feat(xray): add the MASQUE protocol and transport

xray-core v26.10.10 serves MASQUE: CONNECT-IP over HTTP/3 or HTTP/2,
always behind TLS, as an inbound and an outbound protocol riding a
dedicated "masque" transport. The panel could not create either.

Inbound: MASQUE is a multi-user protocol whose users log in with their
email and password over Basic auth. The panel keeps the client's
"password" like trojan and GenXrayInboundConfig hands it to the core as
"pass", so the full-config path, the live AddInbound path and node
pushes all emit what the core reads; one user with an empty pass makes
the core refuse the whole inbound. Live user adds build a masque.Account
from either key, client-only changes diff per user so a new client does
not drop every connected tunnel, and client creation, copy, validation
and edits key on the password. The address pool and MTU get form
fields, TLS is mandatory, and the port check follows the core's
listener choice: HTTP/2 on TCP when the ALPN offers h2, HTTP/3 on UDP
when it offers h3 or not h2. Nodes may host MASQUE from v3.9.1, the
first panel release that knows to rename the password.

MASQUE has no share-link format, so links and Clash skip it; the JSON
subscription builds the client's masque outbound with its email and
password, and the subscription allowlist now lets a subId see MASQUE
inbounds at all. The IP-limit job, client pages and traffic tracking
list the protocol.

Outbound: the form edits the server, remote DNS, and the transport's
host, path, Basic credentials, headers and WARP block (enrolled key,
endpoint public key, tunnel addresses), which xray-core refuses next to
user/pass. The outbound test probes it through the core, since its
default HTTP/3 dial is UDP.

frontend/src/components/command-palette/CommandPalette.tsx

@@ -363,6 +363,7 @@ export default function CommandPalette() {
           'shadowsocks',
           'wireguard',
           'hysteria',
+          'masque',
         ],
         icon: <ImportOutlined />,
       },

frontend/src/lib/xray/inbound-defaults.ts

@@ -4,6 +4,10 @@ import { generateAwgObfuscation } from '@/lib/xray/amneziawg-obfuscation';
 import type { AmneziawgInboundSettings } from '@/schemas/protocols/inbound/amneziawg';
 import type { HttpInboundSettings } from '@/schemas/protocols/inbound/http';
 import type { HysteriaClient, HysteriaInboundSettings } from '@/schemas/protocols/inbound/hysteria';
+import {
+  MASQUE_DEFAULT_ADDRESS_POOL,
+  type MasqueInboundSettings,
+} from '@/schemas/protocols/inbound/masque';
 import type { MixedInboundSettings } from '@/schemas/protocols/inbound/mixed';
 import type { MtprotoClient, MtprotoInboundSettings } from '@/schemas/protocols/inbound/mtproto';
 import type {
@@ -338,6 +342,10 @@ export function createDefaultAmneziawgInboundSettings(): AmneziawgInboundSetting
   };
 }
 
+export function createDefaultMasqueInboundSettings(): MasqueInboundSettings {
+  return { clients: [], address: [...MASQUE_DEFAULT_ADDRESS_POOL] };
+}
+
 export function createDefaultTuicInboundSettings(): TuicInboundSettings {
   return {
     server: {
@@ -375,7 +383,8 @@ export type AnyInboundSettings =
   | WireguardInboundSettings
   | MtprotoInboundSettings
   | AmneziawgInboundSettings
-  | TuicInboundSettings;
+  | TuicInboundSettings
+  | MasqueInboundSettings;
 
 export function createDefaultInboundSettings(protocol: string): AnyInboundSettings | null {
   switch (protocol) {
@@ -405,6 +414,8 @@ export function createDefaultInboundSettings(protocol: string): AnyInboundSettin
       return createDefaultAmneziawgInboundSettings();
     case 'tuic':
       return createDefaultTuicInboundSettings();
+    case 'masque':
+      return createDefaultMasqueInboundSettings();
     default:
       return null;
   }

frontend/src/lib/xray/inbound-form-adapter.ts

@@ -8,6 +8,7 @@ import type { InboundSettings } from '@/schemas/protocols/inbound';
 import {
   AmneziawgClientSchema,
   HysteriaClientSchema,
+  MasqueClientSchema,
   MtprotoClientSchema,
   ShadowsocksClientSchema,
   TrojanClientSchema,
@@ -139,6 +140,8 @@ const NETWORK_SETTINGS_KEY: Record<string, string> = {
   httpupgrade: 'httpupgradeSettings',
   xhttp: 'xhttpSettings',
   hysteria: 'hysteriaSettings',
+  xdrive: 'xdriveSettings',
+  masque: 'masqueSettings',
 };
 
 function healStreamNetworkKey(stream: Record<string, unknown>): void {
@@ -288,6 +291,8 @@ function clientSchemaForProtocol(protocol: string): z.ZodType | null {
       return AmneziawgClientSchema;
     case 'tuic':
       return TuicClientSchema;
+    case 'masque':
+      return MasqueClientSchema;
     default:
       return null;
   }

frontend/src/lib/xray/inbound-tag.ts

@@ -21,6 +21,7 @@ function inboundTransports(
     protocol === 'tuic'
   )
     return UDP;
+  if (protocol === 'masque') return masqueTransports(streamSettings);
 
   let bits: TransportBits = 0;
   const network = asString(streamSettings?.network);
@@ -48,6 +49,18 @@ function inboundTransports(
   return bits;
 }
 
+// MASQUE listens HTTP/2 on TCP when the ALPN offers h2, HTTP/3 on UDP when it offers
+// h3 or does not offer h2.
+function masqueTransports(streamSettings: Record<string, unknown> | undefined): TransportBits {
+  const tls = streamSettings?.tlsSettings as { alpn?: unknown } | undefined;
+  const alpn = Array.isArray(tls?.alpn) ? (tls.alpn as unknown[]) : [];
+  const h2 = alpn.includes('h2');
+  let bits: TransportBits = 0;
+  if (h2) bits |= TCP;
+  if (!h2 || alpn.includes('h3')) bits |= UDP;
+  return bits;
+}
+
 function transportTagSuffix(bits: TransportBits): string {
   if (bits === TCP) return 'tcp';
   if (bits === UDP) return 'udp';

frontend/src/lib/xray/inbound-tls-defaults.ts

@@ -31,6 +31,11 @@ export function createTlsSettingsWithDefaultCert(network?: string): Record<strin
   return tls;
 }
 
+// MASQUE serves HTTP/3 over QUIC by default, so it takes Hysteria's QUIC-ready TLS.
+export function createMasqueTlsSettingsWithDefaultCert(): Record<string, unknown> {
+  return createHysteriaTlsSettingsWithDefaultCert();
+}
+
 export function createHysteriaTlsSettingsWithDefaultCert(): Record<string, unknown> {
   const tls = createTlsSettingsWithDefaultCert();
   tls.alpn = ['h3'];

frontend/src/lib/xray/node-protocols.ts

@@ -17,4 +17,5 @@ export const NODE_ELIGIBLE_PROTOCOLS: Readonly<Record<string, true>> = {
   [Protocols.MTPROTO]: true,
   [Protocols.AMNEZIAWG]: true,
   [Protocols.TUIC]: true,
+  [Protocols.MASQUE]: true,
 };

frontend/src/lib/xray/outbound-defaults.ts

@@ -5,6 +5,7 @@ import type { DNSOutboundSettings } from '@/schemas/protocols/outbound/dns';
 import type { FreedomOutboundSettings } from '@/schemas/protocols/outbound/freedom';
 import type { HttpOutboundSettings } from '@/schemas/protocols/outbound/http';
 import type { HysteriaOutboundSettings } from '@/schemas/protocols/outbound/hysteria';
+import type { MasqueOutboundSettings } from '@/schemas/protocols/outbound/masque';
 import type { LoopbackOutboundSettings } from '@/schemas/protocols/outbound/loopback';
 import type { ShadowsocksOutboundSettings } from '@/schemas/protocols/outbound/shadowsocks';
 import type { SocksOutboundSettings } from '@/schemas/protocols/outbound/socks';
@@ -130,12 +131,17 @@ export function createDefaultHysteriaOutboundSettings(): HysteriaOutboundSetting
   return { address: '', port: 443, version: 2 };
 }
 
