtocolExtra().WgMtu is null or <= 0 ? Global.TunMtus.First() : profileItem.GetProtocolExtra().WgMtu,
+        });

-        if (profileItem.Id.IsNullOrEmpty())
+        if (profileItem.Password.IsNullOrEmpty())
        {
            return -1;
        }
@@ -802,7 +805,7 @@ public static class ConfigHandler
    }

    /// <summary>
-    /// Add or edit a Anytls server
+    /// Add or edit an Anytls server
    /// Validates and processes Anytls-specific settings
    /// </summary>
    /// <param name="config">Current configuration</param>
@@ -815,14 +818,43 @@ public static class ConfigHandler
        profileItem.CoreType = ECoreType.sing_box;

        profileItem.Address = profileItem.Address.TrimEx();
-        profileItem.Id = profileItem.Id.TrimEx();
-        profileItem.Security = profileItem.Security.TrimEx();
+        profileItem.Password = profileItem.Password.TrimEx();
        profileItem.Network = string.Empty;
        if (profileItem.StreamSecurity.IsNullOrEmpty())
        {
            profileItem.StreamSecurity = Global.StreamSecurity;
        }
-        if (profileItem.Id.IsNullOrEmpty())
+        if (profileItem.Password.IsNullOrEmpty())
+        {
+            return -1;
+        }
+        await AddServerCommon(config, profileItem, toFile);
+        return 0;
+    }
+
+    /// <summary>
+    /// Add or edit a Naive server
+    /// Validates and processes Naive-specific settings
+    /// </summary>
+    /// <param name="config">Current configuration</param>
+    /// <param name="profileItem">Naive profile to add</param>
+    /// <param name="toFile">Whether to save to file</param>
+    /// <returns>0 if successful, -1 if failed</returns>
+    public static async Task<int> AddNaiveServer(Config config, ProfileItem profileItem, bool toFile = true)
+    {
+        profileItem.ConfigType = EConfigType.Naive;
+        profileItem.CoreType = ECoreType.sing_box;
+
+        profileItem.Address = profileItem.Address.TrimEx();
+        profileItem.Username = profileItem.Username.TrimEx();
+        profileItem.Password = profileItem.Password.TrimEx();
+        profileItem.Alpn = string.Empty;
+        profileItem.Network = string.Empty;
+        if (profileItem.StreamSecurity.IsNullOrEmpty())
+        {
+            profileItem.StreamSecurity = Global.StreamSecurity;
+        }
+        if (profileItem.Password.IsNullOrEmpty())
        {
            return -1;
        }
@@ -841,7 +873,7 @@ public static class ConfigHandler
    /// <returns>0 if successful, -1 if failed</returns>
    public static async Task<int> SortServers(Config config, string subId, string colName, bool asc)
    {
-        var lstModel = await AppManager.Instance.ProfileItems(subId, "");
+        var lstModel = await AppManager.Instance.ProfileModels(subId, "");
        if (lstModel.Count <= 0)
        {
            return -1;
@@ -860,7 +892,7 @@ public static class ConfigHandler
                              Remarks = t.Remarks,
                              Address = t.Address,
                              Port = t.Port,
-                              Security = t.Security,
+                              //Security = t.Security,
                              Network = t.Network,
                              StreamSecurity = t.StreamSecurity,
                              Delay = t33?.Delay ?? 0,
@@ -959,26 +991,22 @@ public static class ConfigHandler
        profileItem.ConfigType = EConfigType.VLESS;

        profileItem.Address = profileItem.Address.TrimEx();
-        profileItem.Id = profileItem.Id.TrimEx();
-        profileItem.Security = profileItem.Security.TrimEx();
+        profileItem.Password = profileItem.Password.TrimEx();
        profileItem.Network = profileItem.Network.TrimEx();
-        profileItem.HeaderType = profileItem.HeaderType.TrimEx();
-        profileItem.RequestHost = profileItem.RequestHost.TrimEx();
-        profileItem.Path = profileItem.Path.TrimEx();
        profileItem.StreamSecurity = profileItem.StreamSecurity.TrimEx();

-        if (!Global.Flows.Contains(profileItem.Flow))
+        var vlessEncryption = profileItem.GetProtocolExtra().VlessEncryption?.TrimEx();
+        var flow = profileItem.GetProtocolExtra().Flow?.TrimEx() ?? string.Empty;
+        profileItem.SetProtocolExtra(profileItem.GetProtocolExtra() with
        {
-            profileItem.Flow = Global.Flows.First();
-        }
-        if (profileItem.Id.IsNullOrEmpty())
+            VlessEncryption = vlessEncryption.IsNullOrEmpty() ? Global.None : vlessEncryption,
+            Flow = Global.Flows.Contains(flow) ? flow : Global.Flows.First(),
+        });
+
+        if (profileItem.Password.IsNullOrEmpty())
        {
            return -1;
        }
-        if (profileItem.Security.IsNullOrEmpty())
-        {
-            profileItem.Security = Global.None;
-        }

        await AddServerCommon(config, profileItem, toFile);

@@ -1033,12 +1061,12 @@ public static class ConfigHandler
    /// <returns>0 if successful</returns>
    public static async Task<int> AddServerCommon(Config config, ProfileItem profileItem, bool toFile = true)
    {
-        profileItem.ConfigVersion = 2;
+        profileItem.ConfigVersion = 4;

        if (profileItem.StreamSecurity.IsNotEmpty())
        {
-            if (profileItem.StreamSecurity != Global.StreamSecurity
-                 && profileItem.StreamSecurity != Global.StreamSecurityReality)
+            if (profileItem.StreamSecurity is not Global.StreamSecurity
+                 and not Global.StreamSecurityReality)
            {
                profileItem.StreamSecurity = string.Empty;
            }
@@ -1077,42 +1105,13 @@ public static class ConfigHandler

        if (toFile)
        {
+            //profileItem.SetProtocolExtra();
+            profileItem.SetProtocolExtra(profileItem.GetProtocolExtra());
            await SQLiteHelper.Instance.ReplaceAsync(profileItem);
        }
        return 0;
    }

-    public static async Task<int> AddGroupServerCommon(Config config, ProfileItem profileItem, ProfileGroupItem profileGroupItem, bool toFile = true)
-    {
-        var maxSort = -1;
-        if (profileItem.IndexId.IsNullOrEmpty())
-        {
-            profileItem.IndexId = Utils.GetGuid(false);
-            maxSort = ProfileExManager.Instance.GetMaxSort();
-        }
-        var groupType = profileItem.ConfigType == EConfigType.ProxyChain ? EConfigType.ProxyChain.ToString() : profileGroupItem.MultipleLoad.ToString();
-        profileItem.Address = $"{profileItem.CoreType}-{groupType}";
-        if (maxSort > 0)
-        {
-            ProfileExManager.Instance.SetSort(profileItem.IndexId, maxSort + 1);
-        }
-        if (toFile)
-        {
-            await SQLiteHelper.Instance.ReplaceAsync(profileItem);
-            if (profileGroupItem != null)
-            {
-                profileGroupItem.IndexId = profileItem.IndexId;
-                await ProfileGroupItemManager.Instance.SaveItemAsync(profileGroupItem);
-            }
-            else
-            {
-                ProfileGroupItemManager.Instance.GetOrCreateAndMarkDirty(profileItem.IndexId);
-                await ProfileGroupItemManager.Instance.SaveTo();
-            }
-        }
-        return 0;
-    }
-
    /// <summary>
    /// Compare two profile items to determine if they represent the same server
    /// Used for deduplication and server matching
@@ -1128,22 +1127,39 @@ public static class ConfigHandler
            return false;
        }

+        var oProtocolExtra = o.GetProtocolExtra();
+        var nProtocolExtra = n.GetProtocolExtra();
+        var oTransport = o.GetTransportExtra();
+        var nTransport = n.GetTransportExtra();
+
        return o.ConfigType == n.ConfigType
               && AreEqual(o.Address, n.Address)
               && o.Port == n.Port
-               && AreEqual(o.Id, n.Id)
-               && AreEqual(o.Security, n.Security)
+               && AreEqual(o.Password, n.Password)
+               && AreEqual(o.Username, n.Username)
+               && AreEqual(oProtocolExtra.VlessEncryption, nProtocolExtra.VlessEncryption)
+               && AreEqual(oProtocolExtra.SsMethod, nProtocolExtra.SsMethod)
+               && AreEqual(oProtocolExtra.VmessSecurity, nProtocolExtra.VmessSecurity)
               && AreEqual(o.Network, n.Network)
-               && AreEqual(o.HeaderType, n.HeaderType)
-               && AreEqual(o.RequestHost, n.RequestHost)
-               && AreEqual(o.Path, n.Path)
+               && AreEqual(oTransport.RawHeaderType, nTransport.RawHeaderType)
+               && AreEqual(oTransport.Host, nTransport.Host)
+               && AreEqual(oTransport.Path, nTransport.Path)
+               && AreEqual(oTransport.XhttpMode, nTransport.XhttpMode)
+               && AreEqual(oTransport.XhttpExtra, nTransport.XhttpExtra)
+               && AreEqual(oTransport.GrpcAuthority, nTransport.GrpcAuthority)
+               && AreEqual(oTransport.GrpcServiceName, nTransport.GrpcServiceName)
+               && AreEqual(oTransport.GrpcMode, nTransport.GrpcMode)
+               && AreEqual(oTransport.KcpHeaderType, nTransport.KcpHeaderType)
+               && AreEqual(oTransport.KcpSeed, nTransport.KcpSeed)
               && (o.ConfigType == EConfigType.Trojan || o.StreamSecurity == n.StreamSecurity)
-               && AreEqual(o.Flow, n.Flow)
+               && AreEqual(oProtocolExtra.Flow, nProtocolExtra.Flow)
+               && AreEqual(oProtocolExtra.SalamanderPass, nProtocolExtra.SalamanderPass)
               && AreEqual(o.Sni, n.Sni)
               && AreEqual(o.Alpn, n.Alpn)
               && AreEqual(o.Fingerprint, n.Fingerprint)
               && AreEqual(o.PublicKey, n.PublicKey)
               && AreEqual(o.ShortId, n.ShortId)
+               && AreEqual(o.Finalmask, n.Finalmask)
               && (!remarks || o.Remarks == n.Remarks);

        static bool AreEqual(string? a, string? b)
@@ -1152,6 +1168,84 @@ public static class ConfigHandler
        }
    }

+    /// <summary>
+    /// Searches the specified collection for a profile item that matches the target profile item based on a series of
+    /// criteria.
+    /// </summary>
+    /// <remarks>The method attempts to find a match by comparing the target's remarks, address, port, and
+    /// password in various combinations. The search is performed in order of specificity, starting with the most
+    /// detailed comparison. If no match is found at any stage, the method returns null.</remarks>
+    /// <param name="source">An enumerable collection of profile items to search. This parameter can be null.</param>
+    /// <param name="target">The profile item to match against items in the source collection. This parameter can be null.</param>
+    /// <returns>A profile item from the source collection that matches the target item according to defined criteria; otherwise,
+    /// null if no match is found or if either parameter is null.</returns>
+    private static ProfileItem? FindMatchedProfileItem(IEnumerable<ProfileItem>? source, ProfileItem? target)
+    {
+        if (source == null || target == null)
+        {
+            return null;
+        }
+
+        var matchedItem = source.FirstOrDefault(t => CompareProfileItem(t, target, true));
+        if (matchedItem != null)
+        {
+            return matchedItem;
+        }
+
+        if (target.Remarks.IsNotEmpty())
+        {
+            matchedItem = source.FirstOrDefault(t => t.Remarks == target.Remarks);
+            if (matchedItem != null)
+            {
+                return matchedItem;
+            }
+        }
+
+        if (target.Address.IsNotEmpty() && target.Port > 0 && target.Password.IsNotEmpty())
+        {
+            matchedItem = source.FirstOrDefault(t =>
+                IsSameText(t.Address, target.Address) &&
+                t.Port == target.Port &&
+                IsSameText(t.Password, target.Password));
+            if (matchedItem != null)
+            {
+                return matchedItem;
+            }
+        }
+
+        if (target.Address.IsNotEmpty() && target.Port > 0)
+        {
+            matchedItem = source.FirstOrDefault(t =>
+                IsSameText(t.Address, target.Address) &&
+                t.Port == target.Port);
+            if (matchedItem != null)
+            {
+                return matchedItem;
+            }
+        }
+
+        if (target.Address.IsNotEmpty())
+        {
+            matchedItem = source.FirstOrDefault(t => IsSameText(t.Address, target.Address));
+            if (matchedItem != null)
+            {
+                return matchedItem;
+            }
+        }
+
+        return null;
+
+        static bool IsSameText(string? left, string? right)
+        {
+            if (left.IsNullOrEmpty() || right.IsNullOrEmpty())
+            {
+                return false;
+            }
+
+            return string.Equals(left.TrimEx(), right.TrimEx(), StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
    /// <summary>
    /// Remove a single server profile by its index ID
    /// Deletes the configuration file if it's a custom config
@@ -1185,46 +1279,28 @@ public static class ConfigHandler

    /// <summary>
    /// Create a group server that combines multiple servers for load balancing
-    /// Generates a configuration file that references multiple servers
+    /// Generates a PolicyGroup profile with references to the sub-items
    /// </summary>
    /// <param name="config">Current configuration</param>
-    /// <param name="selecteds">Selected servers to combine</param>
-    /// <param name="coreType">Core type to use (Xray or sing_box)</param>
-    /// <param name="multipleLoad">Load balancing algorithm</param>
+    /// <param name="subItem">Sub-item for grouping</param>
    /// <returns>Result object with success state and data</returns>
-    public static async Task<RetResult> AddGroupServer4Multiple(Config config, List<ProfileItem> selecteds, ECoreType coreType, EMultipleLoad multipleLoad, string? subId)
+    public static async Task<RetResult> AddGroupAllServer(Config config, SubItem? subItem)
    {
        var result = new RetResult();

-        var indexId = Utils.GetGuid(false);
-        var childProfileIndexId = Utils.List2String(selecteds.Select(p => p.IndexId).ToList());
+        var subId = subItem?.Id;
+        if (subId.IsNullOrEmpty())
+        {
+            result.Success = false;
+            return result;
+        }

-        var remark = subId.IsNullOrEmpty() ? string.Empty : $"{(await AppManager.Instance.GetSubItem(subId)).Remarks} ";
-        if (coreType == ECoreType.Xray)
-        {
-            remark += multipleLoad switch
-            {
-                EMultipleLoad.LeastPing => ResUI.menuGenGroupMultipleServerXrayLeastPing,
-                EMultipleLoad.Fallback => ResUI.menuGenGroupMultipleServerXrayFallback,
-                EMultipleLoad.Random => ResUI.menuGenGroupMultipleServerXrayRandom,
-                EMultipleLoad.RoundRobin => ResUI.menuGenGroupMultipleServerXrayRoundRobin,
-                EMultipleLoad.LeastLoad => ResUI.menuGenGroupMultipleServerXrayLeastLoad,
-                _ => ResUI.menuGenGroupMultipleServerXrayRoundRobin,
-            };
-        }
-        else if (coreType == ECoreType.sing_box)
-        {
-            remark += multipleLoad switch
-            {
-                EMultipleLoad.LeastPing => ResUI.menuGenGroupMultipleServerSingBoxLeastPing,
-                EMultipleLoad.Fallback => ResUI.menuGenGroupMultipleServerSingBoxFallback,
-                _ => ResUI.menuGenGroupMultipleServerSingBoxLeastPing,
-            };
-        }
+        var indexId = Utils.GetGuid(false);
+        var remark = $"{subItem.Remarks} - {ResUI.TbConfigTypePolicyGroup}";
        var profile = new ProfileItem
        {
            IndexId = indexId,
-            CoreType = coreType,
+            CoreType = ECoreType.Xray,
            ConfigType = EConfigType.PolicyGroup,
            Remarks = remark,
            IsSub = false
@@ -1233,18 +1309,106 @@ public static class ConfigHandler
        {
            profile.Subid = subId;
        }
-        var profileGroup = new ProfileGroupItem
+        var extraItem = new ProtocolExtraItem
        {
-            ChildItems = childProfileIndexId,
-            MultipleLoad = multipleLoad,
-            IndexId = indexId,
+            MultipleLoad = EMultipleLoad.LeastPing,
+            GroupType = profile.ConfigType.ToString(),
+            SubChildItems = subId,
+            Filter = Global.PolicyGroupDefaultAllFilter,
        };
-        var ret = await AddGroupServerCommon(config, profile, profileGroup, true);
+        profile.SetProtocolExtra(extraItem);
+        var ret = await AddServerCommon(config, profile, true);
        result.Success = ret == 0;
        result.Data = indexId;
        return result;
    }

+    private static string CombineWithDefaultAllFilter(string regionPattern)
+    {
+        return $"^(?!.*(?:{Global.PolicyGroupExcludeKeywords})).*(?:{regionPattern}).*$";
+    }
+
+    private static readonly Dictionary<string, string> PolicyGroupRegionFilters = new()
+    {
+        { "JP", "日本|\\b[Jj][Pp]\\b|🇯🇵|[Jj]apan" },
+        { "US", "美国|\\b[Uu][Ss]\\b|🇺🇸|[Uu]nited [Ss]tates|\\b[Uu][Ss][Aa]\\b" },
+        { "HK", "香港|\\b[Hh][Kk]\\b|🇭🇰|[Hh]ong ?[Kk]ong" },
+        { "TW", "台湾|台灣|\\b[Tt][Ww]\\b|🇹🇼|[Tt]aiwan" },
+        { "KR", "韩国|\\b[Kk][Rr]\\b|🇰🇷|[Kk]orea" },
+        { "SG", "新加坡|\\b[Ss][Gg]\\b|🇸🇬|[Ss]ingapore" },
+        { "DE", "德国|\\b[Dd][Ee]\\b|🇩🇪|[Gg]ermany" },
+        { "FR", "法国|\\b[Ff][Rr]\\b|🇫🇷|[Ff]rance" },
+        { "GB", "英国|\\b[Gg][Bb]\\b|🇬🇧|[Uu]nited [Kk]ingdom|[Bb]ritain" },
+        { "CA", "加拿大|🇨🇦|[Cc]anada" },
+        { "AU", "澳大利亚|\\b[Aa][Uu]\\b|🇦🇺|[Aa]ustralia" },
+        { "RU", "俄罗斯|\\b[Rr][Uu]\\b|🇷🇺|[Rr]ussia" },
+        { "BR", "巴西|\\b[Bb][Rr]\\b|🇧🇷|[Bb]razil" },
+        { "IN", "印度|🇮🇳|[Ii]ndia" },
+        { "VN", "越南|\\b[Vv][Nn]\\b|🇻🇳|[Vv]ietnam" },
+        { "ID", "印度尼西亚|\\b[Ii][Dd]\\b|🇮🇩|[Ii]ndonesia" },
+        { "MX", "墨西哥|\\b[Mm][Xx]\\b|🇲🇽|[Mm]exico" }
+    };
+
+    public static async Task<RetResult> AddGroupRegionServer(Config config, SubItem? subItem)
+    {
+        var result = new RetResult();
+        var subId = subItem?.Id;
+        if (subId.IsNullOrEmpty())
+        {
+            result.Success = false;
+            return result;
+        }
+        var childProfiles = await AppManager.Instance.ProfileItems(subId);
+        List<string> indexIdList = [];
+
+        foreach (var regionFilter in PolicyGroupRegionFilters)
+        {
+            var indexId = Utils.GetGuid(false);
+            var remark = $"{subItem.Remarks} - {ResUI.TbConfigTypePolicyGroup} - {regionFilter.Key}";
+            var profile = new ProfileItem
+            {
+                IndexId = indexId,
+                CoreType = ECoreType.Xray,
+                ConfigType = EConfigType.PolicyGroup,
+                Remarks = remark,
+                IsSub = false
+            };
+            if (!subId.IsNullOrEmpty())
+            {
+                profile.Subid = subId;
+            }
+            var extraItem = new ProtocolExtraItem
+            {
+                MultipleLoad = EMultipleLoad.LeastPing,
+                GroupType = profile.ConfigType.ToString(),
+                SubChildItems = subId,
+                Filter = CombineWithDefaultAllFilter(regionFilter.Value),
+            };
+            profile.SetProtocolExtra(extraItem);
+
+            var matchedChildProfiles = childProfiles?.Where(p =>
+                    p != null &&
+                    p.IsValid() &&
+                    !p.ConfigType.IsComplexType() &&
+                    (extraItem.Filter.IsNullOrEmpty() || Regex.IsMatch(p.Remarks, extraItem.Filter))
+                )
+                .ToList() ?? [];
+            if (matchedChildProfiles.Count == 0)
+            {
+                continue;
+            }
+
+            var ret = await AddServerCommon(config, profile, true);
+            if (ret == 0)
+            {
+                indexIdList.Add(indexId);
+            }
+        }
+        result.Success = indexIdList.Count > 0;
+        result.Data = indexIdList;
+        return result;
+    }
+
    /// <summary>
    /// Get a SOCKS server profile for pre-SOCKS functionality
    /// Used when TUN mode is enabled or when a custom config has a pre-SOCKS port
@@ -1253,32 +1417,28 @@ public static class ConfigHandler
    /// <param name="node">Server node that might need pre-SOCKS</param>
    /// <param name="coreType">Core type being used</param>
    /// <returns>A SOCKS profile item or null if not needed</returns>
-    public static async Task<ProfileItem?> GetPreSocksItem(Config config, ProfileItem node, ECoreType coreType)
+    public static ProfileItem? GetPreSocksItem(Config config, ProfileItem node, ECoreType coreType)
    {
        ProfileItem? itemSocks = null;
-        if (node.ConfigType != EConfigType.Custom && coreType != ECoreType.sing_box && config.TunModeItem.EnableTun)
+        var enableLegacyProtect = config.TunModeItem.EnableLegacyProtect
+                                  || Utils.IsNonWindows();
+        if (node.ConfigType != EConfigType.Custom
+            && coreType != ECoreType.sing_box
+            && config.TunModeItem.EnableTun
+            && enableLegacyProtect)
        {
-            var tun2SocksAddress = node.Address;
-            if (node.ConfigType.IsGroupType())
-            {
-                var lstAddresses = (await ProfileGroupItemManager.GetAllChildDomainAddresses(node.IndexId)).ToList();
-                if (lstAddresses.Count > 0)
-                {
-                    tun2SocksAddress = Utils.List2String(lstAddresses);
-                }
-            }
            itemSocks = new ProfileItem()
            {
                CoreType = ECoreType.sing_box,
                ConfigType = EConfigType.SOCKS,
                Address = Global.Loopback,
-                SpiderX = tun2SocksAddress, // Tun2SocksAddress
                Port = AppManager.Instance.GetLocalPort(EInboundProtocol.socks)
            };
        }
-        else if (node.ConfigType == EConfigType.Custom && node.PreSocksPort > 0)
+        else if (node.ConfigType == EConfigType.Custom
+            && node.PreSocksPort is > 0 and <= 65535)
        {
-            var preCoreType = AppManager.Instance.RunningCoreType = config.TunModeItem.EnableTun ? ECoreType.sing_box : ECoreType.Xray;
+            var preCoreType = config.TunModeItem.EnableTun ? ECoreType.sing_box : ECoreType.Xray;
            itemSocks = new ProfileItem()
            {
                CoreType = preCoreType,
@@ -1287,7 +1447,6 @@ public static class ConfigHandler
                Port = node.PreSocksPort.Value,
            };
        }
-        await Task.CompletedTask;
        return itemSocks;
    }

@@ -1300,7 +1459,8 @@ public static class ConfigHandler
    /// <returns>Number of removed servers or -1 if failed</returns>
    public static async Task<int> RemoveInvalidServerResult(Config config, string subid)
    {
-        var lstModel = await AppManager.Instance.ProfileItems(subid, "");
+        var lstModel = await AppManager.Instance.ProfileModels(subid, "");
+        lstModel.RemoveAll(t => t.ConfigType.IsComplexType());
        if (lstModel is { Count: <= 0 })
        {
            return -1;
@@ -1390,6 +1550,7 @@ public static class ConfigHandler
                EConfigType.TUIC => await AddTuicServer(config, profileItem, false),
                EConfigType.WireGuard => await AddWireguardServer(config, profileItem, false),
                EConfigType.Anytls => await AddAnytlsServer(config, profileItem, false),
+                EConfigType.Naive => await AddNaiveServer(config, profileItem, false),
                _ => -1,
            };

@@ -1605,7 +1766,7 @@ public static class ConfigHandler
        if (activeProfile != null)
        {
            var lstSub = await AppManager.Instance.ProfileItems(subid);
-            var existItem = lstSub?.FirstOrDefault(t => config.UiItem.EnableUpdateSubOnlyRemarksExist ? t.Remarks == activeProfile.Remarks : CompareProfileItem(t, activeProfile, true));
+            var existItem = FindMatchedProfileItem(lstSub, activeProfile);
            if (existItem != null)
            {
                await ConfigHandler.SetDefaultServerIndex(config, existItem.IndexId);
@@ -1618,7 +1779,7 @@ public static class ConfigHandler
            var lstSub = await AppManager.Instance.ProfileItems(subid);
            foreach (var item in lstSub)
            {
-                var existItem = lstOriSub?.FirstOrDefault(t => config.UiItem.EnableUpdateSubOnlyRemarksExist ? t.Remarks == item.Remarks : CompareProfileItem(t, item, true));
+                var existItem = FindMatchedProfileItem(lstOriSub, item);
                if (existItem != null)
                {
                    await StatisticsManager.Instance.CloneServerStatItem(existItem.IndexId, item.IndexId);
@@ -1775,6 +1936,12 @@ public static class ConfigHandler
        await SQLiteHelper.Instance.DeleteAsync(item);
        await RemoveServersViaSubid(config, id, false);

+        if (item.Id == config.SubIndexId)
+        {
+            var subs = await AppManager.Instance.SubItems();
+            config.SubIndexId = subs.LastOrDefault()?.Id;
+        }
+
        return 0;
    }

@@ -7,27 +7,27 @@ public static class CoreConfigHandler
 {
    private static readonly string _tag = "CoreConfigHandler";

-    public static async Task<RetResult> GenerateClientConfig(ProfileItem node, string? fileName)
+    public static async Task<RetResult> GenerateClientConfig(CoreConfigContext context, string? fileName)
    {
        var config = AppManager.Instance.Config;
        var result = new RetResult();
+        var node = context.Node;

        if (node.ConfigType == EConfigType.Custom)
        {
            result = node.CoreType switch
            {
                ECoreType.mihomo => await new CoreConfigClashService(config).GenerateClientCustomConfig(node, fileName),
-                ECoreType.sing_box => await new CoreConfigSingboxService(config).GenerateClientCustomConfig(node, fileName),
                _ => await GenerateClientCustomConfig(node, fileName)
            };
        }
-        else if (AppManager.Instance.GetCoreType(node, node.ConfigType) == ECoreType.sing_box)
+        else if (context.RunCoreType == ECoreType.sing_box)
        {
-            result = await new CoreConfigSingboxService(config).GenerateClientConfigContent(node);
+            result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
        }
        else
        {
-            result = await new CoreConfigV2rayService(config).GenerateClientConfigContent(node);
+            result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
        }
        if (result.Success != true)
        {
@@ -93,13 +93,29 @@ public static class CoreConfigHandler
    public static async Task<RetResult> GenerateClientSpeedtestConfig(Config config, string fileName, List<ServerTestItem> selecteds, ECoreType coreType)
    {
        var result = new RetResult();
+        var dummyNode = new ProfileItem
+        {
+            CoreType = coreType
+        };
+        var builderResult = await CoreConfigContextBuilder.Build(config, dummyNode);
+        var context = builderResult.Context;
+        foreach (var testItem in selecteds)
+        {
+            var node = testItem.Profile;
+            var (actNode, _) = await CoreConfigContextBuilder.ResolveNodeAsync(context, node, true);
+            if (node.IndexId == actNode.IndexId)
+            {
+                continue;
+            }
+            context.ServerTestItemMap[node.IndexId] = actNode.IndexId;
+        }
        if (coreType == ECoreType.sing_box)
        {
-            result = await new CoreConfigSingboxService(config).GenerateClientSpeedtestConfig(selecteds);
+            result = new CoreConfigSingboxService(context).GenerateClientSpeedtestConfig(selecteds);
        }
        else if (coreType == ECoreType.Xray)
        {
-            result = await new CoreConfigV2rayService(config).GenerateClientSpeedtestConfig(selecteds);
+            result = new CoreConfigV2rayService(context).GenerateClientSpeedtestConfig(selecteds);
        }
        if (result.Success != true)
        {
@@ -109,20 +125,20 @@ public static class CoreConfigHandler
        return result;
    }

-    public static async Task<RetResult> GenerateClientSpeedtestConfig(Config config, ProfileItem node, ServerTestItem testItem, string fileName)
+    public static async Task<RetResult> GenerateClientSpeedtestConfig(Config config, CoreConfigContext context, ServerTestItem testItem, string fileName)
    {
        var result = new RetResult();
        var initPort = AppManager.Instance.GetLocalPort(EInboundProtocol.speedtest);
        var port = Utils.GetFreePort(initPort + testItem.QueueNum);
        testItem.Port = port;

-        if (AppManager.Instance.GetCoreType(node, node.ConfigType) == ECoreType.sing_box)
+        if (context.RunCoreType == ECoreType.sing_box)
        {
-            result = await new CoreConfigSingboxService(config).GenerateClientSpeedtestConfig(node, port);
+            result = new CoreConfigSingboxService(context).GenerateClientSpeedtestConfig(port);
        }
        else
        {
-            result = await new CoreConfigV2rayService(config).GenerateClientSpeedtestConfig(node, port);
+            result = new CoreConfigV2rayService(context).GenerateClientSpeedtestConfig(port);
        }
        if (result.Success != true)
        {
@@ -20,7 +20,7 @@ public class AnytlsFmt : BaseFmt
            Port = parsedUrl.Port,
        };
        var rawUserInfo = Utils.UrlDecode(parsedUrl.UserInfo);
-        item.Id = rawUserInfo;
+        item.Password = rawUserInfo;

        var query = Utils.ParseQueryString(parsedUrl.Query);
        ResolveUriQuery(query, ref item);
@@ -39,7 +39,7 @@ public class AnytlsFmt : BaseFmt
        {
            remark = "#" + Utils.UrlEncode(item.Remarks);
        }
-        var pw = item.Id;
+        var pw = item.Password;
        var dicQuery = new Dictionary<string, string>();
        ToUriQuery(item, Global.None, ref dicQuery);

@@ -5,6 +5,7 @@ namespace ServiceLib.Handler.Fmt;
 public class BaseFmt
 {
    private static readonly string[] _allowInsecureArray = new[] { "insecure", "allowInsecure", "allow_insecure" };
+    private static string UrlEncodeSafe(string? value) => Utils.UrlEncode(value ?? string.Empty);

    protected static string GetIpv6(string address)
    {
@@ -21,10 +22,7 @@ public class BaseFmt

    protected static int ToUriQuery(ProfileItem item, string? securityDef, ref Dictionary<string, string> dicQuery)
    {
-        if (item.Flow.IsNotEmpty())
-        {
-            dicQuery.Add("flow", item.Flow);
-        }
+        var transport = item.GetTransportExtra();

        if (item.StreamSecurity.IsNotEmpty())
        {
@@ -78,55 +76,79 @@ public class BaseFmt
        {
            dicQuery.Add("pcs", Utils.UrlEncode(item.CertSha));
        }
-
-        dicQuery.Add("type", item.Network.IsNotEmpty() ? item.Network : nameof(ETransport.tcp));
-
-        switch (item.Network)
+        if (item.Finalmask.IsNotEmpty())
        {
-            case nameof(ETransport.tcp):
-                dicQuery.Add("headerType", item.HeaderType.IsNotEmpty() ? item.HeaderType : Global.None);
-                if (item.RequestHost.IsNotEmpty())
+            var node = JsonUtils.ParseJson(item.Finalmask);
+            var finalmask = node != null
+                ? JsonUtils.Serialize(node, new JsonSerializerOptions
                {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
+                    WriteIndented = false,
+                    DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+                    Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+                })
+                : item.Finalmask;
+            dicQuery.Add("fm", Utils.UrlEncode(finalmask));
+        }
+
+        var network = item.GetNetwork();
+        if (!Global.Networks.Contains(network))
+        {
+            network = nameof(ETransport.raw);
+        }
+
+        //dicQuery.Add("type", network);
+        dicQuery.Add("type", network == nameof(ETransport.raw) ? Global.RawNetworkAlias : network);
+
+        switch (network)
+        {
+            case nameof(ETransport.raw):
+                dicQuery.Add("headerType", transport.RawHeaderType.IsNotEmpty() ? transport.RawHeaderType : Global.None);
+                if (transport.Host.IsNotEmpty())
+                {
+                    dicQuery.Add("host", UrlEncodeSafe(transport.Host));
+                }
+                if (transport.Path.IsNotEmpty())
+                {
+                    dicQuery.Add("path", UrlEncodeSafe(transport.Path));
                }
                break;

            case nameof(ETransport.kcp):
-                dicQuery.Add("headerType", item.HeaderType.IsNotEmpty() ? item.HeaderType : Global.None);
-                if (item.Path.IsNotEmpty())
+                dicQuery.Add("headerType", transport.KcpHeaderType.IsNotEmpty() ? transport.KcpHeaderType : Global.None);
+                if (transport.KcpSeed.IsNotEmpty())
                {
-                    dicQuery.Add("seed", Utils.UrlEncode(item.Path));
+                    dicQuery.Add("seed", UrlEncodeSafe(transport.KcpSeed));
                }
                break;

            case nameof(ETransport.ws):
            case nameof(ETransport.httpupgrade):
-                if (item.RequestHost.IsNotEmpty())
+                if (transport.Host.IsNotEmpty())
                {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
+                    dicQuery.Add("host", UrlEncodeSafe(transport.Host));
                }
-                if (item.Path.IsNotEmpty())
+                if (transport.Path.IsNotEmpty())
                {
-                    dicQuery.Add("path", Utils.UrlEncode(item.Path));
+                    dicQuery.Add("path", UrlEncodeSafe(transport.Path));
                }
                break;

            case nameof(ETransport.xhttp):
-                if (item.RequestHost.IsNotEmpty())
+                if (transport.Host.IsNotEmpty())
                {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
+                    dicQuery.Add("host", UrlEncodeSafe(transport.Host));
                }
-                if (item.Path.IsNotEmpty())
+                if (transport.Path.IsNotEmpty())
                {
-                    dicQuery.Add("path", Utils.UrlEncode(item.Path));
+                    dicQuery.Add("path", UrlEncodeSafe(transport.Path));
                }
-                if (item.HeaderType.IsNotEmpty() && Global.XhttpMode.Contains(item.HeaderType))
+                if (transport.XhttpMode.IsNotEmpty() && Global.XhttpMode.Contains(transport.XhttpMode))
                {
-                    dicQuery.Add("mode", Utils.UrlEncode(item.HeaderType));
+                    dicQuery.Add("mode", UrlEncodeSafe(transport.XhttpMode));
                }
-                if (item.Extra.IsNotEmpty())
+                if (transport.XhttpExtra.IsNotEmpty())
                {
-                    var node = JsonUtils.ParseJson(item.Extra);
+                    var node = JsonUtils.ParseJson(transport.XhttpExtra);
                    var extra = node != null
                        ? JsonUtils.Serialize(node, new JsonSerializerOptions
                        {
@@ -134,38 +156,19 @@ public class BaseFmt
                            DefaultIgnoreCondition = JsonIgnoreCondition.Never,
                            Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
                        })
-                        : item.Extra;
-                    dicQuery.Add("extra", Utils.UrlEncode(extra));
+                        : transport.XhttpExtra;
+                    dicQuery.Add("extra", UrlEncodeSafe(extra));
                }
                break;

-            case nameof(ETransport.http):
-            case nameof(ETransport.h2):
-                dicQuery["type"] = nameof(ETransport.http);
-                if (item.RequestHost.IsNotEmpty())
-                {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
-                }
-                if (item.Path.IsNotEmpty())
-                {
-                    dicQuery.Add("path", Utils.UrlEncode(item.Path));
-                }
-                break;
-
-            case nameof(ETransport.quic):
-                dicQuery.Add("headerType", item.HeaderType.IsNotEmpty() ? item.HeaderType : Global.None);
-                dicQuery.Add("quicSecurity", Utils.UrlEncode(item.RequestHost));
-                dicQuery.Add("key", Utils.UrlEncode(item.Path));
-                break;
-
            case nameof(ETransport.grpc):
-                if (item.Path.IsNotEmpty())
+                if (transport.GrpcServiceName.IsNotEmpty())
                {
-                    dicQuery.Add("authority", Utils.UrlEncode(item.RequestHost));
-                    dicQuery.Add("serviceName", Utils.UrlEncode(item.Path));
-                    if (item.HeaderType is Global.GrpcGunMode or Global.GrpcMultiMode)
+                    dicQuery.Add("authority", UrlEncodeSafe(transport.GrpcAuthority));
+                    dicQuery.Add("serviceName", UrlEncodeSafe(transport.GrpcServiceName));
+                    if (transport.GrpcMode is Global.GrpcGunMode or Global.GrpcMultiMode)
                    {
-                        dicQuery.Add("mode", Utils.UrlEncode(item.HeaderType));
+                        dicQuery.Add("mode", UrlEncodeSafe(transport.GrpcMode));
                    }
                }
                break;
@@ -208,7 +211,8 @@ public class BaseFmt

    protected static int ResolveUriQuery(NameValueCollection query, ref ProfileItem item)
    {
-        item.Flow = GetQueryValue(query, "flow");
+        var transport = item.GetTransportExtra();
+
        item.StreamSecurity = GetQueryValue(query, "security");
        item.Sni = GetQueryValue(query, "sni");
        item.Alpn = GetQueryDecoded(query, "alpn");
@@ -220,6 +224,24 @@ public class BaseFmt
        item.EchConfigList = GetQueryDecoded(query, "ech");
        item.CertSha = GetQueryDecoded(query, "pcs");

+        var finalmaskDecoded = GetQueryDecoded(query, "fm");
+        if (finalmaskDecoded.IsNotEmpty())
+        {
+            var node = JsonUtils.ParseJson(finalmaskDecoded);
+            item.Finalmask = node != null
+                ? JsonUtils.Serialize(node, new JsonSerializerOptions
+                {
+                    WriteIndented = true,
+                    DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+                    Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+                })
+                : finalmaskDecoded;
+        }
+        else
+        {
+            item.Finalmask = string.Empty;
+        }
+
        if (_allowInsecureArray.Any(k => GetQueryDecoded(query, k) == "1"))
        {
            item.AllowInsecure = Global.AllowInsecure.First();
@@ -233,36 +255,54 @@ public class BaseFmt
            item.AllowInsecure = string.Empty;
        }

-        item.Network = GetQueryValue(query, "type", nameof(ETransport.tcp));
+        var net = GetQueryValue(query, "type", nameof(ETransport.raw));
+        if (net == Global.RawNetworkAlias)
+        {
+            net = nameof(ETransport.raw);
+        }
+        if (!Global.Networks.Contains(net))
+        {
+            net = nameof(ETransport.raw);
+        }
+
+        item.Network = net;
        switch (item.Network)
        {
-            case nameof(ETransport.tcp):
-                item.HeaderType = GetQueryValue(query, "headerType", Global.None);
-                item.RequestHost = GetQueryDecoded(query, "host");
+            case nameof(ETransport.raw):
+                transport = transport with
+                {
+                    RawHeaderType = GetQueryValue(query, "headerType", Global.None),
+                    Host = GetQueryDecoded(query, "host"),
+                    Path = GetQueryDecoded(query, "path"),
+                };
                break;

            case nameof(ETransport.kcp):
-                item.HeaderType = GetQueryValue(query, "headerType", Global.None);
-                item.Path = GetQueryDecoded(query, "seed");
+                var kcpSeed = GetQueryDecoded(query, "seed");
+                transport = transport with
+                {
+                    KcpHeaderType = GetQueryValue(query, "headerType", Global.None),
+                    KcpSeed = kcpSeed,
+                };
                break;

            case nameof(ETransport.ws):
            case nameof(ETransport.httpupgrade):
-                item.RequestHost = GetQueryDecoded(query, "host");
-                item.Path = GetQueryDecoded(query, "path", "/");
+                transport = transport with
+                {
+                    Host = GetQueryDecoded(query, "host"),
+                    Path = GetQueryDecoded(query, "path", "/"),
+                };
                break;

            case nameof(ETransport.xhttp):
-                item.RequestHost = GetQueryDecoded(query, "host");
-                item.Path = GetQueryDecoded(query, "path", "/");
-                item.HeaderType = GetQueryDecoded(query, "mode");
-                var extraDecoded = GetQueryDecoded(query, "extra");
-                if (extraDecoded.IsNotEmpty())
+                var xhttpExtra = GetQueryDecoded(query, "extra");
+                if (xhttpExtra.IsNotEmpty())
                {
-                    var node = JsonUtils.ParseJson(extraDecoded);
+                    var node = JsonUtils.ParseJson(xhttpExtra);
                    if (node != null)
                    {
-                        extraDecoded = JsonUtils.Serialize(node, new JsonSerializerOptions
+                        xhttpExtra = JsonUtils.Serialize(node, new JsonSerializerOptions
                        {
                            WriteIndented = true,
                            DefaultIgnoreCondition = JsonIgnoreCondition.Never,
@@ -270,31 +310,32 @@ public class BaseFmt
                        });
                    }
                }
-                item.Extra = extraDecoded;
-                break;

-            case nameof(ETransport.http):
-            case nameof(ETransport.h2):
-                item.Network = nameof(ETransport.h2);
-                item.RequestHost = GetQueryDecoded(query, "host");
-                item.Path = GetQueryDecoded(query, "path", "/");
-                break;
-
-            case nameof(ETransport.quic):
-                item.HeaderType = GetQueryValue(query, "headerType", Global.None);
-                item.RequestHost = GetQueryValue(query, "quicSecurity", Global.None);
-                item.Path = GetQueryDecoded(query, "key");
+                transport = transport with
+                {
+                    Host = GetQueryDecoded(query, "host"),
+                    Path = GetQueryDecoded(query, "path", "/"),
+                    XhttpMode = GetQueryDecoded(query, "mode"),
+                    XhttpExtra = xhttpExtra,
+                };
                break;

            case nameof(ETransport.grpc):
-                item.RequestHost = GetQueryDecoded(query, "authority");
-                item.Path = GetQueryDecoded(query, "serviceName");
-                item.HeaderType = GetQueryDecoded(query, "mode", Global.GrpcGunMode);
+                transport = transport with
+                {
+                    GrpcAuthority = GetQueryDecoded(query, "authority"),
+                    GrpcServiceName = GetQueryDecoded(query, "serviceName"),
+                    GrpcMode = GetQueryDecoded(query, "mode", Global.GrpcGunMode),
+                };
                break;

            default:
+                item.Network = nameof(ETransport.raw);
                break;
        }
+
+        item.SetTransportExtra(transport);
+
        return 0;
    }

@@ -19,6 +19,7 @@ public class FmtHandler
                EConfigType.TUIC => TuicFmt.ToUri(item),
                EConfigType.WireGuard => WireguardFmt.ToUri(item),
                EConfigType.Anytls => AnytlsFmt.ToUri(item),
+                EConfigType.Naive => NaiveFmt.ToUri(item),
                _ => null,
            };

@@ -80,6 +81,12 @@ public class FmtHandler
            {
                return AnytlsFmt.Resolve(str, out msg);
            }
+            else if (str.StartsWith(Global.ProtocolShares[EConfigType.Naive])
+                     || str.StartsWith(Global.NaiveHttpsProtocolShare)
+                     || str.StartsWith(Global.NaiveQuicProtocolShare))
+            {
+                return NaiveFmt.Resolve(str, out msg);
+            }
            else
            {
                msg = ResUI.NonvmessOrssProtocol;
@@ -19,16 +19,19 @@ public class Hysteria2Fmt : BaseFmt
        item.Address = url.IdnHost;
        item.Port = url.Port;
        item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
-        item.Id = Utils.UrlDecode(url.UserInfo);
+        item.Password = Utils.UrlDecode(url.UserInfo);

        var query = Utils.ParseQueryString(url.Query);
        ResolveUriQuery(query, ref item);
-        item.Path = GetQueryDecoded(query, "obfs-password");
-        item.Ports = GetQueryDecoded(query, "mport");
        if (item.CertSha.IsNullOrEmpty())
        {
            item.CertSha = GetQueryDecoded(query, "pinSHA256");
        }
+        item.SetProtocolExtra(item.GetProtocolExtra() with
+        {
+            Ports = GetQueryDecoded(query, "mport"),
+            SalamanderPass = GetQueryDecoded(query, "obfs-password"),
+        });

        return item;
    }
@@ -49,20 +52,21 @@ public class Hysteria2Fmt : BaseFmt
        }
        var dicQuery = new Dictionary<string, string>();
        ToUriQueryLite(item, ref dicQuery);
+        var protocolExtraItem = item.GetProtocolExtra();

-        if (item.Path.IsNotEmpty())
+        if (!protocolExtraItem.SalamanderPass.IsNullOrEmpty())
        {
            dicQuery.Add("obfs", "salamander");
-            dicQuery.Add("obfs-password", Utils.UrlEncode(item.Path));
+            dicQuery.Add("obfs-password", Utils.UrlEncode(protocolExtraItem.SalamanderPass));
        }
-        if (item.Ports.IsNotEmpty())
+        if (!protocolExtraItem.Ports.IsNullOrEmpty())
        {
-            dicQuery.Add("mport", Utils.UrlEncode(item.Ports.Replace(':', '-')));
+            dicQuery.Add("mport", Utils.UrlEncode(protocolExtraItem.Ports.Replace(':', '-')));
        }
        if (!item.CertSha.IsNullOrEmpty())
        {
            var sha = item.CertSha;
-            var idx = sha.IndexOf('~');
+            var idx = sha.IndexOf(',');
            if (idx > 0)
            {
                sha = sha[..idx];
@@ -70,7 +74,7 @@ public class Hysteria2Fmt : BaseFmt
            dicQuery.Add("pinSHA256", Utils.UrlEncode(sha));
        }

-        return ToUri(EConfigType.Hysteria2, item.Address, item.Port, item.Id, dicQuery, remark);
+        return ToUri(EConfigType.Hysteria2, item.Address, item.Port, item.Password, dicQuery, remark);
    }

    public static ProfileItem? ResolveFull2(string strData, string? subRemarks)
@@ -0,0 +1,91 @@
+namespace ServiceLib.Handler.Fmt;
+
+public class NaiveFmt : BaseFmt
+{
+    public static ProfileItem? Resolve(string str, out string msg)
+    {
+        msg = ResUI.ConfigurationFormatIncorrect;
+
+        var parsedUrl = Utils.TryUri(str);
+        if (parsedUrl == null)
+        {
+            return null;
+        }
+
+        ProfileItem item = new()
+        {
+            ConfigType = EConfigType.Naive,
+            Remarks = parsedUrl.GetComponents(UriComponents.Fragment, UriFormat.Unescaped),
+            Address = parsedUrl.IdnHost,
+            Port = parsedUrl.Port,
+        };
+        var protocolExtra = item.GetProtocolExtra();
+        if (parsedUrl.Scheme.Contains("quic"))
+        {
+            protocolExtra = protocolExtra with
+            {
+                NaiveQuic = true,
+            };
+        }
+        var rawUserInfo = Utils.UrlDecode(parsedUrl.UserInfo);
+        if (rawUserInfo.Contains(':'))
+        {
+            var split = rawUserInfo.Split(':', 2);
+            item.Username = split[0];
+            item.Password = split[1];
+        }
+        else
+        {
+            item.Password = rawUserInfo;
+        }
+
+        var query = Utils.ParseQueryString(parsedUrl.Query);
+        ResolveUriQuery(query, ref item);
+        var insecureConcurrency = int.TryParse(GetQueryValue(query, "insecure-concurrency"), out var ic) ? ic : 0;
+        if (insecureConcurrency > 0)
+        {
+            protocolExtra = protocolExtra with
+            {
+                InsecureConcurrency = insecureConcurrency,
+            };
+        }
+
+        item.SetProtocolExtra(protocolExtra);
+        return item;
+    }
+
+    public static string? ToUri(ProfileItem? item)
+    {
+        if (item == null)
+        {
+            return null;
+        }
+        var remark = string.Empty;
+        if (item.Remarks.IsNotEmpty())
+        {
+            remark = "#" + Utils.UrlEncode(item.Remarks);
+        }
+        var userInfo = item.Username.IsNotEmpty() ? $"{Utils.UrlEncode(item.Username)}:{Utils.UrlEncode(item.Password)}" : Utils.UrlEncode(item.Password);
+        var dicQuery = new Dictionary<string, string>();
+        ToUriQuery(item, Global.None, ref dicQuery);
+        var protocolExtra = item.GetProtocolExtra();
+        if (protocolExtra.InsecureConcurrency > 0)
+        {
+            dicQuery.Add("insecure-concurrency", protocolExtra?.InsecureConcurrency.ToString());
+        }
+
+        var query = dicQuery.Count > 0
+            ? ("?" + string.Join("&", dicQuery.Select(x => x.Key + "=" + x.Value).ToArray()))
+            : string.Empty;
+        var url = $"{userInfo}@{GetIpv6(item.Address)}:{item.Port}";
+
+        if (protocolExtra.NaiveQuic == true)
+        {
+            return $"{Global.NaiveQuicProtocolShare}{url}{query}{remark}";
+        }
+        else
+        {
+            return $"{Global.NaiveHttpsProtocolShare}{url}{query}{remark}";
+        }
+    }
+}
@@ -12,7 +12,8 @@ public class ShadowsocksFmt : BaseFmt
        {
            return null;
        }
-        if (item.Address.Length == 0 || item.Port == 0 || item.Security.Length == 0 || item.Id.Length == 0)
+
+        if (item.Address.Length == 0 || item.Port == 0 || item.GetProtocolExtra().SsMethod.IsNullOrEmpty() || item.Password.Length == 0)
        {
            return null;
        }
@@ -40,32 +41,29 @@ public class ShadowsocksFmt : BaseFmt
        //    item.port);
        //url = Utile.Base64Encode(url);
        //new Sip002
-        var pw = Utils.Base64Encode($"{item.Security}:{item.Id}", true);
+        var pw = Utils.Base64Encode($"{item.GetProtocolExtra().SsMethod}:{item.Password}", true);
+        var transport = item.GetTransportExtra();

        // plugin
        var plugin = string.Empty;
        var pluginArgs = string.Empty;

