feat(xray): add the XDRIVE transport

xray-core v26.10.10 tunnels a stream through files in shared cloud
storage ("network": "xdrive"): Google Drive, a local folder, or any HTTP
storage API described by a template. The panel could not select it, and
the stream schema rejected a pasted xdrive stream outright.

The inbound and outbound forms now offer XDRIVE with one shared editor:
service, folder, the three Google Drive secrets in the order the core
reads them, a template JSON editor with its {secretN} values, the
optional domain front (the stream-level address/port the storage client
dials), and the core's tuning knobs with their defaults as placeholders.
Switching an inbound to XDRIVE resets security to none, because the
core would otherwise read the inbound's TLS/REALITY as the storage API's
client TLS.

XDRIVE has no share-link format, and a link carrying the storage
secrets would print them into every QR code, so both link generators
emit none for it; the JSON subscription already passes the stream
through intact, and Clash drops the unknown transport.

frontend/src/lib/xray/forms/transport/FinalMaskForm.tsx

@@ -36,7 +36,7 @@ export interface FinalMaskFormProps {
   showAll?: boolean;
 }
 
-const TCP_NETWORKS = ['raw', 'tcp', 'httpupgrade', 'ws', 'grpc', 'xhttp'];
+const TCP_NETWORKS = ['raw', 'tcp', 'httpupgrade', 'ws', 'grpc', 'xhttp', 'xdrive'];
 const DEFAULT_GECKO_PACKET_SIZE = { min: 512, max: 1200 };
 // Xray-core caps the Gecko output packet size at its internal buffer (2048)
 // and needs 1 <= min <= max; mirror those bounds so the panel rejects what

frontend/src/lib/xray/forms/transport/XDriveForm.tsx

@@ -0,0 +1,148 @@
+import { useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { Input, InputNumber, Select, Typography } from 'antd';
+import { useFormContext, useWatch } from 'react-hook-form';
+
+import { JsonEditor } from '@/components/form';
+import { FormField } from '@/components/form/rhf';
+import { XDriveServiceSchema } from '@/schemas/protocols/stream/xdrive';
+
+const BASE = ['streamSettings', 'xdriveSettings'] as const;
+
+const SERVICE_LABEL_KEYS: Partial<Record<string, string>> = {
+  local: 'pages.inbounds.form.xdrive.serviceLocal',
+  template: 'pages.inbounds.form.xdrive.serviceTemplate',
+};
+
+// Core defaults (transport/internet/xdrive/params.go), shown as placeholders so an
+// empty field keeps meaning "use the core's value".
+const TUNING_FIELDS = [
+  ['segmentBytes', 'segmentBytes', 524288],
+  ['flushIntervalMs', 'flushInterval', 20],
+  ['pollIntervalMs', 'pollInterval', 50],
+  ['maxPollIntervalMs', 'maxPollInterval', 500],
+  ['eagerWindowMs', 'eagerWindow', 2000],
+  ['holeTimeoutMs', 'holeTimeout', 30000],
+  ['sessionTtlSeconds', 'sessionTtl', 300],
+  ['concurrency', 'concurrency', 8],
+] as const;
+
+const GOOGLE_DRIVE_SECRETS = ['clientId', 'clientSecret', 'refreshToken'] as const;
+
+function TemplateEditor({
+  value,
+  onChange,
+}: {
+  value?: Record<string, unknown>;
+  onChange?: (next: Record<string, unknown> | undefined) => void;
+}) {
+  const { t } = useTranslation();
+  const [text, setText] = useState(() => (value ? JSON.stringify(value, null, 2) : ''));
+  const [invalid, setInvalid] = useState(false);
+  return (
+    <>
+      <JsonEditor
+        value={text}
+        minHeight="160px"
+        onChange={(next) => {
+          setText(next);
+          if (next.trim() === '') {
+            setInvalid(false);
+            onChange?.(undefined);
+            return;
+          }
+          try {
+            const parsed: unknown = JSON.parse(next);
+            const isObject = !!parsed && typeof parsed === 'object' && !Array.isArray(parsed);
+            setInvalid(!isObject);
+            if (isObject) onChange?.(parsed as Record<string, unknown>);
+          } catch {
+            setInvalid(true);
+          }
+        }}
+      />
+      {invalid && (
+        <Typography.Text type="danger">
+          {t('pages.inbounds.form.xdrive.templateInvalid')}
+        </Typography.Text>
+      )}
+    </>
+  );
+}
+
+export default function XDriveForm() {
+  const { t } = useTranslation();
+  const { control } = useFormContext();
+  const service = useWatch({ control, name: `${BASE.join('.')}.service` }) as string | undefined;
+  const serviceOptions = XDriveServiceSchema.options.map((value) => {
+    const labelKey = SERVICE_LABEL_KEYS[value];
+    return { value, label: labelKey ? t(labelKey) : value };
+  });
+
+  return (
+    <>
+      <FormField label={t('pages.inbounds.form.xdrive.service')} name={[...BASE, 'service']}>
+        <Select options={serviceOptions} />
+      </FormField>
+      <FormField
+        label={t('pages.inbounds.form.xdrive.remoteFolder')}
+        name={[...BASE, 'remoteFolder']}
+        required
+      >
+        <Input placeholder={service === 'local' ? '/var/lib/xdrive' : 'xray-tunnel'} />
+      </FormField>
+      {service === 'Google Drive' &&
+        GOOGLE_DRIVE_SECRETS.map((key, index) => (
+          <FormField
+            key={key}
+            label={t(`pages.inbounds.form.xdrive.${key}`)}
+            name={[...BASE, 'secrets', index]}
+            required
+          >
+            {key === 'clientId' ? <Input /> : <Input.Password />}
+          </FormField>
+        ))}
+      {service === 'template' && (
+        <>
+          <FormField
+            label={t('pages.inbounds.form.xdrive.secrets')}
+            tooltip={t('pages.inbounds.form.xdrive.secretsDesc')}
+            name={[...BASE, 'secrets']}
+          >
+            <Select mode="tags" tokenSeparators={[',']} open={false} />
+          </FormField>
+          <FormField
+            label={t('pages.inbounds.form.xdrive.template')}
+            name={[...BASE, 'template']}
+            required
+          >
+            <TemplateEditor />
+          </FormField>
+        </>
+      )}
+      {service !== 'local' && (
+        <>
+          <FormField
+            label={t('pages.inbounds.form.xdrive.front')}
+            tooltip={t('pages.inbounds.form.xdrive.frontDesc')}
+            name={['streamSettings', 'address']}
+            transform={{ output: (raw) => String(raw ?? '').trim() || undefined }}
+          >
+            <Input placeholder="www.googleapis.com" />
+          </FormField>
+          <FormField
+            label={t('pages.inbounds.form.xdrive.frontPort')}
+            name={['streamSettings', 'port']}
+          >
+            <InputNumber min={1} max={65535} placeholder="443" />
+          </FormField>
+        </>
+      )}
+      {TUNING_FIELDS.map(([key, label, placeholder]) => (
+        <FormField key={key} label={t(`pages.inbounds.form.xdrive.${label}`)} name={[...BASE, key]}>
+          <InputNumber min={0} placeholder={String(placeholder)} style={{ width: '100%' }} />
+        </FormField>
+      ))}
+    </>
+  );
+}