+export function createDefaultMasqueOutboundSettings(): MasqueOutboundSettings {
+  return { address: '', port: 443 };
+}
+
 export type AnyOutboundSettings =
   | BlackholeOutboundSettings
   | DNSOutboundSettings
   | FreedomOutboundSettings
   | HttpOutboundSettings
   | HysteriaOutboundSettings
+  | MasqueOutboundSettings
   | LoopbackOutboundSettings
   | ShadowsocksOutboundSettings
   | SocksOutboundSettings
@@ -177,6 +183,8 @@ export function createDefaultOutboundSettings(protocol: string): AnyOutboundSett
       return createDefaultWireguardOutboundSettings();
     case 'hysteria':
       return createDefaultHysteriaOutboundSettings();
+    case 'masque':
+      return createDefaultMasqueOutboundSettings();
     case 'loopback':
       return createDefaultLoopbackOutboundSettings();
     default:

frontend/src/lib/xray/outbound-form-adapter.ts

@@ -18,6 +18,7 @@ import type {
   FreedomOutboundFormSettings,
   HttpOutboundFormSettings,
   HysteriaOutboundFormSettings,
+  MasqueOutboundFormSettings,
   LoopbackOutboundFormSettings,
   MuxForm,
   OutboundFormSettings,
@@ -313,6 +314,14 @@ function hysteriaFromWire(raw: Raw): HysteriaOutboundFormSettings {
   };
 }
 
+function masqueFromWire(raw: Raw): MasqueOutboundFormSettings {
+  return {
+    address: asString(raw.address),
+    port: asPort(raw.port, 443),
+    remoteDNS: asArray(raw.remoteDNS).filter((v): v is string => typeof v === 'string'),
+  };
+}
+
 function freedomFromWire(
   raw: Raw,
   domainStrategy: OutboundDomainStrategy | '',
@@ -618,6 +627,9 @@ export function rawOutboundToFormValues(raw: RawOutboundRow): OutboundFormValues
     case 'hysteria':
       typed = { protocol: 'hysteria', settings: hysteriaFromWire(settings) };
       break;
+    case 'masque':
+      typed = { protocol: 'masque', settings: masqueFromWire(settings) };
+      break;
     case 'freedom':
       typed = {
         protocol: 'freedom',
@@ -780,6 +792,15 @@ function hysteriaToWire(s: HysteriaOutboundFormSettings) {
   return { address: s.address, port: s.port, version: s.version };
 }
 
+function masqueToWire(s: MasqueOutboundFormSettings) {
+  const remoteDNS = s.remoteDNS.filter(Boolean);
+  return {
+    address: s.address,
+    port: s.port,
+    remoteDNS: remoteDNS.length > 0 ? remoteDNS : undefined,
+  };
+}
+
 function freedomToWire(s: FreedomOutboundFormSettings) {
   // Legacy semantics: emit fragment only when the user actually populated
   // at least one of the four sub-fields. Defaults like packets='1-3' alone
@@ -857,7 +878,7 @@ function loopbackToWire(s: LoopbackOutboundFormSettings) {
 
 // canEnableMux mirrors the legacy Outbound.canEnableMux().
 const MUX_PROTOCOLS = new Set(['vmess', 'vless', 'trojan', 'shadowsocks', 'http', 'socks']);
-const STREAM_PROTOCOLS = new Set(['vmess', 'vless', 'trojan', 'shadowsocks', 'hysteria']);
+const STREAM_PROTOCOLS = new Set(['vmess', 'vless', 'trojan', 'shadowsocks', 'hysteria', 'masque']);
 
 function dropEmptyStrings(obj: Raw): Raw {
   const out: Raw = {};
@@ -926,6 +947,9 @@ export function formValuesToWirePayload(values: OutboundFormValues): WireOutboun
     case 'hysteria':
       settings = hysteriaToWire(values.settings);
       break;
+    case 'masque':
+      settings = masqueToWire(values.settings);
+      break;
     case 'freedom':
       settings = freedomToWire(values.settings);
       break;

frontend/src/lib/xray/protocol-capabilities.ts

@@ -17,6 +17,7 @@ const STREAM_PROTOCOLS = [
   'hysteria',
   'wireguard',
   'tunnel',
+  'masque',
 ];
 const VISION_FLOW = 'xtls-rprx-vision';
 const SS_2022_PREFIX = '2022';
@@ -37,7 +38,7 @@ export interface CapabilityShadowsocksSlice extends CapabilityProtocolSlice {
 }
 
 export function canEnableTls(values: CapabilityProtocolSlice): boolean {
-  if (values.protocol === 'hysteria') return true;
+  if (values.protocol === 'hysteria' || values.protocol === 'masque') return true;
   if (!TLS_ELIGIBLE_PROTOCOLS.includes(values.protocol)) return false;
   return TLS_NETWORKS.includes(values.streamSettings?.network ?? '');
 }

frontend/src/pages/clients/BulkAttachInboundsModal.tsx

@@ -17,6 +17,7 @@ const MULTI_USER_PROTOCOLS = new Set([
   'mtproto',
   'amneziawg',
   'tuic',
+  'masque',
 ]);
 
 interface BulkAttachInboundsModalProps {

frontend/src/pages/clients/BulkDetachInboundsModal.tsx

@@ -17,6 +17,7 @@ const MULTI_USER_PROTOCOLS = new Set([
   'mtproto',
   'amneziawg',
   'tuic',
+  'masque',
 ]);
 
 interface BulkDetachInboundsModalProps {

frontend/src/pages/clients/ClientBulkAddModal.tsx

@@ -39,6 +39,7 @@ const MULTI_CLIENT_PROTOCOLS = new Set([
   'wireguard',
   'amneziawg',
   'tuic',
+  'masque',
 ]);
 
 const EMPTY: ClientBulkAddFormValues = {

frontend/src/pages/clients/ClientFormModal.tsx

@@ -65,6 +65,7 @@ const MULTI_CLIENT_PROTOCOLS = new Set([
   'mtproto',
   'amneziawg',
   'tuic',
+  'masque',
 ]);
 
 const CLIENT_FORM_MODAL_Z_INDEX = 1000;

frontend/src/pages/hosts/HostList.tsx

@@ -44,6 +44,7 @@ const INBOUND_PROTOCOL_COLORS: Record<string, string> = {
   mixed: 'lime',
   tunnel: 'orange',
   tuic: 'orange',
+  masque: 'red',
 };
 
 export function sortHosts(hosts: HostRecord[]): HostRecord[] {

frontend/src/pages/inbounds/InboundsPage.tsx

@@ -326,6 +326,7 @@ export default function InboundsPage() {
       switch (dbInbound.protocol) {
         case 'trojan':
         case 'shadowsocks':
+        case 'masque':
           return c.password === client.password && c.email === client.email;
         default:
           return c.id === client.id && c.email === client.email;