-        if (item.Network == nameof(ETransport.tcp) && item.HeaderType == Global.TcpHeaderHttp)
+        if (item.Network == nameof(ETransport.raw) && transport.RawHeaderType == Global.RawHeaderHttp)
        {
            plugin = "obfs-local";
-            pluginArgs = $"obfs=http;obfs-host={item.RequestHost};";
+            pluginArgs = $"obfs=http;obfs-host={transport.Host};";
        }
        else
        {
            if (item.Network == nameof(ETransport.ws))
            {
                pluginArgs += "mode=websocket;";
-                pluginArgs += $"host={item.RequestHost};";
+                pluginArgs += $"host={transport.Host};";
                // https://github.com/shadowsocks/v2ray-plugin/blob/e9af1cdd2549d528deb20a4ab8d61c5fbe51f306/args.go#L172
                // Equal signs and commas [and backslashes] must be escaped with a backslash.
-                var path = item.Path.Replace("\\", "\\\\").Replace("=", "\\=").Replace(",", "\\,");
+                var path = (transport.Path ?? string.Empty).Replace("\\", "\\\\").Replace("=", "\\=").Replace(",", "\\,");
                pluginArgs += $"path={path};";
            }
-            else if (item.Network == nameof(ETransport.quic))
-            {
-                pluginArgs += "mode=quic;";
-            }
            if (item.StreamSecurity == Global.StreamSecurity)
            {
                pluginArgs += "tls;";
@@ -136,8 +134,8 @@ public class ShadowsocksFmt : BaseFmt
        {
            return null;
        }
-        item.Security = details.Groups["method"].Value;
-        item.Id = details.Groups["password"].Value;
+        item.SetProtocolExtra(item.GetProtocolExtra() with { SsMethod = details.Groups["method"].Value });
+        item.Password = details.Groups["password"].Value;
        item.Address = details.Groups["hostname"].Value;
        item.Port = details.Groups["port"].Value.ToInt();
        return item;
@@ -166,8 +164,8 @@ public class ShadowsocksFmt : BaseFmt
            {
                return null;
            }
-            item.Security = userInfoParts.First();
-            item.Id = Utils.UrlDecode(userInfoParts.Last());
+            item.SetProtocolExtra(item.GetProtocolExtra() with { SsMethod = userInfoParts.First() });
+            item.Password = Utils.UrlDecode(userInfoParts.Last());
        }
        else
        {
@@ -178,8 +176,8 @@ public class ShadowsocksFmt : BaseFmt
            {
                return null;
            }
-            item.Security = userInfoParts.First();
-            item.Id = userInfoParts.Last();
+            item.SetProtocolExtra(item.GetProtocolExtra() with { SsMethod = userInfoParts.First() });
+            item.Password = userInfoParts.Last();
        }

        var queryParameters = Utils.ParseQueryString(parsedUrl.Query);
@@ -212,8 +210,11 @@ public class ShadowsocksFmt : BaseFmt
                {
                    obfsHost = obfsHost.Replace("obfs-host=", "");
                    item.Network = Global.DefaultNetwork;
-                    item.HeaderType = Global.TcpHeaderHttp;
-                    item.RequestHost = obfsHost;
+                    item.SetTransportExtra(item.GetTransportExtra() with
+                    {
+                        RawHeaderType = Global.RawHeaderHttp,
+                        Host = obfsHost,
+                    });
                }
            }
            // Parse v2ray-plugin
@@ -230,21 +231,20 @@ public class ShadowsocksFmt : BaseFmt
                if (modeValue == "websocket")
                {
                    item.Network = nameof(ETransport.ws);
+                    var t = item.GetTransportExtra();
                    if (!host.IsNullOrEmpty())
                    {
-                        item.RequestHost = host.Replace("host=", "");
-                        item.Sni = item.RequestHost;
+                        var wsHost = host.Replace("host=", "");
+                        t = t with { Host = wsHost };
+                        item.Sni = wsHost;
                    }
                    if (!path.IsNullOrEmpty())
                    {
                        var pathValue = path.Replace("path=", "");
                        pathValue = pathValue.Replace("\\=", "=").Replace("\\,", ",").Replace("\\\\", "\\");
-                        item.Path = pathValue;
+                        t = t with { Path = pathValue };
                    }
-                }
-                else if (modeValue == "quic")
-                {
-                    item.Network = nameof(ETransport.quic);
+                    item.SetTransportExtra(t);
                }

                if (hasTls)
@@ -275,7 +275,6 @@ public class ShadowsocksFmt : BaseFmt
                }
            }
        }
-
        return item;
    }

@@ -300,11 +299,11 @@ public class ShadowsocksFmt : BaseFmt
                var ssItem = new ProfileItem()
                {
                    Remarks = it.remarks,
-                    Security = it.method,
-                    Id = it.password,
+                    Password = it.password,
                    Address = it.server,
                    Port = it.server_port.ToInt()
                };
+                ssItem.SetProtocolExtra(new ProtocolExtraItem() { SsMethod = it.method });
                lst.Add(ssItem);
            }
            return lst;
@@ -33,7 +33,7 @@ public class SocksFmt : BaseFmt
            remark = "#" + Utils.UrlEncode(item.Remarks);
        }
        //new
-        var pw = Utils.Base64Encode($"{item.Security}:{item.Id}", true);
+        var pw = Utils.Base64Encode($"{item.Username}:{item.Password}", true);
        return ToUri(EConfigType.SOCKS, item.Address, item.Port, pw, null, remark);
    }

@@ -78,9 +78,8 @@ public class SocksFmt : BaseFmt
        }
        item.Address = arr1[1][..indexPort];
        item.Port = arr1[1][(indexPort + 1)..].ToInt();
-        item.Security = arr21.First();
-        item.Id = arr21[1];
-
+        item.Username = arr21.First();
+        item.Password = arr21[1];
        return item;
    }

@@ -98,15 +97,14 @@ public class SocksFmt : BaseFmt
            Address = parsedUrl.IdnHost,
            Port = parsedUrl.Port,
        };
-
        // parse base64 UserInfo
        var rawUserInfo = Utils.UrlDecode(parsedUrl.UserInfo);
        var userInfo = Utils.Base64Decode(rawUserInfo);
        var userInfoParts = userInfo.Split([':'], 2);
        if (userInfoParts.Length == 2)
        {
-            item.Security = userInfoParts.First();
-            item.Id = userInfoParts[1];
+            item.Username = userInfoParts.First();
+            item.Password = userInfoParts[1];
        }

        return item;
@@ -20,9 +20,10 @@ public class TrojanFmt : BaseFmt
        item.Address = url.IdnHost;
        item.Port = url.Port;
        item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
-        item.Id = Utils.UrlDecode(url.UserInfo);
+        item.Password = Utils.UrlDecode(url.UserInfo);

        var query = Utils.ParseQueryString(url.Query);
+        item.SetProtocolExtra(item.GetProtocolExtra() with { Flow = GetQueryValue(query, "flow") });
        ResolveUriQuery(query, ref item);

        return item;
@@ -40,8 +41,12 @@ public class TrojanFmt : BaseFmt
            remark = "#" + Utils.UrlEncode(item.Remarks);
        }
        var dicQuery = new Dictionary<string, string>();
+        if (!item.GetProtocolExtra().Flow.IsNullOrEmpty())
+        {
+            dicQuery.Add("flow", item.GetProtocolExtra().Flow);
+        }
        ToUriQuery(item, null, ref dicQuery);

-        return ToUri(EConfigType.Trojan, item.Address, item.Port, item.Id, dicQuery, remark);
+        return ToUri(EConfigType.Trojan, item.Address, item.Port, item.Password, dicQuery, remark);
    }
 }
@@ -24,13 +24,16 @@ public class TuicFmt : BaseFmt
        var userInfoParts = rawUserInfo.Split(new[] { ':' }, 2);
        if (userInfoParts.Length == 2)
        {
-            item.Id = userInfoParts.First();
-            item.Security = userInfoParts.Last();
+            item.Username = userInfoParts.First();
+            item.Password = userInfoParts.Last();
        }

        var query = Utils.ParseQueryString(url.Query);
        ResolveUriQuery(query, ref item);
-        item.HeaderType = GetQueryValue(query, "congestion_control");
+        item.SetProtocolExtra(item.GetProtocolExtra() with
+        {
+            CongestionControl = GetQueryValue(query, "congestion_control")
+        });

        return item;
    }
@@ -51,8 +54,11 @@ public class TuicFmt : BaseFmt
        var dicQuery = new Dictionary<string, string>();
        ToUriQueryLite(item, ref dicQuery);

-        dicQuery.Add("congestion_control", item.HeaderType);
+        if (!item.GetProtocolExtra().CongestionControl.IsNullOrEmpty())
+        {
+            dicQuery.Add("congestion_control", item.GetProtocolExtra().CongestionControl);
+        }

-        return ToUri(EConfigType.TUIC, item.Address, item.Port, $"{item.Id}:{item.Security}", dicQuery, remark);
+        return ToUri(EConfigType.TUIC, item.Address, item.Port, $"{item.Username ?? ""}:{item.Password}", dicQuery, remark);
    }
 }
@@ -9,7 +9,6 @@ public class VLESSFmt : BaseFmt
        ProfileItem item = new()
        {
            ConfigType = EConfigType.VLESS,
-            Security = Global.None
        };

        var url = Utils.TryUri(str);
@@ -21,10 +20,14 @@ public class VLESSFmt : BaseFmt
        item.Address = url.IdnHost;
        item.Port = url.Port;
        item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
-        item.Id = Utils.UrlDecode(url.UserInfo);
+        item.Password = Utils.UrlDecode(url.UserInfo);

        var query = Utils.ParseQueryString(url.Query);
-        item.Security = GetQueryValue(query, "encryption", Global.None);
+        item.SetProtocolExtra(item.GetProtocolExtra() with
+        {
+            VlessEncryption = GetQueryValue(query, "encryption", Global.None),
+            Flow = GetQueryValue(query, "flow")
+        });
        item.StreamSecurity = GetQueryValue(query, "security");
        ResolveUriQuery(query, ref item);

@@ -44,16 +47,14 @@ public class VLESSFmt : BaseFmt
            remark = "#" + Utils.UrlEncode(item.Remarks);
        }
        var dicQuery = new Dictionary<string, string>();
-        if (item.Security.IsNotEmpty())
+        dicQuery.Add("encryption",
+            !item.GetProtocolExtra().VlessEncryption.IsNullOrEmpty() ? item.GetProtocolExtra().VlessEncryption : Global.None);
+        if (!item.GetProtocolExtra().Flow.IsNullOrEmpty())
        {
-            dicQuery.Add("encryption", item.Security);
-        }
-        else
-        {
-            dicQuery.Add("encryption", Global.None);
+            dicQuery.Add("flow", item.GetProtocolExtra().Flow);
        }
        ToUriQuery(item, Global.None, ref dicQuery);

-        return ToUri(EConfigType.VLESS, item.Address, item.Port, item.Id, dicQuery, remark);
+        return ToUri(EConfigType.VLESS, item.Address, item.Port, item.Password, dicQuery, remark);
    }
 }
@@ -23,19 +23,45 @@ public class VmessFmt : BaseFmt
        {
            return null;
        }
+
        var vmessQRCode = new VmessQRCode
        {
-            v = item.ConfigVersion,
+            // vmess link keeps shared transport keys; map from new transport model on export.
+            v = 2,
            ps = item.Remarks.TrimEx(),
            add = item.Address,
            port = item.Port,
-            id = item.Id,
-            aid = item.AlterId,
-            scy = item.Security,
-            net = item.Network,
-            type = item.HeaderType,
-            host = item.RequestHost,
-            path = item.Path,
+            id = item.Password,
+            aid = int.TryParse(item.GetProtocolExtra()?.AlterId, out var result) ? result : 0,
+            scy = item.GetProtocolExtra().VmessSecurity ?? "",
+            net = item.GetNetwork() == nameof(ETransport.raw) ? Global.RawNetworkAlias : item.Network,
+            type = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => item.GetTransportExtra().RawHeaderType,
+                nameof(ETransport.kcp) => item.GetTransportExtra().KcpHeaderType,
+                nameof(ETransport.xhttp) => item.GetTransportExtra().XhttpMode,
+                nameof(ETransport.grpc) => item.GetTransportExtra().GrpcMode,
+                _ => Global.None,
+            },
+            host = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => item.GetTransportExtra().Host,
+                nameof(ETransport.ws) => item.GetTransportExtra().Host,
+                nameof(ETransport.httpupgrade) => item.GetTransportExtra().Host,
+                nameof(ETransport.xhttp) => item.GetTransportExtra().Host,
+                nameof(ETransport.grpc) => item.GetTransportExtra().GrpcAuthority,
+                _ => null,
+            },
+            path = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => item.GetTransportExtra().Path,
+                nameof(ETransport.kcp) => item.GetTransportExtra().KcpSeed,
+                nameof(ETransport.ws) => item.GetTransportExtra().Path,
+                nameof(ETransport.httpupgrade) => item.GetTransportExtra().Path,
+                nameof(ETransport.xhttp) => item.GetTransportExtra().Path,
+                nameof(ETransport.grpc) => item.GetTransportExtra().GrpcServiceName,
+                _ => null,
+            },
            tls = item.StreamSecurity,
            sni = item.Sni,
            alpn = item.Alpn,
@@ -69,28 +95,47 @@ public class VmessFmt : BaseFmt
        }

        item.Network = Global.DefaultNetwork;
-        item.HeaderType = Global.None;
+        var transport = new TransportExtraItem
+        {
+            RawHeaderType = Global.None,
+        };

-        item.ConfigVersion = vmessQRCode.v;
+        //item.ConfigVersion = vmessQRCode.v;
        item.Remarks = Utils.ToString(vmessQRCode.ps);
        item.Address = Utils.ToString(vmessQRCode.add);
        item.Port = vmessQRCode.port;
-        item.Id = Utils.ToString(vmessQRCode.id);
-        item.AlterId = vmessQRCode.aid;
-        item.Security = Utils.ToString(vmessQRCode.scy);
-
-        item.Security = vmessQRCode.scy.IsNotEmpty() ? vmessQRCode.scy : Global.DefaultSecurity;
+        item.Password = Utils.ToString(vmessQRCode.id);
+        item.SetProtocolExtra(new ProtocolExtraItem
+        {
+            AlterId = vmessQRCode.aid.ToString(),
+            VmessSecurity = vmessQRCode.scy.IsNullOrEmpty() ? Global.DefaultSecurity : vmessQRCode.scy,
+        });
        if (vmessQRCode.net.IsNotEmpty())
        {
-            item.Network = vmessQRCode.net;
+            item.Network = vmessQRCode.net == Global.RawNetworkAlias ? nameof(ETransport.raw) : vmessQRCode.net;
        }
        if (vmessQRCode.type.IsNotEmpty())
        {
-            item.HeaderType = vmessQRCode.type;
+            transport = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => transport with { RawHeaderType = vmessQRCode.type },
+                nameof(ETransport.kcp) => transport with { KcpHeaderType = vmessQRCode.type },
+                nameof(ETransport.xhttp) => transport with { XhttpMode = vmessQRCode.type },
+                nameof(ETransport.grpc) => transport with { GrpcMode = vmessQRCode.type },
+                _ => transport,
+            };
        }
-
-        item.RequestHost = Utils.ToString(vmessQRCode.host);
-        item.Path = Utils.ToString(vmessQRCode.path);
+        transport = item.GetNetwork() switch
+        {
+            nameof(ETransport.raw) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.kcp) => transport with { KcpSeed = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.ws) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.httpupgrade) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.xhttp) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.grpc) => transport with { GrpcAuthority = Utils.ToString(vmessQRCode.host), GrpcServiceName = Utils.ToString(vmessQRCode.path) },
+            _ => transport,
+        };
+        item.SetTransportExtra(transport);
        item.StreamSecurity = Utils.ToString(vmessQRCode.tls);
        item.Sni = Utils.ToString(vmessQRCode.sni);
        item.Alpn = Utils.ToString(vmessQRCode.alpn);
@@ -105,7 +150,6 @@ public class VmessFmt : BaseFmt
        var item = new ProfileItem
        {
            ConfigType = EConfigType.VMess,
-            Security = "auto"
        };

        var url = Utils.TryUri(str);
@@ -117,7 +161,12 @@ public class VmessFmt : BaseFmt
        item.Address = url.IdnHost;
        item.Port = url.Port;
        item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
-        item.Id = Utils.UrlDecode(url.UserInfo);
+        item.Password = Utils.UrlDecode(url.UserInfo);
+
+        item.SetProtocolExtra(new ProtocolExtraItem
+        {
+            VmessSecurity = Global.DefaultSecurity,
+        });

        var query = Utils.ParseQueryString(url.Query);
        ResolveUriQuery(query, ref item);
@@ -20,14 +20,17 @@ public class WireguardFmt : BaseFmt
        item.Address = url.IdnHost;
        item.Port = url.Port;
        item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
-        item.Id = Utils.UrlDecode(url.UserInfo);
+        item.Password = Utils.UrlDecode(url.UserInfo);

        var query = Utils.ParseQueryString(url.Query);

-        item.PublicKey = GetQueryDecoded(query, "publickey");
-        item.Path = GetQueryDecoded(query, "reserved");
-        item.RequestHost = GetQueryDecoded(query, "address");
-        item.ShortId = GetQueryDecoded(query, "mtu");
+        item.SetProtocolExtra(item.GetProtocolExtra() with
+        {
+            WgPublicKey = GetQueryDecoded(query, "publickey"),
+            WgReserved = GetQueryDecoded(query, "reserved"),
+            WgInterfaceAddress = GetQueryDecoded(query, "address"),
+            WgMtu = int.TryParse(GetQueryDecoded(query, "mtu"), out var mtuVal) ? mtuVal : 1280,
+        });

        return item;
    }
@@ -46,22 +49,19 @@ public class WireguardFmt : BaseFmt
        }

        var dicQuery = new Dictionary<string, string>();
-        if (item.PublicKey.IsNotEmpty())
+        if (!item.GetProtocolExtra().WgPublicKey.IsNullOrEmpty())
        {
-            dicQuery.Add("publickey", Utils.UrlEncode(item.PublicKey));
+            dicQuery.Add("publickey", Utils.UrlEncode(item.GetProtocolExtra().WgPublicKey));
        }
-        if (item.Path.IsNotEmpty())
+        if (!item.GetProtocolExtra().WgReserved.IsNullOrEmpty())
        {
-            dicQuery.Add("reserved", Utils.UrlEncode(item.Path));
+            dicQuery.Add("reserved", Utils.UrlEncode(item.GetProtocolExtra().WgReserved));
        }
-        if (item.RequestHost.IsNotEmpty())
+        if (!item.GetProtocolExtra().WgInterfaceAddress.IsNullOrEmpty())
        {
-            dicQuery.Add("address", Utils.UrlEncode(item.RequestHost));
+            dicQuery.Add("address", Utils.UrlEncode(item.GetProtocolExtra().WgInterfaceAddress));
        }
-        if (item.ShortId.IsNotEmpty())
-        {
-            dicQuery.Add("mtu", Utils.UrlEncode(item.ShortId));
-        }
-        return ToUri(EConfigType.WireGuard, item.Address, item.Port, item.Id, dicQuery, remark);
+        dicQuery.Add("mtu", Utils.UrlEncode(item.GetProtocolExtra().WgMtu > 0 ? item.GetProtocolExtra().WgMtu.ToString() : "1280"));
+        return ToUri(EConfigType.WireGuard, item.Address, item.Port, item.Password, dicQuery, remark);
    }
 }
@@ -24,13 +24,13 @@ public class DownloaderHelper

        var downloadOpt = new DownloadConfiguration()
        {
-            Timeout = timeout * 1000,
+            BlockTimeout = timeout * 1000,
            MaxTryAgainOnFailure = 2,
            RequestConfiguration =
                {
                    Headers = headers,
                    UserAgent = userAgent,
-                    Timeout = timeout * 1000,
+                    ConnectTimeout = timeout * 1000,
                    Proxy = webProxy
                }
        };
@@ -62,11 +62,11 @@ public class DownloaderHelper

        var downloadOpt = new DownloadConfiguration()
        {
-            Timeout = timeout * 1000,
+            BlockTimeout = timeout * 1000,
            MaxTryAgainOnFailure = 2,
            RequestConfiguration =
                {
-                    Timeout= timeout * 1000,
+                    ConnectTimeout= timeout * 1000,
                    Proxy = webProxy
                }
        };
@@ -85,7 +85,7 @@ public class DownloaderHelper
                {
                    maxSpeed = value.BytesPerSecondSpeed;
                }
-                
+
                var ts = DateTime.Now - lastUpdateTime;
                if (ts.TotalMilliseconds >= 1000)
                {
@@ -139,11 +139,11 @@ public class DownloaderHelper

        var downloadOpt = new DownloadConfiguration()
        {
-            Timeout = timeout * 1000,
+            BlockTimeout = timeout * 1000,
            MaxTryAgainOnFailure = 2,
            RequestConfiguration =
                {
-                    Timeout= timeout * 1000,
+                    ConnectTimeout= timeout * 1000,
                    Proxy = webProxy
                }
        };
@@ -1,365 +0,0 @@
-namespace ServiceLib.Manager;
-
-/// <summary>
-/// Centralized pre-checks before sensitive actions (set active profile, generate config, etc.).
-/// </summary>
-public class ActionPrecheckManager
-{
-    private static readonly Lazy<ActionPrecheckManager> _instance = new();
-    public static ActionPrecheckManager Instance => _instance.Value;
-
-    // sing-box supported transports for different protocol types
-    private static readonly HashSet<string> SingboxUnsupportedTransports = [nameof(ETransport.kcp), nameof(ETransport.xhttp)];
-
-    private static readonly HashSet<EConfigType> SingboxTransportSupportedProtocols =
-        [EConfigType.VMess, EConfigType.VLESS, EConfigType.Trojan, EConfigType.Shadowsocks];
-
-    private static readonly HashSet<string> SingboxShadowsocksAllowedTransports =
-        [nameof(ETransport.tcp), nameof(ETransport.ws), nameof(ETransport.quic)];
-
-    public async Task<List<string>> Check(string? indexId)
-    {
-        if (indexId.IsNullOrEmpty())
-        {
-            return [ResUI.PleaseSelectServer];
-        }
-
-        var item = await AppManager.Instance.GetProfileItem(indexId);
-        if (item is null)
-        {
-            return [ResUI.PleaseSelectServer];
-        }
-
-        return await Check(item);
-    }
-
-    public async Task<List<string>> Check(ProfileItem? item)
-    {
-        if (item is null)
-        {
-            return [ResUI.PleaseSelectServer];
-        }
-
-        var errors = new List<string>();
-
-        errors.AddRange(await ValidateCurrentNodeAndCoreSupport(item));
-        errors.AddRange(await ValidateRelatedNodesExistAndValid(item));
-
-        return errors;
-    }
-
-    private async Task<List<string>> ValidateCurrentNodeAndCoreSupport(ProfileItem item)
-    {
-        if (item.ConfigType == EConfigType.Custom)
-        {
-            return [];
-        }
-
-        var coreType = AppManager.Instance.GetCoreType(item, item.ConfigType);
-        return await ValidateNodeAndCoreSupport(item, coreType);
-    }
-
-    private async Task<List<string>> ValidateNodeAndCoreSupport(ProfileItem item, ECoreType? coreType = null)
-    {
-        var errors = new List<string>();
-
-        coreType ??= AppManager.Instance.GetCoreType(item, item.ConfigType);
-
-        if (item.ConfigType is EConfigType.Custom)
-        {
-            errors.Add(string.Format(ResUI.NotSupportProtocol, item.ConfigType.ToString()));
-            return errors;
-        }
-        else if (item.ConfigType.IsGroupType())
-        {
-            var groupErrors = await ValidateGroupNode(item, coreType);
-            errors.AddRange(groupErrors);
-            return errors;
-        }
-        else if (!item.IsComplex())
-        {
-            var normalErrors = await ValidateNormalNode(item, coreType);
-            errors.AddRange(normalErrors);
-            return errors;
-        }
-
-        return errors;
-    }
-
-    private async Task<List<string>> ValidateNormalNode(ProfileItem item, ECoreType? coreType = null)
-    {
-        var errors = new List<string>();
-
-        if (item.Address.IsNullOrEmpty())
-        {
-            errors.Add(string.Format(ResUI.InvalidProperty, "Address"));
-            return errors;
-        }
-
-        if (item.Port is <= 0 or > 65535)
-        {
-            errors.Add(string.Format(ResUI.InvalidProperty, "Port"));
-            return errors;
-        }
-
-        var net = item.GetNetwork();
-
-        if (coreType == ECoreType.sing_box)
-        {
-            var transportError = ValidateSingboxTransport(item.ConfigType, net);
-            if (transportError != null)
-            {
-                errors.Add(transportError);
-            }
-
-            if (!Global.SingboxSupportConfigType.Contains(item.ConfigType))
-            {
-                errors.Add(string.Format(ResUI.CoreNotSupportProtocol,
-                    nameof(ECoreType.sing_box), item.ConfigType.ToString()));
-            }
-        }
-        else if (coreType is ECoreType.Xray)
-        {
-            // Xray core does not support these protocols
-            if (!Global.XraySupportConfigType.Contains(item.ConfigType))
-            {
-                errors.Add(string.Format(ResUI.CoreNotSupportProtocol,
-                    nameof(ECoreType.Xray), item.ConfigType.ToString()));
-            }
-        }
-
-        switch (item.ConfigType)
-        {
-            case EConfigType.VMess:
-                if (item.Id.IsNullOrEmpty() || !Utils.IsGuidByParse(item.Id))
-                {
-                    errors.Add(string.Format(ResUI.InvalidProperty, "Id"));
-                }
-
-                break;
-
-            case EConfigType.VLESS:
-                if (item.Id.IsNullOrEmpty() || (!Utils.IsGuidByParse(item.Id) && item.Id.Length > 30))
-                {
-                    errors.Add(string.Format(ResUI.InvalidProperty, "Id"));
-                }
-
-                if (!Global.Flows.Contains(item.Flow))
-                {
-                    errors.Add(string.Format(ResUI.InvalidProperty, "Flow"));
-                }
-
-                break;
-
-            case EConfigType.Shadowsocks:
-                if (item.Id.IsNullOrEmpty())
-                {
-                    errors.Add(string.Format(ResUI.InvalidProperty, "Id"));
-                }
-
-                if (string.IsNullOrEmpty(item.Security) || !Global.SsSecuritiesInSingbox.Contains(item.Security))
-                {
-                    errors.Add(string.Format(ResUI.InvalidProperty, "Security"));
-                }
-
-                break;
-        }
-
-        if (item.StreamSecurity == Global.StreamSecurity)
-        {
-            // check certificate validity
-            if (!item.Cert.IsNullOrEmpty()
-                && (CertPemManager.ParsePemChain(item.Cert).Count == 0)
-                && !item.CertSha.IsNullOrEmpty())
-            {
-                errors.Add(string.Format(ResUI.InvalidProperty, "TLS Certificate"));
-            }
-        }
-
-        if (item.StreamSecurity == Global.StreamSecurityReality)
-        {
-            if (item.PublicKey.IsNullOrEmpty())
-            {
-                errors.Add(string.Format(ResUI.InvalidProperty, "PublicKey"));
-            }
-        }
-
-        if (item.Network == nameof(ETransport.xhttp)
-            && !item.Extra.IsNullOrEmpty())
-        {
-            // check xhttp extra json validity
-            var xhttpExtra = JsonUtils.ParseJson(item.Extra);
-            if (xhttpExtra is null)
-            {
-                errors.Add(string.Format(ResUI.InvalidProperty, "XHTTP Extra"));
-            }
-        }
-
-        return errors;
-    }
-
-    private async Task<List<string>> ValidateGroupNode(ProfileItem item, ECoreType? coreType = null)
-    {
-        var errors = new List<string>();
-
-        ProfileGroupItemManager.Instance.TryGet(item.IndexId, out var group);
-        if (group is null || group.NotHasChild())
-        {
-            errors.Add(string.Format(ResUI.GroupEmpty, item.Remarks));
-            return errors;
-        }
-
-        var hasCycle = ProfileGroupItemManager.HasCycle(item.IndexId);
-        if (hasCycle)
-        {
-            errors.Add(string.Format(ResUI.GroupSelfReference, item.Remarks));
-            return errors;
-        }
-
-        var childIds = new List<string>();
-        var subItems = await ProfileGroupItemManager.GetSubChildProfileItems(group);
-        childIds.AddRangeSafe(subItems.Select(p => p.IndexId));
-        childIds.AddRangeSafe(Utils.String2List(group.ChildItems));
-
-        foreach (var child in childIds)
-        {
-            var childErrors = new List<string>();
-            if (child.IsNullOrEmpty())
-            {
-                continue;
-            }
-
-            var childItem = await AppManager.Instance.GetProfileItem(child);
-            if (childItem is null)
-            {
-                childErrors.Add(string.Format(ResUI.NodeTagNotExist, child));
-                continue;
-            }
-
-            if (childItem.ConfigType is EConfigType.Custom or EConfigType.ProxyChain)
-            {
-                childErrors.Add(string.Format(ResUI.InvalidProperty, childItem.Remarks));
-                continue;
-            }
-
-            childErrors.AddRange(await ValidateNodeAndCoreSupport(childItem, coreType));
-            errors.AddRange(childErrors.Select(s => s.Insert(0, $"{childItem.Remarks}: ")));
-        }
-        return errors;
-    }
-
-    private static string? ValidateSingboxTransport(EConfigType configType, string net)
-    {
-        // sing-box does not support xhttp / kcp transports
-        if (SingboxUnsupportedTransports.Contains(net))
-        {
-            return string.Format(ResUI.CoreNotSupportNetwork, nameof(ECoreType.sing_box), net);
-        }
-
-        // sing-box does not support non-tcp transports for protocols other than vmess/trojan/vless/shadowsocks
-        if (!SingboxTransportSupportedProtocols.Contains(configType) && net != nameof(ETransport.tcp))
-        {
-            return string.Format(ResUI.CoreNotSupportProtocolTransport,
-                nameof(ECoreType.sing_box), configType.ToString(), net);
-        }
-
-        // sing-box shadowsocks only supports tcp/ws/quic transports
-        if (configType == EConfigType.Shadowsocks && !SingboxShadowsocksAllowedTransports.Contains(net))
-        {
-            return string.Format(ResUI.CoreNotSupportProtocolTransport,
-                nameof(ECoreType.sing_box), configType.ToString(), net);
-        }
-
-        return null;
-    }
-
-    private async Task<List<string>> ValidateRelatedNodesExistAndValid(ProfileItem? item)
-    {
-        var errors = new List<string>();
-        errors.AddRange(await ValidateProxyChainedNodeExistAndValid(item));
-        errors.AddRange(await ValidateRoutingNodeExistAndValid(item));
-        return errors;
-    }
-
-    private async Task<List<string>> ValidateProxyChainedNodeExistAndValid(ProfileItem? item)
-    {
-        var errors = new List<string>();
-        if (item is null)
-        {
-            return errors;
-        }
-
-        // prev node and next node
-        var subItem = await AppManager.Instance.GetSubItem(item.Subid);
-        if (subItem is null)
-        {
-            return errors;
-        }
-
-        var prevNode = await AppManager.Instance.GetProfileItemViaRemarks(subItem.PrevProfile);
-        var nextNode = await AppManager.Instance.GetProfileItemViaRemarks(subItem.NextProfile);
-        var coreType = AppManager.Instance.GetCoreType(item, item.ConfigType);
-
-        await CollectProxyChainedNodeValidation(prevNode, subItem.PrevProfile, coreType, errors);
-        await CollectProxyChainedNodeValidation(nextNode, subItem.NextProfile, coreType, errors);
-
-        return errors;
-    }
-
-    private async Task CollectProxyChainedNodeValidation(ProfileItem? node, string tag, ECoreType coreType, List<string> errors)
-    {
-        if (node is not null)
-        {
-            var nodeErrors = await ValidateNodeAndCoreSupport(node, coreType);
-            errors.AddRange(nodeErrors.Select(s => ResUI.ProxyChainedPrefix + $"{node.Remarks}: " + s));
-        }
-        else if (tag.IsNotEmpty())
-        {
-            errors.Add(ResUI.ProxyChainedPrefix + string.Format(ResUI.NodeTagNotExist, tag));
-        }
-    }
-
-    private async Task<List<string>> ValidateRoutingNodeExistAndValid(ProfileItem? item)
-    {
-        var errors = new List<string>();
-
-        if (item is null)
-        {
-            return errors;
-        }
-
-        var coreType = AppManager.Instance.GetCoreType(item, item.ConfigType);
-        var routing = await ConfigHandler.GetDefaultRouting(AppManager.Instance.Config);
-        if (routing == null)
-        {
-            return errors;
-        }
-
-        var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet);
-        foreach (var ruleItem in rules ?? [])
-        {
-            if (!ruleItem.Enabled)
-            {
-                continue;
-            }
-
-            var outboundTag = ruleItem.OutboundTag;
-            if (outboundTag.IsNullOrEmpty() || Global.OutboundTags.Contains(outboundTag))
-            {
-                continue;
-            }
-
-            var tagItem = await AppManager.Instance.GetProfileItemViaRemarks(outboundTag);
-            if (tagItem is null)
-            {
-                errors.Add(ResUI.RoutingRuleOutboundPrefix + string.Format(ResUI.NodeTagNotExist, outboundTag));
-                continue;
-            }
-
-            var tagErrors = await ValidateNodeAndCoreSupport(tagItem, coreType);
-            errors.AddRange(tagErrors.Select(s => ResUI.RoutingRuleOutboundPrefix + $"{tagItem.Remarks}: " + s));
-        }
-
-        return errors;
-    }
-}
@@ -81,7 +81,9 @@ public sealed class AppManager
        SQLiteHelper.Instance.CreateTable<ProfileExItem>();
        SQLiteHelper.Instance.CreateTable<DNSItem>();
        SQLiteHelper.Instance.CreateTable<FullConfigTemplateItem>();
+#pragma warning disable CS0618
        SQLiteHelper.Instance.CreateTable<ProfileGroupItem>();
+#pragma warning restore CS0618
        return true;
    }

@@ -94,6 +96,11 @@ public sealed class AppManager
        _ = StatePort;
        _ = StatePort2;

+        Task.Run(async () =>
+        {
+            await MigrateProfileExtra();
+        }).Wait();
+
        return true;
    }

@@ -184,10 +191,17 @@ public sealed class AppManager
        return (await ProfileItems(subid))?.Select(t => t.IndexId)?.ToList();
    }

-    public async Task<List<ProfileItemModel>?> ProfileItems(string subid, string filter)
+    public async Task<List<ProfileItemModel>?> ProfileModels(string subid, string filter)
    {
-        var sql = @$"select a.*
-                           ,b.remarks subRemarks
+        var sql = @$"select a.IndexId
+                           ,a.ConfigType
+                           ,a.Remarks
+                           ,a.Address
+                           ,a.Port
+                           ,a.Network
+                           ,a.StreamSecurity
+                           ,a.Subid
+                           ,b.remarks as subRemarks
                        from ProfileItem a
                        left join SubItem b on a.subid = b.id
                        where 1=1 ";
@@ -216,6 +230,42 @@ public sealed class AppManager
        return await SQLiteHelper.Instance.TableAsync<ProfileItem>().FirstOrDefaultAsync(it => it.IndexId == indexId);
    }

+    public async Task<List<ProfileItem>> GetProfileItemsByIndexIds(IEnumerable<string> indexIds)
+    {
+        var ids = indexIds.Where(id => !id.IsNullOrEmpty()).Distinct().ToList();
+        if (ids.Count == 0)
+        {
+            return [];
+        }
+        return await SQLiteHelper.Instance.TableAsync<ProfileItem>()
+            .Where(it => ids.Contains(it.IndexId))
+            .ToListAsync();
+    }
+
+    public async Task<Dictionary<string, ProfileItem>> GetProfileItemsByIndexIdsAsMap(IEnumerable<string> indexIds)
+    {
+        var items = await GetProfileItemsByIndexIds(indexIds);
+        return items.ToDictionary(it => it.IndexId);
+    }
+
+    public async Task<List<ProfileItem>> GetProfileItemsOrderedByIndexIds(IEnumerable<string> indexIds)
+    {
+        var idList = indexIds.Where(id => !id.IsNullOrEmpty()).Distinct().ToList();
+        if (idList.Count == 0)
+        {
+            return [];
+        }
+
+        var items = await SQLiteHelper.Instance.TableAsync<ProfileItem>()
+            .Where(it => idList.Contains(it.IndexId))
+            .ToListAsync();
+        var itemMap = items.ToDictionary(it => it.IndexId);
+
+        return idList.Select(id => itemMap.GetValueOrDefault(id))
+            .Where(item => item != null)
+            .ToList();
+    }
+
    public async Task<ProfileItem?> GetProfileItemViaRemarks(string? remarks)
    {
        if (remarks.IsNullOrEmpty())
@@ -225,15 +275,6 @@ public sealed class AppManager
        return await SQLiteHelper.Instance.TableAsync<ProfileItem>().FirstOrDefaultAsync(it => it.Remarks == remarks);
    }

-    public async Task<ProfileGroupItem?> GetProfileGroupItem(string indexId)
-    {
-        if (indexId.IsNullOrEmpty())
-        {
-            return null;
-        }
-        return await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().FirstOrDefaultAsync(it => it.IndexId == indexId);
-    }
-
    public async Task<List<RoutingItem>?> RoutingItems()
    {
        return await SQLiteHelper.Instance.TableAsync<RoutingItem>().OrderBy(t => t.Sort).ToListAsync();
@@ -264,6 +305,325 @@ public sealed class AppManager
        return await SQLiteHelper.Instance.TableAsync<FullConfigTemplateItem>().FirstOrDefaultAsync(it => it.CoreType == eCoreType);
    }

+#pragma warning disable CS0618
+
+    public async Task MigrateProfileExtra()
+    {
+        await MigrateProfileExtraGroupV2ToV3();
+
+        await MigrateProfileExtraV2ToV3();
+
+        await MigrateProfileTransportV3ToV4();
+    }
+
+    private async Task MigrateProfileExtraV2ToV3()
+    {
+        const int pageSize = 100;
+        var offset = 0;
+
+        while (true)
+        {
+            var sql = $"SELECT * FROM ProfileItem " +
+                $"WHERE ConfigVersion < 3 " +
+                $"AND ConfigType NOT IN ({(int)EConfigType.PolicyGroup}, {(int)EConfigType.ProxyChain}) " +
+                $"LIMIT {pageSize} OFFSET {offset}";
+            var batch = await SQLiteHelper.Instance.QueryAsync<ProfileItem>(sql);
+            if (batch is null || batch.Count == 0)
+            {
+                break;
+            }
+
+            var batchSuccessCount = await MigrateProfileExtraV2ToV3Sub(batch);
+
+            // Only increment offset by the number of failed items that remain in the result set
+            // Successfully updated items are automatically excluded from future queries due to ConfigVersion = 3
+            offset += batch.Count - batchSuccessCount;
+        }
+
+        //await ProfileGroupItemManager.Instance.ClearAll();
+    }
+
+    private async Task MigrateProfileTransportV3ToV4()
+    {
+        const int pageSize = 100;
+        var offset = 0;
+
+        while (true)
+        {
+            var sql = $"SELECT * FROM ProfileItem WHERE ConfigVersion = 3 LIMIT {pageSize} OFFSET {offset}";
+            var batch = await SQLiteHelper.Instance.QueryAsync<ProfileItem>(sql);
+            if (batch is null || batch.Count == 0)
+            {
+                break;
+            }
+
+            var updateProfileItems = new List<ProfileItem>();
+            foreach (var item in batch)
+            {
+                try
+                {
+                    if (item.Network == Global.RawNetworkAlias)
+                    {
+                        item.Network = nameof(ETransport.raw);
+                    }
+                    var transport = item.GetTransportExtra();
+                    var network = item.GetNetwork();
+
+                    switch (network)
+                    {
+                        case nameof(ETransport.raw):
+                            transport = transport with
+                            {
+                                RawHeaderType = item.HeaderType.NullIfEmpty(),
+                                Host = item.RequestHost.NullIfEmpty(),
+                                Path = item.Path.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.ws):
+                        case nameof(ETransport.httpupgrade):
+                            transport = transport with
+                            {
+                                Host = item.RequestHost.NullIfEmpty(),
+                                Path = item.Path.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.xhttp):
+                            transport = transport with
+                            {
+                                Host = item.RequestHost.NullIfEmpty(),
+                                Path = item.Path.NullIfEmpty(),
+                                XhttpMode = item.HeaderType.NullIfEmpty(),
+                                XhttpExtra = item.Extra.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.grpc):
+                            transport = transport with
+                            {
+                                GrpcAuthority = item.RequestHost.NullIfEmpty(),
+                                GrpcServiceName = item.Path.NullIfEmpty(),
+                                GrpcMode = item.HeaderType.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.kcp):
+                            transport = transport with
+                            {
+                                KcpHeaderType = item.HeaderType.NullIfEmpty(),
+                                KcpSeed = item.Path.NullIfEmpty(),
+                            };
+                            break;
+
+                        default:
+                            item.Network = Global.DefaultNetwork;
+                            transport = transport with
+                            {
+                                RawHeaderType = item.HeaderType.NullIfEmpty(),
+                                Host = item.RequestHost.NullIfEmpty(),
+                            };
+                            break;
+                    }
+
+                    item.SetTransportExtra(transport);
+                    item.ConfigVersion = 4;
+                    updateProfileItems.Add(item);
+                }
+                catch (Exception ex)
+                {
+                    Logging.SaveLog($"MigrateProfileTransportV3ToV4 Error: {ex}");
+                }
+            }
+
+            if (updateProfileItems.Count > 0)
+            {
+                try
+                {
+                    var count = await SQLiteHelper.Instance.UpdateAllAsync(updateProfileItems);
+                    offset += batch.Count - count;
+                }
+                catch (Exception ex)
+                {
+                    Logging.SaveLog($"MigrateProfileTransportV3ToV4 update error: {ex}");
+                    offset += batch.Count;
+                }
+            }
+            else
+            {
+                offset += batch.Count;
+            }
+        }
+    }
+
+    private async Task<int> MigrateProfileExtraV2ToV3Sub(List<ProfileItem> batch)
+    {
+        var updateProfileItems = new List<ProfileItem>();
+
+        foreach (var item in batch)
+        {
+            try
+            {
+                var extra = item.GetProtocolExtra();
+                switch (item.ConfigType)
+                {
+                    case EConfigType.Shadowsocks:
+                        extra = extra with { SsMethod = item.Security.NullIfEmpty() };
+                        break;
+
+                    case EConfigType.VMess:
+                        extra = extra with
+                        {
+                            AlterId = item.AlterId.ToString(),
+                            VmessSecurity = item.Security.NullIfEmpty(),
+                        };
+                        break;
+
+                    case EConfigType.VLESS:
+                        extra = extra with
+                        {
+                            Flow = item.Flow.NullIfEmpty(),
+                            VlessEncryption = item.Security,
+                        };
+                        break;
+
+                    case EConfigType.Hysteria2:
+                        extra = extra with
+                        {
+                            SalamanderPass = item.Path.NullIfEmpty(),
+                            Ports = item.Ports.NullIfEmpty(),
+                            UpMbps = _config.HysteriaItem.UpMbps,
+                            DownMbps = _config.HysteriaItem.DownMbps,
+                            HopInterval = _config.HysteriaItem.HopInterval.ToString(),
+                        };
+                        break;
+
+                    case EConfigType.TUIC:
+                        extra = extra with { CongestionControl = item.HeaderType.NullIfEmpty(), };
+                        item.Username = item.Id;
+                        item.Id = item.Security;
+                        item.Password = item.Security;
+                        break;
+
+                    case EConfigType.HTTP:
+                    case EConfigType.SOCKS:
+                        item.Username = item.Security;
+                        break;
+
+                    case EConfigType.WireGuard:
+                        extra = extra with
+                        {
+                            WgPublicKey = item.PublicKey.NullIfEmpty(),
+                            WgInterfaceAddress = item.RequestHost.NullIfEmpty(),
+                            WgReserved = item.Path.NullIfEmpty(),
+                            WgMtu = int.TryParse(item.ShortId, out var mtu) ? mtu : 1280
+                        };
+                        break;
+                }
+
+                item.SetProtocolExtra(extra);
+
+                item.Password = item.Id;
+
+                item.ConfigVersion = 3;
+
+                updateProfileItems.Add(item);
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog($"MigrateProfileExtra Error: {ex}");
+            }
+        }
+
+        if (updateProfileItems.Count > 0)
+        {
+            try
+            {
+                var count = await SQLiteHelper.Instance.UpdateAllAsync(updateProfileItems);
+                return count;
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog($"MigrateProfileExtraGroup update error: {ex}");
+                return 0;
+            }
+        }
+        else
+        {
+            return 0;
+        }
+    }
+
+    private async Task<bool> MigrateProfileExtraGroupV2ToV3()
+    {
+        var list = await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().ToListAsync();
+        var groupItems = new ConcurrentDictionary<string, ProfileGroupItem>(list.Where(t => !string.IsNullOrEmpty(t.IndexId)).ToDictionary(t => t.IndexId!));
+
+        var sql = $"SELECT * FROM ProfileItem WHERE ConfigVersion < 3 AND ConfigType IN ({(int)EConfigType.PolicyGroup}, {(int)EConfigType.ProxyChain})";
+        var items = await SQLiteHelper.Instance.QueryAsync<ProfileItem>(sql);
+
+        if (items is null || items.Count == 0)
+        {
+            Logging.SaveLog("MigrateProfileExtraGroup: No items to migrate.");
+            return true;
+        }
+
+        Logging.SaveLog($"MigrateProfileExtraGroup: Found {items.Count} group items to migrate.");
+
+        var updateProfileItems = new List<ProfileItem>();
+
+        foreach (var item in items)
+        {
+            try
+            {
+                var extra = item.GetProtocolExtra();
+
+                extra = extra with { GroupType = nameof(item.ConfigType) };
+                groupItems.TryGetValue(item.IndexId, out var groupItem);
+                if (groupItem != null && !groupItem.NotHasChild())
+                {
+                    extra = extra with
+                    {
+                        ChildItems = groupItem.ChildItems,
+                        SubChildItems = groupItem.SubChildItems,
+                        Filter = groupItem.Filter,
+                        MultipleLoad = groupItem.MultipleLoad,
+                    };
+                }
+
+                item.SetProtocolExtra(extra);
+
+                item.ConfigVersion = 3;
+                updateProfileItems.Add(item);
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog($"MigrateProfileExtraGroup item error [{item.IndexId}]: {ex}");
+            }
+        }
+
+        if (updateProfileItems.Count > 0)
+        {
+            try
+            {
+                var count = await SQLiteHelper.Instance.UpdateAllAsync(updateProfileItems);
+                Logging.SaveLog($"MigrateProfileExtraGroup: Successfully updated {updateProfileItems.Count} items.");
+                return updateProfileItems.Count == count;
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog($"MigrateProfileExtraGroup update error: {ex}");
+                return false;
+            }
+        }
+
+        return true;
+
+        //await ProfileGroupItemManager.Instance.ClearAll();
+    }
+
+#pragma warning restore CS0618
+
    #endregion SqliteHelper

    #region Core Type
@@ -203,7 +203,7 @@ public class CertPemManager
    /// <summary>
    /// Get certificate in PEM format from a server with CA pinning validation
    /// </summary>
-    public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName, int timeout = 4)
+    public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName, int timeout = 4, bool allowInsecure = false)
    {
        try
        {
@@ -215,12 +215,14 @@ public class CertPemManager
            using var client = new TcpClient();
            await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);

-            using var ssl = new SslStream(client.GetStream(), false, ValidateServerCertificate);
+            var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) =>
+                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, allowInsecure));
+            await using var ssl = new SslStream(client.GetStream(), false, callback);

            var sslOptions = new SslClientAuthenticationOptions
            {
                TargetHost = serverName,
-                RemoteCertificateValidationCallback = ValidateServerCertificate
+                RemoteCertificateValidationCallback = callback
            };

            await ssl.AuthenticateAsClientAsync(sslOptions, cts.Token);
@@ -249,7 +251,7 @@ public class CertPemManager
    /// <summary>
    /// Get certificate chain in PEM format from a server with CA pinning validation
    /// </summary>
-    public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName, int timeout = 4)
+    public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName, int timeout = 4, bool allowInsecure = false)
    {
        var pemList = new List<string>();
        try
@@ -262,12 +264,14 @@ public class CertPemManager
            using var client = new TcpClient();
            await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);

-            using var ssl = new SslStream(client.GetStream(), false, ValidateServerCertificate);
+            var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) =>
+                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, allowInsecure));
+            await using var ssl = new SslStream(client.GetStream(), false, callback);

            var sslOptions = new SslClientAuthenticationOptions
            {
                TargetHost = serverName,
-                RemoteCertificateValidationCallback = ValidateServerCertificate
+                RemoteCertificateValidationCallback = callback
            };

            await ssl.AuthenticateAsClientAsync(sslOptions, cts.Token);
@@ -280,11 +284,7 @@ public class CertPemManager
            var chain = new X509Chain();
            chain.Build(certChain);

-            foreach (var element in chain.ChainElements)
-            {
-                var pem = ExportCertToPem(element.Certificate);
-                pemList.Add(pem);
-            }
+            pemList.AddRange(chain.ChainElements.Select(element => ExportCertToPem(element.Certificate)));

            return (pemList, null);
        }
@@ -304,16 +304,23 @@ public class CertPemManager
    /// Validate server certificate with CA pinning
    /// </summary>
    private bool ValidateServerCertificate(
-        object sender,
+        object _,
        X509Certificate? certificate,
        X509Chain? chain,
-        SslPolicyErrors sslPolicyErrors)
+        SslPolicyErrors sslPolicyErrors,
+        bool allowInsecure)
    {
        if (certificate == null)
        {
            return false;
        }

+        // In insecure mode, accept any certificate so self-signed certs can be fetched.
+        if (allowInsecure)
+        {
+            return true;
+        }
+
        // Check certificate name mismatch
        if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateNameMismatch))
        {
@@ -68,6 +68,7 @@ public sealed class CoreInfoManager
                    DownloadUrlWinArm64 = urlN + "/download/{0}/v2rayN-windows-arm64.zip",
                    DownloadUrlLinux64 = urlN + "/download/{0}/v2rayN-linux-64.zip",
                    DownloadUrlLinuxArm64 = urlN + "/download/{0}/v2rayN-linux-arm64.zip",
+                    DownloadUrlLinuxRiscV64 = urlN + "/download/{0}/v2rayN-linux-riscv64.zip",
                    DownloadUrlOSX64 = urlN + "/download/{0}/v2rayN-macos-64.zip",
                    DownloadUrlOSXArm64 = urlN + "/download/{0}/v2rayN-macos-arm64.zip",
                },
@@ -111,6 +112,7 @@ public sealed class CoreInfoManager
                    DownloadUrlWinArm64 = urlXray + "/download/{0}/Xray-windows-arm64-v8a.zip",
                    DownloadUrlLinux64 = urlXray + "/download/{0}/Xray-linux-64.zip",
                    DownloadUrlLinuxArm64 = urlXray + "/download/{0}/Xray-linux-arm64-v8a.zip",
+                    DownloadUrlLinuxRiscV64 = urlXray + "/download/{0}/Xray-linux-riscv64.zip",
                    DownloadUrlOSX64 = urlXray + "/download/{0}/Xray-macos-64.zip",
                    DownloadUrlOSXArm64 = urlXray + "/download/{0}/Xray-macos-arm64-v8a.zip",
                    Match = "Xray",
@@ -133,6 +135,7 @@ public sealed class CoreInfoManager
                    DownloadUrlWinArm64 = urlMihomo + "/download/{0}/mihomo-windows-arm64-{0}.zip",
                    DownloadUrlLinux64 = urlMihomo + "/download/{0}/mihomo-linux-amd64-v1-{0}.gz",
                    DownloadUrlLinuxArm64 = urlMihomo + "/download/{0}/mihomo-linux-arm64-{0}.gz",
+                    DownloadUrlLinuxRiscV64 = urlMihomo + "/download/{0}/mihomo-linux-riscv64-{0}.gz",
                    DownloadUrlOSX64 = urlMihomo + "/download/{0}/mihomo-darwin-amd64-v1-{0}.gz",
                    DownloadUrlOSXArm64 = urlMihomo + "/download/{0}/mihomo-darwin-arm64-{0}.gz",
                    Match = "Mihomo",
@@ -175,6 +178,7 @@ public sealed class CoreInfoManager
                    DownloadUrlWinArm64 = urlSingbox + "/download/{0}/sing-box-{1}-windows-arm64.zip",
                    DownloadUrlLinux64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-amd64.tar.gz",
                    DownloadUrlLinuxArm64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-arm64.tar.gz",
+                    DownloadUrlLinuxRiscV64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-riscv64.tar.gz",
                    DownloadUrlOSX64 = urlSingbox + "/download/{0}/sing-box-{1}-darwin-amd64.tar.gz",
                    DownloadUrlOSXArm64 = urlSingbox + "/download/{0}/sing-box-{1}-darwin-arm64.tar.gz",
                    Match = "sing-box",
@@ -265,6 +269,7 @@ public sealed class CoreInfoManager
            names.Add("mihomo-linux-amd64-v1");
            names.Add("mihomo-linux-amd64");
            names.Add("mihomo-linux-arm64");
+            names.Add("mihomo-linux-riscv64");
        }
        else if (Utils.IsMacOS())
        {
@@ -57,16 +57,19 @@ public class CoreManager
        }
    }

