fix(finalmask): keep a single udphop mask last in every client finalmask

xray-core reverses finalmask.udp and refuses, at dial time, a mask that
dials its own socket (udphop) anywhere but the socket end: "incorrect
index". xray run -test still says Configuration OK, so the failure only
shows as a client that never connects.

UDPHopClientMaskFix turned a global subJsonFinalMask hop and a host hop
into udphop masks; the JSON subscription then appended both, leaving two
hoppers with the first one misplaced, and a host mask merged after a
global hop pushed it off the end too. A hand-ordered template outbound
or an imported fm= could carry the same order.

maskcompat.NormalizeUDPHop keeps the last-listed udphop alone at the end
of udp, and runs wherever a client finalmask is produced: each JSON
subscription endpoint, share-link fm=, the Go and frontend link
importers and the template outbound heal in GetXrayConfig. The JSON
subscription resolves competing hop ranges most specific first: a host
hop wins over the inbound's own, which wins over the global default.

frontend/src/lib/xray/outbound-link-parser.ts

@@ -1,6 +1,6 @@
 import { Base64 } from '@/utils';
 
-import { upgradeLegacyUdpHop } from './udphop-mask';
+import { normalizeUdpHop, upgradeLegacyUdpHop } from './udphop-mask';
 import { upgradeLegacyXdnsMasks } from './xdns-mask';
 
 // Focused share-link parser for the OutboundFormModal's link-import
@@ -283,7 +283,7 @@ function applyFinalMaskParam(stream: Raw, params: URLSearchParams): void {
       if (parsed && typeof parsed === 'object') {
         sanitizeFinalMaskQuicParams(parsed);
         if (Array.isArray(parsed.udp)) parsed.udp = upgradeLegacyXdnsMasks(parsed.udp).next;
-        stream.finalmask = upgradeLegacyUdpHop(parsed).next;
+        stream.finalmask = normalizeUdpHop(upgradeLegacyUdpHop(parsed).next).next;
       }
     } catch {
       // malformed fm — leave streamSettings.finalmask absent

frontend/src/lib/xray/udphop-mask.ts

@@ -18,7 +18,7 @@ export function upgradeLegacyUdpHop(finalmask: Raw): { next: Raw; changed: boole
 
   const hop = (udpHop && typeof udpHop === 'object' ? udpHop : {}) as Raw;
   const udp = Array.isArray(finalmask.udp) ? [...(finalmask.udp as unknown[])] : [];
-  const hasMask = udp.some((m) => String((m as Raw | null)?.type ?? '').toLowerCase() === 'udphop');
+  const hasMask = udp.some(isUdpHopMask);
   if (!isEmptyHopValue(hop.ports) && !hasMask) {
     const settings: Raw = { mode: 'intervalRemote', remotePorts: hop.ports };
     if (!isEmptyHopValue(hop.interval)) settings.interval = hop.interval;
@@ -27,3 +27,22 @@ export function upgradeLegacyUdpHop(finalmask: Raw): { next: Raw; changed: boole
   }
   return { next, changed: true };
 }
+
+function isUdpHopMask(mask: unknown): boolean {
+  return String((mask as Raw | null)?.type ?? '').toLowerCase() === 'udphop';
+}
+
+// Mirrors maskcompat.NormalizeUDPHop: the core reverses the UDP masks and refuses ("incorrect
+// index") a udphop anywhere but the socket end, so the last one listed is kept alone, last.
+export function normalizeUdpHop(finalmask: Raw): { next: Raw; changed: boolean } {
+  const udp = Array.isArray(finalmask.udp) ? (finalmask.udp as unknown[]) : [];
+  const hops = udp.filter(isUdpHopMask);
+  if (hops.length === 0 || (hops.length === 1 && isUdpHopMask(udp[udp.length - 1]))) {
+    return { next: finalmask, changed: false };
+  }
+  const next = {
+    ...finalmask,
+    udp: [...udp.filter((m) => !isUdpHopMask(m)), hops[hops.length - 1]],
+  };
+  return { next, changed: true };
+}

frontend/src/test/outbound-link-parser.test.ts

@@ -507,6 +507,23 @@ describe('parseHysteria2Link', () => {
     });
   });
 
+  // The core reverses the UDP masks and refuses a udphop anywhere but last ("incorrect index"),
+  // so an import of a link that lists it first must reorder it like the Go importer does.
+  it('moves a udphop mask listed first in fm= to the end', () => {
+    const hop = {
+      type: 'udphop',
+      settings: { mode: 'intervalRemote', remotePorts: '20000-30000' },
+    };
+    const salamander = { type: 'salamander', settings: { password: 's3cr3t' } };
+    const fm = encodeURIComponent(JSON.stringify({ udp: [hop, salamander] }));
+    const out = parseHysteria2Link(
+      `hysteria2://auth@hy.example.com:443?sni=hy.example.com&fm=${fm}#hy`,
+    );
+    expect((out!.streamSettings as Record<string, unknown>).finalmask).toEqual({
+      udp: [salamander, hop],
+    });
+  });
+
   it('parses a hysteria2:// link with sni', () => {
     const link = 'hysteria2://auth-secret@srv.example:443?sni=example.com#imported-hy2';
     const out = parseHysteria2Link(link);