frontend/src/pages/inbounds/form/InboundFormModal.tsx

@@ -44,7 +44,11 @@ import { FormField, rhfZodValidate } from '@/components/form/rhf';
 import { Protocols, TRAFFIC_RESETS } from '@/schemas/primitives';
 import { SockoptStreamSettingsSchema } from '@/schemas/protocols/stream/sockopt';
 import { HysteriaStreamSettingsSchema } from '@/schemas/protocols/stream/hysteria';
-import { createHysteriaTlsSettingsWithDefaultCert } from '@/lib/xray/inbound-tls-defaults';
+import {
+  createHysteriaTlsSettingsWithDefaultCert,
+  createMasqueTlsSettingsWithDefaultCert,
+} from '@/lib/xray/inbound-tls-defaults';
+import { MASQUE_DEFAULT_PATH } from '@/schemas/protocols/stream/masque';
 import { NODE_ELIGIBLE_PROTOCOLS } from '@/lib/xray/node-protocols';
 import { VLESS_AUTH_LABEL_KEYS, vlessEncryptionAuthKind } from '@/lib/xray/vless-encryption';
 import { SniffingSchema } from '@/schemas/primitives/sniffing';
@@ -66,6 +70,8 @@ import {
   AmneziawgFields,
   HttpFields,
   HysteriaFields,
+  MasqueSettingsFields,
+  MasqueStreamFields,
   MixedFields,
   MtprotoFields,
   ShadowsocksFields,
@@ -285,6 +291,7 @@ export default function InboundFormModal({
    */
   const hasSelectableTransport =
     protocol !== Protocols.HYSTERIA &&
+    protocol !== Protocols.MASQUE &&
     protocol !== Protocols.WIREGUARD &&
     protocol !== Protocols.TUNNEL &&
     protocol !== Protocols.TUIC;
@@ -552,11 +559,18 @@ export default function InboundFormModal({
             ],
           },
         });
+      } else if (next === Protocols.MASQUE) {
+        setV('streamSettings', {
+          network: 'masque',
+          security: 'tls',
+          masqueSettings: { path: MASQUE_DEFAULT_PATH },
+          tlsSettings: createMasqueTlsSettingsWithDefaultCert(),
+        });
       } else if (next === Protocols.WIREGUARD || next === Protocols.TUNNEL) {
         setV('streamSettings', { security: 'none' });
       } else {
         const current = getV('streamSettings') as { network?: string } | undefined;
-        if (current?.network === 'hysteria' || !current?.network) {
+        if (current?.network === 'hysteria' || current?.network === 'masque' || !current?.network) {
           setV('streamSettings', { network: 'tcp', security: 'none', tcpSettings: {} });
         }
       }
@@ -819,6 +833,8 @@ export default function InboundFormModal({
 
       {protocol === Protocols.TUIC && <TuicFields />}
 
+      {protocol === Protocols.MASQUE && <MasqueSettingsFields />}
+
       {protocol === Protocols.TUN && <TunFields />}
 
       {protocol === Protocols.TUNNEL && <TunnelFields />}
@@ -943,6 +959,8 @@ export default function InboundFormModal({
           dropdown is hidden above. */}
       {protocol === Protocols.HYSTERIA && <HysteriaFields />}
 
+      {protocol === Protocols.MASQUE && <MasqueStreamFields />}
+
       {hasSelectableTransport && (
         <>
           {network === 'tcp' && <RawForm />}
@@ -989,7 +1007,7 @@ export default function InboundFormModal({
 
   const tlsOk = canEnableTls({ protocol, streamSettings: { network, security } });
   const realityOk = canEnableReality({ protocol, streamSettings: { network, security } });
-  const tlsOnly = protocol === Protocols.HYSTERIA;
+  const tlsOnly = protocol === Protocols.HYSTERIA || protocol === Protocols.MASQUE;
 
   const securityTab = (
     <>
@@ -1177,6 +1195,7 @@ export default function InboundFormModal({
                     Protocols.MTPROTO,
                     Protocols.AMNEZIAWG,
                     Protocols.TUIC,
+                    Protocols.MASQUE,
                   ] as string[]
                 ).includes(protocol) || isFallbackHost
                   ? [

frontend/src/pages/inbounds/form/protocols/index.ts

@@ -9,3 +9,4 @@ export { default as MtprotoFields } from './mtproto';
 export { default as VlessFields } from './vless';
 export { default as AmneziawgFields } from './amneziawg';
 export { default as TuicFields } from './tuic';
+export { default as MasqueStreamFields, MasqueSettingsFields } from './masque';

frontend/src/pages/inbounds/form/protocols/masque.tsx

@@ -0,0 +1,35 @@
+import { useTranslation } from 'react-i18next';
+import { Input, InputNumber, Select } from 'antd';
+
+import { FormField } from '@/components/form/rhf';
+import { MASQUE_DEFAULT_PATH } from '@/schemas/protocols/stream/masque';
+
+export function MasqueSettingsFields() {
+  const { t } = useTranslation();
+  return (
+    <>
+      <FormField
+        label={t('pages.inbounds.form.masque.addressPool')}
+        tooltip={t('pages.inbounds.form.masque.addressPoolDesc')}
+        name={['settings', 'address']}
+        required
+      >
+        <Select mode="tags" tokenSeparators={[',', ' ']} open={false} />
+      </FormField>
+      <FormField label={t('pages.inbounds.info.mtu')} name={['settings', 'mtu']}>
+        <InputNumber min={1280} max={65535} placeholder="1280" style={{ width: '100%' }} />
+      </FormField>
+    </>
+  );
+}
+
+// The server matches requests on `path` alone; host, credentials and headers are
+// the client's, delivered through the JSON subscription.
+export default function MasqueStreamFields() {
+  const { t } = useTranslation();
+  return (
+    <FormField label={t('path')} name={['streamSettings', 'masqueSettings', 'path']}>
+      <Input placeholder={MASQUE_DEFAULT_PATH} />
+    </FormField>
+  );
+}

frontend/src/pages/inbounds/list/helpers.ts

@@ -92,6 +92,7 @@ export function isInboundMultiUser(record: { protocol: string; settings: unknown
     case 'wireguard':
     case 'amneziawg':
     case 'tuic':
+    case 'masque':
       return true;
     case 'shadowsocks':
       return isSSMultiUser({ protocol: 'shadowsocks', settings: readSettings(record.settings) });

frontend/src/pages/inbounds/useInbounds.ts

@@ -68,6 +68,7 @@ const TRACKED_PROTOCOLS: readonly string[] = [
   Protocols.MTPROTO,
   Protocols.AMNEZIAWG,
   Protocols.TUIC,
+  Protocols.MASQUE,
 ];
 
 async function fetchSlimInbounds(): Promise<unknown[]> {

frontend/src/pages/settings/SubBalancerFormModal.tsx

@@ -24,6 +24,7 @@ const MULTI_CLIENT_PROTOCOLS = new Set([
   'trojan',
   'hysteria',
   'wireguard',
+  'masque',
 ]);
 
 const STRATEGY_LABEL_KEYS: Record<SubBalancerStrategy, string> = {

frontend/src/pages/xray/outbounds/OutboundFormModal.tsx

@@ -21,6 +21,7 @@ import {
 import {
   FLOW_OPTIONS,
   HYSTERIA_NETWORK_OPTION,
+  MASQUE_NETWORK_OPTION,
   NETWORK_OPTIONS,
   PROTOCOL_OPTIONS,
   SERVER_PROTOCOLS,
@@ -30,6 +31,7 @@ import {
   applyNetworkChange,
   buildAddModeValues,
   hysteriaStreamSlice,
+  masqueStreamSlice,
   newStreamSlice,
 } from './outbound-form-helpers';
 import {
@@ -38,6 +40,7 @@ import {
   FreedomFields,
   HttpFields,
   LoopbackFields,
+  MasqueFields,
   ServerTarget,
   ShadowsocksFields,
   SocksFields,
@@ -52,6 +55,7 @@ import {
   HttpUpgradeForm,
   HysteriaForm,
   KcpForm,
+  MasqueForm,
   MuxForm,
   RawForm,
   SockoptForm,
@@ -162,6 +166,16 @@ export default function OutboundFormModal({
     } as StreamValue);
   }, [streamAllowed, network, protocol, methods]);
 