-    public async Task LoadCore(ProfileItem? node)
+    /// <param name="mainContext">Resolved main context (with pre-socks ports already merged if applicable).</param>
+    /// <param name="preContext">Optional pre-socks context passed to <see cref="CoreStartPreService"/>.</param>
+    public async Task LoadCore(CoreConfigContext? mainContext, CoreConfigContext? preContext)
    {
-        if (node == null)
+        if (mainContext == null)
        {
            await UpdateFunc(false, ResUI.CheckServerSettings);
            return;
        }

+        var node = mainContext.Node;
        var fileName = Utils.GetBinConfigPath(Global.CoreConfigFileName);
-        var result = await CoreConfigHandler.GenerateClientConfig(node, fileName);
+        var result = await CoreConfigHandler.GenerateClientConfig(mainContext, fileName);
        if (result.Success != true)
        {
            await UpdateFunc(true, result.Msg);
@@ -85,8 +88,11 @@ public class CoreManager
            await WindowsUtils.RemoveTunDevice();
        }

-        await CoreStart(node);
-        await CoreStartPreService(node);
+        await CoreStart(mainContext);
+        await CoreStartPreService(preContext);
+
+        AppManager.Instance.RunningCoreType = preContext?.RunCoreType ?? mainContext.RunCoreType;
+
        if (_processService != null)
        {
            await UpdateFunc(true, $"{node.GetSummary()}");
@@ -95,7 +101,7 @@ public class CoreManager

    public async Task<ProcessService?> LoadCoreConfigSpeedtest(List<ServerTestItem> selecteds)
    {
-        var coreType = selecteds.Any(t => Global.SingboxOnlyConfigType.Contains(t.ConfigType)) ? ECoreType.sing_box : ECoreType.Xray;
+        var coreType = selecteds.FirstOrDefault()?.CoreType == ECoreType.sing_box ? ECoreType.sing_box : ECoreType.Xray;
        var fileName = string.Format(Global.CoreSpeedtestConfigFileName, Utils.GetGuid(false));
        var configPath = Utils.GetBinConfigPath(fileName);
        var result = await CoreConfigHandler.GenerateClientSpeedtestConfig(_config, configPath, selecteds, coreType);
@@ -122,13 +128,14 @@ public class CoreManager

        var fileName = string.Format(Global.CoreSpeedtestConfigFileName, Utils.GetGuid(false));
        var configPath = Utils.GetBinConfigPath(fileName);
-        var result = await CoreConfigHandler.GenerateClientSpeedtestConfig(_config, node, testItem, configPath);
+        var (context, _) = await CoreConfigContextBuilder.Build(_config, node);
+        var result = await CoreConfigHandler.GenerateClientSpeedtestConfig(_config, context, testItem, configPath);
        if (result.Success != true)
        {
            return null;
        }

-        var coreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
+        var coreType = context.RunCoreType;
        var coreInfo = CoreInfoManager.Instance.GetCoreInfo(coreType);
        return await RunProcess(coreInfo, fileName, true, false);
    }
@@ -165,9 +172,10 @@ public class CoreManager

    #region Private

-    private async Task CoreStart(ProfileItem node)
+    private async Task CoreStart(CoreConfigContext context)
    {
-        var coreType = AppManager.Instance.RunningCoreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
+        var node = context.Node;
+        var coreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
        var coreInfo = CoreInfoManager.Instance.GetCoreInfo(coreType);

        var displayLog = node.ConfigType != EConfigType.Custom || node.DisplayLog;
@@ -179,27 +187,22 @@ public class CoreManager
        _processService = proc;
    }

-    private async Task CoreStartPreService(ProfileItem node)
+    private async Task CoreStartPreService(CoreConfigContext? preContext)
    {
-        if (_processService != null && !_processService.HasExited)
+        if (_processService is { HasExited: false } && preContext != null)
        {
-            var coreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
-            var itemSocks = await ConfigHandler.GetPreSocksItem(_config, node, coreType);
-            if (itemSocks != null)
+            var preCoreType = preContext?.Node?.CoreType ?? ECoreType.sing_box;
+            var fileName = Utils.GetBinConfigPath(Global.CorePreConfigFileName);
+            var result = await CoreConfigHandler.GenerateClientConfig(preContext, fileName);
+            if (result.Success)
            {
-                var preCoreType = itemSocks.CoreType ?? ECoreType.sing_box;
-                var fileName = Utils.GetBinConfigPath(Global.CorePreConfigFileName);
-                var result = await CoreConfigHandler.GenerateClientConfig(itemSocks, fileName);
-                if (result.Success)
+                var coreInfo = CoreInfoManager.Instance.GetCoreInfo(preCoreType);
+                var proc = await RunProcess(coreInfo, Global.CorePreConfigFileName, true, true);
+                if (proc is null)
                {
-                    var coreInfo = CoreInfoManager.Instance.GetCoreInfo(preCoreType);
-                    var proc = await RunProcess(coreInfo, Global.CorePreConfigFileName, true, true);
-                    if (proc is null)
-                    {
-                        return;
-                    }
-                    _processPreService = proc;
+                    return;
                }
+                _processPreService = proc;
            }
        }
    }
@@ -0,0 +1,151 @@
+namespace ServiceLib.Manager;
+
+public class GroupProfileManager
+{
+    public static async Task<bool> HasCycle(ProfileItem item)
+    {
+        return await HasCycle(item.IndexId, item.GetProtocolExtra());
+    }
+
+    public static async Task<bool> HasCycle(string? indexId, ProtocolExtraItem? extraInfo)
+    {
+        return await HasCycle(indexId, extraInfo, new HashSet<string>(), new HashSet<string>());
+    }
+
+    private static async Task<bool> HasCycle(string? indexId, ProtocolExtraItem? extraInfo, HashSet<string> visited, HashSet<string> stack)
+    {
+        if (indexId.IsNullOrEmpty() || extraInfo == null)
+        {
+            return false;
+        }
+
+        if (stack.Contains(indexId))
+        {
+            return true;
+        }
+
+        if (visited.Contains(indexId))
+        {
+            return false;
+        }
+
+        visited.Add(indexId);
+        stack.Add(indexId);
+
+        try
+        {
+            if (extraInfo.GroupType.IsNullOrEmpty())
+            {
+                return false;
+            }
+
+            if (extraInfo.ChildItems.IsNullOrEmpty())
+            {
+                return false;
+            }
+
+            var childIds = Utils.String2List(extraInfo.ChildItems)
+                ?.Where(p => !string.IsNullOrEmpty(p))
+                .ToList();
+            if (childIds == null)
+            {
+                return false;
+            }
+
+            var childItems = await AppManager.Instance.GetProfileItemsByIndexIds(childIds);
+            foreach (var childItem in childItems)
+            {
+                if (await HasCycle(childItem.IndexId, childItem?.GetProtocolExtra(), visited, stack))
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+        finally
+        {
+            stack.Remove(indexId);
+        }
+    }
+
+    public static async Task<(List<ProfileItem> Items, ProtocolExtraItem? Extra)> GetChildProfileItems(ProfileItem profileItem)
+    {
+        var protocolExtra = profileItem?.GetProtocolExtra();
+        return (await GetChildProfileItemsByProtocolExtra(protocolExtra), protocolExtra);
+    }
+
+    public static async Task<List<ProfileItem>> GetChildProfileItemsByProtocolExtra(ProtocolExtraItem? protocolExtra)
+    {
+        if (protocolExtra == null)
+        {
+            return [];
+        }
+
+        var items = new List<ProfileItem>();
+        items.AddRange(await GetSubChildProfileItems(protocolExtra));
+        items.AddRange(await GetSelectedChildProfileItems(protocolExtra));
+
+        return items;
+    }
+
+    private static async Task<List<ProfileItem>> GetSelectedChildProfileItems(ProtocolExtraItem? extra)
+    {
+        if (extra == null || extra.ChildItems.IsNullOrEmpty())
+        {
+            return [];
+        }
+        var childProfileIds = Utils.String2List(extra.ChildItems)
+            ?.Where(p => !string.IsNullOrEmpty(p))
+            .ToList() ?? [];
+        if (childProfileIds.Count == 0)
+        {
+            return [];
+        }
+
+        var ordered = await AppManager.Instance.GetProfileItemsOrderedByIndexIds(childProfileIds);
+        return ordered;
+    }
+
+    private static async Task<List<ProfileItem>> GetSubChildProfileItems(ProtocolExtraItem? extra)
+    {
+        if (extra == null || extra.SubChildItems.IsNullOrEmpty())
+        {
+            return [];
+        }
+        var childProfiles = await AppManager.Instance.ProfileItems(extra.SubChildItems ?? string.Empty);
+
+        return childProfiles?.Where(p =>
+                p != null &&
+                p.IsValid() &&
+                !p.ConfigType.IsComplexType() &&
+                (extra.Filter.IsNullOrEmpty() || Regex.IsMatch(p.Remarks, extra.Filter))
+            )
+            .ToList() ?? [];
+    }
+
+    public static async Task<Dictionary<string, ProfileItem>> GetAllChildProfileItems(ProfileItem profileItem)
+    {
+        var itemMap = new Dictionary<string, ProfileItem>();
+        var visited = new HashSet<string>();
+
+        await CollectChildItems(profileItem, itemMap, visited);
+
+        return itemMap;
+    }
+
+    private static async Task CollectChildItems(ProfileItem profileItem, Dictionary<string, ProfileItem> itemMap,
+        HashSet<string> visited)
+    {
+        var (childItems, _) = await GetChildProfileItems(profileItem);
+        foreach (var child in childItems.Where(child => visited.Add(child.IndexId)))
+        {
+            itemMap[child.IndexId] = child;
+
+            if (child.ConfigType.IsGroupType())
+            {
+                await CollectChildItems(child, itemMap, visited);
+            }
+        }
+    }
+}
@@ -38,4 +38,25 @@ public class NoticeManager
        Enqueue(msg);
        SendMessage(msg);
    }
+
+    /// <summary>
+    /// Sends each error and warning in <paramref name="validatorResult"/> to the message panel
+    /// and enqueues a summary snack notification (capped at 10 messages).
+    /// Returns <c>true</c> when there were any messages so the caller can decide on early-return
+    /// based on <see cref="NodeValidatorResult.Success"/>.
+    /// </summary>
+    public bool NotifyValidatorResult(NodeValidatorResult validatorResult)
+    {
+        var msgs = new List<string>([.. validatorResult.Errors, .. validatorResult.Warnings]);
+        if (msgs.Count == 0)
+        {
+            return false;
+        }
+        foreach (var msg in msgs)
+        {
+            SendMessage(msg);
+        }
+        Enqueue(Utils.List2String(msgs.Take(10).ToList(), true));
+        return true;
+    }
 }
@@ -1,388 +0,0 @@
-namespace ServiceLib.Manager;
-
-public class ProfileGroupItemManager
-{
-    private static readonly Lazy<ProfileGroupItemManager> _instance = new(() => new());
-    private ConcurrentDictionary<string, ProfileGroupItem> _items = new();
-
-    public static ProfileGroupItemManager Instance => _instance.Value;
-    private static readonly string _tag = "ProfileGroupItemManager";
-
-    private ProfileGroupItemManager()
-    {
-    }
-
-    public async Task Init()
-    {
-        await InitData();
-    }
-
-    // Read-only getters: do not create or mark dirty
-    public bool TryGet(string indexId, out ProfileGroupItem? item)
-    {
-        item = null;
-        if (string.IsNullOrWhiteSpace(indexId))
-        {
-            return false;
-        }
-
-        return _items.TryGetValue(indexId, out item);
-    }
-
-    public ProfileGroupItem? GetOrDefault(string indexId)
-    {
-        return string.IsNullOrWhiteSpace(indexId) ? null : (_items.TryGetValue(indexId, out var v) ? v : null);
-    }
-
-    private async Task InitData()
-    {
-        await SQLiteHelper.Instance.ExecuteAsync($"delete from ProfileGroupItem where IndexId not in ( select indexId from ProfileItem )");
-
-        var list = await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().ToListAsync();
-        _items = new ConcurrentDictionary<string, ProfileGroupItem>(list.Where(t => !string.IsNullOrEmpty(t.IndexId)).ToDictionary(t => t.IndexId!));
-    }
-
-    private ProfileGroupItem AddProfileGroupItem(string indexId)
-    {
-        var profileGroupItem = new ProfileGroupItem()
-        {
-            IndexId = indexId,
-            ChildItems = string.Empty,
-            MultipleLoad = EMultipleLoad.LeastPing
-        };
-
-        _items[indexId] = profileGroupItem;
-        return profileGroupItem;
-    }
-
-    private ProfileGroupItem GetProfileGroupItem(string indexId)
-    {
-        if (string.IsNullOrEmpty(indexId))
-        {
-            indexId = Utils.GetGuid(false);
-        }
-
-        return _items.GetOrAdd(indexId, AddProfileGroupItem);
-    }
-
-    public async Task ClearAll()
-    {
-        await SQLiteHelper.Instance.ExecuteAsync($"delete from ProfileGroupItem ");
-        _items.Clear();
-    }
-
-    public async Task SaveTo()
-    {
-        try
-        {
-            var lstExists = await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().ToListAsync();
-            var existsMap = lstExists.Where(t => !string.IsNullOrEmpty(t.IndexId)).ToDictionary(t => t.IndexId!);
-
-            var lstInserts = new List<ProfileGroupItem>();
-            var lstUpdates = new List<ProfileGroupItem>();
-
-            foreach (var item in _items.Values)
-            {
-                if (string.IsNullOrEmpty(item.IndexId))
-                {
-                    continue;
-                }
-
-                if (existsMap.ContainsKey(item.IndexId))
-                {
-                    lstUpdates.Add(item);
-                }
-                else
-                {
-                    lstInserts.Add(item);
-                }
-            }
-
-            try
-            {
-                if (lstInserts.Count > 0)
-                {
-                    await SQLiteHelper.Instance.InsertAllAsync(lstInserts);
-                }
-
-                if (lstUpdates.Count > 0)
-                {
-                    await SQLiteHelper.Instance.UpdateAllAsync(lstUpdates);
-                }
-            }
-            catch (Exception ex)
-            {
-                Logging.SaveLog(_tag, ex);
-            }
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-        }
-    }
-
-    public ProfileGroupItem GetOrCreateAndMarkDirty(string indexId)
-    {
-        return GetProfileGroupItem(indexId);
-    }
-
-    public async ValueTask DisposeAsync()
-    {
-        await SaveTo();
-    }
-
-    public async Task SaveItemAsync(ProfileGroupItem item)
-    {
-        if (item is null)
-        {
-            throw new ArgumentNullException(nameof(item));
-        }
-
-        if (string.IsNullOrWhiteSpace(item.IndexId))
-        {
-            throw new ArgumentException("IndexId required", nameof(item));
-        }
-
-        _items[item.IndexId] = item;
-
-        try
-        {
-            var lst = await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().Where(t => t.IndexId == item.IndexId).ToListAsync();
-            if (lst != null && lst.Count > 0)
-            {
-                await SQLiteHelper.Instance.UpdateAllAsync(new List<ProfileGroupItem> { item });
-            }
-            else
-            {
-                await SQLiteHelper.Instance.InsertAllAsync(new List<ProfileGroupItem> { item });
-            }
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-        }
-    }
-
-    #region Helper
-
-    public static bool HasCycle(string? indexId)
-    {
-        return HasCycle(indexId, new HashSet<string>(), new HashSet<string>());
-    }
-
-    public static bool HasCycle(string? indexId, HashSet<string> visited, HashSet<string> stack)
-    {
-        if (indexId.IsNullOrEmpty())
-        {
-            return false;
-        }
-
-        if (stack.Contains(indexId))
-        {
-            return true;
-        }
-
-        if (visited.Contains(indexId))
-        {
-            return false;
-        }
-
-        visited.Add(indexId);
-        stack.Add(indexId);
-
-        try
-        {
-            Instance.TryGet(indexId, out var groupItem);
-
-            if (groupItem == null || groupItem.ChildItems.IsNullOrEmpty())
-            {
-                return false;
-            }
-
-            var childIds = Utils.String2List(groupItem.ChildItems)
-                .Where(p => !string.IsNullOrEmpty(p))
-                .ToList();
-            if (childIds == null)
-            {
-                return false;
-            }
-
-            foreach (var child in childIds)
-            {
-                if (HasCycle(child, visited, stack))
-                {
-                    return true;
-                }
-            }
-
-            return false;
-        }
-        finally
-        {
-            stack.Remove(indexId);
-        }
-    }
-
-    public static async Task<(List<ProfileItem> Items, ProfileGroupItem? Group)> GetChildProfileItems(string? indexId)
-    {
-        Instance.TryGet(indexId, out var profileGroupItem);
-        if (profileGroupItem == null || profileGroupItem.NotHasChild())
-        {
-            return (new List<ProfileItem>(), profileGroupItem);
-        }
-
-        var items = new List<ProfileItem>();
-        items.AddRange(await GetSubChildProfileItems(profileGroupItem));
-        items.AddRange(await GetChildProfileItems(profileGroupItem));
-
-        return (items, profileGroupItem);
-    }
-
-    public static async Task<List<ProfileItem>> GetChildProfileItems(ProfileGroupItem? group)
-    {
-        if (group == null || group.ChildItems.IsNullOrEmpty())
-        {
-            return new();
-        }
-        var childProfiles = (await Task.WhenAll(
-                Utils.String2List(group.ChildItems)
-                    .Where(p => !p.IsNullOrEmpty())
-                    .Select(AppManager.Instance.GetProfileItem)
-            ))
-            .Where(p =>
-                p != null &&
-                p.IsValid() &&
-                p.ConfigType != EConfigType.Custom
-            )
-            .ToList();
-        return childProfiles;
-    }
-
-    public static async Task<List<ProfileItem>> GetSubChildProfileItems(ProfileGroupItem? group)
-    {
-        if (group == null || group.SubChildItems.IsNullOrEmpty())
-        {
-            return new();
-        }
-        var childProfiles = await AppManager.Instance.ProfileItems(group.SubChildItems);
-
-        return childProfiles.Where(p =>
-                p != null &&
-                p.IsValid() &&
-                !p.ConfigType.IsComplexType() &&
-                (group.Filter.IsNullOrEmpty() || Regex.IsMatch(p.Remarks, group.Filter))
-            )
-            .ToList();
-    }
-
-    public static async Task<HashSet<string>> GetAllChildDomainAddresses(string indexId)
-    {
-        // include grand children
-        var childAddresses = new HashSet<string>();
-        if (!Instance.TryGet(indexId, out var groupItem) || groupItem == null)
-        {
-            return childAddresses;
-        }
-
-        if (groupItem.SubChildItems.IsNotEmpty())
-        {
-            var subItems = await GetSubChildProfileItems(groupItem);
-            subItems.ForEach(p => childAddresses.Add(p.Address));
-        }
-
-        var childIds = Utils.String2List(groupItem.ChildItems) ?? [];
-
-        foreach (var childId in childIds)
-        {
-            var childNode = await AppManager.Instance.GetProfileItem(childId);
-            if (childNode == null)
-            {
-                continue;
-            }
-
-            if (!childNode.IsComplex())
-            {
-                childAddresses.Add(childNode.Address);
-            }
-            else if (childNode.ConfigType.IsGroupType())
-            {
-                var subAddresses = await GetAllChildDomainAddresses(childNode.IndexId);
-                foreach (var addr in subAddresses)
-                {
-                    childAddresses.Add(addr);
-                }
-            }
-        }
-
-        return childAddresses;
-    }
-
-    public static async Task<HashSet<string>> GetAllChildEchQuerySni(string indexId)
-    {
-        // include grand children
-        var childAddresses = new HashSet<string>();
-        if (!Instance.TryGet(indexId, out var groupItem) || groupItem == null)
-        {
-            return childAddresses;
-        }
-
-        if (groupItem.SubChildItems.IsNotEmpty())
-        {
-            var subItems = await GetSubChildProfileItems(groupItem);
-            foreach (var childNode in subItems)
-            {
-                if (childNode.EchConfigList.IsNullOrEmpty())
-                {
-                    continue;
-                }
-                if (childNode.StreamSecurity == Global.StreamSecurity
-                    && childNode.EchConfigList?.Contains("://") == true)
-                {
-                    var idx = childNode.EchConfigList.IndexOf('+');
-                    childAddresses.Add(idx > 0 ? childNode.EchConfigList[..idx] : childNode.Sni);
-                }
-                else
-                {
-                    childAddresses.Add(childNode.Sni);
-                }
-            }
-        }
-
-        var childIds = Utils.String2List(groupItem.ChildItems) ?? [];
-
-        foreach (var childId in childIds)
-        {
-            var childNode = await AppManager.Instance.GetProfileItem(childId);
-            if (childNode == null)
-            {
-                continue;
-            }
-
-            if (!childNode.IsComplex() && !childNode.EchConfigList.IsNullOrEmpty())
-            {
-                if (childNode.StreamSecurity == Global.StreamSecurity
-                    && childNode.EchConfigList?.Contains("://") == true)
-                {
-                    var idx = childNode.EchConfigList.IndexOf('+');
-                    childAddresses.Add(idx > 0 ? childNode.EchConfigList[..idx] : childNode.Sni);
-                }
-                else
-                {
-                    childAddresses.Add(childNode.Sni);
-                }
-            }
-            else if (childNode.ConfigType.IsGroupType())
-            {
-                var subAddresses = await GetAllChildDomainAddresses(childNode.IndexId);
-                foreach (var addr in subAddresses)
-                {
-                    childAddresses.Add(addr);
-                }
-            }
-        }
-
-        return childAddresses;
-    }
-
-    #endregion Helper
-}
@@ -15,6 +15,8 @@ public class CoreBasicItem

    public string DefUserAgent { get; set; }

+    public string? SendThrough { get; set; }
+
    public bool EnableFragment { get; set; }

    public bool EnableCacheFile4Sbox { get; set; } = true;
@@ -47,11 +49,9 @@ public class KcpItem

    public int DownlinkCapacity { get; set; }

-    public bool Congestion { get; set; }
+    public int CwndMultiplier { get; set; }

-    public int ReadBufferSize { get; set; }
-
-    public int WriteBufferSize { get; set; }
+    public int MaxSendingWindow { get; set; }
 }

 [Serializable]
@@ -87,7 +87,6 @@ public class MsgUIItem
 public class UIItem
 {
    public bool EnableAutoAdjustMainLvColWidth { get; set; }
-    public bool EnableUpdateSubOnlyRemarksExist { get; set; }
    public int MainGirdHeight1 { get; set; }
    public int MainGirdHeight2 { get; set; }
    public EGirdOrientation MainGirdOrientation { get; set; } = EGirdOrientation.Vertical;
@@ -99,7 +98,7 @@ public class UIItem
    public bool EnableDragDropSort { get; set; }
    public bool DoubleClick2Activate { get; set; }
    public bool AutoHideStartup { get; set; }
-    public bool Hide2TrayWhenClose { get; set; }    
+    public bool Hide2TrayWhenClose { get; set; }
    public bool MacOSShowInDock { get; set; }
    public List<ColumnItem> MainColumnItem { get; set; }
    public List<WindowSizeItem> WindowSizeItem { get; set; }
@@ -144,8 +143,9 @@ public class TunModeItem
    public bool StrictRoute { get; set; } = true;
    public string Stack { get; set; }
    public int Mtu { get; set; }
-    public bool EnableExInbound { get; set; }
    public bool EnableIPv6Address { get; set; }
+    public string IcmpRouting { get; set; }
+    public bool EnableLegacyProtect { get; set; }
 }

 [Serializable]
@@ -195,7 +195,7 @@ public class HysteriaItem
 {
    public int UpMbps { get; set; }
    public int DownMbps { get; set; }
-    public int HopInterval { get; set; } = 30;
+    public int HopInterval { get; set; } = Global.Hysteria2DefaultHopInt;
 }

 [Serializable]
@@ -209,6 +209,7 @@ public class ClashUIItem
    public int ProxiesAutoDelayTestInterval { get; set; } = 10;
    public bool ConnectionsAutoRefresh { get; set; }
    public int ConnectionsRefreshInterval { get; set; } = 2;
+    public List<ColumnItem> ConnectionsColumnItem { get; set; }
 }

 [Serializable]
@@ -0,0 +1,20 @@
+namespace ServiceLib.Models;
+
+public record CoreConfigContext
+{
+    public required ProfileItem Node { get; init; }
+    public required ECoreType RunCoreType { get; init; }
+    public RoutingItem? RoutingItem { get; init; }
+    public DNSItem? RawDnsItem { get; init; }
+    public SimpleDNSItem SimpleDnsItem { get; init; } = new();
+    public Dictionary<string, ProfileItem> AllProxiesMap { get; init; } = new();
+    public Config AppConfig { get; init; } = new();
+    public FullConfigTemplateItem? FullConfigTemplate { get; init; } = new();
+
+    // Test ServerTestItem Map
+    public Dictionary<string, string> ServerTestItemMap { get; init; } = new();
+
+    // TUN Compatibility
+    public bool IsTunEnabled { get; init; } = false;
+    public HashSet<string> ProtectDomainList { get; init; } = [];
+}
@@ -12,6 +12,7 @@ public class CoreInfo
    public string? DownloadUrlWinArm64 { get; set; }
    public string? DownloadUrlLinux64 { get; set; }
    public string? DownloadUrlLinuxArm64 { get; set; }
+    public string? DownloadUrlLinuxRiscV64 { get; set; }
    public string? DownloadUrlOSX64 { get; set; }
    public string? DownloadUrlOSXArm64 { get; set; }
    public string? Match { get; set; }
@@ -1,5 +1,6 @@
 namespace ServiceLib.Models;

+[Obsolete("Use ProtocolExtraItem instead.")]
 [Serializable]
 public class ProfileGroupItem
 {
@@ -1,27 +1,25 @@
 namespace ServiceLib.Models;

 [Serializable]
-public class ProfileItem : ReactiveObject
+public class ProfileItem
 {
+    private ProtocolExtraItem? _protocolExtraCache;
+    private TransportExtraItem? _transportExtraCache;
+
    public ProfileItem()
    {
        IndexId = string.Empty;
        ConfigType = EConfigType.VMess;
-        ConfigVersion = 2;
+        ConfigVersion = 4;
+        Subid = string.Empty;
        Address = string.Empty;
        Port = 0;
-        Id = string.Empty;
-        AlterId = 0;
-        Security = string.Empty;
+        Password = string.Empty;
+        Username = string.Empty;
        Network = string.Empty;
        Remarks = string.Empty;
-        HeaderType = string.Empty;
-        RequestHost = string.Empty;
-        Path = string.Empty;
        StreamSecurity = string.Empty;
        AllowInsecure = string.Empty;
-        Subid = string.Empty;
-        Flow = string.Empty;
    }

    #region function
@@ -81,7 +79,7 @@ public class ProfileItem : ReactiveObject
        switch (ConfigType)
        {
            case EConfigType.VMess:
-                if (Id.IsNullOrEmpty() || !Utils.IsGuidByParse(Id))
+                if (Password.IsNullOrEmpty() || !Utils.IsGuidByParse(Password))
                {
                    return false;
                }
@@ -89,12 +87,12 @@ public class ProfileItem : ReactiveObject
                break;

            case EConfigType.VLESS:
-                if (Id.IsNullOrEmpty() || (!Utils.IsGuidByParse(Id) && Id.Length > 30))
+                if (Password.IsNullOrEmpty() || (!Utils.IsGuidByParse(Password) && Password.Length > 30))
                {
                    return false;
                }

-                if (!Global.Flows.Contains(Flow))
+                if (!Global.Flows.Contains(GetProtocolExtra().Flow ?? string.Empty))
                {
                    return false;
                }
@@ -102,12 +100,13 @@ public class ProfileItem : ReactiveObject
                break;

            case EConfigType.Shadowsocks:
-                if (Id.IsNullOrEmpty())
+                if (Password.IsNullOrEmpty())
                {
                    return false;
                }

-                if (string.IsNullOrEmpty(Security) || !Global.SsSecuritiesInSingbox.Contains(Security))
+                if (string.IsNullOrEmpty(GetProtocolExtra().SsMethod)
+                    || !Global.SsSecuritiesInSingbox.Contains(GetProtocolExtra().SsMethod))
                {
                    return false;
                }
@@ -125,43 +124,91 @@ public class ProfileItem : ReactiveObject
        return true;
    }

+    public ProtocolExtraItem GetProtocolExtra()
+    {
+        return _protocolExtraCache ??= JsonUtils.Deserialize<ProtocolExtraItem>(ProtoExtra) ?? new ProtocolExtraItem();
+    }
+
+    public void SetProtocolExtra(ProtocolExtraItem extraItem)
+    {
+        _protocolExtraCache = extraItem;
+        ProtoExtra = JsonUtils.Serialize(extraItem, false);
+    }
+
+    public TransportExtraItem GetTransportExtra()
+    {
+        return _transportExtraCache ??= JsonUtils.Deserialize<TransportExtraItem>(TransportExtra) ?? new TransportExtraItem();
+    }
+
+    public void SetTransportExtra(TransportExtraItem transportExtra)
+    {
+        _transportExtraCache = transportExtra;
+        TransportExtra = JsonUtils.Serialize(transportExtra, false);
+    }
+
    #endregion function

    [PrimaryKey]
    public string IndexId { get; set; }

    public EConfigType ConfigType { get; set; }
+    public ECoreType? CoreType { get; set; }
    public int ConfigVersion { get; set; }
-    public string Address { get; set; }
-    public int Port { get; set; }
-    public string Ports { get; set; }
-    public string Id { get; set; }
-    public int AlterId { get; set; }
-    public string Security { get; set; }
-    public string Network { get; set; }
-    public string Remarks { get; set; }
-    public string HeaderType { get; set; }
-    public string RequestHost { get; set; }
-    public string Path { get; set; }
-    public string StreamSecurity { get; set; }
-    public string AllowInsecure { get; set; }
    public string Subid { get; set; }
    public bool IsSub { get; set; } = true;
-    public string Flow { get; set; }
+    public int? PreSocksPort { get; set; }
+    public bool DisplayLog { get; set; } = true;
+    public string Remarks { get; set; }
+    public string Address { get; set; }
+    public int Port { get; set; }
+    public string Password { get; set; }
+    public string Username { get; set; }
+    public string Network { get; set; }
+
+    [Obsolete("Use TransportExtra.RawHeaderType/XhttpMode/GrpcMode/KcpHeaderType instead.")]
+    public string HeaderType { get; set; }
+
+    [Obsolete("Use TransportExtra.Host/GrpcAuthority instead.")]
+    public string RequestHost { get; set; }
+
+    [Obsolete("Use TransportExtra.Path/GrpcServiceName/KcpSeed instead.")]
+    public string Path { get; set; }
+
+    public string StreamSecurity { get; set; }
+    public string AllowInsecure { get; set; }
    public string Sni { get; set; }
    public string Alpn { get; set; } = string.Empty;
-    public ECoreType? CoreType { get; set; }
-    public int? PreSocksPort { get; set; }
    public string Fingerprint { get; set; }
-    public bool DisplayLog { get; set; } = true;
    public string PublicKey { get; set; }
    public string ShortId { get; set; }
    public string SpiderX { get; set; }
    public string Mldsa65Verify { get; set; }
+
+    [Obsolete("Use TransportExtra.XhttpExtra instead.")]
    public string Extra { get; set; }
+
    public bool? MuxEnabled { get; set; }
    public string Cert { get; set; }
    public string CertSha { get; set; }
    public string EchConfigList { get; set; }
    public string EchForceQuery { get; set; }
+    public string Finalmask { get; set; }
+
+    public string ProtoExtra { get; set; }
+    public string TransportExtra { get; set; }
+
+    [Obsolete("Use ProtocolExtraItem.Ports instead.")]
+    public string Ports { get; set; }
+
+    [Obsolete("Use ProtocolExtraItem.AlterId instead.")]
+    public int AlterId { get; set; }
+
+    [Obsolete("Use ProtocolExtraItem.Flow instead.")]
+    public string Flow { get; set; }
+
+    [Obsolete("Use ProfileItem.Password instead.")]
+    public string Id { get; set; }
+
+    [Obsolete("Use ProtocolExtraItem.xxx instead.")]
+    public string Security { get; set; }
 }
@@ -1,16 +1,24 @@
 namespace ServiceLib.Models;

 [Serializable]
-public class ProfileItemModel : ProfileItem
+public class ProfileItemModel : ReactiveObject
 {
    public bool IsActive { get; set; }
+    public string IndexId { get; set; }
+    public EConfigType ConfigType { get; set; }
+    public string Remarks { get; set; }
+    public string Address { get; set; }
+    public int Port { get; set; }
+    public string Network { get; set; }
+    public string StreamSecurity { get; set; }
+    public string Subid { get; set; }
    public string SubRemarks { get; set; }
+    public int Sort { get; set; }

    [Reactive]
    public int Delay { get; set; }

    public decimal Speed { get; set; }
-    public int Sort { get; set; }

    [Reactive]
    public string DelayVal { get; set; }
@@ -29,4 +37,15 @@ public class ProfileItemModel : ProfileItem

    [Reactive]
    public string TotalDown { get; set; }
+
+    public string GetSummary()
+    {
+        var summary = $"[{ConfigType}] {Remarks}";
+        if (!ConfigType.IsComplexType())
+        {
+            summary += $"({Address}:{Port})";
+        }
+
+        return summary;
+    }
 }
@@ -0,0 +1,45 @@
+namespace ServiceLib.Models;
+
+public record ProtocolExtraItem
+{
+    public bool? Uot { get; init; }
+    public string? CongestionControl { get; init; }
+
+    // vmess
+    public string? AlterId { get; init; }
+    public string? VmessSecurity { get; init; }
+
+    // vless
+    public string? Flow { get; init; }
+    public string? VlessEncryption { get; init; }
+    //public string? VisionSeed { get; init; }
+
+    // shadowsocks
+    //public string? PluginArgs { get; init; }
+    public string? SsMethod { get; init; }
+
+    // wireguard
+    public string? WgPublicKey { get; init; }
+    public string? WgPresharedKey { get; init; }
+    public string? WgInterfaceAddress { get; init; }
+    public string? WgReserved { get; init; }
+    public int? WgMtu { get; init; }
+
+    // hysteria2
+    public string? SalamanderPass { get; init; }
+    public int? UpMbps { get; init; }
+    public int? DownMbps { get; init; }
+    public string? Ports { get; init; }
+    public string? HopInterval { get; init; }
+
+    // naiveproxy
+    public int? InsecureConcurrency { get; init; }
+    public bool? NaiveQuic { get; init; }
+
+    // group profile
+    public string? GroupType { get; init; }
+    public string? ChildItems { get; init; }
+    public string? SubChildItems { get; init; }
+    public string? Filter { get; init; }
+    public EMultipleLoad? MultipleLoad { get; init; }
+}
@@ -9,4 +9,6 @@ public class ServerTestItem
    public EConfigType ConfigType { get; set; }
    public bool AllowTest { get; set; }
    public int QueueNum { get; set; }
+    public ProfileItem Profile { get; set; }
+    public ECoreType CoreType { get; set; }
 }
@@ -28,6 +28,7 @@ public class Dns4Sbox
    public bool? disable_cache { get; set; }
    public bool? disable_expire { get; set; }
    public bool? independent_cache { get; set; }
+    public int? cache_capacity { get; set; }
    public bool? reverse_mapping { get; set; }
    public string? client_subnet { get; set; }
 }
@@ -133,10 +134,14 @@ public class Outbound4Sbox : BaseServer4Sbox
    public int? recv_window_conn { get; set; }
    public int? recv_window { get; set; }
    public bool? disable_mtu_discovery { get; set; }
+    public int? insecure_concurrency { get; set; }
+    public bool? udp_over_tcp { get; set; }
    public string? method { get; set; }
    public string? username { get; set; }
    public string? password { get; set; }
    public string? congestion_control { get; set; }
+    public bool? quic { get; set; }
+    public string? quic_congestion_control { get; set; }
    public string? version { get; set; }
    public string? network { get; set; }
    public string? packet_encoding { get; set; }
@@ -232,6 +237,8 @@ public class Transport4Sbox
 public class Headers4Sbox
 {
    public string? Host { get; set; }
+    [JsonPropertyName("User-Agent")]
+    public string UserAgent { get; set; }
 }

 public class HyObfs4Sbox
@@ -254,14 +261,6 @@ public class Server4Sbox : BaseServer4Sbox

    // public List<string>? path { get; set; } // hosts
    public Dictionary<string, List<string>>? predefined { get; set; }
-
-    // Deprecated
-    public string? address { get; set; }
-
-    public string? address_resolver { get; set; }
-    public string? address_strategy { get; set; }
-    public string? strategy { get; set; }
-    // Deprecated End
 }

 public class Experimental4Sbox
@@ -0,0 +1,18 @@
+namespace ServiceLib.Models;
+
+public record TransportExtraItem
+{
+    public string? RawHeaderType { get; init; }
+
+    public string? Host { get; init; }
+    public string? Path { get; init; }
+    public string? XhttpMode { get; init; }
+    public string? XhttpExtra { get; init; }
+
+    public string? GrpcAuthority { get; init; }
+    public string? GrpcServiceName { get; init; }
+    public string? GrpcMode { get; init; }
+
+    public string? KcpHeaderType { get; init; }
+    public string? KcpSeed { get; init; }
+}
@@ -47,9 +47,9 @@ public class Inbounds4Ray
 {
    public string tag { get; set; }

-    public int port { get; set; }
+    public int? port { get; set; }

-    public string listen { get; set; }
+    public string? listen { get; set; }

    public string protocol { get; set; }

@@ -75,6 +75,18 @@ public class Inboundsettings4Ray
    public bool? allowTransparent { get; set; }

    public List<AccountsItem4Ray>? accounts { get; set; }
+
+    public string? name { get; set; }
+
+    public int? MTU { get; set; }
+
+    public List<string>? gateway { get; set; }
+
+    public List<string>? autoSystemRoutingTable { get; set; }
+
+    public string? autoOutboundsInterface { get; set; }
+
+    // public List<string>? dns { get; set; }
 }

 public class UsersItem4Ray
@@ -105,6 +117,8 @@ public class Outbounds4Ray

    public string protocol { get; set; }

+    public string? sendThrough { get; set; }
+
    public string? targetStrategy { get; set; }

    public Outboundsettings4Ray settings { get; set; }
@@ -126,11 +140,10 @@ public class Outboundsettings4Ray

    public int? userLevel { get; set; }

-    public FragmentItem4Ray? fragment { get; set; }
-
    public string? secretKey { get; set; }

-    public Object? address { get; set; }
+    public object? address { get; set; }
+
    public int? port { get; set; }

    public List<WireguardPeer4Ray>? peers { get; set; }
@@ -179,6 +192,8 @@ public class ServersItem4Ray

    public string flow { get; set; }

+    public bool? uot { get; set; }
+
    public List<SocksUsersItem4Ray> users { get; set; }
 }

@@ -220,12 +235,6 @@ public class DnsServer4Ray
    public List<string>? domains { get; set; }
    public bool? skipFallback { get; set; }
    public List<string>? expectedIPs { get; set; }
-    public List<string>? unexpectedIPs { get; set; }
-    public string? clientIp { get; set; }
-    public string? queryStrategy { get; set; }
-    public int? timeoutMs { get; set; }
-    public bool? disableCache { get; set; }
-    public bool? finalQuery { get; set; }
    public string? tag { get; set; }
 }

@@ -321,7 +330,7 @@ public class StreamSettings4Ray

    public TlsSettings4Ray? tlsSettings { get; set; }

-    public TcpSettings4Ray? tcpSettings { get; set; }
+    public RawSettings4Ray? rawSettings { get; set; }

    public KcpSettings4Ray? kcpSettings { get; set; }

@@ -341,7 +350,7 @@ public class StreamSettings4Ray

    public HysteriaSettings4Ray? hysteriaSettings { get; set; }

-    public FinalMask4Ray? finalmask { get; set; }
+    public object? finalmask { get; set; }

    public Sockopt4Ray? sockopt { get; set; }
 }
@@ -366,6 +375,7 @@ public class TlsSettings4Ray
    public bool? disableSystemRoot { get; set; }
    public string? echConfigList { get; set; }
    public string? echForceQuery { get; set; }
+    public Sockopt4Ray? echSockopt { get; set; }
 }

 public class CertificateSettings4Ray
@@ -374,7 +384,7 @@ public class CertificateSettings4Ray
    public string? usage { get; set; }
 }

-public class TcpSettings4Ray
+public class RawSettings4Ray
 {
    public Header4Ray header { get; set; }
 }
@@ -398,11 +408,9 @@ public class KcpSettings4Ray

    public int downlinkCapacity { get; set; }

-    public bool congestion { get; set; }
+    public int cwndMultiplier { get; set; }

-    public int readBufferSize { get; set; }
-
-    public int writeBufferSize { get; set; }
+    public int maxSendingWindow { get; set; }
 }

 public class WsSettings4Ray
@@ -424,6 +432,8 @@ public class HttpupgradeSettings4Ray
    public string? path { get; set; }

    public string? host { get; set; }
+
+    public Headers4Ray headers { get; set; }
 }

 public class XhttpSettings4Ray
@@ -459,27 +469,25 @@ public class GrpcSettings4Ray
    public int? health_check_timeout { get; set; }
    public bool? permit_without_stream { get; set; }
    public int? initial_windows_size { get; set; }
+    public string? user_agent { get; set; }
 }

 public class HysteriaSettings4Ray
 {
    public int version { get; set; }
    public string? auth { get; set; }
-    public string? up { get; set; }
-    public string? down { get; set; }
-    public HysteriaUdpHop4Ray? udphop { get; set; }
 }

-public class HysteriaUdpHop4Ray
+public class UdpHop4Ray
 {
    public string? ports { get; set; }
-    public int? interval { get; set; }
+    public string? interval { get; set; }
 }

-public class FinalMask4Ray
+public class Finalmask4Ray
 {
-    public List<Mask4Ray>? tcp { get; set; }
    public List<Mask4Ray>? udp { get; set; }
+    public QuicParams4Ray? quicParams { get; set; }
 }

 public class Mask4Ray
@@ -492,6 +500,27 @@ public class MaskSettings4Ray
 {
    public string? password { get; set; }
    public string? domain { get; set; }
+    // fragment
+    public string? packets { get; set; }
+    public string? length { get; set; }
+    public string? delay { get; set; }
+    // noise
+    public int? reset { get; set; }
+    public List<NoiseMask4Ray>? noise { get; set; }
+}
+
+public class NoiseMask4Ray
+{
+    public string? rand { get; set; }
+    public string? delay { get; set; }
+}
+
+public class QuicParams4Ray
+{
+    public string? congestion { get; set; }
+    public string? brutalUp { get; set; }
+    public string? brutalDown { get; set; }
+    public UdpHop4Ray? udpHop { get; set; }
 }

 public class AccountsItem4Ray
@@ -504,6 +533,8 @@ public class AccountsItem4Ray
 public class Sockopt4Ray
 {
    public string? dialerProxy { get; set; }
+    [JsonPropertyName("interface")]
+    public string? Interface { get; set; }
 }

 public class FragmentItem4Ray
@@ -132,33 +132,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 Core &apos;{0}&apos; does not support network type &apos;{1}&apos;. 的本地化字符串。
-        /// </summary>
-        public static string CoreNotSupportNetwork {
-            get {
-                return ResourceManager.GetString("CoreNotSupportNetwork", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 Core &apos;{0}&apos; does not support protocol &apos;{1}&apos;. 的本地化字符串。
-        /// </summary>
-        public static string CoreNotSupportProtocol {
-            get {
-                return ResourceManager.GetString("CoreNotSupportProtocol", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 Core &apos;{0}&apos; does not support protocol &apos;{1}&apos; when using transport &apos;{2}&apos;. 的本地化字符串。
-        /// </summary>
-        public static string CoreNotSupportProtocolTransport {
-            get {
-                return ResourceManager.GetString("CoreNotSupportProtocolTransport", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 Note that custom configuration relies entirely on your own configuration and does not work with all settings. If you want to use the system proxy, please modify the listening port manually. 的本地化字符串。
        /// </summary>
@@ -249,6 +222,15 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Please fill in the correct IPv4 address for SendThrough. 的本地化字符串。
+        /// </summary>
+        public static string FillCorrectSendThroughIPv4 {
+            get {
+                return ResourceManager.GetString("FillCorrectSendThroughIPv4", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Please enter the correct port format. 的本地化字符串。
        /// </summary>
@@ -312,24 +294,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 Group &apos;{0}&apos; is empty. Please add at least one node. 的本地化字符串。
-        /// </summary>
-        public static string GroupEmpty {
-            get {
-                return ResourceManager.GetString("GroupEmpty", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 {0} Group cannot reference itself or have a circular reference 的本地化字符串。
-        /// </summary>
-        public static string GroupSelfReference {
-            get {
-                return ResourceManager.GetString("GroupSelfReference", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 This is not the correct configuration, please check 的本地化字符串。
        /// </summary>
@@ -357,15 +321,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 The {0} property is invalid, please check. 的本地化字符串。
-        /// </summary>
-        public static string InvalidProperty {
-            get {
-                return ResourceManager.GetString("InvalidProperty", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 Invalid address (URL) 的本地化字符串。
        /// </summary>
@@ -745,7 +700,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Add Child  的本地化字符串。
+        ///   查找类似 Add Child 的本地化字符串。
        /// </summary>
        public static string menuAddChildServer {
            get {
@@ -772,7 +727,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Add [Hysteria2]  的本地化字符串。
+        ///   查找类似 Add [Hysteria2] 的本地化字符串。
        /// </summary>
        public static string menuAddHysteria2Server {
            get {
@@ -781,7 +736,16 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Add Policy Group  的本地化字符串。
+        ///   查找类似 Add [NaïveProxy] 的本地化字符串。
+        /// </summary>
+        public static string menuAddNaiveServer {
+            get {
+                return ResourceManager.GetString("menuAddNaiveServer", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Add Policy Group 的本地化字符串。
        /// </summary>
        public static string menuAddPolicyGroupServer {
            get {
@@ -826,7 +790,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Add [Shadowsocks]  的本地化字符串。
+        ///   查找类似 Add [Shadowsocks] 的本地化字符串。
        /// </summary>
        public static string menuAddShadowsocksServer {
            get {
@@ -835,7 +799,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Add [SOCKS]  的本地化字符串。
+        ///   查找类似 Add [SOCKS] 的本地化字符串。
        /// </summary>
        public static string menuAddSocksServer {
            get {
@@ -844,7 +808,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Add [Trojan]  的本地化字符串。
+        ///   查找类似 Add [Trojan] 的本地化字符串。
        /// </summary>
        public static string menuAddTrojanServer {
            get {
@@ -853,7 +817,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Add [TUIC]  的本地化字符串。
+        ///   查找类似 Add [TUIC] 的本地化字符串。
        /// </summary>
        public static string menuAddTuicServer {
            get {
@@ -862,7 +826,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Add [VLESS]  的本地化字符串。
+        ///   查找类似 Add [VLESS] 的本地化字符串。
        /// </summary>
        public static string menuAddVlessServer {
            get {
@@ -871,7 +835,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Add [VMess]  的本地化字符串。
+        ///   查找类似 Add [VMess] 的本地化字符串。
        /// </summary>
        public static string menuAddVmessServer {
            get {
@@ -880,7 +844,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Add [WireGuard]  的本地化字符串。
+        ///   查找类似 Add [WireGuard] 的本地化字符串。
        /// </summary>
        public static string menuAddWireguardServer {
            get {
@@ -888,6 +852,15 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 All configurations 的本地化字符串。
+        /// </summary>
+        public static string menuAllServers {
+            get {
+                return ResourceManager.GetString("menuAllServers", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Backup and Restore 的本地化字符串。
        /// </summary>
@@ -969,6 +942,42 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Copy 的本地化字符串。
+        /// </summary>
+        public static string menuEditCopy {
+            get {
+                return ResourceManager.GetString("menuEditCopy", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Format 的本地化字符串。
+        /// </summary>
+        public static string menuEditFormat {
+            get {
+                return ResourceManager.GetString("menuEditFormat", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Paste 的本地化字符串。
+        /// </summary>
+        public static string menuEditPaste {
+            get {
+                return ResourceManager.GetString("menuEditPaste", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Select all 的本地化字符串。
+        /// </summary>
+        public static string menuEditSelectAll {
+            get {
+                return ResourceManager.GetString("menuEditSelectAll", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Edit  的本地化字符串。
        /// </summary>
@@ -1060,74 +1069,20 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Generate Policy Group from Multiple Profiles 的本地化字符串。
+        ///   查找类似 Generate Policy Group 的本地化字符串。
        /// </summary>
-        public static string menuGenGroupMultipleServer {
+        public static string menuGenGroupServer {
            get {
-                return ResourceManager.GetString("menuGenGroupMultipleServer", resourceCulture);
+                return ResourceManager.GetString("menuGenGroupServer", resourceCulture);
            }
        }
        
        /// <summary>
-        ///   查找类似 Fallback by sing-box 的本地化字符串。
+        ///   查找类似 Group by Region 的本地化字符串。
        /// </summary>
-        public static string menuGenGroupMultipleServerSingBoxFallback {
+        public static string menuGenRegionGroup {
            get {
-                return ResourceManager.GetString("menuGenGroupMultipleServerSingBoxFallback", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 LeastPing by sing-box 的本地化字符串。
-        /// </summary>
-        public static string menuGenGroupMultipleServerSingBoxLeastPing {
-            get {
-                return ResourceManager.GetString("menuGenGroupMultipleServerSingBoxLeastPing", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 Fallback by Xray 的本地化字符串。
-        /// </summary>
-        public static string menuGenGroupMultipleServerXrayFallback {
-            get {
-                return ResourceManager.GetString("menuGenGroupMultipleServerXrayFallback", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 LeastLoad by Xray 的本地化字符串。
-        /// </summary>
-        public static string menuGenGroupMultipleServerXrayLeastLoad {
-            get {
-                return ResourceManager.GetString("menuGenGroupMultipleServerXrayLeastLoad", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 LeastPing by Xray 的本地化字符串。
-        /// </summary>
-        public static string menuGenGroupMultipleServerXrayLeastPing {
-            get {
-                return ResourceManager.GetString("menuGenGroupMultipleServerXrayLeastPing", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 Random by Xray 的本地化字符串。
-        /// </summary>
-        public static string menuGenGroupMultipleServerXrayRandom {
-            get {
-                return ResourceManager.GetString("menuGenGroupMultipleServerXrayRandom", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 RoundRobin by Xray 的本地化字符串。
-        /// </summary>
-        public static string menuGenGroupMultipleServerXrayRoundRobin {
-            get {
-                return ResourceManager.GetString("menuGenGroupMultipleServerXrayRoundRobin", resourceCulture);
+                return ResourceManager.GetString("menuGenRegionGroup", resourceCulture);
            }
        }
        