frontend/src/lib/xray/inbound-link.ts

@@ -1449,6 +1449,11 @@ export interface GenLinkInput {
   externalProxy?: ExternalProxyEntry | null;
 }
 
+// XDRIVE has no link format; a link carrying its storage secrets would leak them.
+function hasNoLinkFormat(inbound: Inbound): boolean {
+  return inbound.streamSettings?.network === 'xdrive';
+}
+
 // Per-protocol dispatcher matching the legacy `genLink` switch. Returns
 // '' for protocols that don't have client-based share links (wireguard
 // goes through genWireguardLinks/Configs separately, http/mixed/tunnel
@@ -1463,6 +1468,7 @@ export function genLink(input: GenLinkInput): string {
     client,
     externalProxy = null,
   } = input;
+  if (hasNoLinkFormat(inbound)) return '';
   switch (inbound.protocol) {
     case 'vmess':
       return genVmessLink({
@@ -1603,6 +1609,7 @@ export interface GenInboundLinksInput {
 // other clientless protocols (http, mixed, tunnel).
 export function genInboundLinks(input: GenInboundLinksInput): string {
   const { inbound, remark = '', hostOverride = '', fallbackHostname } = input;
+  if (hasNoLinkFormat(inbound)) return '';
   const addr = resolveAddr(inbound, hostOverride, fallbackHostname);
   const clients = getInboundClients(inbound);
   if (clients) {

frontend/src/lib/xray/stream-defaults.ts

@@ -5,6 +5,7 @@ import {
   KcpStreamSettingsSchema,
   TcpStreamSettingsSchema,
   WsStreamSettingsSchema,
+  XDriveStreamSettingsSchema,
   XHttpStreamSettingsSchema,
 } from '@/schemas/protocols/stream';
 import { RealityStreamSettingsSchema, TlsStreamSettingsSchema } from '@/schemas/protocols/security';
@@ -17,6 +18,7 @@ const NETWORK_KEY_MAP = {
   httpupgrade: 'httpupgradeSettings',
   xhttp: 'xhttpSettings',
   hysteria: 'hysteriaSettings',
+  xdrive: 'xdriveSettings',
 } as const;
 
 type SchemaWithParse = { safeParse: (v: unknown) => { success: boolean; data?: unknown } };
@@ -44,6 +46,8 @@ function networkSchemaFor(network: string): SchemaWithParse | null {
       return XHttpStreamSettingsSchema;
     case 'hysteria':
       return HysteriaStreamSettingsSchema;
+    case 'xdrive':
+      return XDriveStreamSettingsSchema;
     default:
       return null;
   }