+  useEffect(() => {
+    if (protocol !== 'masque') return;
+    if (network === 'masque' && security === 'tls') return;
+    const existing = (methods.getValues('streamSettings') ?? {}) as Record<string, unknown>;
+    const slice = masqueStreamSlice();
+    if (existing.masqueSettings) slice.masqueSettings = existing.masqueSettings;
+    if (existing.tlsSettings) slice.tlsSettings = existing.tlsSettings;
+    methods.setValue('streamSettings', slice as StreamValue);
+  }, [protocol, network, security, methods]);
+
   useEffect(() => {
     if (protocol !== 'hysteria') return;
     if (network === 'hysteria' && security === 'tls') return;
@@ -194,9 +208,12 @@ export default function OutboundFormModal({
       const nextProtocol = methods.getValues('protocol');
       const next = rawOutboundToFormValues({ protocol: nextProtocol });
       methods.setValue('settings', next.settings);
+      const currentNetwork = methods.getValues('streamSettings.network') ?? '';
       if (nextProtocol === 'hysteria') {
         methods.setValue('streamSettings', hysteriaStreamSlice() as StreamValue);
-      } else if ((methods.getValues('streamSettings.network') ?? '') === 'hysteria') {
+      } else if (nextProtocol === 'masque') {
+        methods.setValue('streamSettings', masqueStreamSlice() as StreamValue);
+      } else if (currentNetwork === 'hysteria' || currentNetwork === 'masque') {
         methods.setValue('streamSettings', {
           ...newStreamSlice('tcp'),
           security: 'none',
@@ -437,6 +454,7 @@ export default function OutboundFormModal({
                       {protocol === 'shadowsocks' && <ShadowsocksFields />}
                       {protocol === 'http' && <HttpFields />}
                       {protocol === 'socks' && <SocksFields />}
+                      {protocol === 'masque' && <MasqueFields />}
 
                       {protocol === 'loopback' && <LoopbackFields />}
                       {protocol === 'blackhole' && <BlackholeFields />}
@@ -470,7 +488,9 @@ export default function OutboundFormModal({
                               options={
                                 protocol === 'hysteria'
                                   ? [HYSTERIA_NETWORK_OPTION]
-                                  : NETWORK_OPTIONS
+                                  : protocol === 'masque'
+                                    ? [MASQUE_NETWORK_OPTION]
+                                    : NETWORK_OPTIONS
                               }
                             />
                           </Form.Item>
@@ -490,6 +510,8 @@ export default function OutboundFormModal({
                           {network === 'hysteria' && <HysteriaForm />}
 
                           {network === 'xdrive' && <XDriveForm />}
+
+                          {network === 'masque' && <MasqueForm />}
                         </>
                       )}
 
@@ -532,7 +554,7 @@ export default function OutboundFormModal({
                             buttonStyle="solid"
                             onChange={(e) => onSecurityChange(e.target.value as string)}
                           >
-                            {network !== 'hysteria' && (
+                            {network !== 'hysteria' && network !== 'masque' && (
                               <Radio.Button value="none">{t('none')}</Radio.Button>
                             )}
                             {tlsAllowed && <Radio.Button value="tls">TLS</Radio.Button>}

frontend/src/pages/xray/outbounds/outbound-form-constants.ts

@@ -51,6 +51,9 @@ export const NETWORK_OPTIONS: { value: string; label: string }[] = [
 // shows only this option when the parent protocol is hysteria.
 export const HYSTERIA_NETWORK_OPTION = { value: 'hysteria', label: 'Hysteria' };
 
+// MASQUE likewise pairs only with its own CONNECT-IP transport.
+export const MASQUE_NETWORK_OPTION = { value: 'masque', label: 'MASQUE' };
+
 // Protocols whose form schema carries a flat connect target — these all
 // get the shared "server" sub-block (address + port) at the top of the
 // protocol section. Wireguard has an address but no port. DNS/freedom/
@@ -63,4 +66,5 @@ export const SERVER_PROTOCOLS = new Set<string>([
   'socks',
   'http',
   'hysteria',
+  'masque',
 ]);

frontend/src/pages/xray/outbounds/outbound-form-helpers.ts

@@ -67,6 +67,8 @@ export function newStreamSlice(network: string): Record<string, unknown> {
       };
     case 'xdrive':
       return { network: 'xdrive', xdriveSettings: XDriveStreamSettingsSchema.parse({}) };
+    case 'masque':
+      return { network: 'masque', masqueSettings: {} };
     default:
       return { network: 'tcp', tcpSettings: { header: { type: 'none' } } };
   }
@@ -89,6 +91,13 @@ export function hysteriaStreamSlice(): Record<string, unknown> {
   };
 }
 
+// MASQUE needs TLS (xray-core refuses it otherwise) and dials HTTP/3 unless the ALPN
+// offers h2 alone, so it starts on h3 like Hysteria.
+export function masqueStreamSlice(): Record<string, unknown> {
+  const { tlsSettings } = hysteriaStreamSlice();
+  return { ...newStreamSlice('masque'), security: 'tls', tlsSettings };
+}
+
 // Network change cascade: swap the per-network sub-key (tcpSettings,
 // wsSettings, etc.) so the DU branch matches. Carry over the security mode
 // and its settings (tlsSettings/realitySettings, including SNI serverName)
@@ -100,6 +109,7 @@ export function applyNetworkChange(
   next: string,
 ): Record<string, unknown> {
   if (next === 'hysteria') return hysteriaStreamSlice();
+  if (next === 'masque') return masqueStreamSlice();
   const stream = prevStream ?? {};
   const currentSecurity = (stream.security as string) ?? 'none';
   const stillTls = canEnableTls({

frontend/src/pages/xray/outbounds/outbounds-tab-helpers.ts

@@ -31,7 +31,8 @@ export function outboundAddresses(o: OutboundRow): string[] {
       return serverObj ? serverObj.map((s) => `${s.address}:${s.port}`) : [];
     }
     case isOutboundProtocol(o, Protocols.VLESS):
-    case isOutboundProtocol(o, Protocols.Hysteria): {
+    case isOutboundProtocol(o, Protocols.Hysteria):
+    case isOutboundProtocol(o, Protocols.Masque): {
       // A vless row carries either shape, and the probe reads both.
       const vnext = settings?.vnext as Array<{ address?: string; port?: number }> | undefined;
       const addr = vnext?.[0]?.address || (settings?.address as string | undefined);

frontend/src/pages/xray/outbounds/protocols/index.ts

@@ -11,3 +11,4 @@ export { default as FreedomFields } from './freedom';
 export { default as LoopbackFields } from './loopback';
 export { default as BlackholeFields } from './blackhole';
 export { default as DnsFields } from './dns';
+export { default as MasqueFields } from './masque';