@@ -1680,6 +1635,15 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Configuration item preview 的本地化字符串。
+        /// </summary>
+        public static string menuServerListPreview {
+            get {
+                return ResourceManager.GetString("menuServerListPreview", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Configuration 的本地化字符串。
        /// </summary>
@@ -1905,6 +1869,33 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Core &apos;{0}&apos; does not support network type &apos;{1}&apos; 的本地化字符串。
+        /// </summary>
+        public static string MsgCoreNotSupportNetwork {
+            get {
+                return ResourceManager.GetString("MsgCoreNotSupportNetwork", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Core &apos;{0}&apos; does not support protocol &apos;{1}&apos; 的本地化字符串。
+        /// </summary>
+        public static string MsgCoreNotSupportProtocol {
+            get {
+                return ResourceManager.GetString("MsgCoreNotSupportProtocol", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Core &apos;{0}&apos; does not support protocol &apos;{1}&apos; when using transport &apos;{2}&apos; 的本地化字符串。
+        /// </summary>
+        public static string MsgCoreNotSupportProtocolTransport {
+            get {
+                return ResourceManager.GetString("MsgCoreNotSupportProtocolTransport", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Downloaded GeoFile: {0} successfully 的本地化字符串。
        /// </summary>
@@ -1950,6 +1941,60 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Group {0} child group node {1} error: {2}. Skipping this node. 的本地化字符串。
+        /// </summary>
+        public static string MsgGroupChildGroupNodeError {
+            get {
+                return ResourceManager.GetString("MsgGroupChildGroupNodeError", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Group {0} child group node {1} warning: {2} 的本地化字符串。
+        /// </summary>
+        public static string MsgGroupChildGroupNodeWarning {
+            get {
+                return ResourceManager.GetString("MsgGroupChildGroupNodeWarning", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Group {0} child node {1} error: {2}. Skipping this node. 的本地化字符串。
+        /// </summary>
+        public static string MsgGroupChildNodeError {
+            get {
+                return ResourceManager.GetString("MsgGroupChildNodeError", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Group {0} child node {1} warning: {2} 的本地化字符串。
+        /// </summary>
+        public static string MsgGroupChildNodeWarning {
+            get {
+                return ResourceManager.GetString("MsgGroupChildNodeWarning", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Group {0} has a cycle dependency on child node {1}. Skipping this node. 的本地化字符串。
+        /// </summary>
+        public static string MsgGroupCycleDependency {
+            get {
+                return ResourceManager.GetString("MsgGroupCycleDependency", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Group {0} has no valid child node. 的本地化字符串。
+        /// </summary>
+        public static string MsgGroupNoValidChildNode {
+            get {
+                return ResourceManager.GetString("MsgGroupNoValidChildNode", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Information 的本地化字符串。
        /// </summary>
@@ -1959,6 +2004,15 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 The {0} property is invalid, please check 的本地化字符串。
+        /// </summary>
+        public static string MsgInvalidProperty {
+            get {
+                return ResourceManager.GetString("MsgInvalidProperty", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Please enter the URL 的本地化字符串。
        /// </summary>
@@ -1968,6 +2022,15 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Not support protocol &apos;{0}&apos; 的本地化字符串。
+        /// </summary>
+        public static string MsgNotSupportProtocol {
+            get {
+                return ResourceManager.GetString("MsgNotSupportProtocol", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 No valid subscriptions set 的本地化字符串。
        /// </summary>
@@ -1986,6 +2049,42 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Routing rule {0} has an empty outbound tag. Fallback to proxy node only. 的本地化字符串。
+        /// </summary>
+        public static string MsgRoutingRuleEmptyOutboundTag {
+            get {
+                return ResourceManager.GetString("MsgRoutingRuleEmptyOutboundTag", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Routing rule {0} outbound node {1} error: {2}. Fallback to proxy node only. 的本地化字符串。
+        /// </summary>
+        public static string MsgRoutingRuleOutboundNodeError {
+            get {
+                return ResourceManager.GetString("MsgRoutingRuleOutboundNodeError", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Routing rule {0} outbound node {1} not found. Fallback to proxy node only. 的本地化字符串。
+        /// </summary>
+        public static string MsgRoutingRuleOutboundNodeNotFound {
+            get {
+                return ResourceManager.GetString("MsgRoutingRuleOutboundNodeNotFound", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Routing rule {0} outbound node {1} warning: {2} 的本地化字符串。
+        /// </summary>
+        public static string MsgRoutingRuleOutboundNodeWarning {
+            get {
+                return ResourceManager.GetString("MsgRoutingRuleOutboundNodeWarning", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Filter, press Enter to execute 的本地化字符串。
        /// </summary>
@@ -2040,6 +2139,24 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Subscription next proxy {0} not found. Skipping. 的本地化字符串。
+        /// </summary>
+        public static string MsgSubscriptionNextProfileNotFound {
+            get {
+                return ResourceManager.GetString("MsgSubscriptionNextProfileNotFound", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Subscription previous proxy {0} not found. Skipping. 的本地化字符串。
+        /// </summary>
+        public static string MsgSubscriptionPrevProfileNotFound {
+            get {
+                return ResourceManager.GetString("MsgSubscriptionPrevProfileNotFound", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Unpacking... 的本地化字符串。
        /// </summary>
@@ -2094,15 +2211,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 Node alias &apos;{0}&apos; does not exist. 的本地化字符串。
-        /// </summary>
-        public static string NodeTagNotExist {
-            get {
-                return ResourceManager.GetString("NodeTagNotExist", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 Non-VMess or SS protocol 的本地化字符串。
        /// </summary>
@@ -2130,15 +2238,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 Not support protocol &apos;{0}&apos;. 的本地化字符串。
-        /// </summary>
-        public static string NotSupportProtocol {
-            get {
-                return ResourceManager.GetString("NotSupportProtocol", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 Scan completed, no valid QR code found 的本地化字符串。
        /// </summary>
@@ -2220,24 +2319,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 Policy group:  的本地化字符串。
-        /// </summary>
-        public static string PolicyGroupPrefix {
-            get {
-                return ResourceManager.GetString("PolicyGroupPrefix", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 Proxy chained:  的本地化字符串。
-        /// </summary>
-        public static string ProxyChainedPrefix {
-            get {
-                return ResourceManager.GetString("ProxyChainedPrefix", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 Global hotkey {0} registration failed, reason: {1} 的本地化字符串。
        /// </summary>
@@ -2301,15 +2382,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 Routing rule outbound:  的本地化字符串。
-        /// </summary>
-        public static string RoutingRuleOutboundPrefix {
-            get {
-                return ResourceManager.GetString("RoutingRuleOutboundPrefix", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 Run as Admin 的本地化字符串。
        /// </summary>
@@ -2508,6 +2580,24 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Allow insecure cert fetch (self-signed) 的本地化字符串。
+        /// </summary>
+        public static string TbAllowInsecureCertFetch {
+            get {
+                return ResourceManager.GetString("TbAllowInsecureCertFetch", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Only for fetching self-signed certificates. This may expose you to MITM risks. 的本地化字符串。
+        /// </summary>
+        public static string TbAllowInsecureCertFetchTips {
+            get {
+                return ResourceManager.GetString("TbAllowInsecureCertFetchTips", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 ALPN 的本地化字符串。
        /// </summary>
@@ -2598,6 +2688,15 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Camouflage domain 的本地化字符串。
+        /// </summary>
+        public static string TbCamouflageDomain {
+            get {
+                return ResourceManager.GetString("TbCamouflageDomain", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Cancel 的本地化字符串。
        /// </summary>
@@ -2907,6 +3006,15 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Finalmask 的本地化字符串。
+        /// </summary>
+        public static string TbFinalmask {
+            get {
+                return ResourceManager.GetString("TbFinalmask", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Fingerprint 的本地化字符串。
        /// </summary>
@@ -2997,6 +3105,33 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Port hopping interval 的本地化字符串。
+        /// </summary>
+        public static string TbHopInt7 {
+            get {
+                return ResourceManager.GetString("TbHopInt7", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Host 的本地化字符串。
+        /// </summary>
+        public static string TbHost {
+            get {
+                return ResourceManager.GetString("TbHost", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 ICMP routing policy 的本地化字符串。
+        /// </summary>
+        public static string TbIcmpRoutingPolicy {
+            get {
+                return ResourceManager.GetString("TbIcmpRoutingPolicy", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 UUID(id) 的本地化字符串。
        /// </summary>
@@ -3033,6 +3168,15 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Insecure Concurrency 的本地化字符串。
+        /// </summary>
+        public static string TbInsecureConcurrency {
+            get {
+                return ResourceManager.GetString("TbInsecureConcurrency", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Most Stable 的本地化字符串。
        /// </summary>
@@ -3051,6 +3195,15 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Legacy TUN Protect 的本地化字符串。
+        /// </summary>
+        public static string TbLegacyProtect {
+            get {
+                return ResourceManager.GetString("TbLegacyProtect", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Address (IPv4, IPv6) 的本地化字符串。
        /// </summary>
@@ -3276,15 +3429,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 Camouflage domain(host) 的本地化字符串。
-        /// </summary>
-        public static string TbRequestHost {
-            get {
-                return ResourceManager.GetString("TbRequestHost", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 Reserved (2,3,4) 的本地化字符串。
        /// </summary>
@@ -3340,7 +3484,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 Process (Tun mode) 的本地化字符串。
+        ///   查找类似 Process (Linux/Windows) 的本地化字符串。
        /// </summary>
        public static string TbRoutingRuleProcess {
            get {
@@ -3655,7 +3799,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 This parameter is valid only for tcp/http and ws 的本地化字符串。
+        ///   查找类似 This parameter is valid only for raw/http, ws, gRPC and xhttp 的本地化字符串。
        /// </summary>
        public static string TbSettingsDefUserAgentTips {
            get {
@@ -3753,15 +3897,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 Enable additional Inbound 的本地化字符串。
-        /// </summary>
-        public static string TbSettingsEnableExInbound {
-            get {
-                return ResourceManager.GetString("TbSettingsEnableExInbound", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 Enable fragment 的本地化字符串。
        /// </summary>
@@ -3771,15 +3906,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 which conflicts with the group previous proxy 的本地化字符串。
-        /// </summary>
-        public static string TbSettingsEnableFragmentTips {
-            get {
-                return ResourceManager.GetString("TbSettingsEnableFragmentTips", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 Enable hardware acceleration (requires restart) 的本地化字符串。
        /// </summary>
@@ -3798,15 +3924,6 @@ namespace ServiceLib.Resx {
            }
        }
        
-        /// <summary>
-        ///   查找类似 Updating subscription, only determining if remarks exist 的本地化字符串。
-        /// </summary>
-        public static string TbSettingsEnableUpdateSubOnlyRemarksExist {
-            get {
-                return ResourceManager.GetString("TbSettingsEnableUpdateSubOnlyRemarksExist", resourceCulture);
-            }
-        }
-        
        /// <summary>
        ///   查找类似 Exception 的本地化字符串。
        /// </summary>
@@ -4068,6 +4185,24 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 Local outbound address (SendThrough) 的本地化字符串。
+        /// </summary>
+        public static string TbSettingsSendThrough {
+            get {
+                return ResourceManager.GetString("TbSettingsSendThrough", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 For multi-interface environments, enter the local machine&apos;s IPv4 address 的本地化字符串。
+        /// </summary>
+        public static string TbSettingsSendThroughTip {
+            get {
+                return ResourceManager.GetString("TbSettingsSendThroughTip", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Set Win10 UWP Loopback 的本地化字符串。
        /// </summary>
@@ -4446,6 +4581,24 @@ namespace ServiceLib.Resx {
            }
        }
        
+        /// <summary>
+        ///   查找类似 UDP over TCP 的本地化字符串。
+        /// </summary>
+        public static string TbUot {
+            get {
+                return ResourceManager.GetString("TbUot", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Username 的本地化字符串。
+        /// </summary>
+        public static string TbUsername {
+            get {
+                return ResourceManager.GetString("TbUsername", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   查找类似 Validate Regional Domain IPs 的本地化字符串。
        /// </summary>
@@ -4528,7 +4681,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 *Default value tcp 的本地化字符串。
+        ///   查找类似 *Default value raw 的本地化字符串。
        /// </summary>
        public static string TipNetwork {
            get {
@@ -4546,7 +4699,16 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 XHTTP Extra raw JSON, format: { XHTTP Object } 的本地化字符串。
+        ///   查找类似 XHTTP Extra 的本地化字符串。
+        /// </summary>
+        public static string TransportExtra {
+            get {
+                return ResourceManager.GetString("TransportExtra", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Raw JSON, format: { XHTTP Object } 的本地化字符串。
        /// </summary>
        public static string TransportExtraTip {
            get {
@@ -4555,47 +4717,47 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 *tcp camouflage type 的本地化字符串。
+        ///   查找类似 raw camouflage type 的本地化字符串。
        /// </summary>
-        public static string TransportHeaderTypeTip1 {
+        public static string TransportHeaderType1 {
            get {
-                return ResourceManager.GetString("TransportHeaderTypeTip1", resourceCulture);
+                return ResourceManager.GetString("TransportHeaderType1", resourceCulture);
            }
        }
        
        /// <summary>
-        ///   查找类似 *kcp camouflage type 的本地化字符串。
+        ///   查找类似 kcp camouflage type 的本地化字符串。
        /// </summary>
-        public static string TransportHeaderTypeTip2 {
+        public static string TransportHeaderType2 {
            get {
-                return ResourceManager.GetString("TransportHeaderTypeTip2", resourceCulture);
+                return ResourceManager.GetString("TransportHeaderType2", resourceCulture);
            }
        }
        
        /// <summary>
-        ///   查找类似 *QUIC camouflage type 的本地化字符串。
+        ///   查找类似 QUIC camouflage type 的本地化字符串。
        /// </summary>
-        public static string TransportHeaderTypeTip3 {
+        public static string TransportHeaderType3 {
            get {
-                return ResourceManager.GetString("TransportHeaderTypeTip3", resourceCulture);
+                return ResourceManager.GetString("TransportHeaderType3", resourceCulture);
            }
        }
        
        /// <summary>
-        ///   查找类似 *grpc mode 的本地化字符串。
+        ///   查找类似 gRPC mode 的本地化字符串。
        /// </summary>
-        public static string TransportHeaderTypeTip4 {
+        public static string TransportHeaderType4 {
            get {
-                return ResourceManager.GetString("TransportHeaderTypeTip4", resourceCulture);
+                return ResourceManager.GetString("TransportHeaderType4", resourceCulture);
            }
        }
        
        /// <summary>
-        ///   查找类似 *xhttp mode 的本地化字符串。
+        ///   查找类似 xhttp mode 的本地化字符串。
        /// </summary>
-        public static string TransportHeaderTypeTip5 {
+        public static string TransportHeaderType5 {
            get {
-                return ResourceManager.GetString("TransportHeaderTypeTip5", resourceCulture);
+                return ResourceManager.GetString("TransportHeaderType5", resourceCulture);
            }
        }
        
@@ -4627,7 +4789,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 *grpc service name 的本地化字符串。
+        ///   查找类似 gRPC service name 的本地化字符串。
        /// </summary>
        public static string TransportPathTip4 {
            get {
@@ -4681,7 +4843,7 @@ namespace ServiceLib.Resx {
        }
        
        /// <summary>
-        ///   查找类似 *grpc Authority 的本地化字符串。
+        ///   查找类似 gRPC Authority 的本地化字符串。
        /// </summary>
        public static string TransportRequestHostTip5 {
            get {
@@ -343,7 +343,7 @@
    <value>*QUIC key/Kcp seed</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*grpc serviceName</value>
+    <value>gRPC serviceName</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*هاست http جدا شده با کاما (،)</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*QUIC securty</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*tcp camouflage type</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>raw camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*kcp camouflage type</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>kcp camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*QUIC camouflage type</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>QUIC camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*حالت grpc</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>حالت grpc</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>نام مستعار (ملاحظات)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>Camouflage domain(host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>روش رمزگذاری (امنیتی)</value>
  </data>
@@ -619,7 +616,7 @@
    <value>TLS</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*مقدار پیش فرض tcp</value>
+    <value>*مقدار پیش فرض raw</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>نوع هسته</value>
@@ -937,7 +934,7 @@
    <value>User-Agent</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>این پارامتر فقط برای tcp/http و ws معتبر است</value>
+    <value>This parameter is valid only for raw/http, ws, gRPC and xhttp</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>FontFamily (نیاز به راه اندازی مجدد)</value>
@@ -1027,7 +1024,7 @@
    <value>پروتکل sing-box Mux</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>Process (Tun mode)</value>
+    <value>Process (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP or IP CIDR</value>
@@ -1071,9 +1068,6 @@
  <data name="TbSettingsTunMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>فعال سازی additional Inbound</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>فعال سازی آدرس IPv6</value>
  </data>
@@ -1101,21 +1095,15 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>آدرس اینترنتی تست پینگ سرعت</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>اشتراک در حال به‌روزرسانی، فقط مشخص کنید که ملاحظاتی آیا وجود دارد!</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>پایان تست...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*grpc Authority</value>
+    <value>RPC Authority</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
    <value>افزودن سرور [HTTP]</value>
  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>which conflicts with the group previous proxy</value>
-  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>فعال کردن فرگمنت</value>
  </data>
@@ -1329,11 +1317,11 @@
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>The password will be validated via the command line. If a validation error causes the application to malfunction, please restart the application. The password will not be stored and must be entered again after each restart.</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*حالت xhttp</value>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>حالت xhttp</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>جیسون خام XHTTP Extra, فرمت: { XHTTPObject }</value>
+    <value>Raw JSON, format: { XHTTP Object }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>هنگام بستن پنجره در سینی پنهان شوید</value>
@@ -1377,24 +1365,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>مخفی و پورت می شود، با کاما (،) جدا می شود</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>Generate Policy Group from Multiple Profiles</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>چند سرور تصادفی توسط Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>چند سرور RoundRobin توسط Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>چند سرور LeastPing توسط Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>چند سرور LeastLoad توسط Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>LeastPing چند سرور توسط sing-box</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>صادر کردن سرور</value>
  </data>
@@ -1539,44 +1509,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>Fallback</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>Multi-Configuration Fallback by sing-box</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>Core '{0}' does not support network type '{1}'</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>Multi-Configuration Fallback by Xray</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>Core '{0}' does not support network type '{1}'.</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}'</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'.</value>
+  <data name="MsgInvalidProperty" xml:space="preserve">
+    <value>The {0} property is invalid, please check</value>
  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}'.</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>Proxy chained: </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>Routing rule outbound: </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>Policy group: </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>Node alias '{0}' does not exist.</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>Group '{0}' is empty. Please add at least one node.</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
-    <value>The {0} property is invalid, please check.</value>
-  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>{0} Group cannot reference itself or have a circular reference</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>Not support protocol '{0}'.</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>Not support protocol '{0}'</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>If the system does not have a tray function, please do not enable it</value>
@@ -1665,4 +1611,106 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
    <value>If unset or "AsIs", DNS resolution is performed by the remote server's DNS; otherwise, the internal DNS module is used.</value>
  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>Port hopping interval</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>Configuration item preview</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} warning: {2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} error: {2}. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>Group {0} has a cycle dependency on child node {1}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>Group {0} child node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>Group {0} child node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>Group {0} child group node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>Group {0} child group node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>Group {0} has no valid child node.</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>Routing rule {0} has an empty outbound tag. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} not found. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>Subscription previous proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>Subscription next proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>Generate Policy Group</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>All configurations</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>Group by Region</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>کپی</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>انتخاب همه</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>Paste</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>Format</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>Add NaïveProxy</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>Insecure Concurrency</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>Username</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>ICMP routing policy</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>Legacy TUN Protect</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>For multi-interface environments, enter the local machine's IPv4 address</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>Camouflage domain</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>Allow insecure cert fetch (self-signed)</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
+  </data>
 </root>
@@ -343,7 +343,7 @@
    <value>*clé de chiffrement QUIC</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*nom de service gRPC</value>
+    <value>nom de service gRPC</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*hôte http, séparés par des virgules (,)</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*méthode de chiffrement QUIC</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*type de camouflage tcp</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>type de camouflage raw</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*type de camouflage kcp</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>type de camouflage kcp</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*type de camouflage QUIC</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>type de camouflage QUIC</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*mode gRPC</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>mode gRPC</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>Alias (remarks)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>Domaine de camouflage (host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>Méthode de chiffrement (security)</value>
  </data>
@@ -619,7 +616,7 @@
    <value>Sécurité couche transport (TLS)</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*tcp par défaut ; un mauvais choix bloque la connexion</value>
+    <value>*raw par défaut ; un mauvais choix bloque la connexion</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>Type de Core</value>
@@ -937,7 +934,7 @@
    <value>Agent utilisateur (User-Agent)</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>Valable uniquement pour les protocoles tcp/http et ws</value>
+    <value>This parameter is valid only for raw/http, ws, gRPC and xhttp</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>Police actuelle (redémarrage requis)</value>
@@ -1024,7 +1021,7 @@
    <value>Protocole de multiplexage Mux (sing-box)</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>Process (Tun mode)</value>
+    <value>Process (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP ou IP CIDR</value>
@@ -1068,9 +1065,6 @@
  <data name="TbSettingsTunMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>Activer un port d’écoute supplémentaire</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>Activer IPv6</value>
  </data>
@@ -1098,21 +1092,15 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>Adresse de test de connexion réelle</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>Ne vérifier l’existence de l’alias qu’à la maj. des abonnements</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>Arrêt du test en cours...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*Autorité gRPC</value>
+    <value>Autorité gRPC</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
    <value>Ajouter [HTTP]</value>
  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>En conflit avec le proxy amont de groupe</value>
-  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>Activer le fragmentation (Fragment)</value>
  </data>
@@ -1325,12 +1313,21 @@
  </data>
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>Le mot de passe sera vérifié en ligne de commande. En cas d’échec ou de dysfonctionnement, redémarrez l’application. Il n’est pas stocké et doit être saisi à chaque redémarrage.</value>
+    </data>
+  <data name="TbSettingsSendThrough" xml:space="preserve">
+    <value>Adresse sortante locale (SendThrough)</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*Mode XHTTP</value>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>Pour environnements multi-interfaces, entrez l'adresse IPv4 de la machine locale.</value>
+  </data>
+  <data name="FillCorrectSendThroughIPv4" xml:space="preserve">
+    <value>Veuillez saisir l’adresse IPv4 correcte de SendThrough.</value>
+  </data>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>Mode XHTTP</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>JSON brut XHTTP Extra, format : { XHTTPObject }</value>
+    <value>Raw JSON, format: { XHTTP Object }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>Masquer dans la barre d’état à la fermeture de la fenêtre</value>
@@ -1374,24 +1371,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>Écrase le port ; pour plusieurs groupes, séparer par virgules (,)</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>Générer un groupe de stratégie depuis plusieurs profils</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>Xray aléatoire (multi-sélection)</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>Xray équilibrage (tourniquet) multi-sélection</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>Xray latence minimale (multi-sélection)</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>Xray le plus stable (multi-sélection)</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>sing-box latence minimale (multi-sélection)</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>Exporter</value>
  </data>
@@ -1536,44 +1515,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>Basculement (failover)</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>sing-box basculement (multi-sélection)</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>Le cœur « {0} » ne prend pas en charge le type de réseau « {1} »</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>Xray basculement (multi-sélection)</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>Le cœur « {0} » ne prend pas en charge le protocole « {1} » avec le mode de transport « {2} »</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>Le cœur « {0} » ne prend pas en charge le type de réseau « {1} ».</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>Le cœur « {0} » ne prend pas en charge le protocole « {1} »</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>Le cœur « {0} » ne prend pas en charge le protocole « {1} » avec le mode de transport « {2} ».</value>
-  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>Le cœur « {0} » ne prend pas en charge le protocole « {1} ».</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>Chaîne de proxy : </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>Règle de routage sortante : </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>Groupe de stratégie : </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>L’alias « {0} » n’existe pas.</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>Le groupe « {0} » est vide. Veuillez ajouter au moins une configuration.</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
+  <data name="MsgInvalidProperty" xml:space="preserve">
    <value>La propriété {0} est invalide, veuillez vérifier</value>
  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>Le groupe {0} ne peut pas se référencer lui-même ni créer de référence circulaire</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>Protocole « {0} » non pris en charge.</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>Protocole « {0} » non pris en charge</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>Si le système n’a pas de zone de notif., n’activez pas cette option</value>
@@ -1639,27 +1594,126 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
    <value>EchForceQuery</value>
  </data>
  <data name="TbFullCertTips" xml:space="preserve">
-    <value>Full certificate (chain), PEM format</value>
+    <value>Certificat complet (chaîne), format PEM</value>
  </data>
  <data name="TbCertSha256Tips" xml:space="preserve">
-    <value>Certificate fingerprint (SHA-256)</value>
+    <value>Empreinte du certificat (SHA-256)</value>
  </data>
  <data name="TbServeStale" xml:space="preserve">
-    <value>Serve Stale</value>
+    <value>Cache optimiste</value>
  </data>
  <data name="TbParallelQuery" xml:space="preserve">
-    <value>Parallel Query</value>
+    <value>Requête parallèle</value>
  </data>
  <data name="TbDomesticDNSTips" xml:space="preserve">
-    <value>By default, invoked only during routing for resolution</value>
+    <value>Par défaut, utilisé uniquement lors du routage pour la résolution.</value>
  </data>
  <data name="TbRemoteDNSTips" xml:space="preserve">
-    <value>By default, invoked only during routing for resolution; ensure the remote server can reach this DNS</value>
+    <value>Par défaut, invoqué uniquement au routage pour la résolution. Vérifiez que le serveur distant peut joindre ce DNS.</value>
  </data>
  <data name="TbDirectResolveStrategyTips" xml:space="preserve">
-    <value>If unset or "AsIs", DNS resolution uses the system DNS; otherwise, the internal DNS module is used.</value>
+    <value>Si non défini ou « AsIs », le DNS système est utilisé ; sinon, le module DNS interne est utilisé.</value>
  </data>
  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
-    <value>If unset or "AsIs", DNS resolution is performed by the remote server's DNS; otherwise, the internal DNS module is used.</value>
+    <value>Si non défini ou « AsIs », la résolution DNS est assurée par le serveur distant ; sinon, le module DNS interne est utilisé.</value>
+  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>Intervalle de saut de port</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>Aperçu des sous-config</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>Règle de routage {0} nœud sortant {1} avertissement: {2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>Règle {0} nœud VPN sortant {1} erreur : {2}. Repli nœud proxy uniquement.</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>Le groupe {0} a une dépendance cyclique avec le nœud enfant {1}. Nœud ignoré.</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>Groupe {0} nœud enfant {1} avertissement : {2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>Groupe {0} nœud enfant {1} erreur : {2}. Nœud ignoré.</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>Groupe {0} nœud enfant groupe {1} avertissement: {2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>Groupe {0} nœud groupe enfant {1} erreur: {2}. Nœud ignoré.</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>Groupe {0} n’a aucun nœud enfant valide.</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>Règle de routage {0} tag sortant vide. Replié sur le nœud proxy uniquement.</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>Règle de routage {0} nœud sortant {1} introuvable. Repli sur le seul nœud proxy.</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>Nœud proxy précédent de l’abonnement {0} introuvable. Ignoré.</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>Nœud proxy suivant de l’abonnement {0} introuvable. Ignoré.</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>Générer groupe de stratégie</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>Toutes configurations</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>Grouper par région</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>Copier</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>Tout sélect</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>Coller</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>Format</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>Ajouter [NaïveProxy]</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>Insecure Concurrency</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>Nom d’utilisateur</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>Politique de routage ICMP</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>Protection TUN héritée</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>Domaine de camouflage</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>Allow insecure cert fetch (self-signed)</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
  </data>
 </root>
@@ -343,7 +343,7 @@
    <value>*QUIC kulcs/KCP seed</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*grpc szolgáltatásnév</value>
+    <value>gRPC szolgáltatásnév</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*http host vesszővel elválasztva (,)</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*QUIC biztonság</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*tcp álcázási típus</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>raw álcázási típus</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*kcp álcázási típus</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>kcp álcázási típus</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*QUIC álcázási típus</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>QUIC álcázási típus</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*grpc mód</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>gRPC mód</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>Alias (megjegyzések)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>Álcázási tartomány(host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>Titkosítási módszer (biztonság)</value>
  </data>
@@ -619,7 +616,7 @@
    <value>TLS</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*Alapértelmezett érték tcp</value>
+    <value>*Alapértelmezett érték raw</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>Core Típus</value>
@@ -937,7 +934,7 @@
    <value>User-Agent</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>Ez a paraméter csak tcp/http és ws esetén érvényes</value>
+    <value>This parameter is valid only for raw/http, ws, gRPC and xhttp</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>Betűtípus (újraindítást igényel)</value>
@@ -1027,7 +1024,7 @@
    <value>sing-box Mux protokoll</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>Process (Tun mode)</value>
+    <value>Process (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP vagy IP CIDR</value>
@@ -1071,9 +1068,6 @@
  <data name="TbSettingsTunMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>További bejövő engedélyezése</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>IPv6 cím engedélyezése</value>
  </data>
@@ -1101,21 +1095,15 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>Sebesség Ping Teszt URL</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>Előfizetés frissítése, csak a megjegyzések létezésének ellenőrzése</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>Teszt megszakítása...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*grpc Authority</value>
+    <value>gRPC Authority</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
    <value>HTTP konfiguráció hozzáadása</value>
  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>which conflicts with the group previous proxy</value>
-  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>Fragment engedélyezése</value>
  </data>
@@ -1329,11 +1317,11 @@
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>A jelszót a parancssoron keresztül ellenőrizzük. Ha egy érvényesítési hiba miatt az alkalmazás hibásan működik, indítsa újra az alkalmazást. A jelszó nem kerül tárolásra, és minden újraindítás után újra meg kell adni.</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*xhttp mód</value>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>xhttp mód</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>XHTTP Extra nyers JSON, formátum: { XHTTP Objektum }</value>
+    <value>Raw JSON, format: { XHTTP Object }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>Ablak bezárásakor a tálcára rejtés</value>
@@ -1377,24 +1365,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>A portot lefedi, vesszővel (,) elválasztva</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>Generate Policy Group from Multiple Profiles</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>Több konfiguráció véletlenszerűen Xray szerint</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>Több konfiguráció RoundRobin Xray szerint</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>Több konfiguráció legkisebb pinggel Xray szerint</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>Több konfiguráció legkisebb terheléssel Xray szerint</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>Több konfiguráció legkisebb pinggel sing-box szerint</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>Konfiguráció exportálása</value>
  </data>
@@ -1539,44 +1509,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>Fallback</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>Multi-Configuration Fallback by sing-box</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>Core '{0}' does not support network type '{1}'</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>Multi-Configuration Fallback by Xray</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>Core '{0}' does not support network type '{1}'.</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}'</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'.</value>
+  <data name="MsgInvalidProperty" xml:space="preserve">
+    <value>The {0} property is invalid, please check</value>
  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}'.</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>Proxy chained: </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>Routing rule outbound: </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>Policy group: </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>Node alias '{0}' does not exist.</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>Group '{0}' is empty. Please add at least one node.</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
-    <value>The {0} property is invalid, please check.</value>
-  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>{0} Group cannot reference itself or have a circular reference</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>Not support protocol '{0}'.</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>Not support protocol '{0}'</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>If the system does not have a tray function, please do not enable it</value>
@@ -1665,4 +1611,106 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
    <value>If unset or "AsIs", DNS resolution is performed by the remote server's DNS; otherwise, the internal DNS module is used.</value>
  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>Port hopping interval</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>Configuration item preview</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} warning: {2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} error: {2}. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>Group {0} has a cycle dependency on child node {1}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>Group {0} child node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>Group {0} child node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>Group {0} child group node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>Group {0} child group node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>Group {0} has no valid child node.</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>Routing rule {0} has an empty outbound tag. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} not found. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>Subscription previous proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>Subscription next proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>Generate Policy Group</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>All configurations</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>Group by Region</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>Másolás</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>Összes kijelölése</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>Paste</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>Format</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>[NaïveProxy] konfiguráció hozzáadása</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>Insecure Concurrency</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>Username</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>ICMP routing policy</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>Legacy TUN Protect</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>For multi-interface environments, enter the local machine's IPv4 address</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>Álcázási tartomány</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>Allow insecure cert fetch (self-signed)</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
+  </data>
 </root>
@@ -343,7 +343,7 @@
    <value>*QUIC key/KCP seed</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*grpc service name</value>
+    <value>gRPC service name</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*http host separated by commas (,)</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*QUIC security</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*tcp camouflage type</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>raw camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*kcp camouflage type</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>kcp camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*QUIC camouflage type</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>QUIC camouflage type</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*grpc mode</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>gRPC mode</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -514,19 +514,19 @@
    <value>Add a custom configuration</value>
  </data>
  <data name="menuAddShadowsocksServer" xml:space="preserve">
-    <value>Add [Shadowsocks] </value>
+    <value>Add [Shadowsocks]</value>
  </data>
  <data name="menuAddSocksServer" xml:space="preserve">
-    <value>Add [SOCKS] </value>
+    <value>Add [SOCKS]</value>
  </data>
  <data name="menuAddTrojanServer" xml:space="preserve">
-    <value>Add [Trojan] </value>
+    <value>Add [Trojan]</value>
  </data>
  <data name="menuAddVlessServer" xml:space="preserve">
-    <value>Add [VLESS] </value>
+    <value>Add [VLESS]</value>
  </data>
  <data name="menuAddVmessServer" xml:space="preserve">
-    <value>Add [VMess] </value>
+    <value>Add [VMess]</value>
  </data>
  <data name="menuSelectAll" xml:space="preserve">
    <value>Select all</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>Alias (remarks)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>Camouflage domain(host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>Encryption method (security)</value>
  </data>
@@ -619,7 +616,7 @@
    <value>TLS</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*Default value tcp</value>
+    <value>*Default value raw</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>Core Type</value>
@@ -937,7 +934,7 @@
    <value>User-Agent</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>This parameter is valid only for tcp/http and ws</value>
+    <value>This parameter is valid only for raw/http, ws, gRPC and xhttp</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>Font family (requires restart)</value>
@@ -1027,7 +1024,7 @@
    <value>sing-box Mux Protocol</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>Process (Tun mode)</value>
+    <value>Process (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP or IP CIDR</value>
@@ -1036,7 +1033,7 @@
    <value>Domain</value>
  </data>
  <data name="menuAddHysteria2Server" xml:space="preserve">
-    <value>Add [Hysteria2] </value>
+    <value>Add [Hysteria2]</value>
  </data>
  <data name="TbSettingsHysteriaBandwidth" xml:space="preserve">
    <value>Hysteria Max bandwidth (Up/Down)</value>
@@ -1045,7 +1042,7 @@
    <value>Use System Hosts</value>
  </data>
  <data name="menuAddTuicServer" xml:space="preserve">
-    <value>Add [TUIC] </value>
+    <value>Add [TUIC]</value>
  </data>
  <data name="TbHeaderType8" xml:space="preserve">
    <value>Congestion control</value>
@@ -1071,14 +1068,11 @@
  <data name="TbSettingsTunMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>Enable additional Inbound</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>Enable IPv6 Address</value>
  </data>
  <data name="menuAddWireguardServer" xml:space="preserve">
-    <value>Add [WireGuard] </value>
+    <value>Add [WireGuard]</value>
  </data>
  <data name="TbPrivateKey" xml:space="preserve">
    <value>Private Key</value>
@@ -1101,21 +1095,15 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>Speed Ping Test URL</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>Updating subscription, only determining if remarks exist</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>Test terminating...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*grpc Authority</value>
+    <value>gRPC Authority</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
    <value>Add [HTTP]</value>
  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>which conflicts with the group previous proxy</value>
-  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>Enable fragment</value>
  </data>
@@ -1329,11 +1317,20 @@
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>The password will be validated via the command line. If a validation error causes the application to malfunction, please restart the application. The password will not be stored and must be entered again after each restart.</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*xhttp mode</value>
+  <data name="TbSettingsSendThrough" xml:space="preserve">
+    <value>Local outbound address (SendThrough)</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>For multi-interface environments, enter the local machine's IPv4 address</value>
+  </data>
+  <data name="FillCorrectSendThroughIPv4" xml:space="preserve">
+    <value>Please fill in the correct IPv4 address for SendThrough.</value>
+  </data>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>xhttp mode</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>XHTTP Extra raw JSON, format: { XHTTP Object }</value>
+    <value>Raw JSON, format: { XHTTP Object }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>Hide to tray when closing the window</value>
@@ -1377,24 +1374,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>Will cover the port, separate with commas (,)</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>Generate Policy Group from Multiple Profiles</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>Random by Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>RoundRobin by Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>LeastPing by Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>LeastLoad by Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>LeastPing by sing-box</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>Export</value>
  </data>
@@ -1522,13 +1501,13 @@
    <value>Policy Group Type</value>
  </data>
  <data name="menuAddPolicyGroupServer" xml:space="preserve">
-    <value>Add Policy Group </value>
+    <value>Add Policy Group</value>
  </data>
  <data name="menuAddProxyChainServer" xml:space="preserve">
    <value>Add Proxy Chain</value>
  </data>
  <data name="menuAddChildServer" xml:space="preserve">
-    <value>Add Child </value>
+    <value>Add Child</value>
  </data>
  <data name="menuRemoveChildServer" xml:space="preserve">
    <value>Remove Child </value>
@@ -1539,44 +1518,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>Fallback</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>Fallback by sing-box</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>Core '{0}' does not support network type '{1}'</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>Fallback by Xray</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>Core '{0}' does not support network type '{1}'.</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>Core '{0}' does not support protocol '{1}'</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}' when using transport '{2}'.</value>
+  <data name="MsgInvalidProperty" xml:space="preserve">
+    <value>The {0} property is invalid, please check</value>
  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>Core '{0}' does not support protocol '{1}'.</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>Proxy chained: </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>Routing rule outbound: </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>Policy group: </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>Node alias '{0}' does not exist.</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>Group '{0}' is empty. Please add at least one node.</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
-    <value>The {0} property is invalid, please check.</value>
-  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>{0} Group cannot reference itself or have a circular reference</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>Not support protocol '{0}'.</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>Not support protocol '{0}'</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>If the system does not have a tray function, please do not enable it</value>
@@ -1665,4 +1620,103 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
    <value>If unset or "AsIs", DNS resolution is performed by the remote server's DNS; otherwise, the internal DNS module is used.</value>
  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>Port hopping interval</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>Configuration item preview</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} warning: {2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} error: {2}. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>Group {0} has a cycle dependency on child node {1}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>Group {0} child node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>Group {0} child node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>Group {0} child group node {1} warning: {2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>Group {0} child group node {1} error: {2}. Skipping this node.</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>Group {0} has no valid child node.</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>Routing rule {0} has an empty outbound tag. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>Routing rule {0} outbound node {1} not found. Fallback to proxy node only.</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>Subscription previous proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>Subscription next proxy {0} not found. Skipping.</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>Generate Policy Group</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>All configurations</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>Group by Region</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>Copy</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>Select all</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>Paste</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>Format</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>Add [NaïveProxy]</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>Insecure Concurrency</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>Username</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>ICMP routing policy</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>Legacy TUN Protect</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>Camouflage domain</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>Allow insecure cert fetch (self-signed)</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
+  </data>
 </root>
@@ -343,7 +343,7 @@
    <value>*QUIC 加密密钥</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*grpc serviceName</value>
+    <value>gRPC serviceName</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*http host 中间逗号 (,) 分隔</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*QUIC 加密方式</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*tcp 伪装类型</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>raw 伪装类型</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*kcp 伪装类型</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>kcp 伪装类型</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*QUIC 伪装类型</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>QUIC 伪装类型</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*grpc 模式</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>gRPC 模式</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -517,16 +517,16 @@
    <value>添加 [Shadowsocks]</value>
  </data>
  <data name="menuAddSocksServer" xml:space="preserve">
-    <value>添加 [SOCKS] </value>
+    <value>添加 [SOCKS]</value>
  </data>
  <data name="menuAddTrojanServer" xml:space="preserve">
-    <value>添加 [Trojan] </value>
+    <value>添加 [Trojan]</value>
  </data>
  <data name="menuAddVlessServer" xml:space="preserve">
-    <value>添加 [VLESS] </value>
+    <value>添加 [VLESS]</value>
  </data>
  <data name="menuAddVmessServer" xml:space="preserve">
-    <value>添加 [VMess] </value>
+    <value>添加 [VMess]</value>
  </data>
  <data name="menuSelectAll" xml:space="preserve">
    <value>全选</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>别名 (remarks)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>伪装域名 (host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>加密方式 (security)</value>
  </data>
@@ -619,7 +616,7 @@
    <value>传输层安全 (TLS)</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*默认 tcp，选错会无法连接</value>
+    <value>*默认 raw，选错会无法连接</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>Core 类型</value>
@@ -937,7 +934,7 @@
    <value>用户代理 (User-Agent)</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>仅对 tcp/http、ws 协议生效</value>
+    <value>仅对 raw/http、ws、gRPC、xhttp 生效</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>当前字体 (需重启)</value>
@@ -1024,7 +1021,7 @@
    <value>sing-box Mux 多路复用协议</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>进程 (Tun 模式)</value>
+    <value>进程 (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP 或 IP CIDR</value>
@@ -1033,7 +1030,7 @@
    <value>Domain</value>
  </data>
  <data name="menuAddHysteria2Server" xml:space="preserve">
-    <value>添加 [Hysteria2] </value>
+    <value>添加 [Hysteria2]</value>
  </data>
  <data name="TbSettingsHysteriaBandwidth" xml:space="preserve">
    <value>Hysteria 最大带宽 (Up/Dw)</value>
@@ -1042,7 +1039,7 @@
    <value>使用系统 hosts</value>
  </data>
  <data name="menuAddTuicServer" xml:space="preserve">
-    <value>添加 [TUIC] </value>
+    <value>添加 [TUIC]</value>
  </data>
  <data name="TbHeaderType8" xml:space="preserve">
    <value>拥塞控制算法</value>
@@ -1068,14 +1065,11 @@
  <data name="TbSettingsTunMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>启用额外监听端口</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>启用 IPv6</value>
  </data>
  <data name="menuAddWireguardServer" xml:space="preserve">
-    <value>添加 [WireGuard] </value>
+    <value>添加 [WireGuard]</value>
  </data>
  <data name="TbPrivateKey" xml:space="preserve">
    <value>PrivateKey</value>
@@ -1098,20 +1092,14 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>真连接测试地址</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>更新订阅时只判断别名已存在否</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>测试终止中...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*grpc Authority</value>
+    <value>gRPC Authority</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
-    <value>添加 [HTTP] </value>
-  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>和分组前置代理冲突</value>
+    <value>添加 [HTTP]</value>
  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>启用分片 (Fragment)</value>
@@ -1326,11 +1314,20 @@
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>密码将调用命令行校验，如果因为校验错误导致无法正常运行时，请重启本应用。 密码不会存储，每次重启后都需要再次输入。</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*XHTTP 模式</value>
+  <data name="TbSettingsSendThrough" xml:space="preserve">
+    <value>本地出站地址 (SendThrough)</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>用于多网口环境，请填写本机 IPv4 地址</value>
+  </data>
+  <data name="FillCorrectSendThroughIPv4" xml:space="preserve">
+    <value>请填写正确的 SendThrough IPv4 地址。</value>
+  </data>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>XHTTP 模式</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>XHTTP Extra 原始 JSON，格式： { XHTTPObject }</value>
+    <value>原始 JSON，格式： { XHTTPObject }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>关闭窗口时隐藏至托盘</value>
@@ -1374,24 +1371,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>会覆盖端口，多组时用逗号 (,) 隔开</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>多选生成策略组</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>多选随机 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>多选负载均衡 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>多选最低延迟 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>多选最稳定 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>多选最低延迟 sing-box</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>导出</value>
  </data>
@@ -1408,7 +1387,7 @@
    <value>Mldsa65Verify</value>
  </data>
  <data name="menuAddAnytlsServer" xml:space="preserve">
-    <value>添加 [Anytls] </value>
+    <value>添加 [Anytls]</value>
  </data>
  <data name="TbRemoteDNS" xml:space="preserve">
    <value>远程 DNS</value>
@@ -1536,44 +1515,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>故障转移</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>多选故障转移 sing-box</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>核心 '{0}' 不支持网络类型 '{1}'</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>多选故障转移 Xray</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>核心 '{0}' 在使用传输方式 '{2}' 时不支持协议 '{1}'</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>核心 '{0}' 不支持网络类型 '{1}'。</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>核心 '{0}' 不支持协议 '{1}'</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>核心 '{0}' 在使用传输方式 '{2}' 时不支持协议 '{1}'。</value>
+  <data name="MsgInvalidProperty" xml:space="preserve">
+    <value>{0} 属性无效，请检查</value>
  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>核心 '{0}' 不支持协议 '{1}'。</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>代理链： </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>路由规则出站： </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>策略组： </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>别名 '{0}' 不存在。</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>组“{0}”为空。请至少添加一个配置。</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
-    <value>{0}属性无效，请检查</value>
-  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>{0} 分组不能引用自身或循环引用</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>不支持协议 '{0}'。</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>不支持协议 '{0}'</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>如果系统没有托盘功能，请不要开启</value>
@@ -1662,4 +1617,103 @@
  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
    <value>当未选择或 "AsIs" 时，由远程服务器端 DNS 解析；否则，使用内部 DNS 模块解析。</value>
  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>端口跳跃间隔</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>子配置项预览</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>路由规则 {0} 出站节点 {1} 警告：{2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>路由规则 {0} 出站节点 {1} 错误：{2}。已回退为仅使用代理节点。</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>节点组 {0} 与子节点 {1} 存在循环依赖，已跳过该节点。</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>节点组 {0} 子节点 {1} 警告：{2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>节点组 {0} 子节点 {1} 错误：{2}。已跳过该节点。</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>节点组 {0} 子节点组 {1} 警告：{2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>节点组 {0} 子节点组 {1} 错误：{2}。已跳过该节点。</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>节点组 {0} 下没有有效的子节点。</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>路由规则 {0} 的出站标签为空，已回退为仅使用代理节点。</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>路由规则 {0} 的出站节点 {1} 未找到，已回退为仅使用代理节点。</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>订阅前置节点 {0} 未找到，已跳过。</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>订阅后置节点 {0} 未找到，已跳过。</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>一键生成策略组</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>全部配置项</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>按地区分组</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>复制</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>全选</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>粘贴</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>格式化</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>添加 [NaïveProxy]</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>不安全并发</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>用户名</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>ICMP 路由策略</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>旧版 TUN 保护</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>伪装域名</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>允许不安全获取证书（自签名）</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>仅用于抓取自签证书，存在中间人风险。</value>
+  </data>
 </root>
@@ -127,7 +127,7 @@
    <value>設定格式不正確</value>
  </data>
  <data name="CustomServerTips" xml:space="preserve">
-    <value>注意，自訂設定完全依賴您自己的設定，不能使用所有設定功能。如需使用系統代理請手動修改偵聽埠。</value>
+    <value>注意，自訂設定完全依賴您自行輸入的內容，部分功能可能無法使用。如需啟用系統代理，請手動調整監聽埠。</value>
  </data>
  <data name="Downloading" xml:space="preserve">
    <value>下載開始...</value>
@@ -139,7 +139,7 @@
    <value>生成預設設定檔失敗</value>
  </data>
  <data name="FailedGetDefaultConfiguration" xml:space="preserve">
-    <value>獲取預設設定失敗</value>
+    <value>取得預設設定失敗</value>
  </data>
  <data name="FailedImportedCustomServer" xml:space="preserve">
    <value>匯入自訂設定失敗</value>
@@ -148,7 +148,7 @@
    <value>讀取設定失敗</value>
  </data>
  <data name="FillCorrectServerPort" xml:space="preserve">
-    <value>請填寫正確格式的埠</value>
+    <value>請填寫有效的埠號</value>
  </data>
  <data name="FillLocalListeningPort" xml:space="preserve">
    <value>請填寫本機偵聽埠</value>
@@ -247,7 +247,7 @@
    <value>非 VMess 或 SS 協定</value>
  </data>
  <data name="NotFoundCore" xml:space="preserve">
-    <value>在資料夾 ({0}) 下未找到 Core 檔案 (檔案名: {1})，請下載後放入資料夾，下載網址: {2}</value>
+    <value>在資料夾 ({0}) 中找不到 Core 檔案（檔名：{1}）。請下載後放入該資料夾。下載網址：{2}</value>
  </data>
  <data name="NoValidQRcodeFound" xml:space="preserve">
    <value>掃描完成，未發現有效二維碼</value>
@@ -304,7 +304,7 @@
    <value>是否確定移除規則？</value>
  </data>
  <data name="RoutingRuleDetailRequiredTips" xml:space="preserve">
-    <value>{0}，必填其中一項.</value>
+    <value>{0}，至少需填寫其中一項。</value>
  </data>
  <data name="LvRemarks" xml:space="preserve">
    <value>別名</value>
@@ -343,7 +343,7 @@
    <value>*QUIC 加密金鑰</value>
  </data>
  <data name="TransportPathTip4" xml:space="preserve">
-    <value>*grpc serviceName</value>
+    <value>gRPC serviceName</value>
  </data>
  <data name="TransportRequestHostTip1" xml:space="preserve">
    <value>*http host 中間逗號 (,) 分隔</value>
@@ -357,17 +357,17 @@
  <data name="TransportRequestHostTip4" xml:space="preserve">
    <value>*QUIC 加密方式</value>
  </data>
-  <data name="TransportHeaderTypeTip1" xml:space="preserve">
-    <value>*TCP 偽裝類型</value>
+  <data name="TransportHeaderType1" xml:space="preserve">
+    <value>raw 偽裝類型</value>
  </data>
-  <data name="TransportHeaderTypeTip2" xml:space="preserve">
-    <value>*KCP 偽裝類型</value>
+  <data name="TransportHeaderType2" xml:space="preserve">
+    <value>KCP 偽裝類型</value>
  </data>
-  <data name="TransportHeaderTypeTip3" xml:space="preserve">
-    <value>*QUIC 偽裝類型</value>
+  <data name="TransportHeaderType3" xml:space="preserve">
+    <value>QUIC 偽裝類型</value>
  </data>
-  <data name="TransportHeaderTypeTip4" xml:space="preserve">
-    <value>*GRPC 模式</value>
+  <data name="TransportHeaderType4" xml:space="preserve">
+    <value>gRPC 模式</value>
  </data>
  <data name="LvTLS" xml:space="preserve">
    <value>TLS</value>
@@ -385,7 +385,7 @@
    <value>所有</value>
  </data>
  <data name="FillServerAddressCustom" xml:space="preserve">
-    <value>請瀏覽匯入設定</value>
+    <value>請選擇要匯入的設定檔</value>
  </data>
  <data name="Speedtesting" xml:space="preserve">
    <value>測試中...</value>
@@ -472,7 +472,7 @@
    <value>語言 (需重啟)</value>
  </data>
  <data name="menuAddServerViaClipboard" xml:space="preserve">
-    <value>從剪貼簿導入分享連結</value>
+    <value>從剪貼簿匯入分享連結</value>
  </data>
  <data name="menuAddServerViaScan" xml:space="preserve">
    <value>掃描螢幕上的二維碼</value>
@@ -606,9 +606,6 @@
  <data name="TbRemarks" xml:space="preserve">
    <value>別名 (remarks)</value>
  </data>
-  <data name="TbRequestHost" xml:space="preserve">
-    <value>偽裝域名 (host)</value>
-  </data>
  <data name="TbSecurity" xml:space="preserve">
    <value>加密方式 (security)</value>
  </data>
@@ -616,10 +613,10 @@
    <value>SNI</value>
  </data>
  <data name="TbStreamSecurity" xml:space="preserve">
-    <value>傳輸層安全 (TLS)</value>
+    <value>傳輸層安全性 (TLS)</value>
  </data>
  <data name="TipNetwork" xml:space="preserve">
-    <value>*預設 TCP，選錯會無法連接</value>
+    <value>*預設 raw，選錯會無法連線</value>
  </data>
  <data name="TbCoreType" xml:space="preserve">
    <value>Core 類型</value>
@@ -652,7 +649,7 @@
    <value>SOCKS 埠</value>
  </data>
  <data name="TipPreSocksPort" xml:space="preserve">
-    <value>*自訂設定的 Socks 埠值，可不設定；當設定此值後，將使用 Xray/sing-box (Tun) 額外啟動一個前置 Socks 服務，提供分流和速度顯示等功能</value>
+    <value>*自訂設定的 Socks 埠值，可留空；當設定此值後，將使用 Xray/sing-box (Tun) 額外啟動一個前置 Socks 服務，提供分流和速度顯示等功能</value>
  </data>
  <data name="TbBrowse" xml:space="preserve">
    <value>瀏覽</value>
@@ -937,7 +934,7 @@
    <value>使用者代理 (User-Agent)</value>
  </data>
  <data name="TbSettingsDefUserAgentTips" xml:space="preserve">
-    <value>僅對 TCP/HTTP、WS 協定生效</value>
+    <value>僅對 raw/HTTP、WS、gRPC、XHTTP 生效</value>
  </data>
  <data name="TbSettingsCurrentFontFamily" xml:space="preserve">
    <value>目前字型 (需重啟)</value>
@@ -1024,7 +1021,7 @@
    <value>sing-box Mux 多路復用協定</value>
  </data>
  <data name="TbRoutingRuleProcess" xml:space="preserve">
-    <value>行程 (Tun 模式)</value>
+    <value>行程 (Linux/Windows)</value>
  </data>
  <data name="TbRoutingRuleIP" xml:space="preserve">
    <value>IP 或 IP CIDR</value>
@@ -1068,9 +1065,6 @@
  <data name="TbSettingsTunMtu" xml:space="preserve">
    <value>MTU</value>
  </data>
-  <data name="TbSettingsEnableExInbound" xml:space="preserve">
-    <value>啟用額外偵聽連接埠</value>
-  </data>
  <data name="TbSettingsEnableIPv6Address" xml:space="preserve">
    <value>啟用 IPv6</value>
  </data>
@@ -1098,21 +1092,15 @@
  <data name="TbSettingsSpeedPingTestUrl" xml:space="preserve">
    <value>真連線測試位址</value>
  </data>
-  <data name="TbSettingsEnableUpdateSubOnlyRemarksExist" xml:space="preserve">
-    <value>更新訂閱時只判斷別名是否存在</value>
-  </data>
  <data name="SpeedtestingStop" xml:space="preserve">
    <value>測試終止中...</value>
  </data>
  <data name="TransportRequestHostTip5" xml:space="preserve">
-    <value>*grpc Authority</value>
+    <value>gRPC Authority</value>
  </data>
  <data name="menuAddHttpServer" xml:space="preserve">
    <value>新增 [HTTP] 節點</value>
  </data>
-  <data name="TbSettingsEnableFragmentTips" xml:space="preserve">
-    <value>和分組前置代理衝突</value>
-  </data>
  <data name="TbSettingsEnableFragment" xml:space="preserve">
    <value>啟用分片（Fragment）</value>
  </data>
@@ -1315,7 +1303,7 @@
    <value>安裝字體到系統中，選擇或填入字體名稱，重新啟動後生效</value>
  </data>
  <data name="menuExitTips" xml:space="preserve">
-    <value>是否確定退出？</value>
+    <value>確定要退出嗎？</value>
  </data>
  <data name="LvMemo" xml:space="preserve">
    <value>備註備忘</value>
@@ -1326,11 +1314,11 @@
  <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
    <value>密碼將調用命令行校驗，如果因為校驗錯誤導致無法正常運行時，請重啟本應用。密碼不會存儲，每次重啟後都需要再次輸入。</value>
  </data>
-  <data name="TransportHeaderTypeTip5" xml:space="preserve">
-    <value>*xhttp 模式</value>
+  <data name="TransportHeaderType5" xml:space="preserve">
+    <value>xhttp 模式</value>
  </data>
  <data name="TransportExtraTip" xml:space="preserve">
-    <value>XHTTP Extra 原始 JSON，格式： { XHTTPObject }</value>
+    <value>原始 JSON，格式： { XHTTPObject }</value>
  </data>
  <data name="TbSettingsHide2TrayWhenClose" xml:space="preserve">
    <value>關閉視窗時隱藏至托盤</value>
@@ -1374,24 +1362,6 @@
  <data name="TbPorts7Tips" xml:space="preserve">
    <value>會覆蓋埠，多組時用逗號 (,) 隔開</value>
  </data>
-  <data name="menuGenGroupMultipleServer" xml:space="preserve">
-    <value>多選生成策略組</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRandom" xml:space="preserve">
-    <value>多選隨機 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayRoundRobin" xml:space="preserve">
-    <value>多選負載平衡 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastPing" xml:space="preserve">
-    <value>多選最低延遲 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerXrayLeastLoad" xml:space="preserve">
-    <value>多選最穩定 Xray</value>
-  </data>
-  <data name="menuGenGroupMultipleServerSingBoxLeastPing" xml:space="preserve">
-    <value>多選最低延遲 sing-box</value>
-  </data>
  <data name="menuExportConfig" xml:space="preserve">
    <value>匯出</value>
  </data>
@@ -1519,13 +1489,13 @@
    <value>策略組類型</value>
  </data>
  <data name="menuAddPolicyGroupServer" xml:space="preserve">
-    <value>添加策略組</value>
+    <value>新增策略組</value>
  </data>
  <data name="menuAddProxyChainServer" xml:space="preserve">
-    <value>添加鏈式代理</value>
+    <value>新增鏈式代理</value>
  </data>
  <data name="menuAddChildServer" xml:space="preserve">
-    <value>添加子配置</value>
+    <value>新增子配置</value>
  </data>
  <data name="menuRemoveChildServer" xml:space="preserve">
    <value>刪除子配置</value>
@@ -1536,44 +1506,20 @@
  <data name="TbFallback" xml:space="preserve">
    <value>容錯移轉</value>
  </data>
-  <data name="menuGenGroupMultipleServerSingBoxFallback" xml:space="preserve">
-    <value>多選容錯移轉 sing-box</value>
+  <data name="MsgCoreNotSupportNetwork" xml:space="preserve">
+    <value>核心 '{0}' 不支援網路類型 '{1}'</value>
  </data>
-  <data name="menuGenGroupMultipleServerXrayFallback" xml:space="preserve">
-    <value>多選容錯移轉 Xray</value>
+  <data name="MsgCoreNotSupportProtocolTransport" xml:space="preserve">
+    <value>核心 '{0}' 在使用傳輸方式 '{2}' 時不支援協定 '{1}'</value>
  </data>
-  <data name="CoreNotSupportNetwork" xml:space="preserve">
-    <value>核心 '{0}' 不支援網路類型 '{1}'.</value>
+  <data name="MsgCoreNotSupportProtocol" xml:space="preserve">
+    <value>核心 '{0}' 不支援協定 '{1}'</value>
  </data>
-  <data name="CoreNotSupportProtocolTransport" xml:space="preserve">
-    <value>核心 '{0}' 在使用傳輸方式 '{2}' 時不支援協定 '{1}'.</value>
+  <data name="MsgInvalidProperty" xml:space="preserve">
+    <value>{0} 屬性無效，請檢查</value>
  </data>
-  <data name="CoreNotSupportProtocol" xml:space="preserve">
-    <value>核心 '{0}' 不支援協定 '{1}'.</value>
-  </data>
-  <data name="ProxyChainedPrefix" xml:space="preserve">
-    <value>代理鏈： </value>
-  </data>
-  <data name="RoutingRuleOutboundPrefix" xml:space="preserve">
-    <value>路由規則出站： </value>
-  </data>
-  <data name="PolicyGroupPrefix" xml:space="preserve">
-    <value>策略組： </value>
-  </data>
-  <data name="NodeTagNotExist" xml:space="preserve">
-    <value>別名 '{0}' 不存在。</value>
-  </data>
-  <data name="GroupEmpty" xml:space="preserve">
-    <value>組“{0}”為空.請至少添加一個配置。</value>
-  </data>
-  <data name="InvalidProperty" xml:space="preserve">
-    <value>{0}屬性無效，請檢查</value>
-  </data>
-  <data name="GroupSelfReference" xml:space="preserve">
-    <value>{0} 分組不能引用自身或循環引用</value>
-  </data>
-  <data name="NotSupportProtocol" xml:space="preserve">
-    <value>不支援協定 '{0}'.</value>
+  <data name="MsgNotSupportProtocol" xml:space="preserve">
+    <value>不支援協定 '{0}'</value>
  </data>
  <data name="TbSettingsHide2TrayWhenCloseTip" xml:space="preserve">
    <value>如果系統沒有託盤功能，請不要開啟</value>
@@ -1639,27 +1585,129 @@
    <value>EchForceQuery</value>
  </data>
  <data name="TbFullCertTips" xml:space="preserve">
-    <value>Full certificate (chain), PEM format</value>
+    <value>完整憑證（鏈），PEM 格式</value>
  </data>
  <data name="TbCertSha256Tips" xml:space="preserve">
-    <value>Certificate fingerprint (SHA-256)</value>
+    <value>憑證指紋（SHA-256）</value>
  </data>
  <data name="TbServeStale" xml:space="preserve">
-    <value>Serve Stale</value>
+    <value>提供過期快取（Serve Stale）</value>
  </data>
  <data name="TbParallelQuery" xml:space="preserve">
-    <value>Parallel Query</value>
+    <value>并行查詢</value>
  </data>
  <data name="TbDomesticDNSTips" xml:space="preserve">
-    <value>By default, invoked only during routing for resolution</value>
+    <value>預設僅在路由期間進行解析時調用</value>
  </data>
  <data name="TbRemoteDNSTips" xml:space="preserve">
-    <value>By default, invoked only during routing for resolution; ensure the remote server can reach this DNS</value>
+    <value>預設僅在路由期間進行解析時調用；請確保遠端伺服器能連線至此 DNS</value>
  </data>
  <data name="TbDirectResolveStrategyTips" xml:space="preserve">
-    <value>If unset or "AsIs", DNS resolution uses the system DNS; otherwise, the internal DNS module is used.</value>
+    <value>若未設定或為 "AsIs"，使用系統 DNS 解析；否則將使用內建 DNS 模組。</value>
  </data>
  <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
-    <value>If unset or "AsIs", DNS resolution is performed by the remote server's DNS; otherwise, the internal DNS module is used.</value>
+    <value>若未設定或為 "AsIs"，由遠端伺服器的 DNS 解析；否則將使用內建 DNS 模組。</value>
+  </data>
+  <data name="TbHopInt7" xml:space="preserve">
+    <value>連接埠跳轉間隔</value>
+  </data>
+  <data name="menuServerListPreview" xml:space="preserve">
+    <value>子配置項預覽</value>
+  </data>
+  <data name="TbFinalmask" xml:space="preserve">
+    <value>Finalmask</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeWarning" xml:space="preserve">
+    <value>路由規則 {0} 的出站節點 {1} 發出警告：{2}</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
+    <value>路由規則 {0} 的出站節點 {1} 發生錯誤：{2}。已回退為僅使用代理節點。</value>
+  </data>
+  <data name="MsgGroupCycleDependency" xml:space="preserve">
+    <value>節點組 {0} 與子節點 {1} 存在循環依賴。已跳過此節點。</value>
+  </data>
+  <data name="MsgGroupChildNodeWarning" xml:space="preserve">
+    <value>節點組 {0} 的子節點 {1} 發出警告：{2}</value>
+  </data>
+  <data name="MsgGroupChildNodeError" xml:space="preserve">
+    <value>節點組 {0} 的子節點 {1} 發生錯誤：{2}。已跳過此節點。</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
+    <value>節點組 {0} 的子節點組 {1} 發出警告：{2}</value>
+  </data>
+  <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
+    <value>節點組 {0} 的子節點組 {1} 發生錯誤：{2}。已跳過此節點。</value>
+  </data>
+  <data name="MsgGroupNoValidChildNode" xml:space="preserve">
+    <value>節點組 {0} 沒有可用的有效子節點。</value>
+  </data>
+  <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
+    <value>路由規則 {0} 的出站標籤為空。已回退為僅使用代理節點。</value>
+  </data>
+  <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
+    <value>找不到路由規則 {0} 的出站節點 {1}。已回退為僅使用代理節點。</value>
+  </data>
+  <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
+    <value>找不到訂閱的前一個代理 {0}。已跳過。</value>
+  </data>
+  <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
+    <value>找不到訂閱的下一個代理 {0}。已跳過。</value>
+  </data>
+  <data name="menuGenGroupServer" xml:space="preserve">
+    <value>生成策略組</value>
+  </data>
+  <data name="menuAllServers" xml:space="preserve">
+    <value>所有配置項</value>
+  </data>
+  <data name="menuGenRegionGroup" xml:space="preserve">
+    <value>按區域分組</value>
+  </data>
+  <data name="menuEditCopy" xml:space="preserve">
+    <value>複製</value>
+  </data>
+  <data name="menuEditSelectAll" xml:space="preserve">
+    <value>全選</value>
+  </data>
+  <data name="menuEditPaste" xml:space="preserve">
+    <value>貼上</value>
+  </data>
+  <data name="menuEditFormat" xml:space="preserve">
+    <value>格式化</value>
+  </data>
+  <data name="TbUot" xml:space="preserve">
+    <value>UDP over TCP</value>
+  </data>
+  <data name="menuAddNaiveServer" xml:space="preserve">
+    <value>新增 [NaïveProxy] 節點</value>
+  </data>
+  <data name="TbInsecureConcurrency" xml:space="preserve">
+    <value>不安全的並行處理</value>
+  </data>
+  <data name="TbUsername" xml:space="preserve">
+    <value>使用者名稱</value>
+  </data>
+  <data name="TbIcmpRoutingPolicy" xml:space="preserve">
+    <value>ICMP 路由策略</value>
+  </data>
+  <data name="TbLegacyProtect" xml:space="preserve">
+    <value>Legacy TUN Protect</value>
+  </data>
+  <data name="TbSettingsSendThroughTip" xml:space="preserve">
+    <value>For multi-interface environments, enter the local machine's IPv4 address</value>
+  </data>
+  <data name="TbCamouflageDomain" xml:space="preserve">
+    <value>偽裝域名</value>
+  </data>
+  <data name="TbHost" xml:space="preserve">
+    <value>Host</value>
+  </data>
+  <data name="TransportExtra" xml:space="preserve">
+    <value>XHTTP Extra</value>
+  </data>
+  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
+    <value>允許不安全獲取證書（自簽名）</value>
+  </data>
+  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
+    <value>僅用於抓取自簽證書，存在中間人風險。</value>
  </data>
 </root>
@@ -1,4 +1,4 @@
-{
+{
 	"log": {
 		"access": "Vaccess.log",
 		"error": "Verror.log",
@@ -6,34 +6,6 @@
 	},
 	"inbounds": [],
 	"outbounds": [
-		{
-			"tag": "proxy",
-			"protocol": "vmess",
-			"settings": {
-				"vnext": [{
-					"address": "",
-					"port": 0,
-					"users": [{
-						"id": "",
-						"security": "auto"
-					}]
-				}],
-				"servers": [{
-					"address": "",
-					"method": "",
-					"ota": false,
-					"password": "",
-					"port": 0,
-					"level": 1
-				}]
-			},
-			"streamSettings": {
-				"network": "tcp"
-			},
-			"mux": {
-				"enabled": false
-			}
-		},
 		{
 			"protocol": "freedom",
 			"tag": "direct"
@@ -0,0 +1,24 @@
+{
+  "tag": "tun",
+  "protocol": "tun",
+  "settings": {
+    "name": "xray_tun",
+    "MTU": 9000,
+    "gateway": [
+      "172.18.0.1/30",
+      "fdfe:dcba:9876::1/126"
+    ],
+    "autoSystemRoutingTable": [
+      "0.0.0.0/0",
+      "::/0"
+    ],
+    "autoOutboundsInterface": "auto"
+  },
+  "sniffing": {
+    "enabled": true,
+    "destOverride": [
+      "http",
+      "tls"
+    ]
+  }
+}
@@ -0,0 +1,14 @@
+[
+  {
+    "network": "udp",
+    "port": "135,137-139,5353",
+    "outboundTag": "block"
+  },
+  {
+    "ip": [
+      "224.0.0.0/3",
+      "ff00::/8"
+    ],
+    "outboundTag": "block"
+  }
+]
@@ -5,19 +5,12 @@
 	},
 	"inbounds": [],
 	"outbounds": [
-		{
-			"type": "vless",
-			"tag": "proxy",
-			"server": "",
-			"server_port": 443
-		},
 		{
 			"type": "direct",
 			"tag": "direct"
 		}
 	],
 	"route": {
-		"rules": [
-		]
+		"rules": []
 	}
 }
@@ -1,5 +1,24 @@
 #!/bin/bash