frontend/src/pages/xray/outbounds/protocols/masque.tsx

@@ -0,0 +1,18 @@
+import { useTranslation } from 'react-i18next';
+import { Select } from 'antd';
+
+import { FormField } from '@/components/form/rhf';
+
+export default function MasqueFields() {
+  const { t } = useTranslation();
+  return (
+    <FormField label={t('pages.xray.outboundForm.remoteDNS')} name={['settings', 'remoteDNS']}>
+      <Select
+        mode="tags"
+        tokenSeparators={[',', ' ']}
+        open={false}
+        placeholder="1.1.1.1, 2606:4700:4700::1111"
+      />
+    </FormField>
+  );
+}

frontend/src/pages/xray/outbounds/transport/index.ts

@@ -5,5 +5,6 @@ export { default as GrpcForm } from './grpc';
 export { default as HttpUpgradeForm } from './httpupgrade';
 export { default as XhttpForm } from './xhttp';
 export { default as HysteriaForm } from './hysteria';
+export { default as MasqueForm } from './masque';
 export { default as SockoptForm } from './sockopt';
 export { default as MuxForm } from './mux';

frontend/src/pages/xray/outbounds/transport/masque.tsx

@@ -0,0 +1,92 @@
+import { useTranslation } from 'react-i18next';
+import { Form, Input, Select, Switch } from 'antd';
+import { useFormContext, useWatch } from 'react-hook-form';
+
+import { HeaderMapEditor } from '@/components/form';
+import { FormField } from '@/components/form/rhf';
+import { MASQUE_DEFAULT_PATH } from '@/schemas/protocols/stream/masque';
+
+const BASE = ['streamSettings', 'masqueSettings'] as const;
+
+// WARP authenticates with its enrolled key instead of Basic auth, and xray-core
+// refuses user/pass next to warp; host and path then default to Cloudflare's endpoint.
+export default function MasqueForm() {
+  const { t } = useTranslation();
+  const { control, setValue } = useFormContext();
+  const warp = useWatch({ control, name: 'streamSettings.masqueSettings.warp' });
+  const warpOn = warp != null;
+
+  return (
+    <>
+      <FormField label={t('host')} name={[...BASE, 'host']}>
+        <Input placeholder={warpOn ? 'cloudflareaccess.com' : undefined} />
+      </FormField>
+      <FormField label={t('path')} name={[...BASE, 'path']}>
+        <Input placeholder={warpOn ? '/' : MASQUE_DEFAULT_PATH} />
+      </FormField>
+      <Form.Item label="WARP" tooltip={t('pages.xray.outboundForm.masqueWarpDesc')}>
+        <Switch
+          checked={warpOn}
+          onChange={(on) => {
+            setValue(
+              'streamSettings.masqueSettings.warp',
+              on ? { privateKey: '', publicKey: '', address: [] } : undefined,
+            );
+            if (on) {
+              setValue('streamSettings.masqueSettings.user', undefined);
+              setValue('streamSettings.masqueSettings.pass', undefined);
+            }
+          }}
+        />
+      </Form.Item>
+      {warpOn ? (
+        <>
+          <FormField
+            label={t('pages.xray.warp.privateKey')}
+            name={[...BASE, 'warp', 'privateKey']}
+            required
+          >
+            <Input.TextArea
+              autoSize={{ minRows: 2, maxRows: 6 }}
+              placeholder="-----BEGIN PRIVATE KEY-----"
+            />
+          </FormField>
+          <FormField
+            label={t('pages.xray.outboundForm.masqueWarpPublicKey')}
+            name={[...BASE, 'warp', 'publicKey']}
+            required
+          >
+            <Input.TextArea
+              autoSize={{ minRows: 2, maxRows: 6 }}
+              placeholder="-----BEGIN PUBLIC KEY-----"
+            />
+          </FormField>
+          <FormField
+            label={t('pages.xray.outboundForm.masqueWarpAddress')}
+            name={[...BASE, 'warp', 'address']}
+            required
+          >
+            <Select
+              mode="tags"
+              tokenSeparators={[',', ' ']}
+              open={false}
+              placeholder="172.16.0.2, 2606:4700:110:8a36::2"
+            />
+          </FormField>
+        </>
+      ) : (
+        <>
+          <FormField label={t('username')} name={[...BASE, 'user']}>
+            <Input />
+          </FormField>
+          <FormField label={t('password')} name={[...BASE, 'pass']}>
+            <Input.Password />
+          </FormField>
+        </>
+      )}
+      <FormField label={t('pages.inbounds.form.headers')} name={[...BASE, 'headers']}>
+        <HeaderMapEditor mode="v1" />
+      </FormField>
+    </>
+  );
+}

frontend/src/schemas/forms/outbound-form.ts

@@ -125,6 +125,13 @@ export const HysteriaOutboundFormSettingsSchema = z.object({
 });
 export type HysteriaOutboundFormSettings = z.infer<typeof HysteriaOutboundFormSettingsSchema>;
 
+export const MasqueOutboundFormSettingsSchema = z.object({
+  address: z.string().default(''),
+  port: PortSchema.default(443),
+  remoteDNS: z.array(z.string()).default([]),
+});
+export type MasqueOutboundFormSettings = z.infer<typeof MasqueOutboundFormSettingsSchema>;
+
 // FinalRule (freedom): network/port are strings; ip is string[]; blockDelay
 // is only meaningful when action === 'block'. The adapter omits empty
 // fields from the wire payload.
@@ -200,6 +207,7 @@ export const OutboundFormSettingsSchema = z.discriminatedUnion('protocol', [
   z.object({ protocol: z.literal('wireguard'), settings: WireguardOutboundFormSettingsSchema }),
   z.object({ protocol: z.literal('amneziawg'), settings: AmneziaWGOutboundFormSettingsSchema }),
   z.object({ protocol: z.literal('hysteria'), settings: HysteriaOutboundFormSettingsSchema }),
+  z.object({ protocol: z.literal('masque'), settings: MasqueOutboundFormSettingsSchema }),
   z.object({ protocol: z.literal('freedom'), settings: FreedomOutboundFormSettingsSchema }),
   z.object({ protocol: z.literal('blackhole'), settings: BlackholeOutboundFormSettingsSchema }),
   z.object({ protocol: z.literal('dns'), settings: DnsOutboundFormSettingsSchema }),

frontend/src/schemas/primitives/outbound-protocol.ts

@@ -19,6 +19,7 @@ export const OutboundProtocols = Object.freeze({
   Wireguard: 'wireguard',
   AmneziaWG: 'amneziawg',
   Hysteria: 'hysteria',
+  Masque: 'masque',
   Socks: 'socks',
   HTTP: 'http',
   Loopback: 'loopback',

frontend/src/schemas/primitives/protocol.ts

@@ -14,6 +14,7 @@ export const ProtocolSchema = z.enum([
   'mtproto',
   'amneziawg',
   'tuic',
+  'masque',
 ]);
 export type Protocol = z.infer<typeof ProtocolSchema>;
 
@@ -37,4 +38,5 @@ export const Protocols = Object.freeze({
   MTPROTO: 'mtproto',
   AMNEZIAWG: 'amneziawg',
   TUIC: 'tuic',
+  MASQUE: 'masque',
 });

frontend/src/schemas/protocols/inbound/index.ts

@@ -3,6 +3,7 @@ import { z } from 'zod';
 import { AmneziawgInboundSettingsSchema } from './amneziawg';
 import { HttpInboundSettingsSchema } from './http';
 import { HysteriaInboundSettingsSchema } from './hysteria';
+import { MasqueInboundSettingsSchema } from './masque';
 import { MixedInboundSettingsSchema } from './mixed';
 import { MtprotoInboundSettingsSchema } from './mtproto';
 import { ShadowsocksInboundSettingsSchema } from './shadowsocks';
@@ -17,6 +18,7 @@ import { WireguardInboundSettingsSchema } from './wireguard';
 export * from './amneziawg';
 export * from './http';
 export * from './hysteria';
+export * from './masque';
 export * from './mixed';
 export * from './mtproto';
 export * from './shadowsocks';
@@ -47,5 +49,6 @@ export const InboundSettingsSchema = z.discriminatedUnion('protocol', [
   z.object({ protocol: z.literal('mtproto'), settings: MtprotoInboundSettingsSchema }),
   z.object({ protocol: z.literal('amneziawg'), settings: AmneziawgInboundSettingsSchema }),
   z.object({ protocol: z.literal('tuic'), settings: TuicInboundSettingsSchema }),
+  z.object({ protocol: z.literal('masque'), settings: MasqueInboundSettingsSchema }),
 ]);
 export type InboundSettings = z.infer<typeof InboundSettingsSchema>;

frontend/src/schemas/protocols/inbound/masque.ts

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+
+// MASQUE inbound (CONNECT-IP over HTTP/3 or HTTP/2). Clients log in with their email
+// and password over Basic auth; the panel stores `password` and the backend hands it
+// to xray-core as `pass`.
+export const MasqueClientSchema = z.object({
+  password: z.string().min(1),
+  email: z.string().min(1),
+  limitIp: z.number().int().min(0).default(0),
+  totalGB: z.number().int().min(0).default(0),
+  expiryTime: z.number().int().default(0),
+  enable: z.boolean().default(true),
+  tgId: z
+    .union([z.number(), z.string()])
+    .transform((v) => Number(v) || 0)
+    .default(0),
+  subId: z.string().default(''),
+  comment: z.string().default(''),
+  reset: z.number().int().min(0).default(0),
+  created_at: z.number().int().optional(),
+  updated_at: z.number().int().optional(),
+});
+export type MasqueClient = z.infer<typeof MasqueClientSchema>;
+
+export const MASQUE_DEFAULT_ADDRESS_POOL = ['10.14.0.1/24', 'fd14::1/64'];
+
+export const MasqueInboundSettingsSchema = z.object({
+  clients: z.array(MasqueClientSchema).default([]),
+  // Tunnel addresses are leased from these prefixes: at most one IPv4 and one IPv6.
+  address: z.array(z.string()).default(MASQUE_DEFAULT_ADDRESS_POOL),
+  mtu: z.number().int().min(1280).max(65535).optional(),
+});
+export type MasqueInboundSettings = z.infer<typeof MasqueInboundSettingsSchema>;

frontend/src/schemas/protocols/outbound/index.ts

@@ -6,6 +6,7 @@ import { DNSOutboundSettingsSchema } from './dns';
 import { FreedomOutboundSettingsSchema } from './freedom';
 import { HttpOutboundSettingsSchema } from './http';
 import { HysteriaOutboundSettingsSchema } from './hysteria';
+import { MasqueOutboundSettingsSchema } from './masque';
 import { LoopbackOutboundSettingsSchema } from './loopback';
 import { ShadowsocksOutboundSettingsSchema } from './shadowsocks';
 import { SocksOutboundSettingsSchema } from './socks';
@@ -20,6 +21,7 @@ export * from './dns';
 export * from './freedom';
 export * from './http';
 export * from './hysteria';
+export * from './masque';
 export * from './loopback';
 export * from './shadowsocks';
 export * from './socks';
@@ -36,6 +38,7 @@ export const OutboundSettingsSchema = z.discriminatedUnion('protocol', [
   z.object({ protocol: z.literal('wireguard'), settings: WireguardOutboundSettingsSchema }),
   z.object({ protocol: z.literal('amneziawg'), settings: AmneziaWGOutboundSettingsSchema }),
   z.object({ protocol: z.literal('hysteria'), settings: HysteriaOutboundSettingsSchema }),
+  z.object({ protocol: z.literal('masque'), settings: MasqueOutboundSettingsSchema }),
   z.object({ protocol: z.literal('http'), settings: HttpOutboundSettingsSchema }),
   z.object({ protocol: z.literal('socks'), settings: SocksOutboundSettingsSchema }),
   z.object({ protocol: z.literal('freedom'), settings: FreedomOutboundSettingsSchema }),

frontend/src/schemas/protocols/outbound/masque.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+
+import { PortSchema } from '@/schemas/primitives';
+
+// MASQUE outbound names its server only; credentials, path and WARP ride on the
+// masque transport. remoteDNS lists IPs queried inside the CONNECT-IP tunnel.
+export const MasqueOutboundSettingsSchema = z.object({
+  address: z.string().min(1),
+  port: PortSchema,
+  remoteDNS: z.array(z.string()).optional(),
+});
+export type MasqueOutboundSettings = z.infer<typeof MasqueOutboundSettingsSchema>;

frontend/src/schemas/protocols/stream/index.ts

@@ -8,6 +8,7 @@ import { GrpcStreamSettingsSchema } from './grpc';
 import { HttpUpgradeStreamSettingsSchema } from './httpupgrade';
 import { HysteriaStreamSettingsSchema } from './hysteria';
 import { KcpStreamSettingsSchema } from './kcp';
+import { MasqueStreamSettingsSchema } from './masque';
 import { SockoptStreamSettingsSchema } from './sockopt';
 import { TcpStreamSettingsSchema } from './tcp';
 import { WsStreamSettingsSchema } from './ws';
@@ -20,6 +21,7 @@ export * from './grpc';
 export * from './httpupgrade';
 export * from './hysteria';
 export * from './kcp';
+export * from './masque';
 export * from './sockopt';
 export * from './tcp';
 export * from './ws';
@@ -35,6 +37,7 @@ export const NetworkSchema = z.enum([
   'xhttp',
   'hysteria',
   'xdrive',
+  'masque',
 ]);
 export type Network = z.infer<typeof NetworkSchema>;
 
@@ -58,6 +61,8 @@ const TransportNetworkSettingsSchema = z.discriminatedUnion('network', [
   }),
   z.object({ network: z.literal('xhttp'), xhttpSettings: XHttpStreamSettingsSchema }),
   z.object({ network: z.literal('hysteria'), hysteriaSettings: HysteriaStreamSettingsSchema }),
+  // `masque` pairs only with the masque protocol, in both directions.
+  z.object({ network: z.literal('masque'), masqueSettings: MasqueStreamSettingsSchema }),
   // The stream-level address/port is the domain front XDRIVE dials for its storage API.
   z.object({
     network: z.literal('xdrive'),

frontend/src/schemas/protocols/stream/masque.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+
+// The path xray-core's MASQUE transport uses when none is set; the server matches
+// a request on it after expanding {target}/{ipproto} to "*".
+export const MASQUE_DEFAULT_PATH = '/.well-known/masque/ip/*/*/';
+
+// WARP over MASQUE: an enrolled ECDSA P-256 key (PEM or base64 DER), the endpoint's
+// public key, and the tunnel addresses Cloudflare assigned (one IPv4, one IPv6).
+export const MasqueWarpSchema = z.object({
+  privateKey: z.string().default(''),
+  publicKey: z.string().default(''),
+  address: z.array(z.string()).default([]),
+});
+export type MasqueWarp = z.infer<typeof MasqueWarpSchema>;
+
+// A server reads only `path`; host, user/pass (Basic auth), headers and warp are the
+// client side. Every key is optional so a stored stream round-trips byte-stably.
+export const MasqueStreamSettingsSchema = z.object({
+  host: z.string().optional(),
+  path: z.string().optional(),
+  user: z.string().optional(),
+  pass: z.string().optional(),
+  headers: z.record(z.string(), z.string()).optional(),
+  warp: MasqueWarpSchema.optional(),
+});
+export type MasqueStreamSettings = z.infer<typeof MasqueStreamSettingsSchema>;

frontend/src/test/__snapshots__/inbound-full.test.ts.snap

@@ -84,6 +84,95 @@ exports[`InboundSchema (full) fixtures > parses hysteria-tls byte-stably 1`] = `
 }
 `;
 