+trim() {
+    local -n ref=$1
+    ref="${ref#"${ref%%[![:space:]]*}"}"
+    ref="${ref%"${ref##*[![:space:]]}"}"
+}
+
+build_gsettings_array() {
+    [[ -z "$1" ]] && echo "[]" && return
+    local host joined hosts=()
+    IFS=',' read -ra parts <<< "$1"
+    for host in "${parts[@]}"; do
+        trim host
+        [[ -n "$host" ]] && hosts+=("$host")
+    done
+    [[ ${#hosts[@]} -eq 0 ]] && echo "[]" && return
+    printf -v joined "'%s'," "${hosts[@]}"
+    echo "[${joined%,}]"
+}
+
 # Function to set proxy for GNOME
 set_gnome_proxy() {
    local MODE=$1
@@ -21,7 +40,7 @@ set_gnome_proxy() {
        done

        # Set ignored hosts
-        gsettings set org.gnome.system.proxy ignore-hosts "['$IGNORE_HOSTS']"
+        gsettings set org.gnome.system.proxy ignore-hosts "$(build_gsettings_array "$IGNORE_HOSTS")"

        echo "GNOME: Manual proxy settings applied."
        echo "Proxy IP: $PROXY_IP"
@@ -38,6 +38,8 @@
 		<EmbeddedResource Include="Sample\SampleHttpResponse" />
 		<EmbeddedResource Include="Sample\SampleInbound" />
 		<EmbeddedResource Include="Sample\SampleOutbound" />
+		<EmbeddedResource Include="Sample\SampleTunInbound" />
+		<EmbeddedResource Include="Sample\SampleTunRules" />
 		<EmbeddedResource Include="Sample\SingboxSampleClientConfig" />
 		<EmbeddedResource Include="Sample\SingboxSampleOutbound" />
 		<EmbeddedResource Include="Sample\tun_singbox_dns" />
@@ -1,43 +1,34 @@
 namespace ServiceLib.Services.CoreConfig;

-public partial class CoreConfigSingboxService(Config config)
+public partial class CoreConfigSingboxService(CoreConfigContext context)
 {
-    private readonly Config _config = config;
    private static readonly string _tag = "CoreConfigSingboxService";
+    private readonly Config _config = context.AppConfig;
+    private readonly ProfileItem _node = context.Node;
+
+    private SingboxConfig _coreConfig = new();

    #region public gen function

-    public async Task<RetResult> GenerateClientConfigContent(ProfileItem node)
+    public RetResult GenerateClientConfigContent()
    {
        var ret = new RetResult();
        try
        {
-            if (node == null
-                || !node.IsValid())
+            if (_node == null
+                || !_node.IsValid())
            {
                ret.Msg = ResUI.CheckServerSettings;
                return ret;
            }
-            if (node.GetNetwork() is nameof(ETransport.kcp) or nameof(ETransport.xhttp))
+            if (_node.GetNetwork() is nameof(ETransport.kcp) or nameof(ETransport.xhttp))
            {
-                ret.Msg = ResUI.Incorrectconfiguration + $" - {node.GetNetwork()}";
+                ret.Msg = ResUI.Incorrectconfiguration + $" - {_node.GetNetwork()}";
                return ret;
            }

            ret.Msg = ResUI.InitialConfiguration;

-            if (node.ConfigType.IsGroupType())
-            {
-                switch (node.ConfigType)
-                {
-                    case EConfigType.PolicyGroup:
-                        return await GenerateClientMultipleLoadConfig(node);
-
-                    case EConfigType.ProxyChain:
-                        return await GenerateClientChainConfig(node);
-                }
-            }
-
            var result = EmbedUtils.GetEmbedText(Global.SingboxSampleClient);
            if (result.IsNullOrEmpty())
            {
@@ -45,44 +36,33 @@ public partial class CoreConfigSingboxService(Config config)
                return ret;
            }

-            var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result);
-            if (singboxConfig == null)
+            _coreConfig = JsonUtils.Deserialize<SingboxConfig>(result);
+            if (_coreConfig == null)
            {
                ret.Msg = ResUI.FailedGenDefaultConfiguration;
                return ret;
            }

-            await GenLog(singboxConfig);
+            GenLog();

-            await GenInbounds(singboxConfig);
+            GenInbounds();

-            if (node.ConfigType == EConfigType.WireGuard)
-            {
-                singboxConfig.outbounds.RemoveAt(0);
-                var endpoints = new Endpoints4Sbox();
-                await GenEndpoint(node, endpoints);
-                endpoints.tag = Global.ProxyTag;
-                singboxConfig.endpoints = new() { endpoints };
-            }
-            else
-            {
-                await GenOutbound(node, singboxConfig.outbounds.First());
-            }
+            GenOutbounds();

-            await GenMoreOutbounds(node, singboxConfig);
+            GenRouting();

-            await GenRouting(singboxConfig);
+            GenDns();

-            await GenDns(node, singboxConfig);
+            GenExperimental();

-            await GenExperimental(singboxConfig);
+            ConvertGeo2Ruleset();

-            await ConvertGeo2Ruleset(singboxConfig);
+            ApplyOutboundSendThrough();

            ret.Msg = string.Format(ResUI.SuccessfulConfiguration, "");
            ret.Success = true;

-            ret.Data = await ApplyFullConfigTemplate(singboxConfig);
+            ret.Data = ApplyFullConfigTemplate();
            return ret;
        }
        catch (Exception ex)
@@ -93,17 +73,11 @@ public partial class CoreConfigSingboxService(Config config)
        }
    }

-    public async Task<RetResult> GenerateClientSpeedtestConfig(List<ServerTestItem> selecteds)
+    public RetResult GenerateClientSpeedtestConfig(List<ServerTestItem> selecteds)
    {
        var ret = new RetResult();
        try
        {
-            if (_config == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
            ret.Msg = ResUI.InitialConfiguration;

            var result = EmbedUtils.GetEmbedText(Global.SingboxSampleClient);
@@ -114,44 +88,35 @@ public partial class CoreConfigSingboxService(Config config)
                return ret;
            }

-            var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result);
-            if (singboxConfig == null)
+            _coreConfig = JsonUtils.Deserialize<SingboxConfig>(result);
+            if (_coreConfig == null)
            {
                ret.Msg = ResUI.FailedGenDefaultConfiguration;
                return ret;
            }
-            List<IPEndPoint> lstIpEndPoints = new();
-            List<TcpConnectionInformation> lstTcpConns = new();
-            try
-            {
-                lstIpEndPoints.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpListeners());
-                lstIpEndPoints.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveUdpListeners());
-                lstTcpConns.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpConnections());
-            }
-            catch (Exception ex)
-            {
-                Logging.SaveLog(_tag, ex);
-            }

-            await GenLog(singboxConfig);
-            //GenDns(new(), singboxConfig);
-            singboxConfig.inbounds.Clear();
-            singboxConfig.outbounds.RemoveAt(0);
+            var (lstIpEndPoints, lstTcpConns) = Utils.GetActiveNetworkInfo();
+
+            GenLog();
+            GenMinimizedDns();
+            _coreConfig.inbounds.Clear();
+            _coreConfig.outbounds.RemoveAt(0);

            var initPort = AppManager.Instance.GetLocalPort(EInboundProtocol.speedtest);

            foreach (var it in selecteds)
            {
-                if (!Global.SingboxSupportConfigType.Contains(it.ConfigType))
+                if (!(Global.SingboxSupportConfigType.Contains(it.ConfigType) || it.ConfigType.IsGroupType()))
                {
                    continue;
                }
-                if (it.Port <= 0)
+                if (!it.ConfigType.IsComplexType() && it.Port <= 0)
                {
                    continue;
                }
-                var item = await AppManager.Instance.GetProfileItem(it.IndexId);
-                if (item is null || item.IsComplex() || !item.IsValid())
+                var actIndexId = context.ServerTestItemMap.GetValueOrDefault(it.IndexId, it.IndexId);
+                var item = context.AllProxiesMap.GetValueOrDefault(actIndexId);
+                if (item is null || item.ConfigType is EConfigType.Custom || !item.IsValid())
                {
                    continue;
                }
@@ -190,26 +155,11 @@ public partial class CoreConfigSingboxService(Config config)
                    type = EInboundProtocol.mixed.ToString(),
                };
                inbound.tag = inbound.type + inbound.listen_port.ToString();
-                singboxConfig.inbounds.Add(inbound);
+                _coreConfig.inbounds.Add(inbound);

-                //outbound
-                var server = await GenServer(item);
-                if (server is null)
-                {
-                    ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                    return ret;
-                }
                var tag = Global.ProxyTag + inbound.listen_port.ToString();
-                server.tag = tag;
-                if (server is Endpoints4Sbox endpoint)
-                {
-                    singboxConfig.endpoints ??= new();
-                    singboxConfig.endpoints.Add(endpoint);
-                }
-                else if (server is Outbound4Sbox outbound)
-                {
-                    singboxConfig.outbounds.Add(outbound);
-                }
+                var serverList = new CoreConfigSingboxService(context with { Node = item }).BuildAllProxyOutbounds(tag);
+                FillRangeProxy(serverList, _coreConfig, false);

                //rule
                Rule4Sbox rule = new()
@@ -217,25 +167,12 @@ public partial class CoreConfigSingboxService(Config config)
                    inbound = new List<string> { inbound.tag },
                    outbound = tag
                };
-                singboxConfig.route.rules.Add(rule);
+                _coreConfig.route.rules.Add(rule);
            }

-            var rawDNSItem = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
-            if (rawDNSItem != null && rawDNSItem.Enabled == true)
-            {
-                await GenDnsDomainsCompatible(singboxConfig, rawDNSItem);
-            }
-            else
-            {
-                await GenDnsDomains(singboxConfig, _config.SimpleDNSItem);
-            }
-            singboxConfig.route.default_domain_resolver = new()
-            {
-                server = Global.SingboxLocalDNSTag,
-            };
-
+            ApplyOutboundSendThrough();
            ret.Success = true;
-            ret.Data = JsonUtils.Serialize(singboxConfig);
+            ret.Data = JsonUtils.Serialize(_coreConfig);
            return ret;
        }
        catch (Exception ex)
@@ -246,20 +183,20 @@ public partial class CoreConfigSingboxService(Config config)
        }
    }

-    public async Task<RetResult> GenerateClientSpeedtestConfig(ProfileItem node, int port)
+    public RetResult GenerateClientSpeedtestConfig(int port)
    {
        var ret = new RetResult();
        try
        {
-            if (node == null
-                || !node.IsValid())
+            if (_node == null
+                || !_node.IsValid())
            {
                ret.Msg = ResUI.CheckServerSettings;
                return ret;
            }
-            if (node.GetNetwork() is nameof(ETransport.kcp) or nameof(ETransport.xhttp))
+            if (_node.GetNetwork() is nameof(ETransport.kcp) or nameof(ETransport.xhttp))
            {
-                ret.Msg = ResUI.Incorrectconfiguration + $" - {node.GetNetwork()}";
+                ret.Msg = ResUI.Incorrectconfiguration + $" - {_node.GetNetwork()}";
                return ret;
            }

@@ -272,249 +209,31 @@ public partial class CoreConfigSingboxService(Config config)
                return ret;
            }

-            var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result);
-            if (singboxConfig == null)
+            _coreConfig = JsonUtils.Deserialize<SingboxConfig>(result);
+            if (_coreConfig == null)
            {
                ret.Msg = ResUI.FailedGenDefaultConfiguration;
                return ret;
            }

-            await GenLog(singboxConfig);
-            if (node.ConfigType == EConfigType.WireGuard)
-            {
-                singboxConfig.outbounds.RemoveAt(0);
-                var endpoints = new Endpoints4Sbox();
-                await GenEndpoint(node, endpoints);
-                endpoints.tag = Global.ProxyTag;
-                singboxConfig.endpoints = new() { endpoints };
-            }
-            else
-            {
-                await GenOutbound(node, singboxConfig.outbounds.First());
-            }
-            await GenMoreOutbounds(node, singboxConfig);
-            var item = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
-            if (item != null && item.Enabled == true)
-            {
-                await GenDnsDomainsCompatible(singboxConfig, item);
-            }
-            else
-            {
-                await GenDnsDomains(singboxConfig, _config.SimpleDNSItem);
-            }
-            singboxConfig.route.default_domain_resolver = new()
-            {
-                server = Global.SingboxLocalDNSTag,
-            };
+            GenLog();
+            GenOutbounds();
+            GenMinimizedDns();

-            singboxConfig.route.rules.Clear();
-            singboxConfig.inbounds.Clear();
-            singboxConfig.inbounds.Add(new()
+            _coreConfig.route.rules.Clear();
+            _coreConfig.inbounds.Clear();
+            _coreConfig.inbounds.Add(new()
            {
                tag = $"{EInboundProtocol.mixed}{port}",
                listen = Global.Loopback,
                listen_port = port,
                type = EInboundProtocol.mixed.ToString(),
            });
+            ApplyOutboundSendThrough();

            ret.Msg = string.Format(ResUI.SuccessfulConfiguration, "");
            ret.Success = true;
-            ret.Data = JsonUtils.Serialize(singboxConfig);
-            return ret;
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-            ret.Msg = ResUI.FailedGenDefaultConfiguration;
-            return ret;
-        }
-    }
-
-    public async Task<RetResult> GenerateClientMultipleLoadConfig(ProfileItem parentNode)
-    {
-        var ret = new RetResult();
-        try
-        {
-            if (_config == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
-            ret.Msg = ResUI.InitialConfiguration;
-
-            var result = EmbedUtils.GetEmbedText(Global.SingboxSampleClient);
-            var txtOutbound = EmbedUtils.GetEmbedText(Global.SingboxSampleOutbound);
-            if (result.IsNullOrEmpty() || txtOutbound.IsNullOrEmpty())
-            {
-                ret.Msg = ResUI.FailedGetDefaultConfiguration;
-                return ret;
-            }
-
-            var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result);
-            if (singboxConfig == null)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-            singboxConfig.outbounds.RemoveAt(0);
-
-            await GenLog(singboxConfig);
-            await GenInbounds(singboxConfig);
-
-            var groupRet = await GenGroupOutbound(parentNode, singboxConfig);
-            if (groupRet != 0)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-
-            await GenRouting(singboxConfig);
-            await GenExperimental(singboxConfig);
-            await GenDns(parentNode, singboxConfig);
-            await ConvertGeo2Ruleset(singboxConfig);
-
-            ret.Success = true;
-
-            ret.Data = await ApplyFullConfigTemplate(singboxConfig);
-            return ret;
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-            ret.Msg = ResUI.FailedGenDefaultConfiguration;
-            return ret;
-        }
-    }
-
-    public async Task<RetResult> GenerateClientChainConfig(ProfileItem parentNode)
-    {
-        var ret = new RetResult();
-        try
-        {
-            if (_config == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
-            ret.Msg = ResUI.InitialConfiguration;
-
-            var result = EmbedUtils.GetEmbedText(Global.SingboxSampleClient);
-            var txtOutbound = EmbedUtils.GetEmbedText(Global.SingboxSampleOutbound);
-            if (result.IsNullOrEmpty() || txtOutbound.IsNullOrEmpty())
-            {
-                ret.Msg = ResUI.FailedGetDefaultConfiguration;
-                return ret;
-            }
-
-            var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result);
-            if (singboxConfig == null)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-            singboxConfig.outbounds.RemoveAt(0);
-
-            await GenLog(singboxConfig);
-            await GenInbounds(singboxConfig);
-
-            var groupRet = await GenGroupOutbound(parentNode, singboxConfig);
-            if (groupRet != 0)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-
-            await GenRouting(singboxConfig);
-            await GenExperimental(singboxConfig);
-            await GenDns(parentNode, singboxConfig);
-            await ConvertGeo2Ruleset(singboxConfig);
-
-            ret.Success = true;
-
-            ret.Data = await ApplyFullConfigTemplate(singboxConfig);
-            return ret;
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-            ret.Msg = ResUI.FailedGenDefaultConfiguration;
-            return ret;
-        }
-    }
-
-    public async Task<RetResult> GenerateClientCustomConfig(ProfileItem node, string? fileName)
-    {
-        var ret = new RetResult();
-        if (node == null || fileName is null)
-        {
-            ret.Msg = ResUI.CheckServerSettings;
-            return ret;
-        }
-
-        ret.Msg = ResUI.InitialConfiguration;
-
-        try
-        {
-            if (node == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
-            if (File.Exists(fileName))
-            {
-                File.Delete(fileName);
-            }
-
-            var addressFileName = node.Address;
-            if (addressFileName.IsNullOrEmpty())
-            {
-                ret.Msg = ResUI.FailedGetDefaultConfiguration;
-                return ret;
-            }
-            if (!File.Exists(addressFileName))
-            {
-                addressFileName = Path.Combine(Utils.GetConfigPath(), addressFileName);
-            }
-            if (!File.Exists(addressFileName))
-            {
-                ret.Msg = ResUI.FailedReadConfiguration + "1";
-                return ret;
-            }
-
-            if (node.Address == Global.CoreMultipleLoadConfigFileName)
-            {
-                var txtFile = File.ReadAllText(addressFileName);
-                var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(txtFile);
-                if (singboxConfig == null)
-                {
-                    File.Copy(addressFileName, fileName);
-                }
-                else
-                {
-                    await GenInbounds(singboxConfig);
-                    await GenExperimental(singboxConfig);
-
-                    var content = JsonUtils.Serialize(singboxConfig, true);
-                    await File.WriteAllTextAsync(fileName, content);
-                }
-            }
-            else
-            {
-                File.Copy(addressFileName, fileName);
-            }
-
-            //check again
-            if (!File.Exists(fileName))
-            {
-                ret.Msg = ResUI.FailedReadConfiguration + "2";
-                return ret;
-            }
-
-            ret.Msg = string.Format(ResUI.SuccessfulConfiguration, "");
-            ret.Success = true;
+            ret.Data = JsonUtils.Serialize(_coreConfig);
            return ret;
        }
        catch (Exception ex)
@@ -2,29 +2,29 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<string> ApplyFullConfigTemplate(SingboxConfig singboxConfig)
+    private string ApplyFullConfigTemplate()
    {
-        var fullConfigTemplate = await AppManager.Instance.GetFullConfigTemplateItem(ECoreType.sing_box);
-        if (fullConfigTemplate == null || !fullConfigTemplate.Enabled)
+        var fullConfigTemplate = context.FullConfigTemplate;
+        if (fullConfigTemplate is not { Enabled: true })
        {
-            return JsonUtils.Serialize(singboxConfig);
+            return JsonUtils.Serialize(_coreConfig);
        }

-        var fullConfigTemplateItem = _config.TunModeItem.EnableTun ? fullConfigTemplate.TunConfig : fullConfigTemplate.Config;
+        var fullConfigTemplateItem = context.IsTunEnabled ? fullConfigTemplate.TunConfig : fullConfigTemplate.Config;
        if (fullConfigTemplateItem.IsNullOrEmpty())
        {
-            return JsonUtils.Serialize(singboxConfig);
+            return JsonUtils.Serialize(_coreConfig);
        }

        var fullConfigTemplateNode = JsonNode.Parse(fullConfigTemplateItem);
        if (fullConfigTemplateNode == null)
        {
-            return JsonUtils.Serialize(singboxConfig);
+            return JsonUtils.Serialize(_coreConfig);
        }

        // Process outbounds
-        var customOutboundsNode = fullConfigTemplateNode["outbounds"] is JsonArray outbounds ? outbounds : new JsonArray();
-        foreach (var outbound in singboxConfig.outbounds)
+        var customOutboundsNode = fullConfigTemplateNode["outbounds"] is JsonArray outbounds ? outbounds : [];
+        foreach (var outbound in _coreConfig.outbounds)
        {
            if (outbound.type.ToLower() is "direct" or "block")
            {
@@ -42,10 +42,10 @@ public partial class CoreConfigSingboxService
        fullConfigTemplateNode["outbounds"] = customOutboundsNode;

        // Process endpoints
-        if (singboxConfig.endpoints != null && singboxConfig.endpoints.Count > 0)
+        if (_coreConfig.endpoints != null && _coreConfig.endpoints.Count > 0)
        {
-            var customEndpointsNode = fullConfigTemplateNode["endpoints"] is JsonArray endpoints ? endpoints : new JsonArray();
-            foreach (var endpoint in singboxConfig.endpoints)
+            var customEndpointsNode = fullConfigTemplateNode["endpoints"] is JsonArray endpoints ? endpoints : [];
+            foreach (var endpoint in _coreConfig.endpoints)
            {
                if (endpoint.detour.IsNullOrEmpty() && !fullConfigTemplate.ProxyDetour.IsNullOrEmpty())
                {
@@ -56,6 +56,42 @@ public partial class CoreConfigSingboxService
            fullConfigTemplateNode["endpoints"] = customEndpointsNode;
        }

-        return await Task.FromResult(JsonUtils.Serialize(fullConfigTemplateNode));
+        return JsonUtils.Serialize(fullConfigTemplateNode);
+    }
+
+    private void ApplyOutboundSendThrough()
+    {
+        var sendThrough = _config.CoreBasicItem.SendThrough?.TrimEx();
+        foreach (var outbound in _coreConfig.outbounds ?? [])
+        {
+            outbound.inet4_bind_address = ShouldApplySendThrough(outbound, sendThrough) ? sendThrough : null;
+        }
+    }
+
+    private static bool ShouldApplySendThrough(Outbound4Sbox outbound, string? sendThrough)
+    {
+        if (sendThrough.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        if (outbound.type is "direct" or "block" or "dns" or "selector" or "urltest")
+        {
+            return false;
+        }
+
+        if (!outbound.detour.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        var outboundAddress = outbound.server ?? string.Empty;
+
+        if (outboundAddress.Equals("localhost", StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        return !IPAddress.TryParse(outboundAddress, out var address) || !IPAddress.IsLoopback(address);
    }
 }
@@ -2,65 +2,68 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<int> GenDns(ProfileItem? node, SingboxConfig singboxConfig)
+    private void GenDns()
    {
        try
        {
-            var item = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
-            if (item != null && item.Enabled == true)
+            var item = context.RawDnsItem;
+            if (item is { Enabled: true })
            {
-                return await GenDnsCompatible(node, singboxConfig);
+                GenDnsCustom();
+                return;
            }

-            var simpleDNSItem = _config.SimpleDNSItem;
-            await GenDnsServers(node, singboxConfig, simpleDNSItem);
-            await GenDnsRules(node, singboxConfig, simpleDNSItem);
+            GenDnsServers();
+            GenDnsRules();

-            singboxConfig.dns ??= new Dns4Sbox();
-            singboxConfig.dns.independent_cache = true;
+            _coreConfig.dns ??= new Dns4Sbox();
+            _coreConfig.dns.independent_cache = true;

            // final dns
-            var routing = await ConfigHandler.GetDefaultRouting(_config);
+            var routing = context.RoutingItem;
            var useDirectDns = false;
            if (routing != null)
            {
                var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet) ?? [];

-                useDirectDns = rules?.LastOrDefault() is { } lastRule &&
-                                  lastRule.OutboundTag == Global.DirectTag &&
-                                  (lastRule.Port == "0-65535" ||
-                                   lastRule.Network == "tcp,udp" ||
-                                   lastRule.Ip?.Contains("0.0.0.0/0") == true);
+                if (rules?.LastOrDefault() is { } lastRule && lastRule.OutboundTag == Global.DirectTag)
+                {
+                    var noDomain = lastRule.Domain == null || lastRule.Domain.Count == 0;
+                    var noProcess = lastRule.Process == null || lastRule.Process.Count == 0;
+                    var isAnyIp = lastRule.Ip == null || lastRule.Ip.Count == 0 || lastRule.Ip.Contains("0.0.0.0/0");
+                    var isAnyPort = string.IsNullOrEmpty(lastRule.Port) || lastRule.Port == "0-65535";
+                    var isAnyNetwork = string.IsNullOrEmpty(lastRule.Network) || lastRule.Network == "tcp,udp";
+                    useDirectDns = noDomain && noProcess && isAnyIp && isAnyPort && isAnyNetwork;
+                }
            }
-            singboxConfig.dns.final = useDirectDns ? Global.SingboxDirectDNSTag : Global.SingboxRemoteDNSTag;
-            if ((!useDirectDns) && simpleDNSItem.FakeIP == true && simpleDNSItem.GlobalFakeIp == false)
+            _coreConfig.dns.final = useDirectDns ? Global.SingboxDirectDNSTag : Global.SingboxRemoteDNSTag;
+            var simpleDnsItem = context.SimpleDnsItem;
+            if ((!useDirectDns) && simpleDnsItem.FakeIP == true && simpleDnsItem.GlobalFakeIp == false)
            {
-                singboxConfig.dns.rules.Add(new()
+                _coreConfig.dns.rules.Add(new()
                {
                    server = Global.SingboxFakeDNSTag,
                    query_type = new List<int> { 1, 28 }, // A and AAAA
                    rewrite_ttl = 1,
                });
            }
-
-            await GenOutboundDnsRule(node, singboxConfig);
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return 0;
    }

-    private async Task<int> GenDnsServers(ProfileItem? node, SingboxConfig singboxConfig, SimpleDNSItem simpleDNSItem)
+    private void GenDnsServers()
    {
-        var finalDns = await GenDnsDomains(singboxConfig, simpleDNSItem);
+        var simpleDnsItem = context.SimpleDnsItem;
+        var finalDns = GenBootstrapDns();

-        var directDns = ParseDnsAddress(simpleDNSItem.DirectDNS);
+        var directDns = ParseDnsAddress(simpleDnsItem.DirectDNS ?? Global.DomainDirectDNSAddress.First());
        directDns.tag = Global.SingboxDirectDNSTag;
        directDns.domain_resolver = Global.SingboxLocalDNSTag;

-        var remoteDns = ParseDnsAddress(simpleDNSItem.RemoteDNS);
+        var remoteDns = ParseDnsAddress(simpleDnsItem.RemoteDNS ?? Global.DomainRemoteDNSAddress.First());
        remoteDns.tag = Global.SingboxRemoteDNSTag;
        remoteDns.detour = Global.ProxyTag;
        remoteDns.domain_resolver = Global.SingboxLocalDNSTag;
@@ -71,12 +74,12 @@ public partial class CoreConfigSingboxService
            type = "hosts",
            predefined = new(),
        };
-        if (simpleDNSItem.AddCommonHosts == true)
+        if (simpleDnsItem.AddCommonHosts == true)
        {
            hostsDns.predefined = Global.PredefinedHosts;
        }

-        if (simpleDNSItem.UseSystemHosts == true)
+        if (simpleDnsItem.UseSystemHosts == true)
        {
            var systemHosts = Utils.GetSystemHosts();
            if (systemHosts != null && systemHosts.Count > 0)
@@ -88,13 +91,24 @@ public partial class CoreConfigSingboxService
            }
        }

-        if (!simpleDNSItem.Hosts.IsNullOrEmpty())
+        foreach (var kvp in Utils.ParseHostsToDictionary(simpleDnsItem.Hosts))
        {
-            var userHostsMap = Utils.ParseHostsToDictionary(simpleDNSItem.Hosts);
-
-            foreach (var kvp in userHostsMap)
+            // only allow full match
+            // like example.com and full:example.com,
+            // but not domain:example.com, keyword:example.com or regex:example.com etc.
+            var testRule = new Rule4Sbox();
+            if (!ParseV2Domain(kvp.Key, testRule))
            {
-                hostsDns.predefined[kvp.Key] = kvp.Value;
+                continue;
+            }
+            if (testRule.domain_keyword?.Count > 0 && !kvp.Key.Contains(':'))
+            {
+                testRule.domain = testRule.domain_keyword;
+                testRule.domain_keyword = null;
+            }
+            if (testRule.domain?.Count == 1)
+            {
+                hostsDns.predefined[testRule.domain.First()] = kvp.Value.Where(Utils.IsIpAddress).ToList();
            }
        }

@@ -114,14 +128,14 @@ public partial class CoreConfigSingboxService
            }
        }

-        singboxConfig.dns ??= new Dns4Sbox();
-        singboxConfig.dns.servers ??= new List<Server4Sbox>();
-        singboxConfig.dns.servers.Add(remoteDns);
-        singboxConfig.dns.servers.Add(directDns);
-        singboxConfig.dns.servers.Add(hostsDns);
+        _coreConfig.dns ??= new Dns4Sbox();
+        _coreConfig.dns.servers ??= [];
+        _coreConfig.dns.servers.Add(remoteDns);
+        _coreConfig.dns.servers.Add(directDns);
+        _coreConfig.dns.servers.Add(hostsDns);

        // fake ip
-        if (simpleDNSItem.FakeIP == true)
+        if (simpleDnsItem.FakeIP == true)
        {
            var fakeip = new Server4Sbox
            {
@@ -130,103 +144,129 @@ public partial class CoreConfigSingboxService
                inet4_range = "198.18.0.0/15",
                inet6_range = "fc00::/18",
            };
-            singboxConfig.dns.servers.Add(fakeip);
+            _coreConfig.dns.servers.Add(fakeip);
        }
-
-        // ech
-        var (_, dnsServer) = ParseEchParam(node?.EchConfigList);
-        if (dnsServer is not null)
-        {
-            dnsServer.tag = Global.SingboxEchDNSTag;
-            if (dnsServer.server is not null
-                && hostsDns.predefined.ContainsKey(dnsServer.server))
-            {
-                dnsServer.domain_resolver = Global.SingboxHostsDNSTag;
-            }
-            else
-            {
-                dnsServer.domain_resolver = Global.SingboxLocalDNSTag;
-            }
-            singboxConfig.dns.servers.Add(dnsServer);
-        }
-        else if (node?.ConfigType.IsGroupType() == true)
-        {
-            var echDnsObject = JsonUtils.DeepCopy(directDns);
-            echDnsObject.tag = Global.SingboxEchDNSTag;
-            singboxConfig.dns.servers.Add(echDnsObject);
-        }
-
-        return await Task.FromResult(0);
    }

-    private async Task<Server4Sbox> GenDnsDomains(SingboxConfig singboxConfig, SimpleDNSItem? simpleDNSItem)
+    private Server4Sbox GenBootstrapDns()
    {
-        var finalDns = ParseDnsAddress(simpleDNSItem.BootstrapDNS);
+        var finalDns = ParseDnsAddress(context.SimpleDnsItem?.BootstrapDNS ?? Global.DomainPureIPDNSAddress.First());
        finalDns.tag = Global.SingboxLocalDNSTag;
-        singboxConfig.dns ??= new Dns4Sbox();
-        singboxConfig.dns.servers ??= new List<Server4Sbox>();
-        singboxConfig.dns.servers.Add(finalDns);
-        return await Task.FromResult(finalDns);
+        _coreConfig.dns ??= new Dns4Sbox();
+        _coreConfig.dns.servers ??= [];
+        _coreConfig.dns.servers.Add(finalDns);
+        return finalDns;
    }

-    private async Task<int> GenDnsRules(ProfileItem? node, SingboxConfig singboxConfig, SimpleDNSItem simpleDNSItem)
+    private void GenDnsRules()
    {
-        singboxConfig.dns ??= new Dns4Sbox();
-        singboxConfig.dns.rules ??= new List<Rule4Sbox>();
+        var simpleDnsItem = context.SimpleDnsItem;
+        _coreConfig.dns ??= new Dns4Sbox();
+        _coreConfig.dns.rules ??= [];

-        singboxConfig.dns.rules.AddRange(new[]
+        _coreConfig.dns.rules.Add(new() { ip_accept_any = true, server = Global.SingboxHostsDNSTag });
+
+        if (context.ProtectDomainList.Count > 0)
+        {
+            _coreConfig.dns.rules.Add(new()
+            {
+                server = Global.SingboxDirectDNSTag,
+                strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Freedom),
+                domain = context.ProtectDomainList.ToList(),
+            });
+        }
+
+        _coreConfig.dns.rules.AddRange(new[]
        {
-            new Rule4Sbox { ip_accept_any = true, server = Global.SingboxHostsDNSTag },
            new Rule4Sbox
            {
                server = Global.SingboxRemoteDNSTag,
-                strategy = Utils.DomainStrategy4Sbox(simpleDNSItem.Strategy4Proxy),
+                strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Proxy),
                clash_mode = ERuleMode.Global.ToString()
            },
            new Rule4Sbox
            {
                server = Global.SingboxDirectDNSTag,
-                strategy = Utils.DomainStrategy4Sbox(simpleDNSItem.Strategy4Freedom),
+                strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Freedom),
                clash_mode = ERuleMode.Direct.ToString()
            }
        });

-        var (ech, _) = ParseEchParam(node?.EchConfigList);
-        if (ech is not null)
+        foreach (var kvp in Utils.ParseHostsToDictionary(simpleDnsItem.Hosts))
        {
-            var echDomain = ech.query_server_name ?? node?.Sni;
-            singboxConfig.dns.rules.Add(new()
+            var predefined = kvp.Value.First();
+            if (predefined.IsNullOrEmpty())
            {
-                query_type = new List<int> { 64, 65 },
-                server = Global.SingboxEchDNSTag,
-                domain = echDomain is not null ? new List<string> { echDomain } : null,
-            });
-        }
-        else if (node?.ConfigType.IsGroupType() == true)
-        {
-            var queryServerNames = (await ProfileGroupItemManager.GetAllChildEchQuerySni(node.IndexId)).ToList();
-            if (queryServerNames.Count > 0)
-            {
-                singboxConfig.dns.rules.Add(new()
-                {
-                    query_type = new List<int> { 64, 65 },
-                    server = Global.SingboxEchDNSTag,
-                    domain = queryServerNames,
-                });
+                continue;
            }
+            var rule = new Rule4Sbox()
+            {
+                query_type = [1, 5, 28], // A, CNAME and AAAA
+                action = "predefined",
+                rcode = "NOERROR",
+            };
+            if (!ParseV2Domain(kvp.Key, rule))
+            {
+                continue;
+            }
+            // see: https://xtls.github.io/en/config/dns.html#dnsobject
+            // The matching format (domain:, full:, etc.) is the same as the domain
+            // in the commonly used Routing System. The difference is that without a prefix,
+            // it defaults to using the full: prefix (similar to the common hosts file syntax).
+            if (rule.domain_keyword?.Count > 0 && !kvp.Key.Contains(':'))
+            {
+                rule.domain = rule.domain_keyword;
+                rule.domain_keyword = null;
+            }
+            // example.com #0 -> example.com with NOERROR
+            if (predefined.StartsWith('#') && int.TryParse(predefined.AsSpan(1), out var rcode))
+            {
+                rule.rcode = rcode switch
+                {
+                    0 => "NOERROR",
+                    1 => "FORMERR",
+                    2 => "SERVFAIL",
+                    3 => "NXDOMAIN",
+                    4 => "NOTIMP",
+                    5 => "REFUSED",
+                    _ => "NOERROR",
+                };
+            }
+            else if (Utils.IsDomain(predefined))
+            {
+                // example.com CNAME target.com -> example.com with CNAME target.com
+                rule.answer = new List<string> { $"*. IN CNAME {predefined}." };
+            }
+            else if (Utils.IsIpAddress(predefined) && (rule.domain?.Count ?? 0) == 0)
+            {
+                // not full match, but an IP address, treat it as predefined answer
+                if (Utils.IsIpv6(predefined))
+                {
+                    rule.answer = new List<string> { $"*. IN AAAA {predefined}" };
+                }
+                else
+                {
+                    rule.answer = new List<string> { $"*. IN A {predefined}" };
+                }
+            }
+            else
+            {
+                continue;
+            }
+            _coreConfig.dns.rules.Add(rule);
        }