+exports[`InboundSchema (full) fixtures > parses masque-tls byte-stably 1`] = `
+{
+  "down": 0,
+  "enable": true,
+  "expiryTime": 0,
+  "id": 31,
+  "listen": "",
+  "port": 8443,
+  "protocol": "masque",
+  "remark": "ivy-masque",
+  "settings": {
+    "address": [
+      "10.14.0.1/24",
+      "fd14::1/64",
+    ],
+    "clients": [
+      {
+        "comment": "",
+        "email": "ivy@example.test",
+        "enable": true,
+        "expiryTime": 0,
+        "limitIp": 0,
+        "password": "masque-pass-ivy",
+        "reset": 0,
+        "subId": "masque-001",
+        "tgId": 0,
+        "totalGB": 0,
+      },
+    ],
+    "mtu": 1400,
+  },
+  "shareAddr": "",
+  "shareAddrStrategy": "node",
+  "sniffing": {
+    "destOverride": [
+      "http",
+      "tls",
+      "quic",
+      "fakedns",
+    ],
+    "domainsExcluded": [],
+    "enabled": true,
+    "ipsExcluded": [],
+    "metadataOnly": false,
+    "routeOnly": false,
+  },
+  "streamSettings": {
+    "masqueSettings": {
+      "path": "/.well-known/masque/ip/*/*/",
+    },
+    "network": "masque",
+    "security": "tls",
+    "tlsSettings": {
+      "alpn": [
+        "h3",
+        "h2",
+      ],
+      "certificates": [
+        {
+          "buildChain": false,
+          "certificateFile": "/etc/ssl/certs/masque.crt",
+          "keyFile": "/etc/ssl/private/masque.key",
+          "ocspStapling": 0,
+          "oneTimeLoading": false,
+          "usage": "encipherment",
+        },
+      ],
+      "cipherSuites": "",
+      "disableSystemRoot": false,
+      "echServerKeys": "",
+      "enableSessionResumption": false,
+      "maxVersion": "1.3",
+      "minVersion": "1.2",
+      "rejectUnknownSni": false,
+      "serverName": "masque.example.test",
+      "settings": {
+        "echConfigList": "",
+        "fingerprint": "chrome",
+        "pinnedPeerCertSha256": [],
+        "verifyPeerCertByName": "",
+      },
+    },
+  },
+  "tag": "inbound-masque",
+  "total": 0,
+  "up": 0,
+}
+`;
+
 exports[`InboundSchema (full) fixtures > parses shadowsocks-tcp-2022 byte-stably 1`] = `
 {
   "down": 0,

frontend/src/test/__snapshots__/inbound-link.test.ts.snap

@@ -4,6 +4,8 @@ exports[`genHysteriaLink > hysteria-tls: byte-stable 1`] = `"hysteria2://hyst-v1
 
 exports[`genInboundLinks orchestrator > hysteria-tls: byte-stable 1`] = `"hysteria2://hyst-v1-auth-XYZ@override.test:36715?security=tls&fp=chrome&alpn=h3&sni=hysteria.example.test#parity-test"`;
 
+exports[`genInboundLinks orchestrator > masque-tls: byte-stable 1`] = `""`;
+
 exports[`genInboundLinks orchestrator > shadowsocks-tcp-2022: byte-stable 1`] = `"ss://2022-blake3-aes-256-gcm:ZmFrZS1zZXJ2ZXItcGFzc3dvcmQtMDAwMQ%3D%3D:dGVzdC1jbGllbnQtcGFzc3dvcmQtMQ%3D%3D@override.test:8388?type=tcp#parity-test"`;
 
 exports[`genInboundLinks orchestrator > trojan-ws-tls: byte-stable 1`] = `"trojan://trojan-test-pw-XYZ@override.test:443?type=ws&path=%2Ftrojan&host=trojan.example.test&security=tls&fp=chrome&alpn=h2%2Chttp%2F1.1&sni=trojan.example.test#parity-test"`;

frontend/src/test/client-form-modal.test.tsx

@@ -43,7 +43,7 @@ function tooltipIconForLabel(label: string): HTMLElement {
 }
 
 describe('ClientFormModal credential tooltips', () => {
-  it('explains that the Password field is only consumed by Trojan/Shadowsocks', async () => {
+  it('explains which protocols consume the Password field', async () => {
     renderModal();
     openCredentialsTab();
 
@@ -52,7 +52,7 @@ describe('ClientFormModal credential tooltips', () => {
 
     await waitFor(() => {
       expect(document.body.textContent).toContain(
-        'Used by Trojan, Shadowsocks, and TUIC clients; ignored for VLESS, VMess, Hysteria, and WireGuard.',
+        'Used by Trojan, Shadowsocks, TUIC, and MASQUE clients; ignored for VLESS, VMess, Hysteria, and WireGuard.',
       );
     });
   });

frontend/src/test/golden/fixtures/inbound-full/masque-tls.json

@@ -0,0 +1,70 @@
+{
+  "id": 31,
+  "up": 0,
+  "down": 0,
+  "total": 0,
+  "remark": "ivy-masque",
+  "enable": true,
+  "expiryTime": 0,
+  "listen": "",
+  "port": 8443,
+  "tag": "inbound-masque",
+  "sniffing": {
+    "enabled": true,
+    "destOverride": ["http", "tls", "quic", "fakedns"],
+    "metadataOnly": false,
+    "routeOnly": false,
+    "ipsExcluded": [],
+    "domainsExcluded": []
+  },
+  "protocol": "masque",
+  "settings": {
+    "clients": [
+      {
+        "password": "masque-pass-ivy",
+        "email": "ivy@example.test",
+        "limitIp": 0,
+        "totalGB": 0,
+        "expiryTime": 0,
+        "enable": true,
+        "tgId": 0,
+        "subId": "masque-001",
+        "comment": "",
+        "reset": 0
+      }
+    ],
+    "address": ["10.14.0.1/24", "fd14::1/64"],
+    "mtu": 1400
+  },
+  "streamSettings": {
+    "network": "masque",
+    "masqueSettings": {
+      "path": "/.well-known/masque/ip/*/*/"
+    },
+    "security": "tls",
+    "tlsSettings": {
+      "serverName": "masque.example.test",
+      "minVersion": "1.2",
+      "maxVersion": "1.3",
+      "cipherSuites": "",
+      "rejectUnknownSni": false,
+      "disableSystemRoot": false,
+      "enableSessionResumption": false,
+      "certificates": [
+        {
+          "certificateFile": "/etc/ssl/certs/masque.crt",
+          "keyFile": "/etc/ssl/private/masque.key",
+          "oneTimeLoading": false,
+          "usage": "encipherment",
+          "buildChain": false
+        }
+      ],
+      "alpn": ["h3", "h2"],
+      "echServerKeys": "",
+      "settings": {
+        "fingerprint": "chrome",
+        "echConfigList": ""
+      }
+    }
+  }
+}

frontend/src/test/inbound-form-modal.test.tsx

@@ -5,6 +5,7 @@ import InboundFormModal from '@/pages/inbounds/form/InboundFormModal';
 import { DBInbound } from '@/models/dbinbound';
 import { ThemeProvider } from '@/hooks/useTheme';
 import { HttpUtil } from '@/utils';
+import { Protocols } from '@/schemas/primitives';
 import {
   renderWithProviders,
   fieldLabels,
@@ -39,6 +40,22 @@ function renderModal() {
   );
 }
 