-        if (simpleDNSItem.BlockBindingQuery == true)
+        if (simpleDnsItem.BlockBindingQuery == true)
        {
-            singboxConfig.dns.rules.Add(new()
+            _coreConfig.dns.rules.Add(new()
            {
-                query_type = new List<int> { 64, 65 },
+                query_type = [64, 65],
                action = "predefined",
-                rcode = "NOTIMP"
+                rcode = "NOERROR"
            });
        }

-        if (simpleDNSItem.FakeIP == true && simpleDNSItem.GlobalFakeIp == true)
+        if (simpleDnsItem.FakeIP == true && simpleDnsItem.GlobalFakeIp == true)
        {
            var fakeipFilterRule = JsonUtils.Deserialize<Rule4Sbox>(EmbedUtils.GetEmbedText(Global.SingboxFakeIPFilterFileName));
            fakeipFilterRule.invert = true;
@@ -236,22 +276,23 @@ public partial class CoreConfigSingboxService
                type = "logical",
                mode = "and",
                rewrite_ttl = 1,
-                rules = new List<Rule4Sbox>
-                {
-                    new() {
-                        query_type = new List<int> { 1, 28 }, // A and AAAA
+                rules =
+                [
+                    new()
+                    {
+                        query_type = [1, 28], // A and AAAA
                    },
-                    fakeipFilterRule,
-                }
+                    fakeipFilterRule
+                ]
            };

-            singboxConfig.dns.rules.Add(rule4Fake);
+            _coreConfig.dns.rules.Add(rule4Fake);
        }

-        var routing = await ConfigHandler.GetDefaultRouting(_config);
+        var routing = context.RoutingItem;
        if (routing == null)
        {
-            return 0;
+            return;
        }

        var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet) ?? [];
@@ -259,9 +300,9 @@ public partial class CoreConfigSingboxService
        var expectedIPsRegions = new List<string>();
        var regionNames = new HashSet<string>();

-        if (!string.IsNullOrEmpty(simpleDNSItem?.DirectExpectedIPs))
+        if (!string.IsNullOrEmpty(simpleDnsItem?.DirectExpectedIPs))
        {
-            var ipItems = simpleDNSItem.DirectExpectedIPs
+            var ipItems = simpleDnsItem.DirectExpectedIPs
                .Split(new[] { ',', ';' }, StringSplitOptions.RemoveEmptyEntries)
                .Select(s => s.Trim())
                .Where(s => !string.IsNullOrEmpty(s))
@@ -309,7 +350,7 @@ public partial class CoreConfigSingboxService
            if (item.OutboundTag == Global.DirectTag)
            {
                rule.server = Global.SingboxDirectDNSTag;
-                rule.strategy = Utils.DomainStrategy4Sbox(simpleDNSItem.Strategy4Freedom);
+                rule.strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Freedom);

                if (expectedIPsRegions.Count > 0 && rule.geosite?.Count > 0)
                {
@@ -334,31 +375,46 @@ public partial class CoreConfigSingboxService
            }
            else
            {
-                if (simpleDNSItem.FakeIP == true && simpleDNSItem.GlobalFakeIp == false)
+                if (simpleDnsItem.FakeIP == true && simpleDnsItem.GlobalFakeIp == false)
                {
                    var rule4Fake = JsonUtils.DeepCopy(rule);
                    rule4Fake.server = Global.SingboxFakeDNSTag;
                    rule4Fake.query_type = new List<int> { 1, 28 }; // A and AAAA
                    rule4Fake.rewrite_ttl = 1;
-                    singboxConfig.dns.rules.Add(rule4Fake);
+                    _coreConfig.dns.rules.Add(rule4Fake);
                }
                rule.server = Global.SingboxRemoteDNSTag;
-                rule.strategy = Utils.DomainStrategy4Sbox(simpleDNSItem.Strategy4Proxy);
+                rule.strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Proxy);
            }

-            singboxConfig.dns.rules.Add(rule);
+            _coreConfig.dns.rules.Add(rule);
        }
-
-        return 0;
    }

-    private async Task<int> GenDnsCompatible(ProfileItem? node, SingboxConfig singboxConfig)
+    private void GenMinimizedDns()
+    {
+        GenDnsServers();
+        foreach (var server in _coreConfig.dns!.servers.Where(s => !string.IsNullOrEmpty(s.detour)).ToList())
+        {
+            _coreConfig.dns.servers.Remove(server);
+        }
+        _coreConfig.dns ??= new();
+        _coreConfig.dns.rules ??= [];
+        _coreConfig.dns.rules.Clear();
+        _coreConfig.dns.final = Global.SingboxDirectDNSTag;
+        _coreConfig.route.default_domain_resolver = new()
+        {
+            server = Global.SingboxDirectDNSTag,
+        };
+    }
+
+    private void GenDnsCustom()
    {
        try
        {
-            var item = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
+            var item = context.RawDnsItem;
            var strDNS = string.Empty;
-            if (_config.TunModeItem.EnableTun)
+            if (context.IsTunEnabled)
            {
                strDNS = string.IsNullOrEmpty(item?.TunDNS) ? EmbedUtils.GetEmbedText(Global.TunSingboxDNSFileName) : item?.TunDNS;
            }
@@ -370,61 +426,25 @@ public partial class CoreConfigSingboxService
            var dns4Sbox = JsonUtils.Deserialize<Dns4Sbox>(strDNS);
            if (dns4Sbox is null)
            {
-                return 0;
+                return;
            }
-            singboxConfig.dns = dns4Sbox;
-
-            if (dns4Sbox.servers != null && dns4Sbox.servers.Count > 0 && dns4Sbox.servers.First().address.IsNullOrEmpty())
-            {
-                await GenDnsDomainsCompatible(singboxConfig, item);
-            }
-            else
-            {
-                await GenDnsDomainsLegacyCompatible(singboxConfig, item);
-            }
-
-            await GenOutboundDnsRule(node, singboxConfig);
+            _coreConfig.dns = dns4Sbox;
+            GenDnsProtectCustom();
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return 0;
    }

-    private async Task<int> GenDnsDomainsCompatible(SingboxConfig singboxConfig, DNSItem? dnsItem)
+    private void GenDnsProtectCustom()
    {
-        var dns4Sbox = singboxConfig.dns ?? new();
+        var dnsItem = context.RawDnsItem;
+        var dns4Sbox = _coreConfig.dns ?? new();
        dns4Sbox.servers ??= [];
        dns4Sbox.rules ??= [];

        var tag = Global.SingboxLocalDNSTag;
-
-        var finalDnsAddress = string.IsNullOrEmpty(dnsItem?.DomainDNSAddress) ? Global.DomainPureIPDNSAddress.FirstOrDefault() : dnsItem?.DomainDNSAddress;
-
-        var localDnsServer = ParseDnsAddress(finalDnsAddress);
-        localDnsServer.tag = tag;
-
-        dns4Sbox.servers.Add(localDnsServer);
-
-        singboxConfig.dns = dns4Sbox;
-        return await Task.FromResult(0);
-    }
-
-    private async Task<int> GenDnsDomainsLegacyCompatible(SingboxConfig singboxConfig, DNSItem? dnsItem)
-    {
-        var dns4Sbox = singboxConfig.dns ?? new();
-        dns4Sbox.servers ??= [];
-        dns4Sbox.rules ??= [];
-
-        var tag = Global.SingboxLocalDNSTag;
-        dns4Sbox.servers.Add(new()
-        {
-            tag = tag,
-            address = string.IsNullOrEmpty(dnsItem?.DomainDNSAddress) ? Global.DomainPureIPDNSAddress.FirstOrDefault() : dnsItem?.DomainDNSAddress,
-            detour = Global.DirectTag,
-            strategy = string.IsNullOrEmpty(dnsItem?.DomainStrategy4Freedom) ? null : dnsItem?.DomainStrategy4Freedom,
-        });
        dns4Sbox.rules.Insert(0, new()
        {
            server = tag,
@@ -436,56 +456,32 @@ public partial class CoreConfigSingboxService
            clash_mode = ERuleMode.Global.ToString()
        });

-        var lstDomain = singboxConfig.outbounds
-                       .Where(t => t.server.IsNotEmpty() && Utils.IsDomain(t.server))
-                       .Select(t => t.server)
-                       .Distinct()
-                       .ToList();
-        if (lstDomain != null && lstDomain.Count > 0)
+        var finalDnsAddress = string.IsNullOrEmpty(dnsItem?.DomainDNSAddress) ? Global.DomainPureIPDNSAddress.FirstOrDefault() : dnsItem?.DomainDNSAddress;
+
+        var localDnsServer = ParseDnsAddress(finalDnsAddress);
+        localDnsServer.tag = tag;
+
+        dns4Sbox.servers.Add(localDnsServer);
+        var protectDomainRule = BuildProtectDomainRule();
+        if (protectDomainRule != null)
        {
-            dns4Sbox.rules.Insert(0, new()
-            {
-                server = tag,
-                domain = lstDomain
-            });
+            dns4Sbox.rules.Insert(0, protectDomainRule);
        }

-        singboxConfig.dns = dns4Sbox;
-        return await Task.FromResult(0);
+        _coreConfig.dns = dns4Sbox;
    }

-    private async Task<int> GenOutboundDnsRule(ProfileItem? node, SingboxConfig singboxConfig)
+    private Rule4Sbox? BuildProtectDomainRule()
    {
-        if (node == null)
+        if (context.ProtectDomainList.Count == 0)
        {
-            return 0;
+            return null;
        }
-
-        List<string> domain = new();
-        if (Utils.IsDomain(node.Address)) // normal outbound
-        {
-            domain.Add(node.Address);
-        }
-        if (node.Address == Global.Loopback && node.SpiderX.IsNotEmpty()) // Tun2SocksAddress
-        {
-            domain.AddRange(Utils.String2List(node.SpiderX)
-                .Where(Utils.IsDomain)
-                .Distinct()
-                .ToList());
-        }
-        if (domain.Count == 0)
-        {
-            return 0;
-        }
-
-        singboxConfig.dns.rules ??= new List<Rule4Sbox>();
-        singboxConfig.dns.rules.Insert(0, new Rule4Sbox
+        return new()
        {
            server = Global.SingboxLocalDNSTag,
-            domain = domain,
-        });
-
-        return await Task.FromResult(0);
+            domain = context.ProtectDomainList.ToList(),
+        };
    }

    private static Server4Sbox? ParseDnsAddress(string address)
@@ -2,15 +2,16 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<int> GenInbounds(SingboxConfig singboxConfig)
+    private void GenInbounds()
    {
        try
        {
            var listen = "0.0.0.0";
-            singboxConfig.inbounds = [];
+            var listenPort = AppManager.Instance.GetLocalPort(EInboundProtocol.socks);
+            _coreConfig.inbounds = [];

-            if (!_config.TunModeItem.EnableTun
-                || (_config.TunModeItem.EnableTun && _config.TunModeItem.EnableExInbound && AppManager.Instance.RunningCoreType == ECoreType.sing_box))
+            if (!context.IsTunEnabled
+                || (context.IsTunEnabled && _node.Address != Global.Loopback && _node.Port != listenPort))
            {
                var inbound = new Inbound4Sbox()
                {
@@ -18,23 +19,23 @@ public partial class CoreConfigSingboxService
                    tag = EInboundProtocol.socks.ToString(),
                    listen = Global.Loopback,
                };
-                singboxConfig.inbounds.Add(inbound);
+                _coreConfig.inbounds.Add(inbound);

-                inbound.listen_port = AppManager.Instance.GetLocalPort(EInboundProtocol.socks);
+                inbound.listen_port = listenPort;

                if (_config.Inbound.First().SecondLocalPortEnabled)
                {
-                    var inbound2 = GetInbound(inbound, EInboundProtocol.socks2, true);
-                    singboxConfig.inbounds.Add(inbound2);
+                    var inbound2 = BuildInbound(inbound, EInboundProtocol.socks2, true);
+                    _coreConfig.inbounds.Add(inbound2);
                }

                if (_config.Inbound.First().AllowLANConn)
                {
                    if (_config.Inbound.First().NewPort4LAN)
                    {
-                        var inbound3 = GetInbound(inbound, EInboundProtocol.socks3, true);
+                        var inbound3 = BuildInbound(inbound, EInboundProtocol.socks3, true);
                        inbound3.listen = listen;
-                        singboxConfig.inbounds.Add(inbound3);
+                        _coreConfig.inbounds.Add(inbound3);

                        //auth
                        if (_config.Inbound.First().User.IsNotEmpty() && _config.Inbound.First().Pass.IsNotEmpty())
@@ -49,7 +50,7 @@ public partial class CoreConfigSingboxService
                }
            }

-            if (_config.TunModeItem.EnableTun)
+            if (context.IsTunEnabled)
            {
                if (_config.TunModeItem.Mtu <= 0)
                {
@@ -71,17 +72,16 @@ public partial class CoreConfigSingboxService
                    tunInbound.address = ["172.18.0.1/30"];
                }

-                singboxConfig.inbounds.Add(tunInbound);
+                _coreConfig.inbounds.Add(tunInbound);
            }
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return await Task.FromResult(0);
    }

-    private Inbound4Sbox GetInbound(Inbound4Sbox inItem, EInboundProtocol protocol, bool bSocks)
+    private Inbound4Sbox BuildInbound(Inbound4Sbox inItem, EInboundProtocol protocol, bool bSocks)
    {
        var inbound = JsonUtils.DeepCopy(inItem);
        inbound.tag = protocol.ToString();
@@ -2,7 +2,7 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<int> GenLog(SingboxConfig singboxConfig)
+    private void GenLog()
    {
        try
        {
@@ -11,11 +11,11 @@ public partial class CoreConfigSingboxService
                case "debug":
                case "info":
                case "error":
-                    singboxConfig.log.level = _config.CoreBasicItem.Loglevel;
+                    _coreConfig.log.level = _config.CoreBasicItem.Loglevel;
                    break;

                case "warning":
-                    singboxConfig.log.level = "warn";
+                    _coreConfig.log.level = "warn";
                    break;

                default:
@@ -23,18 +23,17 @@ public partial class CoreConfigSingboxService
            }
            if (_config.CoreBasicItem.Loglevel == Global.None)
            {
-                singboxConfig.log.disabled = true;
+                _coreConfig.log.disabled = true;
            }
            if (_config.CoreBasicItem.LogEnabled)
            {
                var dtNow = DateTime.Now;
-                singboxConfig.log.output = Utils.GetLogPath($"sbox_{dtNow:yyyy-MM-dd}.txt");
+                _coreConfig.log.output = Utils.GetLogPath($"sbox_{dtNow:yyyy-MM-dd}.txt");
            }
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return await Task.FromResult(0);
    }
 }
@@ -2,121 +2,187 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<int> GenRouting(SingboxConfig singboxConfig)
+    private void GenRouting()
    {
        try
        {
-            singboxConfig.route.final = Global.ProxyTag;
-            var simpleDnsItem = _config.SimpleDNSItem;
+            _coreConfig.route.final = Global.ProxyTag;
+            var simpleDnsItem = context.SimpleDnsItem;

            var defaultDomainResolverTag = Global.SingboxDirectDNSTag;
            var directDnsStrategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Freedom);

-            var rawDNSItem = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
+            var rawDNSItem = context.RawDnsItem;
            if (rawDNSItem is { Enabled: true })
            {
                defaultDomainResolverTag = Global.SingboxLocalDNSTag;
                directDnsStrategy = rawDNSItem.DomainStrategy4Freedom.IsNullOrEmpty() ? null : rawDNSItem.DomainStrategy4Freedom;
            }
-            singboxConfig.route.default_domain_resolver = new()
+            _coreConfig.route.default_domain_resolver = new()
            {
                server = defaultDomainResolverTag,
                strategy = directDnsStrategy
            };

-            if (_config.TunModeItem.EnableTun)
+            if (context.IsTunEnabled)
            {
-                singboxConfig.route.auto_detect_interface = true;
+                _coreConfig.route.auto_detect_interface = true;

                var tunRules = JsonUtils.Deserialize<List<Rule4Sbox>>(EmbedUtils.GetEmbedText(Global.TunSingboxRulesFileName));
                if (tunRules != null)
                {
-                    singboxConfig.route.rules.AddRange(tunRules);
+                    _coreConfig.route.rules.AddRange(tunRules);
                }

-                GenRoutingDirectExe(out var lstDnsExe, out var lstDirectExe);
-                singboxConfig.route.rules.Add(new()
+                var (lstDnsExe, lstDirectExe) = BuildRoutingDirectExe();
+                _coreConfig.route.rules.Add(new()
                {
-                    port = new() { 53 },
+                    port = [53],
                    action = "hijack-dns",
                    process_name = lstDnsExe
                });

-                singboxConfig.route.rules.Add(new()
+                _coreConfig.route.rules.Add(new()
                {
                    outbound = Global.DirectTag,
                    process_name = lstDirectExe
                });
+
+                // ICMP Routing
+                var icmpRouting = _config.TunModeItem.IcmpRouting ?? "";
+                if (!Global.TunIcmpRoutingPolicies.Contains(icmpRouting))
+                {
+                    icmpRouting = Global.TunIcmpRoutingPolicies.First();
+                }
+                if (icmpRouting == "direct")
+                {
+                    _coreConfig.route.rules.Add(new()
+                    {
+                        network = ["icmp"],
+                        outbound = Global.DirectTag,
+                    });
+                }
+                else if (icmpRouting != "rule")
+                {
+                    var rejectMethod = icmpRouting switch
+                    {
+                        "unreachable" => "default",
+                        "drop" => "drop",
+                        _ => "reply",
+                    };
+                    _coreConfig.route.rules.Add(new()
+                    {
+                        network = ["icmp"],
+                        action = "reject",
+                        method = rejectMethod,
+                    });
+                }
            }

            if (_config.Inbound.First().SniffingEnabled)
            {
-                singboxConfig.route.rules.Add(new()
+                _coreConfig.route.rules.Add(new()
                {
                    action = "sniff"
                });
-                singboxConfig.route.rules.Add(new()
+                _coreConfig.route.rules.Add(new()
                {
-                    protocol = new() { "dns" },
+                    protocol = ["dns"],
                    action = "hijack-dns"
                });
            }
            else
            {
-                singboxConfig.route.rules.Add(new()
+                _coreConfig.route.rules.Add(new()
                {
-                    port = new() { 53 },
-                    network = new() { "udp" },
+                    port = [53],
                    action = "hijack-dns"
                });
            }

            var hostsDomains = new List<string>();
-            var dnsItem = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
-            if (dnsItem == null || !dnsItem.Enabled)
+            if (rawDNSItem is not { Enabled: true })
            {
-                if (!simpleDnsItem.Hosts.IsNullOrEmpty())
-                {
-                    var userHostsMap = Utils.ParseHostsToDictionary(simpleDnsItem.Hosts);
-                    foreach (var kvp in userHostsMap)
-                    {
-                        hostsDomains.Add(kvp.Key);
-                    }
-                }
+                var userHostsMap = Utils.ParseHostsToDictionary(simpleDnsItem.Hosts);
+                hostsDomains.AddRange(userHostsMap.Select(kvp => kvp.Key));
                if (simpleDnsItem.UseSystemHosts == true)
                {
                    var systemHostsMap = Utils.GetSystemHosts();
-                    foreach (var kvp in systemHostsMap)
-                    {
-                        hostsDomains.Add(kvp.Key);
-                    }
+                    hostsDomains.AddRange(systemHostsMap.Select(kvp => kvp.Key));
                }
            }
            if (hostsDomains.Count > 0)
            {
-                singboxConfig.route.rules.Add(new()
+                var hostsResolveRule = new Rule4Sbox
                {
                    action = "resolve",
-                    domain = hostsDomains,
-                });
+                };
+                var hostsCounter = 0;
+                foreach (var host in hostsDomains)
+                {
+                    var domainRule = new Rule4Sbox();
+                    if (!ParseV2Domain(host, domainRule))
+                    {
+                        continue;
+                    }
+                    if (domainRule.domain_keyword?.Count > 0 && !host.Contains(':'))
+                    {
+                        domainRule.domain = domainRule.domain_keyword;
+                        domainRule.domain_keyword = null;
+                    }
+                    if (domainRule.domain?.Count > 0)
+                    {
+                        hostsResolveRule.domain ??= [];
+                        hostsResolveRule.domain.AddRange(domainRule.domain);
+                        hostsCounter++;
+                    }
+                    else if (domainRule.domain_keyword?.Count > 0)
+                    {
+                        hostsResolveRule.domain_keyword ??= [];
+                        hostsResolveRule.domain_keyword.AddRange(domainRule.domain_keyword);
+                        hostsCounter++;
+                    }
+                    else if (domainRule.domain_suffix?.Count > 0)
+                    {
+                        hostsResolveRule.domain_suffix ??= [];
+                        hostsResolveRule.domain_suffix.AddRange(domainRule.domain_suffix);
+                        hostsCounter++;
+                    }
+                    else if (domainRule.domain_regex?.Count > 0)
+                    {
+                        hostsResolveRule.domain_regex ??= [];
+                        hostsResolveRule.domain_regex.AddRange(domainRule.domain_regex);
+                        hostsCounter++;
+                    }
+                    else if (domainRule.geosite?.Count > 0)
+                    {
+                        hostsResolveRule.geosite ??= [];
+                        hostsResolveRule.geosite.AddRange(domainRule.geosite);
+                        hostsCounter++;
+                    }
+                }
+                if (hostsCounter > 0)
+                {
+                    _coreConfig.route.rules.Add(hostsResolveRule);
+                }
            }

-            singboxConfig.route.rules.Add(new()
+            _coreConfig.route.rules.Add(new()
            {
                outbound = Global.DirectTag,
                clash_mode = ERuleMode.Direct.ToString()
            });
-            singboxConfig.route.rules.Add(new()
+            _coreConfig.route.rules.Add(new()
            {
                outbound = Global.ProxyTag,
                clash_mode = ERuleMode.Global.ToString()
            });

            var domainStrategy = _config.RoutingBasicItem.DomainStrategy4Singbox.NullIfEmpty();
-            var defaultRouting = await ConfigHandler.GetDefaultRouting(_config);
-            if (defaultRouting.DomainStrategy4Singbox.IsNotEmpty())
+            var routing = context.RoutingItem;
+            if (routing.DomainStrategy4Singbox.IsNotEmpty())
            {
-                domainStrategy = defaultRouting.DomainStrategy4Singbox;
+                domainStrategy = routing.DomainStrategy4Singbox;
            }
            var resolveRule = new Rule4Sbox
            {
@@ -125,10 +191,9 @@ public partial class CoreConfigSingboxService
            };
            if (_config.RoutingBasicItem.DomainStrategy == Global.IPOnDemand)
            {
-                singboxConfig.route.rules.Add(resolveRule);
+                _coreConfig.route.rules.Add(resolveRule);
            }

-            var routing = await ConfigHandler.GetDefaultRouting(_config);
            var ipRules = new List<RulesItem>();
            if (routing != null)
            {
@@ -145,7 +210,7 @@ public partial class CoreConfigSingboxService
                        continue;
                    }

-                    await GenRoutingUserRule(item1, singboxConfig);
+                    GenRoutingUserRule(item1);

                    if (item1.Ip?.Count > 0)
                    {
@@ -155,10 +220,10 @@ public partial class CoreConfigSingboxService
            }
            if (_config.RoutingBasicItem.DomainStrategy == Global.IPIfNonMatch)
            {
-                singboxConfig.route.rules.Add(resolveRule);
+                _coreConfig.route.rules.Add(resolveRule);
                foreach (var item2 in ipRules)
                {
-                    await GenRoutingUserRule(item2, singboxConfig);
+                    GenRoutingUserRule(item2);
                }
            }
        }
@@ -166,10 +231,9 @@ public partial class CoreConfigSingboxService
        {
            Logging.SaveLog(_tag, ex);
        }
-        return 0;
    }

-    private void GenRoutingDirectExe(out List<string> lstDnsExe, out List<string> lstDirectExe)
+    private static (List<string> lstDnsExe, List<string> lstDirectExe) BuildRoutingDirectExe()
    {
        var dnsExeSet = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
        var directExeSet = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
@@ -193,20 +257,22 @@ public partial class CoreConfigSingboxService
            }
        }

-        lstDnsExe = new List<string>(dnsExeSet);
-        lstDirectExe = new List<string>(directExeSet);
+        var lstDnsExe = new List<string>(dnsExeSet);
+        var lstDirectExe = new List<string>(directExeSet);
+
+        return (lstDnsExe, lstDirectExe);
    }

-    private async Task<int> GenRoutingUserRule(RulesItem item, SingboxConfig singboxConfig)
+    private void GenRoutingUserRule(RulesItem? item)
    {
        try
        {
            if (item == null)
            {
-                return 0;
+                return;
            }
-            item.OutboundTag = await GenRoutingUserRuleOutbound(item.OutboundTag, singboxConfig);
-            var rules = singboxConfig.route.rules;
+            item.OutboundTag = GenRoutingUserRuleOutbound(item.OutboundTag ?? Global.ProxyTag);
+            var rules = _coreConfig.route.rules;

            var rule = new Rule4Sbox();
            if (item.OutboundTag == "block")
@@ -277,7 +343,7 @@ public partial class CoreConfigSingboxService
                }
            }

-            if (_config.TunModeItem.EnableTun && item.Process?.Count > 0)
+            if (item.Process?.Count > 0)
            {
                var ruleProcName = JsonUtils.DeepCopy(rule3);
                ruleProcName.process_name ??= [];
@@ -304,11 +370,7 @@ public partial class CoreConfigSingboxService
                    }

                    // sing-box strictly matches the exe suffix on Windows
-                    var procName = process;
-                    if (Utils.IsWindows() && !procName.EndsWith(".exe", StringComparison.OrdinalIgnoreCase))
-                    {
-                        procName += ".exe";
-                    }
+                    var procName = Utils.GetExeName(process);

                    ruleProcName.process_name.Add(procName);
                }
@@ -336,10 +398,9 @@ public partial class CoreConfigSingboxService
        {
            Logging.SaveLog(_tag, ex);
        }
-        return await Task.FromResult(0);
    }

-    private bool ParseV2Domain(string domain, Rule4Sbox rule)
+    private static bool ParseV2Domain(string domain, Rule4Sbox rule)
    {
        if (domain.StartsWith('#') || domain.StartsWith("ext:") || domain.StartsWith("ext-domain:"))
        {
@@ -370,6 +431,11 @@ public partial class CoreConfigSingboxService
            rule.domain_keyword ??= [];
            rule.domain_keyword?.Add(domain.Substring(8));
        }
+        else if (domain.StartsWith("dotless:"))
+        {
+            rule.domain_keyword ??= [];
+            rule.domain_keyword?.Add(domain.Substring(8));
+        }
        else
        {
            rule.domain_keyword ??= [];
@@ -378,7 +444,7 @@ public partial class CoreConfigSingboxService
        return true;
    }

-    private bool ParseV2Address(string address, Rule4Sbox rule)
+    private static bool ParseV2Address(string address, Rule4Sbox rule)
    {
        if (address.StartsWith("ext:") || address.StartsWith("ext-ip:"))
        {
@@ -411,14 +477,14 @@ public partial class CoreConfigSingboxService
        return true;
    }

-    private async Task<string?> GenRoutingUserRuleOutbound(string outboundTag, SingboxConfig singboxConfig)
+    private string GenRoutingUserRuleOutbound(string outboundTag)
    {
        if (Global.OutboundTags.Contains(outboundTag))
        {
            return outboundTag;
        }

-        var node = await AppManager.Instance.GetProfileItemViaRemarks(outboundTag);
+        var node = context.AllProxiesMap.GetValueOrDefault($"remark:{outboundTag}");

        if (node == null
            || (!Global.SingboxSupportConfigType.Contains(node.ConfigType)
@@ -427,40 +493,16 @@ public partial class CoreConfigSingboxService
            return Global.ProxyTag;
        }

-        var tag = $"{node.IndexId}-{Global.ProxyTag}";
-        if (singboxConfig.outbounds.Any(o => o.tag == tag)
-            || (singboxConfig.endpoints != null && singboxConfig.endpoints.Any(e => e.tag == tag)))
+        var tag = $"{node.IndexId}-{Global.ProxyTag}-{node.Remarks}";
+        if (_coreConfig.outbounds.Any(o => o.tag.StartsWith(tag))
+            || (_coreConfig.endpoints != null && _coreConfig.endpoints.Any(e => e.tag.StartsWith(tag))))
        {
            return tag;
        }

-        if (node.ConfigType.IsGroupType())
-        {
-            var ret = await GenGroupOutbound(node, singboxConfig, tag);
-            if (ret == 0)
-            {
-                return tag;
-            }
-            return Global.ProxyTag;
-        }
+        var proxyOutbounds = new CoreConfigSingboxService(context with { Node = node, }).BuildAllProxyOutbounds(tag);
+        FillRangeProxy(proxyOutbounds, _coreConfig, false);

-        var server = await GenServer(node);
-        if (server is null)
-        {
-            return Global.ProxyTag;
-        }
-
-        server.tag = tag;
-        if (server is Endpoints4Sbox endpoint)
-        {
-            singboxConfig.endpoints ??= new();
-            singboxConfig.endpoints.Add(endpoint);
-        }
-        else if (server is Outbound4Sbox outbound)
-        {
-            singboxConfig.outbounds.Add(outbound);
-        }
-
-        return server.tag;
+        return tag;
    }
 }
@@ -2,7 +2,7 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<int> ConvertGeo2Ruleset(SingboxConfig singboxConfig)
+    private void ConvertGeo2Ruleset()
    {
        static void AddRuleSets(List<string> ruleSets, List<string>? rule_set)
        {
@@ -16,14 +16,14 @@ public partial class CoreConfigSingboxService
        var ruleSets = new List<string>();

        //convert route geosite & geoip to ruleset
-        foreach (var rule in singboxConfig.route.rules.Where(t => t.geosite?.Count > 0).ToList() ?? [])
+        foreach (var rule in _coreConfig.route.rules.Where(t => t.geosite?.Count > 0).ToList() ?? [])
        {
            rule.rule_set ??= new List<string>();
            rule.rule_set.AddRange(rule?.geosite?.Select(t => $"{geosite}-{t}").ToList());
            rule.geosite = null;
            AddRuleSets(ruleSets, rule.rule_set);
        }
-        foreach (var rule in singboxConfig.route.rules.Where(t => t.geoip?.Count > 0).ToList() ?? [])
+        foreach (var rule in _coreConfig.route.rules.Where(t => t.geoip?.Count > 0).ToList() ?? [])
        {
            rule.rule_set ??= new List<string>();
            rule.rule_set.AddRange(rule?.geoip?.Select(t => $"{geoip}-{t}").ToList());
@@ -32,24 +32,24 @@ public partial class CoreConfigSingboxService
        }

        //convert dns geosite & geoip to ruleset
-        foreach (var rule in singboxConfig.dns?.rules.Where(t => t.geosite?.Count > 0).ToList() ?? [])
+        foreach (var rule in _coreConfig.dns?.rules.Where(t => t.geosite?.Count > 0).ToList() ?? [])
        {
            rule.rule_set ??= new List<string>();
            rule.rule_set.AddRange(rule?.geosite?.Select(t => $"{geosite}-{t}").ToList());
            rule.geosite = null;
        }
-        foreach (var rule in singboxConfig.dns?.rules.Where(t => t.geoip?.Count > 0).ToList() ?? [])
+        foreach (var rule in _coreConfig.dns?.rules.Where(t => t.geoip?.Count > 0).ToList() ?? [])
        {
            rule.rule_set ??= new List<string>();
            rule.rule_set.AddRange(rule?.geoip?.Select(t => $"{geoip}-{t}").ToList());
            rule.geoip = null;
        }
-        foreach (var dnsRule in singboxConfig.dns?.rules.Where(t => t.rule_set?.Count > 0).ToList() ?? [])
+        foreach (var dnsRule in _coreConfig.dns?.rules.Where(t => t.rule_set?.Count > 0).ToList() ?? [])
        {
            AddRuleSets(ruleSets, dnsRule.rule_set);
        }
        //rules in rules
-        foreach (var item in singboxConfig.dns?.rules.Where(t => t.rules?.Count > 0).Select(t => t.rules).ToList() ?? [])
+        foreach (var item in _coreConfig.dns?.rules.Where(t => t.rules?.Count > 0).Select(t => t.rules).ToList() ?? [])
        {
            foreach (var item2 in item ?? [])
            {
@@ -60,7 +60,7 @@ public partial class CoreConfigSingboxService
        //load custom ruleset file
        List<Ruleset4Sbox> customRulesets = [];

-        var routing = await ConfigHandler.GetDefaultRouting(_config);
+        var routing = context.RoutingItem;
        if (routing.CustomRulesetPath4Singbox.IsNotEmpty())
        {
            var result = EmbedUtils.LoadResource(routing.CustomRulesetPath4Singbox);
@@ -78,7 +78,7 @@ public partial class CoreConfigSingboxService
        var localSrss = Utils.GetBinPath("srss");

        //Add ruleset srs
-        singboxConfig.route.rule_set = [];
+        _coreConfig.route.rule_set = [];
        foreach (var item in new HashSet<string>(ruleSets))
        {
            if (item.IsNullOrEmpty())
@@ -113,9 +113,7 @@ public partial class CoreConfigSingboxService
                    };
                }
            }
-            singboxConfig.route.rule_set.Add(customRuleset);
+            _coreConfig.route.rule_set.Add(customRuleset);
        }
-
-        return 0;
    }
 }
@@ -2,12 +2,12 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigSingboxService
 {
-    private async Task<int> GenExperimental(SingboxConfig singboxConfig)
+    private void GenExperimental()
    {
        //if (_config.guiItem.enableStatistics)
        {
-            singboxConfig.experimental ??= new Experimental4Sbox();
-            singboxConfig.experimental.clash_api = new Clash_Api4Sbox()
+            _coreConfig.experimental ??= new Experimental4Sbox();
+            _coreConfig.experimental.clash_api = new Clash_Api4Sbox()
            {
                external_controller = $"{Global.Loopback}:{AppManager.Instance.StatePort2}",
            };
@@ -15,15 +15,13 @@ public partial class CoreConfigSingboxService

        if (_config.CoreBasicItem.EnableCacheFile4Sbox)
        {
-            singboxConfig.experimental ??= new Experimental4Sbox();
-            singboxConfig.experimental.cache_file = new CacheFile4Sbox()
+            _coreConfig.experimental ??= new Experimental4Sbox();
+            _coreConfig.experimental.cache_file = new CacheFile4Sbox()
            {
                enabled = true,
                path = Utils.GetBinPath("cache.db"),
-                store_fakeip = _config.SimpleDNSItem.FakeIP == true
+                store_fakeip = context.SimpleDnsItem.FakeIP == true
            };
        }
-
-        return await Task.FromResult(0);
    }
 }
@@ -1,44 +1,35 @@
 namespace ServiceLib.Services.CoreConfig;

-public partial class CoreConfigV2rayService(Config config)
+public partial class CoreConfigV2rayService(CoreConfigContext context)
 {
-    private readonly Config _config = config;
    private static readonly string _tag = "CoreConfigV2rayService";
+    private readonly Config _config = context.AppConfig;
+    private readonly ProfileItem _node = context.Node;
+
+    private V2rayConfig _coreConfig = new();

    #region public gen function

-    public async Task<RetResult> GenerateClientConfigContent(ProfileItem node)
+    public RetResult GenerateClientConfigContent()
    {
        var ret = new RetResult();
        try
        {
-            if (node == null
-                || !node.IsValid())
+            if (_node == null
+                || !_node.IsValid())
            {
                ret.Msg = ResUI.CheckServerSettings;
                return ret;
            }

-            if (node.GetNetwork() is nameof(ETransport.quic))
+            if (_node.GetNetwork() is nameof(ETransport.quic))
            {
-                ret.Msg = ResUI.Incorrectconfiguration + $" - {node.GetNetwork()}";
+                ret.Msg = ResUI.Incorrectconfiguration + $" - {_node.GetNetwork()}";
                return ret;
            }

            ret.Msg = ResUI.InitialConfiguration;

-            if (node.ConfigType.IsGroupType())
-            {
-                switch (node.ConfigType)
-                {
-                    case EConfigType.PolicyGroup:
-                        return await GenerateClientMultipleLoadConfig(node);
-
-                    case EConfigType.ProxyChain:
-                        return await GenerateClientChainConfig(node);
-                }
-            }
-
            var result = EmbedUtils.GetEmbedText(Global.V2raySampleClient);
            if (result.IsNullOrEmpty())
            {
@@ -46,30 +37,40 @@ public partial class CoreConfigV2rayService(Config config)
                return ret;
            }

-            var v2rayConfig = JsonUtils.Deserialize<V2rayConfig>(result);
-            if (v2rayConfig == null)
+            _coreConfig = JsonUtils.Deserialize<V2rayConfig>(result);
+            if (_coreConfig == null)
            {
                ret.Msg = ResUI.FailedGenDefaultConfiguration;
                return ret;
            }

-            await GenLog(v2rayConfig);
+            GenLog();

-            await GenInbounds(v2rayConfig);
+            GenInbounds();

-            await GenOutbound(node, v2rayConfig.outbounds.First());
+            GenOutbounds();

-            await GenMoreOutbounds(node, v2rayConfig);
+            GenRouting();

-            await GenRouting(v2rayConfig);
+            GenDns();

-            await GenDns(node, v2rayConfig);
+            GenStatistic();

-            await GenStatistic(v2rayConfig);
+            if (_config.CoreBasicItem.EnableFragment)
+            {
+                ApplyOutboundFragment();
+            }
+            ApplyOutboundSendThrough();
+
+            var finalRule = BuildFinalRule();
+            if (!string.IsNullOrEmpty(finalRule?.balancerTag))
+            {
+                _coreConfig.routing.rules.Add(finalRule);
+            }

            ret.Msg = string.Format(ResUI.SuccessfulConfiguration, "");
            ret.Success = true;
-            ret.Data = await ApplyFullConfigTemplate(v2rayConfig);
+            ret.Data = ApplyFullConfigTemplate();
            return ret;
        }
        catch (Exception ex)
@@ -80,18 +81,11 @@ public partial class CoreConfigV2rayService(Config config)
        }
    }

-    public async Task<RetResult> GenerateClientMultipleLoadConfig(ProfileItem parentNode)
+    public RetResult GenerateClientSpeedtestConfig(List<ServerTestItem> selecteds)
    {
        var ret = new RetResult();
-
        try
        {
-            if (_config == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
            ret.Msg = ResUI.InitialConfiguration;

            var result = EmbedUtils.GetEmbedText(Global.V2raySampleClient);
@@ -102,208 +96,35 @@ public partial class CoreConfigV2rayService(Config config)
                return ret;
            }

-            var v2rayConfig = JsonUtils.Deserialize<V2rayConfig>(result);
-            if (v2rayConfig == null)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-            v2rayConfig.outbounds.RemoveAt(0);
-
-            await GenLog(v2rayConfig);
-            await GenInbounds(v2rayConfig);
-
-            var groupRet = await GenGroupOutbound(parentNode, v2rayConfig);
-            if (groupRet != 0)
+            _coreConfig = JsonUtils.Deserialize<V2rayConfig>(result);
+            if (_coreConfig == null)
            {
                ret.Msg = ResUI.FailedGenDefaultConfiguration;
                return ret;
            }

-            await GenRouting(v2rayConfig);
-            await GenDns(null, v2rayConfig);
-            await GenStatistic(v2rayConfig);
+            var (lstIpEndPoints, lstTcpConns) = Utils.GetActiveNetworkInfo();

-            var defaultBalancerTag = $"{Global.ProxyTag}{Global.BalancerTagSuffix}";
-
-            //add rule
-            var rules = v2rayConfig.routing.rules;
-            if (rules?.Count > 0 && ((v2rayConfig.routing.balancers?.Count ?? 0) > 0))
-            {
-                var balancerTagSet = v2rayConfig.routing.balancers
-                    .Select(b => b.tag)
-                    .ToHashSet();
-
-                foreach (var rule in rules)
-                {
-                    if (rule.outboundTag == null)
-                    {
-                        continue;
-                    }
-
-                    if (balancerTagSet.Contains(rule.outboundTag))
-                    {
-                        rule.balancerTag = rule.outboundTag;
-                        rule.outboundTag = null;
-                        continue;
-                    }
-
-                    var outboundWithSuffix = rule.outboundTag + Global.BalancerTagSuffix;
-                    if (balancerTagSet.Contains(outboundWithSuffix))
-                    {
-                        rule.balancerTag = outboundWithSuffix;
-                        rule.outboundTag = null;
-                    }
-                }
-            }
-            if (v2rayConfig.routing.domainStrategy == Global.IPIfNonMatch)
-            {
-                v2rayConfig.routing.rules.Add(new()
-                {
-                    ip = ["0.0.0.0/0", "::/0"],
-                    balancerTag = defaultBalancerTag,
-                    type = "field"
-                });
-            }
-            else
-            {
-                v2rayConfig.routing.rules.Add(new()
-                {
-                    network = "tcp,udp",
-                    balancerTag = defaultBalancerTag,
-                    type = "field"
-                });
-            }
-
-            ret.Success = true;
-
-            ret.Data = await ApplyFullConfigTemplate(v2rayConfig);
-            return ret;
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-            ret.Msg = ResUI.FailedGenDefaultConfiguration;
-            return ret;
-        }
-    }
-
-    public async Task<RetResult> GenerateClientChainConfig(ProfileItem parentNode)
-    {
-        var ret = new RetResult();
-
-        try
-        {
-            if (_config == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
-            ret.Msg = ResUI.InitialConfiguration;
-
-            var result = EmbedUtils.GetEmbedText(Global.V2raySampleClient);
-            var txtOutbound = EmbedUtils.GetEmbedText(Global.V2raySampleOutbound);
-            if (result.IsNullOrEmpty() || txtOutbound.IsNullOrEmpty())
-            {
-                ret.Msg = ResUI.FailedGetDefaultConfiguration;
-                return ret;
-            }
-
-            var v2rayConfig = JsonUtils.Deserialize<V2rayConfig>(result);
-            if (v2rayConfig == null)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-            v2rayConfig.outbounds.RemoveAt(0);
-
-            await GenLog(v2rayConfig);
-            await GenInbounds(v2rayConfig);
-
-            var groupRet = await GenGroupOutbound(parentNode, v2rayConfig);
-            if (groupRet != 0)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-
-            await GenRouting(v2rayConfig);
-            await GenDns(null, v2rayConfig);
-            await GenStatistic(v2rayConfig);
-
-            ret.Success = true;
-
-            ret.Data = await ApplyFullConfigTemplate(v2rayConfig);
-            return ret;
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-            ret.Msg = ResUI.FailedGenDefaultConfiguration;
-            return ret;
-        }
-    }
-
-    public async Task<RetResult> GenerateClientSpeedtestConfig(List<ServerTestItem> selecteds)
-    {
-        var ret = new RetResult();
-        try
-        {
-            if (_config == null)
-            {
-                ret.Msg = ResUI.CheckServerSettings;
-                return ret;
-            }
-
-            ret.Msg = ResUI.InitialConfiguration;
-
-            var result = EmbedUtils.GetEmbedText(Global.V2raySampleClient);
-            var txtOutbound = EmbedUtils.GetEmbedText(Global.V2raySampleOutbound);
-            if (result.IsNullOrEmpty() || txtOutbound.IsNullOrEmpty())
-            {
-                ret.Msg = ResUI.FailedGetDefaultConfiguration;
-                return ret;
-            }
-
-            var v2rayConfig = JsonUtils.Deserialize<V2rayConfig>(result);
-            if (v2rayConfig == null)
-            {
-                ret.Msg = ResUI.FailedGenDefaultConfiguration;
-                return ret;
-            }
-            List<IPEndPoint> lstIpEndPoints = new();
-            List<TcpConnectionInformation> lstTcpConns = new();
-            try
-            {
-                lstIpEndPoints.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpListeners());
-                lstIpEndPoints.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveUdpListeners());
-                lstTcpConns.AddRange(IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpConnections());
-            }
-            catch (Exception ex)
-            {
-                Logging.SaveLog(_tag, ex);
-            }
-
-            await GenLog(v2rayConfig);
-            v2rayConfig.inbounds.Clear();
-            v2rayConfig.outbounds.Clear();
-            v2rayConfig.routing.rules.Clear();
+            GenLog();
+            _coreConfig.inbounds.Clear();
+            _coreConfig.outbounds.Clear();
+            _coreConfig.routing.rules.Clear();

            var initPort = AppManager.Instance.GetLocalPort(EInboundProtocol.speedtest);

            foreach (var it in selecteds)
            {
-                if (!Global.XraySupportConfigType.Contains(it.ConfigType))
+                if (!(Global.XraySupportConfigType.Contains(it.ConfigType) || it.ConfigType.IsGroupType()))
                {
                    continue;
                }
-                if (it.Port <= 0)
+                if (!it.ConfigType.IsComplexType() && it.Port <= 0)
                {
                    continue;
                }
-                var item = await AppManager.Instance.GetProfileItem(it.IndexId);
-                if (item is null || item.IsComplex() || !item.IsValid())
+                var actIndexId = context.ServerTestItemMap.GetValueOrDefault(it.IndexId, it.IndexId);
+                var item = context.AllProxiesMap.GetValueOrDefault(actIndexId);
+                if (item is null || item.ConfigType is EConfigType.Custom || !item.IsValid())
                {
                    continue;
                }
@@ -342,27 +163,45 @@ public partial class CoreConfigV2rayService(Config config)
                    protocol = EInboundProtocol.mixed.ToString(),
                };
                inbound.tag = inbound.protocol + inbound.port.ToString();
-                v2rayConfig.inbounds.Add(inbound);
+                _coreConfig.inbounds.Add(inbound);

+                var tag = Global.ProxyTag + inbound.port.ToString();
+                var isBalancer = false;
                //outbound
-                var outbound = JsonUtils.Deserialize<Outbounds4Ray>(txtOutbound);
-                await GenOutbound(item, outbound);
-                outbound.tag = Global.ProxyTag + inbound.port.ToString();
-                v2rayConfig.outbounds.Add(outbound);
+                var proxyOutbounds =
+                    new CoreConfigV2rayService(context with { Node = item }).BuildAllProxyOutbounds(tag);
+                _coreConfig.outbounds.AddRange(proxyOutbounds);
+                if (proxyOutbounds.Count(n => n.tag.StartsWith(tag)) > 1)
+                {
+                    isBalancer = true;
+                    var multipleLoad = _node.GetProtocolExtra().MultipleLoad ?? EMultipleLoad.LeastPing;
+                    GenObservatory(multipleLoad, tag);
+                    GenBalancer(multipleLoad, tag);
+                }

                //rule
                RulesItem4Ray rule = new()
                {
-                    inboundTag = new List<string> { inbound.tag },
-                    outboundTag = outbound.tag,
+                    inboundTag = [inbound.tag],
+                    outboundTag = tag,
                    type = "field"
                };
-                v2rayConfig.routing.rules.Add(rule);
+                if (isBalancer)
+                {
+                    rule.balancerTag = tag + Global.BalancerTagSuffix;
+                    rule.outboundTag = null;
+                }
+                _coreConfig.routing.rules.Add(rule);
            }

+            if (_config.CoreBasicItem.EnableFragment)
+            {
+                ApplyOutboundFragment();
+            }
+            ApplyOutboundSendThrough();
            //ret.Msg =string.Format(ResUI.SuccessfulConfiguration"), node.getSummary());
            ret.Success = true;
-            ret.Data = JsonUtils.Serialize(v2rayConfig);
+            ret.Data = JsonUtils.Serialize(_coreConfig);
            return ret;
        }
        catch (Exception ex)
@@ -373,21 +212,21 @@ public partial class CoreConfigV2rayService(Config config)
        }
    }

-    public async Task<RetResult> GenerateClientSpeedtestConfig(ProfileItem node, int port)
+    public RetResult GenerateClientSpeedtestConfig(int port)
    {
        var ret = new RetResult();
        try
        {
-            if (node == null
-                || !node.IsValid())
+            if (_node == null
+                || !_node.IsValid())
            {
                ret.Msg = ResUI.CheckServerSettings;
                return ret;
            }

-            if (node.GetNetwork() is nameof(ETransport.quic))
+            if (_node.GetNetwork() is nameof(ETransport.quic))
            {
-                ret.Msg = ResUI.Incorrectconfiguration + $" - {node.GetNetwork()}";
+                ret.Msg = ResUI.Incorrectconfiguration + $" - {_node.GetNetwork()}";
                return ret;
            }

@@ -398,20 +237,20 @@ public partial class CoreConfigV2rayService(Config config)
                return ret;
            }

-            var v2rayConfig = JsonUtils.Deserialize<V2rayConfig>(result);
-            if (v2rayConfig == null)
+            _coreConfig = JsonUtils.Deserialize<V2rayConfig>(result);
+            if (_coreConfig == null)
            {
                ret.Msg = ResUI.FailedGenDefaultConfiguration;
                return ret;
            }

-            await GenLog(v2rayConfig);
-            await GenOutbound(node, v2rayConfig.outbounds.First());
-            await GenMoreOutbounds(node, v2rayConfig);
+            GenLog();
+            GenOutbounds();

-            v2rayConfig.routing.rules.Clear();
-            v2rayConfig.inbounds.Clear();
-            v2rayConfig.inbounds.Add(new()
+            _coreConfig.routing.domainStrategy = Global.AsIs;
+            _coreConfig.routing.rules.Clear();
+            _coreConfig.inbounds.Clear();
+            _coreConfig.inbounds.Add(new()
            {
                tag = $"{EInboundProtocol.socks}{port}",
                listen = Global.Loopback,
@@ -419,9 +258,17 @@ public partial class CoreConfigV2rayService(Config config)
                protocol = EInboundProtocol.mixed.ToString(),
            });

+            _coreConfig.routing.rules.Add(BuildFinalRule());
+
+            if (_config.CoreBasicItem.EnableFragment)
+            {
+                ApplyOutboundFragment();
+            }
+            ApplyOutboundSendThrough();
+
            ret.Msg = string.Format(ResUI.SuccessfulConfiguration, "");
            ret.Success = true;
-            ret.Data = JsonUtils.Serialize(v2rayConfig);
+            ret.Data = JsonUtils.Serialize(_coreConfig);
            return ret;
        }
        catch (Exception ex)
@@ -2,17 +2,17 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigV2rayService
 {
-    private async Task<int> GenObservatory(V2rayConfig v2rayConfig, EMultipleLoad multipleLoad, string baseTagName = Global.ProxyTag)
+    private void GenObservatory(EMultipleLoad multipleLoad, string baseTagName = Global.ProxyTag)
    {
        // Collect all existing subject selectors from both observatories
        var subjectSelectors = new List<string>();
-        subjectSelectors.AddRange(v2rayConfig.burstObservatory?.subjectSelector ?? []);
-        subjectSelectors.AddRange(v2rayConfig.observatory?.subjectSelector ?? []);
+        subjectSelectors.AddRange(_coreConfig.burstObservatory?.subjectSelector ?? []);
+        subjectSelectors.AddRange(_coreConfig.observatory?.subjectSelector ?? []);

        // Case 1: exact match already exists -> nothing to do
        if (subjectSelectors.Any(baseTagName.StartsWith))
        {
-            return await Task.FromResult(0);
+            return;
        }