+// The protocol dropdown is virtualized, so jsdom renders only its first options; step
+// the active option by keyboard from the current protocol in the options' own order.
+function chooseVirtualizedProtocol(optionText: string) {
+  const input = document.getElementById('protocol') as HTMLElement;
+  const select = input.closest('.ant-select') as HTMLElement;
+  const current = (select.textContent ?? '').trim();
+  const order = Object.values(Protocols) as string[];
+  const steps = order.indexOf(optionText) - order.indexOf(current);
+  if (order.indexOf(optionText) < 0 || order.indexOf(current) < 0 || steps < 0) {
+    throw new Error(`cannot step from '${current}' to '${optionText}'`);
+  }
+  fireEvent.mouseDown(select.querySelector('.ant-select-selector') ?? select);
+  for (let i = 0; i < steps; i++) fireEvent.keyDown(input, { key: 'ArrowDown', keyCode: 40 });
+  fireEvent.keyDown(input, { key: 'Enter', keyCode: 13 });
+}
+
 function primaryButton(): HTMLElement {
   const button = document.querySelector('.ant-modal-footer .ant-btn-primary');
   if (!button) throw new Error('Primary modal button not found');
@@ -362,6 +379,44 @@ describe('InboundFormModal', () => {
     expect(stream.realitySettings).toBeUndefined();
   });
 
+  // xray-core runs MASQUE only on its own transport behind TLS, and leases tunnel
+  // addresses from settings.address; picking the protocol must seed all three.
+  it('adds a MASQUE inbound on its own transport with TLS and an address pool', async () => {
+    const post = vi.mocked(HttpUtil.post);
+    post.mockClear();
+    renderModal();
+
+    chooseVirtualizedProtocol('masque');
+    await act(async () => {
+      await new Promise((r) => setTimeout(r, 0));
+    });
+    fireEvent.click(screen.getByRole('tab', { name: 'Security' }));
+    expect(screen.queryByRole('radio', { name: 'None' })).toBeNull();
+    fireEvent.change(await screen.findByLabelText('Public Key'), {
+      target: { value: '/etc/ssl/certs/m.crt' },
+    });
+    fireEvent.change(screen.getByLabelText('Private Key'), {
+      target: { value: '/etc/ssl/private/m.key' },
+    });
+    fireEvent.click(primaryButton());
+
+    const isAdd = ([url]: unknown[]) => url === '/panel/api/inbounds/add';
+    await waitFor(() => expect(post.mock.calls.some(isAdd)).toBe(true));
+    const payload = post.mock.calls.find(isAdd)![1] as {
+      protocol: string;
+      settings: string;
+      streamSettings: string;
+    };
+    expect(payload.protocol).toBe('masque');
+    expect(JSON.parse(payload.settings)).toMatchObject({ address: ['10.14.0.1/24', 'fd14::1/64'] });
+    expect(JSON.parse(payload.streamSettings)).toMatchObject({
+      network: 'masque',
+      security: 'tls',
+      masqueSettings: { path: '/.well-known/masque/ip/*/*/' },
+      tlsSettings: { alpn: ['h3'] },
+    });
+  });
+
   // Clients and enable change through their own endpoints; the server keeps the
   // stored ones, so the edit form must neither send nor validate its stale copy.
   it('edit save neither sends nor validates the clients it loaded', async () => {

frontend/src/test/inbound-tag.test.ts

@@ -31,6 +31,27 @@ describe('composeInboundTag transport suffix parity', () => {
       'in-443-udp',
     ],
     ['wireguard forced udp', base({ protocol: 'wireguard' }), 'in-443-udp'],
+    [
+      'masque without alpn is udp',
+      base({ protocol: 'masque', streamSettings: { network: 'masque', tlsSettings: {} } }),
+      'in-443-udp',
+    ],
+    [
+      'masque h2 is tcp',
+      base({
+        protocol: 'masque',
+        streamSettings: { network: 'masque', tlsSettings: { alpn: ['h2'] } },
+      }),
+      'in-443-tcp',
+    ],
+    [
+      'masque h3+h2 is both',
+      base({
+        protocol: 'masque',
+        streamSettings: { network: 'masque', tlsSettings: { alpn: ['h3', 'h2'] } },
+      }),
+      'in-443-tcpudp',
+    ],
     [
       'tuic forced udp',
       base({ protocol: 'tuic', streamSettings: { network: 'tcp' } }),

frontend/src/test/outbound-form-modal.test.tsx

@@ -378,3 +378,77 @@ describe('OutboundFormModal', () => {
     });
   });
 });
+
+describe('OutboundFormModal MASQUE', () => {
+  // xray-core refuses user/pass next to warp, and builds the WARP client certificate
+  // from privateKey; a save that kept stale credentials or dropped a key never connects.
+  it('saves a WARP-over-MASQUE outbound without Basic-auth credentials', async () => {
+    const onConfirm = vi.fn();
+    const queryClient = makeTestQueryClient();
+    const outbound = {
+      protocol: 'masque',
+      tag: 'warp-masque',
+      settings: { address: '162.159.198.1', port: 443 },
+      streamSettings: {
+        network: 'masque',
+        security: 'tls',
+        tlsSettings: { serverName: '' },
+        masqueSettings: { user: 'old-user', pass: 'old-pass' },
+      },
+    };
+    const tree = (open: boolean) => (
+      <QueryClientProvider client={queryClient}>
+        <ThemeProvider>
+          <OutboundFormModal
+            open={open}
+            outbound={outbound}
+            existingTags={[]}
+            onClose={() => {}}
+            onConfirm={onConfirm}
+          />
+        </ThemeProvider>
+      </QueryClientProvider>
+    );
+    const { rerender } = render(tree(false));
+    rerender(tree(true));
+    await act(async () => {
+      await new Promise((r) => setTimeout(r, 0));
+    });
+
+    toggleSwitch('WARP');
+    await act(async () => {
+      await new Promise((r) => setTimeout(r, 0));
+    });
+    fireEvent.change(screen.getByLabelText('Private key'), { target: { value: 'PRIVATE-PEM' } });
+    fireEvent.change(screen.getByLabelText('Endpoint public key'), {
+      target: { value: 'PUBLIC-PEM' },
+    });
+    const ok = document.querySelector('.ant-modal-footer .ant-btn-primary') as HTMLElement;
+    await act(async () => {
+      fireEvent.click(ok);
+    });
+    await act(async () => {
+      await new Promise((r) => setTimeout(r, 0));
+    });
+
+    expect(onConfirm).toHaveBeenCalledTimes(1);
+    const payload = onConfirm.mock.calls[0][0] as {
+      protocol: string;
+      settings: Record<string, unknown>;
+      streamSettings: {
+        network: string;
+        security: string;
+        masqueSettings: Record<string, unknown>;
+      };
+    };
+    expect(payload.protocol).toBe('masque');
+    expect(payload.settings).toMatchObject({ address: '162.159.198.1', port: 443 });
+    expect(payload.streamSettings).toMatchObject({ network: 'masque', security: 'tls' });
+    expect(payload.streamSettings.masqueSettings.warp).toMatchObject({
+      privateKey: 'PRIVATE-PEM',
+      publicKey: 'PUBLIC-PEM',
+    });
+    expect(payload.streamSettings.masqueSettings.user).toBeUndefined();
+    expect(payload.streamSettings.masqueSettings.pass).toBeUndefined();
+  });
+});