        // Case 2: prefix match exists -> reuse it and move to the first position
@@ -21,28 +21,28 @@ public partial class CoreConfigV2rayService
        {
            baseTagName = matched;

-            if (v2rayConfig.burstObservatory?.subjectSelector?.Contains(baseTagName) == true)
+            if (_coreConfig.burstObservatory?.subjectSelector?.Contains(baseTagName) == true)
            {
-                v2rayConfig.burstObservatory.subjectSelector.Remove(baseTagName);
-                v2rayConfig.burstObservatory.subjectSelector.Insert(0, baseTagName);
+                _coreConfig.burstObservatory.subjectSelector.Remove(baseTagName);
+                _coreConfig.burstObservatory.subjectSelector.Insert(0, baseTagName);
            }

-            if (v2rayConfig.observatory?.subjectSelector?.Contains(baseTagName) == true)
+            if (_coreConfig.observatory?.subjectSelector?.Contains(baseTagName) == true)
            {
-                v2rayConfig.observatory.subjectSelector.Remove(baseTagName);
-                v2rayConfig.observatory.subjectSelector.Insert(0, baseTagName);
+                _coreConfig.observatory.subjectSelector.Remove(baseTagName);
+                _coreConfig.observatory.subjectSelector.Insert(0, baseTagName);
            }

-            return await Task.FromResult(0);
+            return;
        }

        // Case 3: need to create or insert based on multipleLoad type
        if (multipleLoad is EMultipleLoad.LeastLoad or EMultipleLoad.Fallback)
        {
-            if (v2rayConfig.burstObservatory is null)
+            if (_coreConfig.burstObservatory is null)
            {
                // Create new burst observatory with default ping config
-                v2rayConfig.burstObservatory = new BurstObservatory4Ray
+                _coreConfig.burstObservatory = new BurstObservatory4Ray
                {
                    subjectSelector = [baseTagName],
                    pingConfig = new()
@@ -56,16 +56,16 @@ public partial class CoreConfigV2rayService
            }
            else
            {
-                v2rayConfig.burstObservatory.subjectSelector ??= new();
-                v2rayConfig.burstObservatory.subjectSelector.Add(baseTagName);
+                _coreConfig.burstObservatory.subjectSelector ??= new();
+                _coreConfig.burstObservatory.subjectSelector.Add(baseTagName);
            }
        }
        else if (multipleLoad is EMultipleLoad.LeastPing)
        {
-            if (v2rayConfig.observatory is null)
+            if (_coreConfig.observatory is null)
            {
                // Create new observatory with default probe config
-                v2rayConfig.observatory = new Observatory4Ray
+                _coreConfig.observatory = new Observatory4Ray
                {
                    subjectSelector = [baseTagName],
                    probeUrl = AppManager.Instance.Config.SpeedTestItem.SpeedPingTestUrl,
@@ -75,15 +75,13 @@ public partial class CoreConfigV2rayService
            }
            else
            {
-                v2rayConfig.observatory.subjectSelector ??= new();
-                v2rayConfig.observatory.subjectSelector.Add(baseTagName);
+                _coreConfig.observatory.subjectSelector ??= new();
+                _coreConfig.observatory.subjectSelector.Add(baseTagName);
            }
        }
-
-        return await Task.FromResult(0);
    }

-    private async Task<string> GenBalancer(V2rayConfig v2rayConfig, EMultipleLoad multipleLoad, string selector = Global.ProxyTag)
+    private void GenBalancer(EMultipleLoad multipleLoad, string selector = Global.ProxyTag)
    {
        var strategyType = multipleLoad switch
        {
@@ -107,8 +105,7 @@ public partial class CoreConfigV2rayService
            },
            tag = balancerTag,
        };
-        v2rayConfig.routing.balancers ??= new();
-        v2rayConfig.routing.balancers.Add(balancer);
-        return await Task.FromResult(balancerTag);
+        _coreConfig.routing.balancers ??= new();
+        _coreConfig.routing.balancers.Add(balancer);
    }
 }
@@ -2,35 +2,45 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigV2rayService
 {
-    private async Task<string> ApplyFullConfigTemplate(V2rayConfig v2rayConfig)
+    private string ApplyFullConfigTemplate()
    {
-        var fullConfigTemplate = await AppManager.Instance.GetFullConfigTemplateItem(ECoreType.Xray);
-        if (fullConfigTemplate == null || !fullConfigTemplate.Enabled || fullConfigTemplate.Config.IsNullOrEmpty())
+        var fullConfigTemplate = context.FullConfigTemplate;
+        if (fullConfigTemplate is not { Enabled: true })
        {
-            return JsonUtils.Serialize(v2rayConfig);
+            return JsonUtils.Serialize(_coreConfig);
        }

-        var fullConfigTemplateNode = JsonNode.Parse(fullConfigTemplate.Config);
+        var fullConfigTemplateItem = context.IsTunEnabled ? fullConfigTemplate.TunConfig : fullConfigTemplate.Config;
+        if (fullConfigTemplateItem.IsNullOrEmpty())
+        {
+            return JsonUtils.Serialize(_coreConfig);
+        }
+
+        var fullConfigTemplateNode = JsonNode.Parse(fullConfigTemplateItem);
        if (fullConfigTemplateNode == null)
        {
-            return JsonUtils.Serialize(v2rayConfig);
+            return JsonUtils.Serialize(_coreConfig);
        }

        // Handle balancer and rules modifications (for multiple load scenarios)
-        if (v2rayConfig.routing?.balancers?.Count > 0)
+        if (_coreConfig.routing?.balancers?.Count > 0)
        {
-            var balancer = v2rayConfig.routing.balancers.First();
+            var balancer =
+                _coreConfig.routing.balancers.FirstOrDefault(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix, null);

            // Modify existing rules in custom config
-            var rulesNode = fullConfigTemplateNode["routing"]?["rules"];
-            if (rulesNode != null)
+            if (balancer != null)
            {
-                foreach (var rule in rulesNode.AsArray())
+                var rulesNode = fullConfigTemplateNode["routing"]?["rules"];
+                if (rulesNode != null)
                {
-                    if (rule["outboundTag"]?.GetValue<string>() == Global.ProxyTag)
+                    foreach (var rule in rulesNode.AsArray())
                    {
-                        rule.AsObject().Remove("outboundTag");
-                        rule["balancerTag"] = balancer.tag;
+                        if (rule["outboundTag"]?.GetValue<string>() == Global.ProxyTag)
+                        {
+                            rule.AsObject().Remove("outboundTag");
+                            rule["balancerTag"] = balancer.tag;
+                        }
                    }
                }
            }
@@ -44,7 +54,7 @@ public partial class CoreConfigV2rayService
            // Handle balancers - append instead of override
            if (fullConfigTemplateNode["routing"]["balancers"] is JsonArray customBalancersNode)
            {
-                if (JsonNode.Parse(JsonUtils.Serialize(v2rayConfig.routing.balancers)) is JsonArray newBalancers)
+                if (JsonNode.Parse(JsonUtils.Serialize(_coreConfig.routing.balancers)) is JsonArray newBalancers)
                {
                    foreach (var balancerNode in newBalancers)
                    {
@@ -54,33 +64,33 @@ public partial class CoreConfigV2rayService
            }
            else
            {
-                fullConfigTemplateNode["routing"]["balancers"] = JsonNode.Parse(JsonUtils.Serialize(v2rayConfig.routing.balancers));
+                fullConfigTemplateNode["routing"]["balancers"] = JsonNode.Parse(JsonUtils.Serialize(_coreConfig.routing.balancers));
            }
        }

-        if (v2rayConfig.observatory != null)
+        if (_coreConfig.observatory != null)
        {
            if (fullConfigTemplateNode["observatory"] == null)
            {
-                fullConfigTemplateNode["observatory"] = JsonNode.Parse(JsonUtils.Serialize(v2rayConfig.observatory));
+                fullConfigTemplateNode["observatory"] = JsonNode.Parse(JsonUtils.Serialize(_coreConfig.observatory));
            }
            else
            {
-                var subjectSelector = v2rayConfig.observatory.subjectSelector;
+                var subjectSelector = _coreConfig.observatory.subjectSelector;
                subjectSelector.AddRange(fullConfigTemplateNode["observatory"]?["subjectSelector"]?.AsArray()?.Select(x => x?.GetValue<string>()) ?? []);
                fullConfigTemplateNode["observatory"]["subjectSelector"] = JsonNode.Parse(JsonUtils.Serialize(subjectSelector.Distinct().ToList()));
            }
        }

-        if (v2rayConfig.burstObservatory != null)
+        if (_coreConfig.burstObservatory != null)
        {
            if (fullConfigTemplateNode["burstObservatory"] == null)
            {
-                fullConfigTemplateNode["burstObservatory"] = JsonNode.Parse(JsonUtils.Serialize(v2rayConfig.burstObservatory));
+                fullConfigTemplateNode["burstObservatory"] = JsonNode.Parse(JsonUtils.Serialize(_coreConfig.burstObservatory));
            }
            else
            {
-                var subjectSelector = v2rayConfig.burstObservatory.subjectSelector;
+                var subjectSelector = _coreConfig.burstObservatory.subjectSelector;
                subjectSelector.AddRange(fullConfigTemplateNode["burstObservatory"]?["subjectSelector"]?.AsArray()?.Select(x => x?.GetValue<string>()) ?? []);
                fullConfigTemplateNode["burstObservatory"]["subjectSelector"] = JsonNode.Parse(JsonUtils.Serialize(subjectSelector.Distinct().ToList()));
            }
@@ -88,7 +98,7 @@ public partial class CoreConfigV2rayService

        var customOutboundsNode = new JsonArray();

-        foreach (var outbound in v2rayConfig.outbounds)
+        foreach (var outbound in _coreConfig.outbounds)
        {
            if (outbound.protocol.ToLower() is "blackhole" or "dns" or "freedom")
            {
@@ -97,17 +107,15 @@ public partial class CoreConfigV2rayService
                    continue;
                }
            }
-            else if ((!fullConfigTemplate.ProxyDetour.IsNullOrEmpty())
-                && ((outbound.streamSettings?.sockopt?.dialerProxy.IsNullOrEmpty() ?? true) == true))
+            else if (!fullConfigTemplate.ProxyDetour.IsNullOrEmpty()
+                && (outbound.streamSettings?.sockopt?.dialerProxy.IsNullOrEmpty() ?? true))
            {
                var outboundAddress = outbound.settings?.servers?.FirstOrDefault()?.address
                    ?? outbound.settings?.vnext?.FirstOrDefault()?.address
                    ?? string.Empty;
                if (!Utils.IsPrivateNetwork(outboundAddress))
                {
-                    outbound.streamSettings ??= new StreamSettings4Ray();
-                    outbound.streamSettings.sockopt ??= new Sockopt4Ray();
-                    outbound.streamSettings.sockopt.dialerProxy = fullConfigTemplate.ProxyDetour;
+                    FillDialerProxy(outbound, fullConfigTemplate.ProxyDetour);
                }
            }
            customOutboundsNode.Add(JsonUtils.DeepCopy(outbound));
@@ -123,6 +131,45 @@ public partial class CoreConfigV2rayService

        fullConfigTemplateNode["outbounds"] = customOutboundsNode;

-        return await Task.FromResult(JsonUtils.Serialize(fullConfigTemplateNode));
+        return JsonUtils.Serialize(fullConfigTemplateNode);
+    }
+
+    private void ApplyOutboundSendThrough()
+    {
+        var sendThrough = _config.CoreBasicItem.SendThrough?.TrimEx();
+        foreach (var outbound in _coreConfig.outbounds ?? [])
+        {
+            outbound.sendThrough = ShouldApplySendThrough(outbound, sendThrough) ? sendThrough : null;
+        }
+    }
+
+    private static bool ShouldApplySendThrough(Outbounds4Ray outbound, string? sendThrough)
+    {
+        if (sendThrough.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        if (outbound.protocol is "freedom" or "blackhole" or "dns" or "loopback")
+        {
+            return false;
+        }
+
+        if (outbound.streamSettings?.sockopt?.dialerProxy.IsNullOrEmpty() == false)
+        {
+            return false;
+        }
+
+        var outboundAddress = outbound.settings?.servers?.FirstOrDefault()?.address
+                              ?? outbound.settings?.vnext?.FirstOrDefault()?.address
+                              ?? outbound.settings?.address?.ToString()
+                              ?? string.Empty;
+
+        if (outboundAddress.Equals("localhost", StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        return !IPAddress.TryParse(outboundAddress, out var address) || !IPAddress.IsLoopback(address);
    }
 }
@@ -2,46 +2,45 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigV2rayService
 {
-    private async Task<int> GenDns(ProfileItem? node, V2rayConfig v2rayConfig)
+    private void GenDns()
    {
        try
        {
-            var item = await AppManager.Instance.GetDNSItem(ECoreType.Xray);
+            var item = context.RawDnsItem;
            if (item is { Enabled: true })
            {
-                var result = await GenDnsCompatible(node, v2rayConfig);
+                GenDnsCustom();

-                if (v2rayConfig.routing.domainStrategy != Global.IPIfNonMatch)
+                if (_coreConfig.routing.domainStrategy != Global.IPIfNonMatch)
                {
-                    return result;
+                    return;
                }

                // DNS routing
-                var dnsObj = JsonUtils.SerializeToNode(v2rayConfig.dns);
+                var dnsObj = JsonUtils.SerializeToNode(_coreConfig.dns);
                if (dnsObj == null)
                {
-                    return result;
+                    return;
                }

                dnsObj["tag"] = Global.DnsTag;
-                v2rayConfig.dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(dnsObj));
-                v2rayConfig.routing.rules.Add(new RulesItem4Ray
+                _coreConfig.dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(dnsObj));
+                _coreConfig.routing.rules.Add(new RulesItem4Ray
                {
                    type = "field",
                    inboundTag = new List<string> { Global.DnsTag },
                    outboundTag = Global.ProxyTag,
                });
-
-                return result;
+                return;
            }
-            var simpleDnsItem = _config.SimpleDNSItem;
-            var dnsItem = v2rayConfig.dns is Dns4Ray dns4Ray ? dns4Ray : new Dns4Ray();
+            var simpleDnsItem = context.SimpleDnsItem;
+            var dnsItem = _coreConfig.dns is Dns4Ray dns4Ray ? dns4Ray : new Dns4Ray();

            var strategy4Freedom = simpleDnsItem?.Strategy4Freedom ?? Global.AsIs;
            //Outbound Freedom domainStrategy
            if (strategy4Freedom.IsNotEmpty() && strategy4Freedom != Global.AsIs)
            {
-                var outbound = v2rayConfig.outbounds.FirstOrDefault(t => t is { protocol: "freedom", tag: Global.DirectTag });
+                var outbound = _coreConfig.outbounds.FirstOrDefault(t => t is { protocol: "freedom", tag: Global.DirectTag });
                if (outbound != null)
                {
                    outbound.settings = new()
@@ -59,80 +58,59 @@ public partial class CoreConfigV2rayService
                var xraySupportConfigTypeNames = Global.XraySupportConfigType
                        .Select(x => x == EConfigType.Hysteria2 ? "hysteria" : Global.ProtocolTypes[x])
                        .ToHashSet();
-                v2rayConfig.outbounds
+                _coreConfig.outbounds
                    .Where(t => xraySupportConfigTypeNames.Contains(t.protocol))
                    .ToList()
                    .ForEach(outbound => outbound.targetStrategy = strategy4Proxy);
            }

-            await GenDnsServers(node, dnsItem, simpleDnsItem);
-            await GenDnsHosts(dnsItem, simpleDnsItem);
+            FillDnsServers(dnsItem);
+            FillDnsHosts(dnsItem);

            dnsItem.serveStale = simpleDnsItem?.ServeStale is true ? true : null;
            dnsItem.enableParallelQuery = simpleDnsItem?.ParallelQuery is true ? true : null;

-            if (v2rayConfig.routing.domainStrategy == Global.IPIfNonMatch)
+            // DNS routing
+            var directDnsTags = dnsItem.servers
+                .Select(server =>
+                {
+                    var tagNode = (server as JsonObject)?["tag"];
+                    return tagNode is JsonValue value && value.TryGetValue<string>(out var tag) ? tag : null;
+                })
+                .Where(tag => tag is not null && tag.StartsWith(Global.DirectDnsTag, StringComparison.Ordinal))
+                .Select(tag => tag!)
+                .ToList();
+            if (directDnsTags.Count > 0)
            {
-                // DNS routing
-                dnsItem.tag = Global.DnsTag;
-                v2rayConfig.routing.rules.Add(new RulesItem4Ray
+                _coreConfig.routing.rules.Add(new()
                {
                    type = "field",
-                    inboundTag = new List<string> { Global.DnsTag },
-                    outboundTag = Global.ProxyTag,
+                    inboundTag = directDnsTags,
+                    outboundTag = Global.DirectTag,
                });
            }

-            v2rayConfig.dns = dnsItem;
+            var finalRule = BuildFinalRule();
+            dnsItem.tag = Global.DnsTag;
+            _coreConfig.routing.rules.Add(new()
+            {
+                type = "field",
+                inboundTag = [Global.DnsTag],
+                outboundTag = finalRule.outboundTag,
+                balancerTag = finalRule.balancerTag,
+            });
+
+            _coreConfig.dns = dnsItem;
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return 0;
    }

-    private async Task<int> GenDnsServers(ProfileItem? node, Dns4Ray dnsItem, SimpleDNSItem simpleDNSItem)
+    private void FillDnsServers(Dns4Ray dnsItem)
    {
-        static List<string> ParseDnsAddresses(string? dnsInput, string defaultAddress)
-        {
-            var addresses = dnsInput?.Split(dnsInput.Contains(',') ? ',' : ';')
-                .Select(addr => addr.Trim())
-                .Where(addr => !string.IsNullOrEmpty(addr))
-                .Select(addr => addr.StartsWith("dhcp", StringComparison.OrdinalIgnoreCase) ? "localhost" : addr)
-                .Distinct()
-                .ToList() ?? new List<string> { defaultAddress };
-            return addresses.Count > 0 ? addresses : new List<string> { defaultAddress };
-        }
-
-        static object? CreateDnsServer(string dnsAddress, List<string> domains, List<string>? expectedIPs = null)
-        {
-            var (domain, scheme, port, path) = Utils.ParseUrl(dnsAddress);
-            var domainFinal = dnsAddress;
-            int? portFinal = null;
-            if (scheme.IsNullOrEmpty() || scheme.StartsWith("udp", StringComparison.OrdinalIgnoreCase))
-            {
-                domainFinal = domain;
-                portFinal = port > 0 ? port : null;
-            }
-            else if (scheme.StartsWith("tcp", StringComparison.OrdinalIgnoreCase))
-            {
-                domainFinal = scheme + "://" + domain;
-                portFinal = port > 0 ? port : null;
-            }
-            var dnsServer = new DnsServer4Ray
-            {
-                address = domainFinal,
-                port = portFinal,
-                skipFallback = true,
-                domains = domains.Count > 0 ? domains : null,
-                expectedIPs = expectedIPs?.Count > 0 ? expectedIPs : null
-            };
-            return JsonUtils.SerializeToNode(dnsServer, new JsonSerializerOptions
-            {
-                DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
-            });
-        }
+        var simpleDNSItem = context.SimpleDnsItem;

        var directDNSAddress = ParseDnsAddresses(simpleDNSItem?.DirectDNS, Global.DomainDirectDNSAddress.First());
        var remoteDNSAddress = ParseDnsAddresses(simpleDNSItem?.RemoteDNS, Global.DomainRemoteDNSAddress.First());
@@ -197,9 +175,9 @@ public partial class CoreConfigV2rayService
            }
        }

-        var routing = await ConfigHandler.GetDefaultRouting(_config);
+        var routing = context.RoutingItem;
        List<RulesItem>? rules = null;
-        rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet) ?? [];
+        rules = JsonUtils.Deserialize<List<RulesItem>>(routing?.RuleSet) ?? [];
        foreach (var item in rules)
        {
            if (!item.Enabled || item.Domain is null || item.Domain.Count == 0)
@@ -246,69 +224,117 @@ public partial class CoreConfigV2rayService
            }
        }

-        if (Utils.IsDomain(node?.Address))
+        if (context.ProtectDomainList.Count > 0)
        {
-            directDomainList.Add(node.Address);
-        }
-
-        if (node?.Subid is not null)
-        {
-            var subItem = await AppManager.Instance.GetSubItem(node.Subid);
-            if (subItem is not null)
-            {
-                foreach (var profile in new[] { subItem.PrevProfile, subItem.NextProfile })
-                {
-                    var profileNode = await AppManager.Instance.GetProfileItemViaRemarks(profile);
-                    if (profileNode is not null
-                        && Global.XraySupportConfigType.Contains(profileNode.ConfigType)
-                        && Utils.IsDomain(profileNode.Address))
-                    {
-                        directDomainList.Add(profileNode.Address);
-                    }
-                }
-            }
+            directDomainList.AddRange(context.ProtectDomainList);
        }

        dnsItem.servers ??= [];

-        void AddDnsServers(List<string> dnsAddresses, List<string> domains, List<string>? expectedIPs = null)
-        {
-            if (domains.Count > 0)
-            {
-                foreach (var dnsAddress in dnsAddresses)
-                {
-                    dnsItem.servers.Add(CreateDnsServer(dnsAddress, domains, expectedIPs));
-                }
-            }
-        }
+        var directDnsTagIndex = 1;

        AddDnsServers(remoteDNSAddress, proxyDomainList);
-        AddDnsServers(directDNSAddress, directDomainList);
+        AddDnsServers(directDNSAddress, directDomainList, true);
        AddDnsServers(remoteDNSAddress, proxyGeositeList);
-        AddDnsServers(directDNSAddress, directGeositeList);
-        AddDnsServers(directDNSAddress, expectedDomainList, expectedIPs);
+        AddDnsServers(directDNSAddress, directGeositeList, true);
+        AddDnsServers(directDNSAddress, expectedDomainList, true, expectedIPs);
        if (dnsServerDomains.Count > 0)
        {
            AddDnsServers(bootstrapDNSAddress, dnsServerDomains);
        }

-        var useDirectDns = rules?.LastOrDefault() is { } lastRule
-            && lastRule.OutboundTag == Global.DirectTag
-            && (lastRule.Port == "0-65535"
-                || lastRule.Network == "tcp,udp"
-                || lastRule.Ip?.Contains("0.0.0.0/0") == true);
+        var useDirectDns = false;

-        var defaultDnsServers = useDirectDns ? directDNSAddress : remoteDNSAddress;
-        dnsItem.servers.AddRange(defaultDnsServers);
+        if (rules?.LastOrDefault() is { } lastRule && lastRule.OutboundTag == Global.DirectTag)
+        {
+            var noDomain = lastRule.Domain == null || lastRule.Domain.Count == 0;
+            var noProcess = lastRule.Process == null || lastRule.Process.Count == 0;
+            var isAnyIp = lastRule.Ip == null || lastRule.Ip.Count == 0 || lastRule.Ip.Contains("0.0.0.0/0");
+            var isAnyPort = string.IsNullOrEmpty(lastRule.Port) || lastRule.Port == "0-65535";
+            var isAnyNetwork = string.IsNullOrEmpty(lastRule.Network) || lastRule.Network == "tcp,udp";
+            useDirectDns = noDomain && noProcess && isAnyIp && isAnyPort && isAnyNetwork;
+        }

-        return 0;
+        if (!useDirectDns)
+        {
+            dnsItem.servers.AddRange(remoteDNSAddress);
+        }
+        else
+        {
+            foreach (var dns in directDNSAddress)
+            {
+                var dnsServer = CreateDnsServer(dns, []);
+                dnsServer.tag = $"{Global.DirectDnsTag}-{directDnsTagIndex++}";
+                dnsServer.skipFallback = false;
+                dnsItem.servers.Add(JsonUtils.SerializeToNode(dnsServer,
+                    new JsonSerializerOptions { DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull }));
+            }
+        }
+        return;
+
+        static List<string> ParseDnsAddresses(string? dnsInput, string defaultAddress)
+        {
+            var addresses = dnsInput?.Split(dnsInput.Contains(',') ? ',' : ';')
+                .Select(addr => addr.Trim())
+                .Where(addr => !string.IsNullOrEmpty(addr))
+                .Select(addr => addr.StartsWith("dhcp", StringComparison.OrdinalIgnoreCase) ? "localhost" : addr)
+                .Distinct()
+                .ToList() ?? [defaultAddress];
+            return addresses.Count > 0 ? addresses : new List<string> { defaultAddress };
+        }
+
+        static DnsServer4Ray CreateDnsServer(string dnsAddress, List<string> domains, List<string>? expectedIPs = null)
+        {
+            var (domain, scheme, port, path) = Utils.ParseUrl(dnsAddress);
+            var domainFinal = dnsAddress;
+            int? portFinal = null;
+            if (scheme.IsNullOrEmpty() || scheme.StartsWith("udp", StringComparison.OrdinalIgnoreCase))
+            {
+                domainFinal = domain;
+                portFinal = port > 0 ? port : null;
+            }
+            else if (scheme.StartsWith("tcp", StringComparison.OrdinalIgnoreCase))
+            {
+                domainFinal = scheme + "://" + domain;
+                portFinal = port > 0 ? port : null;
+            }
+            var dnsServer = new DnsServer4Ray
+            {
+                address = domainFinal,
+                port = portFinal,
+                skipFallback = true,
+                domains = domains.Count > 0 ? domains : null,
+                expectedIPs = expectedIPs?.Count > 0 ? expectedIPs : null
+            };
+            return dnsServer;
+        }
+
+        void AddDnsServers(List<string> dnsAddresses, List<string> domains, bool isDirectDns = false, List<string>? expectedIPs = null)
+        {
+            if (domains.Count <= 0)
+            {
+                return;
+            }
+            foreach (var dnsAddress in dnsAddresses)
+            {
+                var dnsServer = CreateDnsServer(dnsAddress, domains, expectedIPs);
+                if (isDirectDns)
+                {
+                    dnsServer.tag = $"{Global.DirectDnsTag}-{directDnsTagIndex++}";
+                }
+                var dnsServerNode = JsonUtils.SerializeToNode(dnsServer,
+                    new JsonSerializerOptions { DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull });
+                dnsItem.servers.Add(dnsServerNode);
+            }
+        }
    }

-    private async Task<int> GenDnsHosts(Dns4Ray dnsItem, SimpleDNSItem simpleDNSItem)
+    private void FillDnsHosts(Dns4Ray dnsItem)
    {
+        var simpleDNSItem = context.SimpleDnsItem;
        if (simpleDNSItem.AddCommonHosts == false && simpleDNSItem.UseSystemHosts == false && simpleDNSItem.Hosts.IsNullOrEmpty())
        {
-            return await Task.FromResult(0);
+            return;
        }
        dnsItem.hosts ??= new Dictionary<string, object>();
        if (simpleDNSItem.AddCommonHosts == true)
@@ -333,34 +359,28 @@ public partial class CoreConfigV2rayService
            }
        }

-        if (!simpleDNSItem.Hosts.IsNullOrEmpty())
+        foreach (var kvp in Utils.ParseHostsToDictionary(simpleDNSItem.Hosts))
        {
-            var userHostsMap = Utils.ParseHostsToDictionary(simpleDNSItem.Hosts);
-
-            foreach (var kvp in userHostsMap)
-            {
-                dnsItem.hosts[kvp.Key] = kvp.Value;
-            }
+            dnsItem.hosts[kvp.Key] = kvp.Value;
        }
-        return await Task.FromResult(0);
    }

-    private async Task<int> GenDnsCompatible(ProfileItem? node, V2rayConfig v2rayConfig)
+    private void GenDnsCustom()
    {
        try
        {
-            var item = await AppManager.Instance.GetDNSItem(ECoreType.Xray);
-            var normalDNS = item?.NormalDNS;
+            var item = context.RawDnsItem;
+            var customDNS = context.IsTunEnabled ? item?.TunDNS : item?.NormalDNS;
            var domainStrategy4Freedom = item?.DomainStrategy4Freedom;
-            if (normalDNS.IsNullOrEmpty())
+            if (customDNS.IsNullOrEmpty())
            {
-                normalDNS = EmbedUtils.GetEmbedText(Global.DNSV2rayNormalFileName);
+                customDNS = EmbedUtils.GetEmbedText(Global.DNSV2rayNormalFileName);
            }

            //Outbound Freedom domainStrategy
            if (domainStrategy4Freedom.IsNotEmpty())
            {
-                var outbound = v2rayConfig.outbounds.FirstOrDefault(t => t is { protocol: "freedom", tag: Global.DirectTag });
+                var outbound = _coreConfig.outbounds.FirstOrDefault(t => t is { protocol: "freedom", tag: Global.DirectTag });
                if (outbound != null)
                {
                    outbound.settings = new();
@@ -369,11 +389,11 @@ public partial class CoreConfigV2rayService
                }
            }

-            var obj = JsonUtils.ParseJson(normalDNS);
+            var obj = JsonUtils.ParseJson(customDNS);
            if (obj is null)
            {
                List<string> servers = [];
-                var arrDNS = normalDNS.Split(',');
+                var arrDNS = customDNS.Split(',');
                foreach (var str in arrDNS)
                {
                    servers.Add(str);
@@ -415,63 +435,37 @@ public partial class CoreConfigV2rayService
                }
            }

-            await GenDnsDomainsCompatible(node, obj, item);
+            FillDnsDomainsCustom(obj);

-            v2rayConfig.dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(obj));
+            _coreConfig.dns = obj;
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return 0;
    }

-    private async Task<int> GenDnsDomainsCompatible(ProfileItem? node, JsonNode dns, DNSItem? dnsItem)
+    private void FillDnsDomainsCustom(JsonNode dns)
    {
-        if (node == null)
-        {
-            return 0;
-        }
        var servers = dns["servers"];
-        if (servers != null)
+        if (servers == null)
        {
-            var domainList = new List<string>();
-            if (Utils.IsDomain(node.Address))
-            {
-                domainList.Add(node.Address);
-            }
-            var subItem = await AppManager.Instance.GetSubItem(node.Subid);
-            if (subItem is not null)
-            {
-                // Previous proxy
-                var prevNode = await AppManager.Instance.GetProfileItemViaRemarks(subItem.PrevProfile);
-                if (prevNode is not null
-                    && Global.SingboxSupportConfigType.Contains(prevNode.ConfigType)
-                    && Utils.IsDomain(prevNode.Address))
-                {
-                    domainList.Add(prevNode.Address);
-                }
-
-                // Next proxy
-                var nextNode = await AppManager.Instance.GetProfileItemViaRemarks(subItem.NextProfile);
-                if (nextNode is not null
-                    && Global.SingboxSupportConfigType.Contains(nextNode.ConfigType)
-                    && Utils.IsDomain(nextNode.Address))
-                {
-                    domainList.Add(nextNode.Address);
-                }
-            }
-            if (domainList.Count > 0)
-            {
-                var dnsServer = new DnsServer4Ray()
-                {
-                    address = string.IsNullOrEmpty(dnsItem?.DomainDNSAddress) ? Global.DomainPureIPDNSAddress.FirstOrDefault() : dnsItem?.DomainDNSAddress,
-                    skipFallback = true,
-                    domains = domainList
-                };
-                servers.AsArray().Add(JsonUtils.SerializeToNode(dnsServer));
-            }
+            return;
        }
-        return await Task.FromResult(0);
+
+        var domainList = context.ProtectDomainList;
+        if (domainList.Count <= 0)
+        {
+            return;
+        }
+
+        var dnsItem = context.RawDnsItem;
+        var dnsServer = new DnsServer4Ray()
+        {
+            address = string.IsNullOrEmpty(dnsItem?.DomainDNSAddress) ? Global.DomainPureIPDNSAddress.FirstOrDefault() : dnsItem?.DomainDNSAddress,
+            skipFallback = true,
+            domains = domainList.ToList(),
+        };
+        servers.AsArray().Add(JsonUtils.SerializeToNode(dnsServer));
    }
 }
@@ -2,51 +2,75 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigV2rayService
 {
-    private async Task<int> GenInbounds(V2rayConfig v2rayConfig)
+    private void GenInbounds()
    {
        try
        {
            var listen = "0.0.0.0";
-            v2rayConfig.inbounds = [];
+            var listenPort = AppManager.Instance.GetLocalPort(EInboundProtocol.socks);
+            _coreConfig.inbounds = [];
+            var inbound = BuildInbound(_config.Inbound.First(), EInboundProtocol.socks, true);

-            var inbound = GetInbound(_config.Inbound.First(), EInboundProtocol.socks, true);
-            v2rayConfig.inbounds.Add(inbound);
-
-            if (_config.Inbound.First().SecondLocalPortEnabled)
+            if (!context.IsTunEnabled
+                || (context.IsTunEnabled && _node.Address != Global.Loopback && _node.Port != listenPort))
            {
-                var inbound2 = GetInbound(_config.Inbound.First(), EInboundProtocol.socks2, true);
-                v2rayConfig.inbounds.Add(inbound2);
-            }
+                _coreConfig.inbounds.Add(inbound);

-            if (_config.Inbound.First().AllowLANConn)
-            {
-                if (_config.Inbound.First().NewPort4LAN)
+                if (_config.Inbound.First().SecondLocalPortEnabled)
                {
-                    var inbound3 = GetInbound(_config.Inbound.First(), EInboundProtocol.socks3, true);
-                    inbound3.listen = listen;
-                    v2rayConfig.inbounds.Add(inbound3);
+                    var inbound2 = BuildInbound(_config.Inbound.First(), EInboundProtocol.socks2, true);
+                    _coreConfig.inbounds.Add(inbound2);
+                }

-                    //auth
-                    if (_config.Inbound.First().User.IsNotEmpty() && _config.Inbound.First().Pass.IsNotEmpty())
+                if (_config.Inbound.First().AllowLANConn)
+                {
+                    if (_config.Inbound.First().NewPort4LAN)
                    {
-                        inbound3.settings.auth = "password";
-                        inbound3.settings.accounts = new List<AccountsItem4Ray> { new AccountsItem4Ray() { user = _config.Inbound.First().User, pass = _config.Inbound.First().Pass } };
+                        var inbound3 = BuildInbound(_config.Inbound.First(), EInboundProtocol.socks3, true);
+                        inbound3.listen = listen;
+                        _coreConfig.inbounds.Add(inbound3);
+
+                        //auth
+                        if (_config.Inbound.First().User.IsNotEmpty() && _config.Inbound.First().Pass.IsNotEmpty())
+                        {
+                            inbound3.settings.auth = "password";
+                            inbound3.settings.accounts = new List<AccountsItem4Ray>
+                            {
+                                new() { user = _config.Inbound.First().User, pass = _config.Inbound.First().Pass }
+                            };
+                        }
+                    }
+                    else
+                    {
+                        inbound.listen = listen;
                    }
                }
-                else
+            }
+
+            if (context.IsTunEnabled)
+            {
+                if (_config.TunModeItem.Mtu <= 0)
                {
-                    inbound.listen = listen;
+                    _config.TunModeItem.Mtu = Global.TunMtus.First();
                }
+                var tunInbound = JsonUtils.Deserialize<Inbounds4Ray>(EmbedUtils.GetEmbedText(Global.V2raySampleTunInbound)) ?? new Inbounds4Ray { };
+                tunInbound.settings.name = Utils.IsMacOS() ? $"utun{new Random().Next(99)}" : "xray_tun";
+                tunInbound.settings.MTU = _config.TunModeItem.Mtu;
+                if (_config.TunModeItem.EnableIPv6Address == false)
+                {
+                    tunInbound.settings.gateway = ["172.18.0.1/30"];
+                }
+                tunInbound.sniffing = inbound.sniffing;
+                _coreConfig.inbounds.Add(tunInbound);
            }
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return await Task.FromResult(0);
    }

-    private Inbounds4Ray GetInbound(InItem inItem, EInboundProtocol protocol, bool bSocks)
+    private Inbounds4Ray BuildInbound(InItem inItem, EInboundProtocol protocol, bool bSocks)
    {
        var result = EmbedUtils.GetEmbedText(Global.V2raySampleInbound);
        if (result.IsNullOrEmpty())
@@ -2,28 +2,27 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigV2rayService
 {
-    private async Task<int> GenLog(V2rayConfig v2rayConfig)
+    private void GenLog()
    {
        try
        {
            if (_config.CoreBasicItem.LogEnabled)
            {
                var dtNow = DateTime.Now;
-                v2rayConfig.log.loglevel = _config.CoreBasicItem.Loglevel;
-                v2rayConfig.log.access = Utils.GetLogPath($"Vaccess_{dtNow:yyyy-MM-dd}.txt");
-                v2rayConfig.log.error = Utils.GetLogPath($"Verror_{dtNow:yyyy-MM-dd}.txt");
+                _coreConfig.log.loglevel = _config.CoreBasicItem.Loglevel;
+                _coreConfig.log.access = Utils.GetLogPath($"Vaccess_{dtNow:yyyy-MM-dd}.txt");
+                _coreConfig.log.error = Utils.GetLogPath($"Verror_{dtNow:yyyy-MM-dd}.txt");
            }
            else
            {
-                v2rayConfig.log.loglevel = _config.CoreBasicItem.Loglevel;
-                v2rayConfig.log.access = null;
-                v2rayConfig.log.error = null;
+                _coreConfig.log.loglevel = _config.CoreBasicItem.Loglevel;
+                _coreConfig.log.access = null;
+                _coreConfig.log.error = null;
            }
        }
        catch (Exception ex)
        {
            Logging.SaveLog(_tag, ex);
        }
-        return await Task.FromResult(0);
    }
 }
@@ -2,20 +2,45 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigV2rayService
 {
-    private async Task<int> GenRouting(V2rayConfig v2rayConfig)
+    private void GenRouting()
    {
        try
        {
-            if (v2rayConfig.routing?.rules != null)
+            if (context.IsTunEnabled)
            {
-                v2rayConfig.routing.domainStrategy = _config.RoutingBasicItem.DomainStrategy;
+                var tunRules = JsonUtils.Deserialize<List<RulesItem4Ray>>(EmbedUtils.GetEmbedText(Global.V2raySampleTunRules));
+                if (tunRules != null)
+                {
+                    _coreConfig.routing.rules.AddRange(tunRules);
+                }
+                var (lstDnsExe, lstDirectExe) = BuildRoutingDirectExe();
+                _coreConfig.routing.rules.Add(new()
+                {
+                    port = "53",
+                    process = lstDnsExe,
+                    outboundTag = Global.DnsOutboundTag,
+                });
+                _coreConfig.routing.rules.Add(new()
+                {
+                    process = lstDirectExe,
+                    outboundTag = Global.DirectTag,
+                });
+                _coreConfig.routing.rules.Add(new()
+                {
+                    port = "53",
+                    outboundTag = Global.DnsOutboundTag,
+                });
+            }
+            if (_coreConfig.routing?.rules != null)
+            {
+                _coreConfig.routing.domainStrategy = _config.RoutingBasicItem.DomainStrategy;

-                var routing = await ConfigHandler.GetDefaultRouting(_config);
+                var routing = context.RoutingItem;
                if (routing != null)
                {
                    if (routing.DomainStrategy.IsNotEmpty())
                    {
-                        v2rayConfig.routing.domainStrategy = routing.DomainStrategy;
+                        _coreConfig.routing.domainStrategy = routing.DomainStrategy;
                    }
                    var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet);
                    foreach (var item in rules)
@@ -31,7 +56,18 @@ public partial class CoreConfigV2rayService
                        }

                        var item2 = JsonUtils.Deserialize<RulesItem4Ray>(JsonUtils.Serialize(item));
-                        await GenRoutingUserRule(item2, v2rayConfig);
+                        GenRoutingUserRule(item2);
+                    }
+                }
+                var balancerTagList = _coreConfig.routing.balancers
+                    ?.Select(p => p.tag)
+                    .ToList() ?? [];
+                if (balancerTagList.Count > 0)
+                {
+                    foreach (var rulesItem in _coreConfig.routing.rules.Where(r => balancerTagList.Contains(r.outboundTag + Global.BalancerTagSuffix)))
+                    {
+                        rulesItem.balancerTag = rulesItem.outboundTag + Global.BalancerTagSuffix;
+                        rulesItem.outboundTag = null;
                    }
                }
            }
@@ -40,95 +76,94 @@ public partial class CoreConfigV2rayService
        {
            Logging.SaveLog(_tag, ex);
        }
-        return 0;
    }

-    private async Task<int> GenRoutingUserRule(RulesItem4Ray? rule, V2rayConfig v2rayConfig)
+    private void GenRoutingUserRule(RulesItem4Ray? userRule)
    {
        try
        {
-            if (rule == null)
+            if (userRule == null)
            {
-                return 0;
+                return;
            }
-            rule.outboundTag = await GenRoutingUserRuleOutbound(rule.outboundTag, v2rayConfig);
+            userRule.outboundTag = GenRoutingUserRuleOutbound(userRule.outboundTag ?? Global.ProxyTag);

-            if (rule.port.IsNullOrEmpty())
+            if (userRule.port.IsNullOrEmpty())
            {
-                rule.port = null;
+                userRule.port = null;
            }
-            if (rule.network.IsNullOrEmpty())
+            if (userRule.network.IsNullOrEmpty())
            {
-                rule.network = null;
+                userRule.network = null;
            }
-            if (rule.domain?.Count == 0)
+            if (userRule.domain?.Count == 0)
            {
-                rule.domain = null;
+                userRule.domain = null;
            }
-            if (rule.ip?.Count == 0)
+            if (userRule.ip?.Count == 0)
            {
-                rule.ip = null;
+                userRule.ip = null;
            }
-            if (rule.protocol?.Count == 0)
+            if (userRule.protocol?.Count == 0)
            {
-                rule.protocol = null;
+                userRule.protocol = null;
            }
-            if (rule.inboundTag?.Count == 0)
+            if (userRule.inboundTag?.Count == 0)
            {
-                rule.inboundTag = null;
+                userRule.inboundTag = null;
            }
-            if (rule.process?.Count == 0)
+            if (userRule.process?.Count == 0)
            {
-                rule.process = null;
+                userRule.process = null;
            }

            var hasDomainIp = false;
-            if (rule.domain?.Count > 0)
+            if (userRule.domain?.Count > 0)
            {
-                var it = JsonUtils.DeepCopy(rule);
+                var it = JsonUtils.DeepCopy(userRule);
                it.ip = null;
                it.process = null;
                it.type = "field";
                for (var k = it.domain.Count - 1; k >= 0; k--)
                {
-                    if (it.domain[k].StartsWith("#"))
+                    if (it.domain[k].StartsWith('#'))
                    {
                        it.domain.RemoveAt(k);
                    }
                    it.domain[k] = it.domain[k].Replace(Global.RoutingRuleComma, ",");
                }
-                v2rayConfig.routing.rules.Add(it);
+                _coreConfig.routing.rules.Add(it);
                hasDomainIp = true;
            }
-            if (rule.ip?.Count > 0)
+            if (userRule.ip?.Count > 0)
            {
-                var it = JsonUtils.DeepCopy(rule);
+                var it = JsonUtils.DeepCopy(userRule);
                it.domain = null;
                it.process = null;
                it.type = "field";
-                v2rayConfig.routing.rules.Add(it);
+                _coreConfig.routing.rules.Add(it);
                hasDomainIp = true;
            }
-            if (_config.TunModeItem.EnableTun && rule.process?.Count > 0)
+            if (userRule.process?.Count > 0)
            {
-                var it = JsonUtils.DeepCopy(rule);
+                var it = JsonUtils.DeepCopy(userRule);
                it.domain = null;
                it.ip = null;
                it.type = "field";
-                v2rayConfig.routing.rules.Add(it);
+                _coreConfig.routing.rules.Add(it);
                hasDomainIp = true;
            }
            if (!hasDomainIp)
            {
-                if (rule.port.IsNotEmpty()
-                    || rule.protocol?.Count > 0
-                    || rule.inboundTag?.Count > 0
-                    || rule.network != null
+                if (userRule.port.IsNotEmpty()
+                    || userRule.protocol?.Count > 0
+                    || userRule.inboundTag?.Count > 0
+                    || userRule.network != null
                    )
                {
-                    var it = JsonUtils.DeepCopy(rule);
+                    var it = JsonUtils.DeepCopy(userRule);
                    it.type = "field";
-                    v2rayConfig.routing.rules.Add(it);
+                    _coreConfig.routing.rules.Add(it);
                }
            }
        }
@@ -136,17 +171,16 @@ public partial class CoreConfigV2rayService
        {
            Logging.SaveLog(_tag, ex);
        }
-        return await Task.FromResult(0);
    }

-    private async Task<string?> GenRoutingUserRuleOutbound(string outboundTag, V2rayConfig v2rayConfig)
+    private string GenRoutingUserRuleOutbound(string outboundTag)
    {
        if (Global.OutboundTags.Contains(outboundTag))
        {
            return outboundTag;
        }

-        var node = await AppManager.Instance.GetProfileItemViaRemarks(outboundTag);
+        var node = context.AllProxiesMap.GetValueOrDefault($"remark:{outboundTag}");

        if (node == null
            || (!Global.XraySupportConfigType.Contains(node.ConfigType)
@@ -155,28 +189,78 @@ public partial class CoreConfigV2rayService
            return Global.ProxyTag;
        }

-        var tag = $"{node.IndexId}-{Global.ProxyTag}";
-        if (v2rayConfig.outbounds.Any(p => p.tag == tag))
+        var tag = $"{node.IndexId}-{Global.ProxyTag}-{node.Remarks}";
+        if (_coreConfig.outbounds.Any(p => p.tag.StartsWith(tag)))
        {
            return tag;
        }

-        if (node.ConfigType.IsGroupType())
+        var proxyOutbounds = new CoreConfigV2rayService(context with { Node = node, }).BuildAllProxyOutbounds(tag);
+        _coreConfig.outbounds.AddRange(proxyOutbounds);
+        if (proxyOutbounds.Count(n => n.tag.StartsWith(tag)) > 1)
        {
-            var ret = await GenGroupOutbound(node, v2rayConfig, tag);
-            if (ret == 0)
-            {
-                return tag;
-            }
-            return Global.ProxyTag;
+            var multipleLoad = node.GetProtocolExtra().MultipleLoad ?? EMultipleLoad.LeastPing;
+            GenObservatory(multipleLoad, tag);
+            GenBalancer(multipleLoad, tag);
        }

-        var txtOutbound = EmbedUtils.GetEmbedText(Global.V2raySampleOutbound);
-        var outbound = JsonUtils.Deserialize<Outbounds4Ray>(txtOutbound);
-        await GenOutbound(node, outbound);
-        outbound.tag = tag;
-        v2rayConfig.outbounds.Add(outbound);
+        return tag;
+    }

-        return outbound.tag;
+    private RulesItem4Ray BuildFinalRule()
+    {
+        var finalRule = new RulesItem4Ray()
+        {
+            type = "field",
+            network = "tcp,udp",
+            outboundTag = Global.ProxyTag,
+        };
+        var balancer =
+            _coreConfig?.routing?.balancers?.FirstOrDefault(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix, null);
+        var domainStrategy = _coreConfig.routing?.domainStrategy ?? Global.AsIs;
+        if (balancer is not null)
+        {
+            finalRule.outboundTag = null;
+            finalRule.balancerTag = balancer.tag;
+        }
+        if (domainStrategy == Global.IPIfNonMatch)
+        {
+            finalRule.network = null;
+            finalRule.ip = ["0.0.0.0/0", "::/0"];
+        }
+        return finalRule;
+    }
+
+    private static (List<string> lstDnsExe, List<string> lstDirectExe) BuildRoutingDirectExe()
+    {
+        var dnsExeSet = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var directExeSet = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        var coreInfoResult = CoreInfoManager.Instance.GetCoreInfo();
+
+        foreach (var coreConfig in coreInfoResult)
+        {
+            if (coreConfig.CoreType == ECoreType.v2rayN)
+            {
+                continue;
+            }
+
+            foreach (var baseExeName in coreConfig.CoreExes)
+            {
+                if (coreConfig.CoreType != ECoreType.Xray)
+                {
+                    dnsExeSet.Add(Utils.GetExeName(baseExeName));
+                }
+                directExeSet.Add(Utils.GetExeName(baseExeName));
+            }
+        }
+
+        directExeSet.Add("xray/");
+        directExeSet.Add("self/");
+
+        var lstDnsExe = new List<string>(dnsExeSet);
+        var lstDirectExe = new List<string>(directExeSet);
+
+        return (lstDnsExe, lstDirectExe);
    }
 }
@@ -2,7 +2,7 @@ namespace ServiceLib.Services.CoreConfig;

 public partial class CoreConfigV2rayService
 {
-    private async Task<int> GenStatistic(V2rayConfig v2rayConfig)
+    private void GenStatistic()
    {
        if (_config.GuiItem.EnableStatistics || _config.GuiItem.DisplayRealTimeSpeed)
        {
@@ -11,17 +11,17 @@ public partial class CoreConfigV2rayService
            Policy4Ray policyObj = new();
            SystemPolicy4Ray policySystemSetting = new();

-            v2rayConfig.stats = new Stats4Ray();
+            _coreConfig.stats = new Stats4Ray();

            apiObj.tag = tag;
-            v2rayConfig.metrics = apiObj;
+            _coreConfig.metrics = apiObj;

            policySystemSetting.statsOutboundDownlink = true;
            policySystemSetting.statsOutboundUplink = true;
            policyObj.system = policySystemSetting;
-            v2rayConfig.policy = policyObj;
+            _coreConfig.policy = policyObj;

-            if (!v2rayConfig.inbounds.Exists(item => item.tag == tag))
+            if (!_coreConfig.inbounds.Exists(item => item.tag == tag))
            {
                Inbounds4Ray apiInbound = new();
                Inboundsettings4Ray apiInboundSettings = new();
@@ -31,10 +31,10 @@ public partial class CoreConfigV2rayService
                apiInbound.protocol = Global.InboundAPIProtocol;
                apiInboundSettings.address = Global.Loopback;
                apiInbound.settings = apiInboundSettings;
-                v2rayConfig.inbounds.Add(apiInbound);
+                _coreConfig.inbounds.Add(apiInbound);
            }

-            if (!v2rayConfig.routing.rules.Exists(item => item.outboundTag == tag))
+            if (!_coreConfig.routing.rules.Exists(item => item.outboundTag == tag))
            {
                RulesItem4Ray apiRoutingRule = new()
                {
@@ -43,9 +43,8 @@ public partial class CoreConfigV2rayService
                    type = "field"
                };

-                v2rayConfig.routing.rules.Add(apiRoutingRule);
+                _coreConfig.routing.rules.Add(apiRoutingRule);
            }
        }
-        return await Task.FromResult(0);
    }
 }
@@ -61,26 +61,36 @@ public class SpeedtestService(Config config, Func<SpeedTestResult, Task> updateF

    private async Task<List<ServerTestItem>> GetClearItem(ESpeedActionType actionType, List<ProfileItem> selecteds)
    {
-        var lstSelected = new List<ServerTestItem>();
-        foreach (var it in selecteds)
+        var lstSelected = new List<ServerTestItem>(selecteds.Count);
+        var ids = selecteds.Where(it => !it.IndexId.IsNullOrEmpty()
+            && it.ConfigType != EConfigType.Custom
+            && (it.ConfigType.IsComplexType() || it.Port > 0))
+            .Select(it => it.IndexId)
+            .ToList();
+        var profileMap = await AppManager.Instance.GetProfileItemsByIndexIdsAsMap(ids);
+        for (var i = 0; i < selecteds.Count; i++)
        {
-            if (it.ConfigType.IsComplexType())
+            var it = selecteds[i];
+            if (it.ConfigType == EConfigType.Custom)
            {
                continue;
            }

-            if (it.Port <= 0)
+            if (!it.ConfigType.IsComplexType() && it.Port <= 0)
            {
                continue;
            }

+            var profile = profileMap.GetValueOrDefault(it.IndexId, it);
            lstSelected.Add(new ServerTestItem()
            {
                IndexId = it.IndexId,
                Address = it.Address,
                Port = it.Port,
                ConfigType = it.ConfigType,
-                QueueNum = selecteds.IndexOf(it)
+                QueueNum = i,
+                Profile = profile,
+                CoreType = AppManager.Instance.GetCoreType(profile, it.ConfigType),
            });
        }

@@ -353,8 +363,8 @@ public class SpeedtestService(Config config, Func<SpeedTestResult, Task> updateF
    private List<List<ServerTestItem>> GetTestBatchItem(List<ServerTestItem> lstSelected, int pageSize)
    {
        List<List<ServerTestItem>> lstTest = new();
-        var lst1 = lstSelected.Where(t => Global.XraySupportConfigType.Contains(t.ConfigType)).ToList();
-        var lst2 = lstSelected.Where(t => Global.SingboxOnlyConfigType.Contains(t.ConfigType)).ToList();
+        var lst1 = lstSelected.Where(t => t.CoreType == ECoreType.Xray).ToList();
+        var lst2 = lstSelected.Where(t => t.CoreType == ECoreType.sing_box).ToList();

        for (var num = 0; num < (int)Math.Ceiling(lst1.Count * 1.0 / pageSize); num++)
        {
@@ -299,15 +299,22 @@ public class UpdateService(Config config, Func<bool, string, Task> updateFunc)

            return url;
        }
+
        else if (Utils.IsLinux())
        {
-            return RuntimeInformation.ProcessArchitecture switch
+            var arch = RuntimeInformation.ProcessArchitecture;
+            if (arch.ToString().Equals("RiscV64", StringComparison.OrdinalIgnoreCase))
+            {
+                return coreInfo?.DownloadUrlLinuxRiscV64;
+            }
+            return arch switch
            {
                Architecture.Arm64 => coreInfo?.DownloadUrlLinuxArm64,
                Architecture.X64 => coreInfo?.DownloadUrlLinux64,
                _ => null,
            };
        }
+        
        else if (Utils.IsMacOS())
        {
            return RuntimeInformation.ProcessArchitecture switch
@@ -363,44 +370,36 @@ public class UpdateService(Config config, Func<bool, string, Task> updateFunc)
        var geoipFiles = new List<string>();
        var geoSiteFiles = new List<string>();

-        //Collect used files list
+        // Collect from routing rules
        var routingItems = await AppManager.Instance.RoutingItems();
        foreach (var routing in routingItems)
        {
            var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet);
            foreach (var item in rules ?? [])
            {
-                foreach (var ip in item.Ip ?? [])
-                {
-                    var prefix = "geoip:";
-                    if (ip.StartsWith(prefix))
-                    {
-                        geoipFiles.Add(ip.Substring(prefix.Length));
-                    }
-                }
-
-                foreach (var domain in item.Domain ?? [])
-                {
-                    var prefix = "geosite:";
-                    if (domain.StartsWith(prefix))
-                    {
-                        geoSiteFiles.Add(domain.Substring(prefix.Length));
-                    }
-                }
+                AddPrefixedItems(item.Ip, "geoip:", geoipFiles);
+                AddPrefixedItems(item.Domain, "geosite:", geoSiteFiles);
            }
        }

-        //append dns items TODO
-        geoSiteFiles.Add("google");
-        geoSiteFiles.Add("cn");
-        geoSiteFiles.Add("geolocation-cn");
-        geoSiteFiles.Add("category-ads-all");
+        // Collect from DNS configuration
+        var dnsItem = await AppManager.Instance.GetDNSItem(ECoreType.sing_box);
+        if (dnsItem != null)
+        {
+            ExtractDnsRuleSets(dnsItem.NormalDNS, geoipFiles, geoSiteFiles);
+            ExtractDnsRuleSets(dnsItem.TunDNS, geoipFiles, geoSiteFiles);
+        }

+        // Append default items
+        geoSiteFiles.AddRange(["google", "cn", "geolocation-cn", "category-ads-all"]);
+
+        // Download files
        var path = Utils.GetBinPath("srss");
        if (!Directory.Exists(path))
        {
            Directory.CreateDirectory(path);
        }
+
        foreach (var item in geoipFiles.Distinct())
        {
            await UpdateSrsFile("geoip", item);
@@ -412,6 +411,63 @@ public class UpdateService(Config config, Func<bool, string, Task> updateFunc)
        }
    }

+    private void AddPrefixedItems(List<string>? items, string prefix, List<string> output)
+    {
+        if (items == null)
+        {
+            return;
+        }
+
+        foreach (var item in items)
+        {
+            if (item.StartsWith(prefix))
+            {
+                output.Add(item.Substring(prefix.Length));
+            }
+        }
+    }
+
+    private void ExtractDnsRuleSets(string? dnsJson, List<string> geoipFiles, List<string> geoSiteFiles)
+    {
+        if (string.IsNullOrEmpty(dnsJson))
+        {
+            return;
+        }
+
+        try
+        {
+            var dns = JsonUtils.Deserialize<Dns4Sbox>(dnsJson);
+            if (dns?.rules != null)
+            {
+                foreach (var rule in dns.rules)
+                {
+                    ExtractSrsRuleSets(rule, geoipFiles, geoSiteFiles);
+                }
+            }
+        }
+        catch { }
+    }
+
+    private void ExtractSrsRuleSets(Rule4Sbox? rule, List<string> geoipFiles, List<string> geoSiteFiles)
+    {
+        if (rule == null)
+        {
+            return;
+        }
+
+        AddPrefixedItems(rule.rule_set, "geosite-", geoSiteFiles);
+        AddPrefixedItems(rule.rule_set, "geoip-", geoipFiles);
+
+        // Handle nested rules recursively
+        if (rule.rules != null)
+        {
+            foreach (var nestedRule in rule.rules)
+            {
+                ExtractSrsRuleSets(nestedRule, geoipFiles, geoSiteFiles);
+            }
+        }
+    }
+
    private async Task UpdateSrsFile(string type, string srsName)
    {
        var srsUrl = string.IsNullOrEmpty(_config.ConstItem.SrsSourceUrl)
@@ -27,6 +27,8 @@ public class AddGroupServerViewModel : MyReactiveObject

    public IObservableCollection<ProfileItem> ChildItemsObs { get; } = new ObservableCollectionExtended<ProfileItem>();

+    public IObservableCollection<ProfileItem> AllProfilePreviewItemsObs { get; } = new ObservableCollectionExtended<ProfileItem>();
+
    //public ReactiveCommand<Unit, Unit> AddCmd { get; }
    public ReactiveCommand<Unit, Unit> RemoveCmd { get; }

@@ -79,8 +81,8 @@ public class AddGroupServerViewModel : MyReactiveObject

    public async Task Init()
    {
-        ProfileGroupItemManager.Instance.TryGet(SelectedSource.IndexId, out var profileGroup);
-        PolicyGroupType = (profileGroup?.MultipleLoad ?? EMultipleLoad.LeastPing) switch
+        var protocolExtra = SelectedSource.GetProtocolExtra();
+        PolicyGroupType = (protocolExtra?.MultipleLoad ?? EMultipleLoad.LeastPing) switch
        {
            EMultipleLoad.LeastPing => ResUI.TbLeastPing,
            EMultipleLoad.Fallback => ResUI.TbFallback,
@@ -93,23 +95,12 @@ public class AddGroupServerViewModel : MyReactiveObject
        var subs = await AppManager.Instance.SubItems();
        subs.Add(new SubItem());
        SubItems.AddRange(subs);
-        SelectedSubItem = SubItems.Where(s => s.Id == profileGroup?.SubChildItems).FirstOrDefault();
-        Filter = profileGroup?.Filter;
+        SelectedSubItem = SubItems.FirstOrDefault(s => s.Id == protocolExtra?.SubChildItems);
+        Filter = protocolExtra?.Filter;

-        var childItemMulti = ProfileGroupItemManager.Instance.GetOrCreateAndMarkDirty(SelectedSource?.IndexId);
-        if (childItemMulti != null)
-        {
-            var childIndexIds = Utils.String2List(childItemMulti.ChildItems) ?? [];
-            foreach (var item in childIndexIds)
-            {
-                var child = await AppManager.Instance.GetProfileItem(item);
-                if (child == null)
-                {
-                    continue;
-                }
-                ChildItemsObs.Add(child);
-            }
-        }
+        var childIndexIds = Utils.String2List(protocolExtra?.ChildItems) ?? [];
+        var childItemList = await AppManager.Instance.GetProfileItemsOrderedByIndexIds(childIndexIds);
+        ChildItemsObs.AddRange(childItemList);
    }

    public async Task ChildRemoveAsync()
@@ -186,6 +177,32 @@ public class AddGroupServerViewModel : MyReactiveObject
        await Task.CompletedTask;
    }

+    private ProtocolExtraItem GetUpdatedProtocolExtra()
+    {
+        return SelectedSource.GetProtocolExtra() with
+        {
+            ChildItems =
+            Utils.List2String(ChildItemsObs.Where(s => !s.IndexId.IsNullOrEmpty()).Select(s => s.IndexId).ToList()),
+            MultipleLoad = PolicyGroupType switch
+            {
+                var s when s == ResUI.TbLeastPing => EMultipleLoad.LeastPing,
+                var s when s == ResUI.TbFallback => EMultipleLoad.Fallback,
+                var s when s == ResUI.TbRandom => EMultipleLoad.Random,
+                var s when s == ResUI.TbRoundRobin => EMultipleLoad.RoundRobin,
+                var s when s == ResUI.TbLeastLoad => EMultipleLoad.LeastLoad,
+                _ => EMultipleLoad.LeastPing,
+            },
+            SubChildItems = SelectedSubItem?.Id,
+            Filter = Filter,
+        };
+    }
+
+    public async Task UpdatePreviewList()
+    {
+        AllProfilePreviewItemsObs.Clear();
+        AllProfilePreviewItemsObs.AddRange(await GroupProfileManager.GetChildProfileItemsByProtocolExtra(GetUpdatedProtocolExtra()));
+    }
+
    private async Task SaveServerAsync()
    {
        var remarks = SelectedSource.Remarks;
@@ -205,38 +222,12 @@ public class AddGroupServerViewModel : MyReactiveObject
        {
            return;
        }
-        var childIndexIds = new List<string>();
-        foreach (var item in ChildItemsObs)
-        {
-            if (item.IndexId.IsNullOrEmpty())
-            {
-                continue;
-            }
-            childIndexIds.Add(item.IndexId);
-        }
-        var profileGroup = ProfileGroupItemManager.Instance.GetOrCreateAndMarkDirty(SelectedSource.IndexId);
-        profileGroup.ChildItems = Utils.List2String(childIndexIds);
-        profileGroup.MultipleLoad = PolicyGroupType switch
-        {
-            var s when s == ResUI.TbLeastPing => EMultipleLoad.LeastPing,
-            var s when s == ResUI.TbFallback => EMultipleLoad.Fallback,
-            var s when s == ResUI.TbRandom => EMultipleLoad.Random,
-            var s when s == ResUI.TbRoundRobin => EMultipleLoad.RoundRobin,
-            var s when s == ResUI.TbLeastLoad => EMultipleLoad.LeastLoad,
-            _ => EMultipleLoad.LeastPing,
-        };

-        profileGroup.SubChildItems = SelectedSubItem?.Id;
-        profileGroup.Filter = Filter;
+        var protocolExtra = GetUpdatedProtocolExtra();

-        var hasCycle = ProfileGroupItemManager.HasCycle(profileGroup.IndexId);
-        if (hasCycle)
-        {
-            NoticeManager.Instance.Enqueue(string.Format(ResUI.GroupSelfReference, remarks));
-            return;
-        }
+        SelectedSource.SetProtocolExtra(protocolExtra);

-        if (await ConfigHandler.AddGroupServerCommon(_config, SelectedSource, profileGroup, true) == 0)
+        if (await ConfigHandler.AddServerCommon(_config, SelectedSource) == 0)
        {
            NoticeManager.Instance.Enqueue(ResUI.OperationSuccess);
            _updateView?.Invoke(EViewAction.CloseWindow, null);
@@ -17,6 +17,222 @@ public class AddServerViewModel : MyReactiveObject
    [Reactive]
    public string CertSha { get; set; }

+    [Reactive]
+    public bool AllowInsecureCertFetch { get; set; }
+
+    [Reactive]
+    public string SalamanderPass { get; set; }
+
+    [Reactive]
+    public int AlterId { get; set; }
+
+    [Reactive]
+    public string Ports { get; set; }
+
+    [Reactive]
+    public int? UpMbps { get; set; }
+
+    [Reactive]
+    public int? DownMbps { get; set; }
+
+    [Reactive]
+    public string HopInterval { get; set; }
+
+    [Reactive]
+    public string Flow { get; set; }
+
+    [Reactive]
+    public string VmessSecurity { get; set; }
+
+    [Reactive]
+    public string VlessEncryption { get; set; }
+
+    [Reactive]
+    public string SsMethod { get; set; }
+
+    [Reactive]
+    public string WgPublicKey { get; set; }
+
+    //[Reactive]
+    //public string WgPresharedKey { get; set; }
+    [Reactive]
+    public string WgInterfaceAddress { get; set; }
+
+    [Reactive]
+    public string WgReserved { get; set; }
+
+    [Reactive]
+    public int WgMtu { get; set; }
+
+    [Reactive]
+    public bool Uot { get; set; }
+
+    [Reactive]
+    public string CongestionControl { get; set; }
+
+    [Reactive]
+    public int? InsecureConcurrency { get; set; }
+
+    [Reactive]
+    public bool NaiveQuic { get; set; }
+
+    [Reactive]
+    public string RawHeaderType { get; set; }
+
+    [Reactive]
+    public string Host { get; set; }
+
+    [Reactive]
+    public string Path { get; set; }
+
+    [Reactive]
+    public string XhttpMode { get; set; }
+
+    [Reactive]
+    public string XhttpExtra { get; set; }
+
+    [Reactive]
+    public string GrpcAuthority { get; set; }
+
+    [Reactive]
+    public string GrpcServiceName { get; set; }
+
+    [Reactive]
+    public string GrpcMode { get; set; }
+
+    [Reactive]
+    public string KcpHeaderType { get; set; }
+
+    [Reactive]
+    public string KcpSeed { get; set; }
+
+    public string TransportHeaderType
+    {
+        get => SelectedSource.GetNetwork() switch
+        {
+            nameof(ETransport.raw) => RawHeaderType,
+            nameof(ETransport.kcp) => KcpHeaderType,
+            nameof(ETransport.xhttp) => XhttpMode,
+            nameof(ETransport.grpc) => GrpcMode,
+            _ => string.Empty,
+        };
+        set
+        {
+            switch (SelectedSource.GetNetwork())
+            {
+                case nameof(ETransport.raw):
+                    RawHeaderType = value;
+                    break;
+
+                case nameof(ETransport.kcp):
+                    KcpHeaderType = value;
+                    break;
+
+                case nameof(ETransport.xhttp):
+                    XhttpMode = value;
+                    break;
+
+                case nameof(ETransport.grpc):
+                    GrpcMode = value;
+                    break;
+            }
+            this.RaisePropertyChanged();
+        }
+    }
+
+    public string TransportHost
+    {
+        get => SelectedSource.GetNetwork() switch
+        {
+            nameof(ETransport.raw) => Host,
+            nameof(ETransport.ws) => Host,
+            nameof(ETransport.httpupgrade) => Host,
+            nameof(ETransport.xhttp) => Host,
+            nameof(ETransport.grpc) => GrpcAuthority,
+            _ => string.Empty,
+        };
+        set
+        {
+            switch (SelectedSource.GetNetwork())
+            {
+                case nameof(ETransport.raw):
+                    Host = value;
+                    break;
+
+                case nameof(ETransport.ws):
+                    Host = value;
+                    break;
+
+                case nameof(ETransport.httpupgrade):
+                    Host = value;
+                    break;
+
+                case nameof(ETransport.xhttp):
+                    Host = value;
+                    break;
+
+                case nameof(ETransport.grpc):
+                    GrpcAuthority = value;
+                    break;
+            }
+            this.RaisePropertyChanged();
+        }
+    }
+
+    public string TransportPath
+    {
+        get => SelectedSource.GetNetwork() switch
+        {
+            nameof(ETransport.kcp) => KcpSeed,
+            nameof(ETransport.ws) => Path,
+            nameof(ETransport.httpupgrade) => Path,
+            nameof(ETransport.xhttp) => Path,
+            nameof(ETransport.grpc) => GrpcServiceName,
+            _ => string.Empty,
+        };
+        set
+        {
+            switch (SelectedSource.GetNetwork())
+            {
+                case nameof(ETransport.kcp):
+                    KcpSeed = value;
+                    break;
+
+                case nameof(ETransport.ws):
+                    Path = value;
+                    break;
+
+                case nameof(ETransport.httpupgrade):
+                    Path = value;
+                    break;
+
+                case nameof(ETransport.xhttp):
+                    Path = value;
+                    break;
+
+                case nameof(ETransport.grpc):
+                    GrpcServiceName = value;
+                    break;
+            }
+            this.RaisePropertyChanged();
+        }
+    }
+
+    public string TransportExtraText
+    {
+        get => SelectedSource.GetNetwork() == nameof(ETransport.xhttp)
+            ? XhttpExtra
+            : string.Empty;
+        set
+        {
+            if (SelectedSource.GetNetwork() == nameof(ETransport.xhttp))
+            {
+                XhttpExtra = value;
+            }
+            this.RaisePropertyChanged();
+        }
+    }
+
    public ReactiveCommand<Unit, Unit> FetchCertCmd { get; }
    public ReactiveCommand<Unit, Unit> FetchCertChainCmd { get; }
    public ReactiveCommand<Unit, Unit> SaveCmd { get; }
@@ -45,14 +261,21 @@ public class AddServerViewModel : MyReactiveObject
        this.WhenAnyValue(x => x.CertSha)
            .Subscribe(_ => UpdateCertTip());

+        this.WhenAnyValue(x => x.SelectedSource.Network)
+            .Subscribe(_ =>
+            {
+                this.RaisePropertyChanged(nameof(TransportHeaderType));
+                this.RaisePropertyChanged(nameof(TransportHost));
+                this.RaisePropertyChanged(nameof(TransportPath));
+                this.RaisePropertyChanged(nameof(TransportExtraText));
+            });
+
        this.WhenAnyValue(x => x.Cert)
            .Subscribe(_ => UpdateCertSha());

        if (profileItem.IndexId.IsNullOrEmpty())
        {
            profileItem.Network = Global.DefaultNetwork;
-            profileItem.HeaderType = Global.None;
-            profileItem.RequestHost = "";
            profileItem.StreamSecurity = "";
            SelectedSource = profileItem;
        }
@@ -63,6 +286,38 @@ public class AddServerViewModel : MyReactiveObject
        CoreType = SelectedSource?.CoreType?.ToString();
        Cert = SelectedSource?.Cert?.ToString() ?? string.Empty;
        CertSha = SelectedSource?.CertSha?.ToString() ?? string.Empty;
+
+        var protocolExtra = SelectedSource?.GetProtocolExtra();
+        var transport = SelectedSource?.GetTransportExtra();
+        Ports = protocolExtra?.Ports ?? string.Empty;
+        AlterId = int.TryParse(protocolExtra?.AlterId, out var result) ? result : 0;
+        Flow = protocolExtra?.Flow ?? string.Empty;
+        SalamanderPass = protocolExtra?.SalamanderPass ?? string.Empty;
+        UpMbps = protocolExtra?.UpMbps;
+        DownMbps = protocolExtra?.DownMbps;
+        HopInterval = protocolExtra?.HopInterval ?? string.Empty;
+        VmessSecurity = protocolExtra?.VmessSecurity?.IsNullOrEmpty() == false ? protocolExtra.VmessSecurity : Global.DefaultSecurity;
+        VlessEncryption = protocolExtra?.VlessEncryption.IsNullOrEmpty() == false ? protocolExtra.VlessEncryption : Global.None;
+        SsMethod = protocolExtra?.SsMethod ?? string.Empty;
+        WgPublicKey = protocolExtra?.WgPublicKey ?? string.Empty;
+        WgInterfaceAddress = protocolExtra?.WgInterfaceAddress ?? string.Empty;
+        WgReserved = protocolExtra?.WgReserved ?? string.Empty;
+        WgMtu = protocolExtra?.WgMtu ?? 1280;
+        Uot = protocolExtra?.Uot ?? false;
+        CongestionControl = protocolExtra?.CongestionControl ?? string.Empty;
+        InsecureConcurrency = protocolExtra?.InsecureConcurrency > 0 ? protocolExtra.InsecureConcurrency : null;
+        NaiveQuic = protocolExtra?.NaiveQuic ?? false;
+
+        RawHeaderType = transport.RawHeaderType ?? Global.None;
+        Host = transport.Host ?? string.Empty;
+        Path = transport.Path ?? string.Empty;
+        XhttpMode = transport.XhttpMode ?? Global.DefaultXhttpMode;
+        XhttpExtra = transport.XhttpExtra ?? string.Empty;
+        GrpcAuthority = transport.GrpcAuthority ?? string.Empty;
+        GrpcServiceName = transport.GrpcServiceName ?? string.Empty;
+        GrpcMode = transport.GrpcMode.IsNullOrEmpty() ? Global.GrpcGunMode : transport.GrpcMode;
+        KcpHeaderType = transport.KcpHeaderType.IsNullOrEmpty() ? Global.None : transport.KcpHeaderType;
+        KcpSeed = transport.KcpSeed ?? string.Empty;
    }

    private async Task SaveServerAsync()
@@ -87,12 +342,12 @@ public class AddServerViewModel : MyReactiveObject
        }
        if (SelectedSource.ConfigType == EConfigType.Shadowsocks)
        {
-            if (SelectedSource.Id.IsNullOrEmpty())
+            if (SelectedSource.Password.IsNullOrEmpty())
            {
                NoticeManager.Instance.Enqueue(ResUI.FillPassword);
                return;
            }
-            if (SelectedSource.Security.IsNullOrEmpty())
+            if (SsMethod.IsNullOrEmpty())
            {
                NoticeManager.Instance.Enqueue(ResUI.PleaseSelectEncryption);
                return;
@@ -100,7 +355,7 @@ public class AddServerViewModel : MyReactiveObject
        }
        if (SelectedSource.ConfigType is not EConfigType.SOCKS and not EConfigType.HTTP)
        {
-            if (SelectedSource.Id.IsNullOrEmpty())
+            if (SelectedSource.Password.IsNullOrEmpty())
            {
                NoticeManager.Instance.Enqueue(ResUI.FillUUID);
                return;
@@ -109,6 +364,47 @@ public class AddServerViewModel : MyReactiveObject
        SelectedSource.CoreType = CoreType.IsNullOrEmpty() ? null : (ECoreType)Enum.Parse(typeof(ECoreType), CoreType);
        SelectedSource.Cert = Cert.IsNullOrEmpty() ? string.Empty : Cert;
        SelectedSource.CertSha = CertSha.IsNullOrEmpty() ? string.Empty : CertSha;
+        if (!Global.Networks.Contains(SelectedSource.Network))
+        {
+            SelectedSource.Network = Global.DefaultNetwork;
+        }
+
+        var transport = new TransportExtraItem
+        {
+            RawHeaderType = RawHeaderType.NullIfEmpty(),
+            Host = Host.NullIfEmpty(),
+            Path = Path.NullIfEmpty(),
+            XhttpMode = XhttpMode.NullIfEmpty(),
+            XhttpExtra = XhttpExtra.NullIfEmpty(),
+            GrpcAuthority = GrpcAuthority.NullIfEmpty(),
+            GrpcServiceName = GrpcServiceName.NullIfEmpty(),
+            GrpcMode = GrpcMode.NullIfEmpty(),
+            KcpHeaderType = KcpHeaderType.NullIfEmpty(),
+            KcpSeed = KcpSeed.NullIfEmpty(),
+        };
+
+        SelectedSource.SetProtocolExtra(SelectedSource.GetProtocolExtra() with
+        {
+            Ports = Ports.NullIfEmpty(),
+            AlterId = AlterId > 0 ? AlterId.ToString() : null,
+            Flow = Flow.NullIfEmpty(),
+            SalamanderPass = SalamanderPass.NullIfEmpty(),
+            UpMbps = UpMbps,
+            DownMbps = DownMbps,
+            HopInterval = HopInterval.NullIfEmpty(),
+            VmessSecurity = VmessSecurity.NullIfEmpty(),
+            VlessEncryption = VlessEncryption.NullIfEmpty(),
+            SsMethod = SsMethod.NullIfEmpty(),
+            WgPublicKey = WgPublicKey.NullIfEmpty(),
+            WgInterfaceAddress = WgInterfaceAddress.NullIfEmpty(),
+            WgReserved = WgReserved.NullIfEmpty(),
+            WgMtu = WgMtu >= 576 ? WgMtu : null,
+            Uot = Uot ? true : null,
+            CongestionControl = CongestionControl.NullIfEmpty(),
+            InsecureConcurrency = InsecureConcurrency > 0 ? InsecureConcurrency : null,
+            NaiveQuic = NaiveQuic ? true : null,
+        });
+        SelectedSource.SetTransportExtra(transport);

        if (await ConfigHandler.AddServer(_config, SelectedSource) == 0)
        {
@@ -141,7 +437,7 @@ public class AddServerViewModel : MyReactiveObject
            return;
        }

-        List<string> shaList = new();
+        List<string> shaList = [];
        foreach (var cert in certList)
        {
            var sha = CertPemManager.GetCertSha256Thumbprint(cert);
@@ -151,7 +447,7 @@ public class AddServerViewModel : MyReactiveObject
            }
            shaList.Add(sha);
        }
-        CertSha = string.Join('~', shaList);
+        CertSha = string.Join(',', shaList);
    }

    private async Task FetchCert()
@@ -164,23 +460,18 @@ public class AddServerViewModel : MyReactiveObject
        var serverName = SelectedSource.Sni;
        if (serverName.IsNullOrEmpty())
        {
-            serverName = SelectedSource.RequestHost;
+            serverName = GetCurrentTransportHost();
        }
        if (serverName.IsNullOrEmpty())
        {
            serverName = SelectedSource.Address;
        }
-        if (!Utils.IsDomain(serverName))
-        {
-            UpdateCertTip(ResUI.ServerNameMustBeValidDomain);
-            return;
-        }
        if (SelectedSource.Port > 0)
        {
            domain += $":{SelectedSource.Port}";
        }

-        (Cert, var certError) = await CertPemManager.Instance.GetCertPemAsync(domain, serverName);
+        (Cert, var certError) = await CertPemManager.Instance.GetCertPemAsync(domain, serverName, allowInsecure: AllowInsecureCertFetch);
        UpdateCertTip(certError);
    }

@@ -194,24 +485,32 @@ public class AddServerViewModel : MyReactiveObject
        var serverName = SelectedSource.Sni;
        if (serverName.IsNullOrEmpty())
        {
-            serverName = SelectedSource.RequestHost;
+            serverName = GetCurrentTransportHost();
        }
        if (serverName.IsNullOrEmpty())
        {
            serverName = SelectedSource.Address;
        }
-        if (!Utils.IsDomain(serverName))
-        {
-            UpdateCertTip(ResUI.ServerNameMustBeValidDomain);
-            return;
-        }
        if (SelectedSource.Port > 0)
        {
            domain += $":{SelectedSource.Port}";
        }

-        var (certs, certError) = await CertPemManager.Instance.GetCertChainPemAsync(domain, serverName);
+        var (certs, certError) = await CertPemManager.Instance.GetCertChainPemAsync(domain, serverName, allowInsecure: AllowInsecureCertFetch);
        Cert = CertPemManager.ConcatenatePemChain(certs);
        UpdateCertTip(certError);
    }
+
+    private string GetCurrentTransportHost()
+    {
+        return SelectedSource.GetNetwork() switch
+        {
+            nameof(ETransport.raw) => Host,
+            nameof(ETransport.ws) => Host,
+            nameof(ETransport.httpupgrade) => Host,
+            nameof(ETransport.xhttp) => Host,
+            nameof(ETransport.grpc) => GrpcAuthority,
+            _ => string.Empty,
+        };
+    }
 }
@@ -204,7 +204,7 @@ public class CheckUpdateViewModel : MyReactiveObject

    private async Task UpdateFinishedSub(bool blReload)
    {
-        RxApp.MainThreadScheduler.Schedule(blReload, (scheduler, blReload) =>
+        RxSchedulers.MainThreadScheduler.Schedule(blReload, (scheduler, blReload) =>
        {
            _ = UpdateFinishedResult(blReload);
            return Disposable.Empty;
@@ -317,7 +317,7 @@ public class CheckUpdateViewModel : MyReactiveObject
            Remarks = msg,
        };

-        RxApp.MainThreadScheduler.Schedule(item, (scheduler, model) =>
+        RxSchedulers.MainThreadScheduler.Schedule(item, (scheduler, model) =>
        {
            _ = UpdateViewResult(model);
            return Disposable.Empty;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
2dust	c4e071cac3	up 7.21.0	2026-04-24 14:39:38 +08:00
2dust	798831128a	Update Directory.Packages.props	2026-04-24 14:34:05 +08:00
DHR60	a2de087aef	Fix (#9171 )	2026-04-21 17:17:25 +08:00
DHR60	89bc012c95	Fix (#9166 )	2026-04-21 09:51:28 +08:00
2dust	39ef5d8174	Default to first sub; update SubIndexId on delete https://github.com/2dust/v2rayN/issues/9151	2026-04-20 19:23:45 +08:00
DHR60	90b055e364	Remove legacy sing-box dns compatibility (#9163 )	2026-04-20 18:58:56 +08:00
DHR60	d67321eed0	Add more test (#9162 ) * Add test Add more test and fmt test * Update to xunit.v3	2026-04-20 18:58:36 +08:00
Bonjour LI	67592d1922	CI: Sleep 0-2s for race condition between matrix jobs (#9161 )	2026-04-20 18:58:26 +08:00
DHR60	c5db319e0e	URL test apply fragment (#9157 )	2026-04-20 09:19:26 +08:00
Bonjour LI	6a7b359fcc	CI: Explicitly define GitHub token permissions in config (#9155 ) GitHub has updated its behavior: new forks no longer inherit the original repository's GitHub token permissions. To ensure consistent access, this change explicitly defines the required permissions in the configuration file.	2026-04-20 09:15:23 +08:00
DHR60	25d7f393b6	Fetch cert allow insecure (#8998 )	2026-04-19 17:16:06 +08:00
DHR60	171ed6f58f	Custom MessageBoxDialog (#9147 )	2026-04-19 17:06:15 +08:00
Mangoo	b604a5b787	fix: remove Save/Cancel from routing settings, save edits immediately (#9133 )	2026-04-19 14:25:53 +08:00
DHR60	35b98f945f	Support new fragment (#9122 )	2026-04-19 13:42:55 +08:00
DHR60	cabd0df282	Support kcp cwndMultiplier (#9113 )	2026-04-18 19:19:03 +08:00
DHR60	eeecef4db9	Fix (#9143 ) * Adjust XHTTP style * Add xray tun custom support	2026-04-18 19:18:17 +08:00
DHR60	021e64e20b	Fix (#9141 )	2026-04-18 15:23:42 +08:00
JieXu	452478434c	Fix & Update (#9126 ) * Update build-linux.yml * Update build-all.yml * Update build-linux.yml * Update build-linux.yml * Update build-linux.yml * Update OptionSettingWindow.axaml.cs * Update ResUI.fr.resx * Update package-rhel-riscv.sh * Update build-linux.yml * Update build-linux.yml * Update build-all.yml --------- Co-authored-by: xujie86 <167618598+xujie86@users.noreply.github.com>	2026-04-17 15:29:51 +08:00
DHR60	5305b0843b	Fix (#9128 )	2026-04-17 13:36:42 +08:00
DHR60	9f0ef36cc0	Refactor Transport (#9004 ) * Refactor transport * Rename tcp to raw * Fix * Fix Fix raw http ui Fill xhttp default mode Fix share uri Remove RawHost Fix singbox tcp http path Fix vmess share uri * Tidy Resx * Fix * Rename TransportExtra to TransportExtraItem --------- Co-authored-by: 2dust <31833384+2dust@users.noreply.github.com>	2026-04-16 20:21:10 +08:00
DHR60	494b35c1f7	Add xray tun support (#9063 ) * Add xray tun support * Revert mtu list	2026-04-16 19:17:44 +08:00
2dust	177ad7db3d	up 7.20.4	2026-04-16 13:39:52 +08:00
JieXu	3bda022574	Add RiscV64 RPM build && Update (#9114 ) * Create package-rhel-riscv.sh * Update build-linux.yml * Update UpdateService.cs * Update CoreInfo.cs * Add RiscV64 download URLs for various platforms * Update build-linux.yml * Update ResUI.fr.resx * Update ResUI.fr.resx * Update ResUI.fr.resx * Update proxy_set_linux_sh --------- Co-authored-by: xujie86 <167618598+xujie86@users.noreply.github.com>	2026-04-15 20:50:27 +08:00
DHR60	2ea9c5a2ff	Fix mux (#9117 )	2026-04-15 19:06:26 +08:00
DHR60	3cb2869920	Fix (#9110 )	2026-04-15 19:06:03 +08:00
Bonjour LI	43dcb90632	CI Workflow fix: rpm/deb runs-on (#9106 )	2026-04-14 14:29:52 +08:00
Bonjour LI	e56fca05fc	Refactor and Optimize CI Workflow (#9083 ) * Refactor and Optimize CI Workflow * Refactor and Optimize CI Workflow (Added input option value annotations for clarity.)	2026-04-14 09:41:07 +08:00
DHR60	495b5db4f1	Adjust DNS priority order (#9091 )	2026-04-13 10:59:37 +08:00
DHR60	dea143b20d	Add sing-box ua (#9087 ) * Add sing-box ua * Add curl and fix	2026-04-13 10:58:40 +08:00
2dust	0db611b7a9	up 7.20.3	2026-04-12 10:00:43 +08:00
2dust	c3d67d186a	Update xunit.runner and fix socks port names	2026-04-12 10:00:14 +08:00
DHR60	6b07ca63a0	Add sing-box send-through (#9081 ) * Add sing-box send-through * Perf resx	2026-04-12 09:25:17 +08:00
renwofei423	6c8f22ab86	feat(send-through): 支持配置本地出站地址 (#8946 ) * feat(send-through): 支持配置本地出站地址为 Xray 增加 SendThrough 配置项，允许指定本机 IPv4 作为出站源地址。 - 在核心设置页新增 SendThrough 输入框及中英文提示文案 - 保存配置时校验并持久化本机 IPv4 地址 - 生成 Xray 配置时为所有 outbound 写入 sendThrough 字段影响说明： - 仅对 Xray 生效，留空时不设置该字段 * fix(send-through): limit sendThrough to remote egress outbounds	2026-04-11 21:02:43 +08:00
DHR60	49f65579aa	Replace protect-ss with protect-socks (#9052 )	2026-04-11 19:45:23 +08:00
dependabot[bot]	a69e407bda	Bump actions/upload-artifact from 7.0.0 to 7.0.1 (#9073 ) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v7.0.0...v7.0.1) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-11 19:42:39 +08:00
taskmgr818	96e5c11fc7	Replace 100MB Cloudflare speedtest URL with 99MB (#9076 )	2026-04-11 19:39:25 +08:00
2dust	53041906b3	Use LibraryImport for native APIs	2026-04-06 20:16:30 +08:00
2dust	f2d929f40e	Update GlobalHotKeys	2026-04-06 20:00:48 +08:00
2dust	1160d8c154	Add Windows screen QR scan support for avalonia	2026-04-06 15:34:25 +08:00
2dust	75f2cbaef9	Code clean	2026-04-05 17:18:28 +08:00
2dust	55b08de5fe	up 7.20.2	2026-04-04 20:36:18 +08:00
2dust	14d598a232	Update Directory.Packages.props	2026-04-04 20:35:11 +08:00
nirvanalinlei	b3102b34b3	修复 sing-box TUN 模式下 relay 出站的 mux 问题 (#9018 ) * Fix sing-box selector generation for dynamic group tags * 修复 TUN 模式下 DNS 失败及 Windows 提权重启后 TUN 状态丢失 * 按上游意见回滚 TUN 提权时保留启用状态的改动	2026-04-02 20:47:34 +08:00
Miheichev Aleksandr Sergeevich	b556adaa09	i18n(ru): complete and improve Russian localization (#9021 ) Translate 9 previously untranslated strings and improve 104 existing translations in ResUI.ru.resx for accuracy, consistency and naturalness. New translations: - TbCustomDnsRay, TbCustomDnsSingbox — custom DNS labels - TbIcmpRoutingPolicy, TbInsecureConcurrency, TbLegacyProtect, TbUot - TbUsername, menuEditFormat, menuEditPaste Key improvements: - Unify "перезагрузка" → "перезапуск" for app restart context - Fix grammar: missing spaces before parentheses, hyphen in "по умолчанию", capitalization - Restore lost parts of original strings (Enter hint, restart notes, process in auto-sort list) - Fix incorrect translations: "системные узлы" → "системный файл hosts", "PublicKey" → "Открытый ключ", "Режим VPN" → "Включить TUN" - Improve naturalness: "Обнулить" → "Сбросить", "Просмотр" → "Обзор", "Содействие" → "Продвижение" - Align checkbox labels to infinitive form per Russian UI conventions - Standardize terminology across all proxy, routing, DNS settings 15 universal technical abbreviations (LAN, UUID, MTU, TLS, ALPN, SNI, FakeIP, Bootstrap DNS, etc.) intentionally kept as-is.	2026-04-01 09:47:15 +08:00
DHR60	fce86e1434	Finalmask check (#9024 )	2026-03-31 19:33:25 +08:00
DHR60	70003e8a81	Report node validator result (#9025 )	2026-03-31 19:30:11 +08:00
JieXu	e19b000081	fix (#9017 ) * Update package-rhel.sh * Enhance download_singbox function to handle cronet	2026-03-31 19:26:53 +08:00
2dust	7329dbae11	up 7.20.1	2026-03-30 20:46:52 +08:00
nirvanalinlei	695a073cd6	Fix sing-box selector generation for dynamic group tags (#9015 )	2026-03-30 20:12:36 +08:00
DHR60	01c85adedf	Show clash ui when tun enabled (#9010 )	2026-03-30 20:09:10 +08:00
2dust	2caf8ea14f	Bug fix https://github.com/2dust/v2rayN/issues/9016	2026-03-30 19:49:37 +08:00
2dust	1090afd774	up 7.20.0	2026-03-29 15:05:55 +08:00
2dust	c758c5abf9	Update Directory.Packages.props	2026-03-29 15:05:30 +08:00
DHR60	c61b023ab3	Allow enable legacy process name tun protect (#9005 )	2026-03-29 14:44:04 +08:00
DHR60	80178aeb2f	Fix xhttp dialer proxy (#8993 )	2026-03-26 19:55:53 +08:00
DHR60	005cb620ec	Add xhttp download protect (#8987 )	2026-03-24 19:18:54 +08:00
DHR60	7ddb46e74d	Xray browser header masquerading (#8981 )	2026-03-24 11:25:02 +08:00
DHR60	ad11a7e6a5	Support new hysteria2 stream settings (#8908 ) * Support new hysteria2 stream settings * Fix * Sync	2026-03-24 11:24:42 +08:00
DHR60	92c8c1463c	Fix (#8985 )	2026-03-24 11:24:26 +08:00
DHR60	661affd6a5	Tag add remark (#8980 )	2026-03-23 09:12:14 +08:00
DHR60	14c5b92423	Fix edge case (#8979 )	2026-03-23 09:11:33 +08:00
tt2563	74e5ead1ed	Update Traditional Chinese translation (#8973 ) * Update Traditional Chinese translation * Update confirmation message for removing nodes	2026-03-22 14:33:47 +08:00
DHR60	2caec729fc	Protect xhttp split address (#8970 )	2026-03-21 19:59:52 +08:00
DHR60	194c240243	Add ICMP routing (#8894 )	2026-03-21 19:55:34 +08:00
DHR60	db9fe9c5ea	Fix (#8972 )	2026-03-21 19:47:04 +08:00
DHR60	bbfd93f5a3	Add sing-box ech query server name (#8869 )	2026-03-21 16:55:43 +08:00
DHR60	04783ecf44	Add NaiveProxy support (#8819 ) * Add UoT support * Add NaiveProxy support * Fix	2026-03-21 16:54:36 +08:00
2dust	5fbcc46013	up 7.19.5	2026-03-20 17:59:19 +08:00
2dust	90f7b8b751	Update Directory.Packages.props	2026-03-20 16:45:55 +08:00
DHR60	dd94199bbb	Json editor with syntax highlighting (#8932 ) * Add json editor * Replace JsonEditor with TextBox * Replace JsonEditor with TextBox * Remove TextMateSharp.Grammars * Fix two way bind * Update ResUI.ru.resx --------- Co-authored-by: 2dust <31833384+2dust@users.noreply.github.com>	2026-03-20 16:32:02 +08:00
Miheichev Aleksandr Sergeevich	0cec5986cd	i18n(ru): translate 68 untranslated strings in Russian localization (#8931 ) Complete the Russian (ru) localization by translating all remaining English strings in ResUI.ru.resx. Categories include: - Policy Group and Proxy Chain UI elements - Routing and DNS settings/tips - Certificate Pinning UI - Core error and warning messages - Server list and menu items - System proxy and miscellaneous settings 5 universal technical abbreviations (LAN, UUID, User-Agent, MTU, TLS) are intentionally kept as-is per standard Russian IT terminology.	2026-03-20 16:19:37 +08:00
JieXu	a2929c6086	Update package-debian.sh (#8941 ) * Update package-debian.sh * Update build-linux.yml * Update package-debian.sh * Update package-debian.sh * Update package-debian.sh * Update package-rhel.sh * Update package-debian.sh * Update package-debian.sh * Update package-rhel.sh * Update package-debian.sh * Update package-rhel.sh * Update package-debian.sh * Update package-rhel.sh * Update package-rhel.sh * Update package-rhel.sh * Update package-debian.sh * Update package-rhel.sh	2026-03-20 14:25:42 +08:00
2dust	eb0ef90ed2	Bug fix https://github.com/2dust/v2rayN/issues/8906	2026-03-15 20:11:45 +08:00
2dust	214a09bc48	up 7.19.4	2026-03-13 10:44:20 +08:00
2dust	e6af9ab342	Fix https://github.com/2dust/v2rayN/issues/8916	2026-03-13 10:36:58 +08:00
DHR60	0f4031f445	Update dep (#8926 )	2026-03-12 20:45:28 +08:00
2dust	5cf3d6eff6	Modify routing rule process name description	2026-03-12 17:19:30 +08:00
2dust	17ed26cd06	Improve profile matching for Subscription, remove old option	2026-03-12 14:56:01 +08:00
2dust	5e18567ce6	Modify routing rule process name description	2026-03-12 14:21:21 +08:00
2dust	06cec89ec9	up 7.19.3	2026-03-10 17:38:03 +08:00
2dust	26f65dd3b2	Code cleanup: pattern matching and minor fixes	2026-03-10 17:19:21 +08:00
2dust	0c2114d2e1	Refactor SRS rule collection and add DNS parsing	2026-03-10 15:29:36 +08:00
DHR60	4af528f8e2	Typo (#8917 )	2026-03-10 14:10:23 +08:00
DHR60	588e82f0d9	Tun ech protect (#8915 )	2026-03-10 09:16:16 +08:00
DHR60	0c13488410	Fix (#8914 ) * Fix * Fix	2026-03-10 09:14:57 +08:00
DHR60	a88396c11d	Fix custom config sub chain (#8913 )	2026-03-10 09:13:52 +08:00
DHR60	ef5fee9975	Fix (#8909 )	2026-03-08 19:00:27 +08:00
2dust	df800a60c2	Persist DataGrid column layout for ClashConnectionsView	2026-03-08 18:59:56 +08:00
2dust	679bd8afcc	Persist DataGrid column layout for ClashConnectionsView https://github.com/2dust/v2rayN/issues/8893	2026-03-08 17:57:09 +08:00
DHR60	66e1aeae1f	Fix speedtest core type (#8900 ) * Fix speedtest core type * Simplify code	2026-03-07 16:36:03 +08:00
dependabot[bot]	e03c22092f	Bump actions/setup-dotnet from 5.0.1 to 5.2.0 (#8891 ) Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.0.1 to 5.2.0. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](https://github.com/actions/setup-dotnet/compare/v5.0.1...v5.2.0) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-07 16:33:41 +08:00
2dust	c0aa829abb	up 7.19.2	2026-03-05 09:49:46 +08:00
DHR60	b8f7cc0768	Fix hosts matching (#8890 ) * Fix hosts matching * Fix hosts resolve rule * Fix	2026-03-04 20:13:06 +08:00
2dust	81da72bb39	Fix https://github.com/2dust/v2rayN/issues/8881	2026-03-04 19:11:31 +08:00
2dust	d9201157c8	Bug fix https://github.com/2dust/v2rayN/issues/8875	2026-03-04 18:58:59 +08:00
2dust	e179d5bc42	Fix https://github.com/2dust/v2rayN/issues/8870	2026-03-03 16:03:23 +08:00
2dust	4d2f32099e	Bug fix https://github.com/2dust/v2rayN/issues/8879	2026-03-03 10:07:48 +08:00
2dust	f24a79aa2c	Bug fix https://github.com/2dust/v2rayN/issues/8875	2026-03-02 20:18:07 +08:00
2dust	9a3604e89b	Bug fix https://github.com/2dust/v2rayN/issues/8874	2026-03-02 20:00:02 +08:00
DHR60	fd7cf0d453	Fix xray custom dns (#8872 )	2026-03-02 19:46:01 +08:00
tt2563	65cf782eb0	更新繁體中文翻譯 (#8873 ) Co-authored-by: ertet <sfsa@sdaf.cc>	2026-03-02 19:44:53 +08:00
2dust	bfa9eaa5ec	up 7.19.1	2026-03-02 09:31:57 +08:00
2dust	cea725ae3d	Update Directory.Packages.props	2026-03-02 09:31:34 +08:00
DHR60	c9df9a0001	Fix (#8868 )	2026-03-01 19:44:44 +08:00
DHR60	56f1794e47	Fix DNS rule (#8866 )	2026-03-01 18:38:16 +08:00
DHR60	a71ebbd01c	Optimize (#8862 ) * Relax group type restrictions * Optimize db read	2026-03-01 17:41:59 +08:00
DHR60	9f6237fb21	Speedtest respect user-set core type (#8856 ) * Respect user-set core type * Allow test group	2026-03-01 16:11:40 +08:00
DHR60	99d67ca3f1	Fix DNS routing (#8841 )	2026-03-01 14:41:02 +08:00
2dust	d56e896f07	Ignore json file extensions in IsDomain	2026-03-01 14:20:05 +08:00
DHR60	6b4ae5a386	Fix (#8864 ) * Fix * Build all contexts * Notify validator result * Fix	2026-03-01 13:47:48 +08:00
DHR60	a3ff31088e	Perf Policy Group generate (#8855 ) * Perf Policy Group generate * Scroll to new group node * Add region group * I18n * Fix * Fix * Move default filter to Global * Default Filter List * Increase UI column widths for AddGroupServerWindow --------- Co-authored-by: 2dust <31833384+2dust@users.noreply.github.com>	2026-03-01 10:05:03 +08:00
DHR60	584e538623	Refactor node pre check (#8848 ) * Refactor node pre check * Rename method * I18n * Add remark not found warnings * Fix * Fix * Fix * Update v2rayN/ServiceLib/Handler/CoreConfigHandler.cs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-02-28 16:31:02 +08:00
JieXu	67c4ae02ba	Fix bugs (#8854 ) * Update package-rhel.sh * Update package-debian.sh * Update ResUI.fr.resx * Update package-rhel.sh * Update package-rhel.sh	2026-02-27 15:15:31 +08:00
2dust	ed1275e29f	Upgrade Downloader to 4.1.1 and update API usage	2026-02-27 11:21:51 +08:00
dependabot[bot]	0cf07e925f	Bump actions/download-artifact from 7 to 8 (#8851 ) Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v7...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-02-27 11:04:20 +08:00
dependabot[bot]	49e487886d	Bump actions/upload-artifact from 6.0.0 to 7.0.0 (#8850 ) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v6.0.0...v7.0.0) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-02-27 11:04:16 +08:00
DHR60	ad07f281c7	Fix routing (#8849 ) Fix	2026-02-27 11:04:00 +08:00
2dust	f98f517368	up 7.19.0	2026-02-26 19:58:34 +08:00
2dust	7931058342	Centralize active network info retrieval	2026-02-26 17:34:57 +08:00
2dust	b53507f486	Update Directory.Packages.props	2026-02-26 15:40:03 +08:00
DHR60	68ea10158a	Fix udphop (#8843 )	2026-02-26 15:08:50 +08:00
DHR60	2f35e7a99c	Fix fragment (#8840 )	2026-02-26 15:07:24 +08:00
DHR60	3c1ecf085b	Tun protect (#8779 ) * Tun protect * Remove EnableExInbound * Fix * Fix balancer tag * Fix --------- Co-authored-by: 2dust <31833384+2dust@users.noreply.github.com>	2026-02-26 15:06:17 +08:00
DHR60	3a5293bf87	Fix cert separator (#8837 )	2026-02-25 19:30:29 +08:00
DHR60	ac43bb051d	Node test with sub chain (#8778 )	2026-02-25 19:28:20 +08:00
DHR60	7b31bcdd9f	Add Finalmask support (#8820 ) * Add Finalmask support * UI	2026-02-24 21:09:17 +08:00
DHR60	aea7078e95	Add IP cert support (#8833 )	2026-02-24 19:58:23 +08:00
DHR60	9c82df5b49	Refactor core config gen (#8768 ) * Refactor core config gen * Update tag naming * Support sing-box 1.11 DNS * Fix * Optimize ProfileItem acquisition speed * Fix * Fix	2026-02-24 19:48:59 +08:00
JieXu	b5800f7dfc	Update SingboxDnsService.cs (#8775 ) * Update Utils.cs * Update SingboxDnsService.cs * Update package-rhel.sh * Update package-rhel.sh * Withdraw	2026-02-07 19:31:35 +08:00
DHR60	0f3a3eac02	Group preview (#8760 ) * Group Preview * Fix	2026-02-06 14:33:58 +08:00
2dust	54608ab2b9	Adjust GroupProfileManager	2026-02-06 14:15:21 +08:00
2dust	6167624443	Rename ProfileItems to ProfileModels and refactor	2026-02-06 13:50:47 +08:00
2dust	7a58e78381	Refactor profile migration and add group handling	2026-02-06 11:45:26 +08:00
DHR60	677e81f9a7	Refactor profile item config (#8659 ) * Refactor * Add hysteria2 bandwidth and hop interval support * Upgrade config version and rename * Refactor id and security * Refactor flow * Fix hy2 bbr * Fix warning CS0618 * Remove unused code * Fix hy2 migrate * Fix * Refactor * Refactor ProfileItem protocol extra handling * Refactor, use record instead of class * Hy2 SalamanderPass * Fix Tuic * Fix group * Fix Tuic * Fix hy2 Brutal Bandwidth * Clean Code * Fix * Support interval range * Add Username --------- Co-authored-by: 2dust <31833384+2dust@users.noreply.github.com>	2026-02-05 19:48:33 +08:00
DHR60	d9843dc775	Add DNS Hosts features (#8756 )	2026-02-05 17:05:27 +08:00
2dust	bceebc1661	Add process to routing domains https://github.com/2dust/v2rayN/issues/8757	2026-02-05 16:52:48 +08:00