up 7.23.0

https://github.com/2dust/v2rayN/issues/9562

.editorconfig

@@ -100,7 +100,6 @@ csharp_style_prefer_tuple_swap = true:warning
 csharp_style_prefer_utf8_string_literals = true:warning
 csharp_style_throw_expression = true:warning
 csharp_style_unused_value_assignment_preference = discard_variable:warning
-csharp_style_unused_value_expression_statement_preference = discard_variable:warning
 csharp_using_directive_placement = outside_namespace:warning
 csharp_style_allow_blank_line_after_colon_in_constructor_initializer_experimental = true:warning
 csharp_style_allow_blank_line_after_token_in_arrow_expression_clause_experimental = true:warning

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -18,8 +18,8 @@ body:
   - type: input
     id: "os-version"
     attributes:
-      label: "操作系统和版本"
-      description: "操作系统和版本"
+      label: "操作系统 / v2rayN / Core 版本"
+      description: "操作系统 / v2rayN / Core 版本"
     validations:
       required: true
 

.github/workflows/build-all.yml

@@ -7,13 +7,16 @@ on:
         required: false
         type: string
 
+permissions: 
+  actions: write
+
 jobs:
   update:
     runs-on: ubuntu-latest
     steps:
 
       - name: Trigger build windows
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
         run: |
           curl -X POST \
             -H "Accept: application/vnd.github.v3+json" \
@@ -22,12 +25,12 @@ jobs:
             -d "{
               \"ref\": \"master\",
               \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
               }
             }"
 
       - name: Trigger build linux
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
         run: |
           curl -X POST \
             -H "Accept: application/vnd.github.v3+json" \
@@ -36,12 +39,12 @@ jobs:
             -d "{
               \"ref\": \"master\",
               \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
               }
             }"
 
       - name: Trigger build osx
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
         run: |
           curl -X POST \
             -H "Accept: application/vnd.github.v3+json" \
@@ -50,12 +53,12 @@ jobs:
             -d "{
               \"ref\": \"master\",
               \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
               }
             }"
 
       - name: Trigger build windows desktop
-        if: github.event.inputs.release_tag != ''
+        if: inputs.release_tag != ''
         run: |
           curl -X POST \
             -H "Accept: application/vnd.github.v3+json" \
@@ -64,6 +67,20 @@ jobs:
             -d "{
               \"ref\": \"master\",
               \"inputs\": {
-                \"release_tag\": \"${{ github.event.inputs.release_tag }}\"
+                \"release_tag\": \"${{ inputs.release_tag }}\"
               }
-            }"
+            }"
+            
+      - name: Trigger build windows x86
+        if: inputs.release_tag != ''
+        run: |
+          curl -X POST \
+            -H "Accept: application/vnd.github.v3+json" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            https://api.github.com/repos/${{ github.repository }}/actions/workflows/build-windows-x86.yml/dispatches \
+            -d "{
+              \"ref\": \"master\",
+              \"inputs\": {
+                \"release_tag\": \"${{ inputs.release_tag }}\"
+              }
+            }"

.github/workflows/build-linux.yml

@@ -9,177 +9,104 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
-      - 'V*'
 
 permissions:
   contents: write
 
-env:
-  OutputArch: "linux-64"
-  OutputArchArm: "linux-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/linux-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/linux-arm64"
-
 jobs:
   build:
-    strategy:
-      matrix:
-        configuration: [Release]
-    runs-on: ubuntu-24.04
+    uses: ./.github/workflows/build.yml
+    with:
+      target: linux
 
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: linux
+      release_tag: ${{ inputs.release_tag }}
+
+  deb:
+    name: build and release deb x64 & arm64
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-26.04
+    container: debian:13
+    env: { RELEASE_TAG: "${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}" }
     steps:
-    - name: Checkout
-      uses: actions/checkout@v6.0.2
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'
-
-    - name: Setup .NET
-      uses: actions/setup-dotnet@v5.2.0
-      with:
-        dotnet-version: '8.0.x'
-
-    - name: Build
+    - name: Prepare tools (Debian)
+      shell: bash
       run: |
-        cd v2rayN
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r linux-x64   -p:SelfContained=true -o "$OutputPath64"
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r linux-arm64 -p:SelfContained=true -o "$OutputPathArm64"
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r linux-x64   -p:SelfContained=true -p:PublishTrimmed=true -o "$OutputPath64"
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r linux-arm64 -p:SelfContained=true -p:PublishTrimmed=true -o "$OutputPathArm64"
-
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v7.0.0
-      with:
-        name: v2rayN-linux
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/linux*
-
-    # release debian package
-    - name: Package debian
-      if: github.event.inputs.release_tag != ''
+        set -euo pipefail
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update
+        apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev libc6 libgcc-s1 libstdc++6 zlib1g libicu-dev libssl-dev
+    - name: Checkout repo (for scripts)
+      uses: actions/checkout@v7
+      with: { submodules: 'recursive', fetch-depth: '0' }
+    - name: Ensure script permissions
+      run: chmod 755 package-debian.sh
+    - name: Package DEB (Debian-family)
+      run: ./package-debian.sh "${RELEASE_TAG}" --arch all
+    - name: Collect DEBs into workspace
       run: |
-        chmod 755 package-debian.sh
-        ./package-debian.sh "$OutputArch" "$OutputPath64" "${{ github.event.inputs.release_tag }}"
-        ./package-debian.sh "$OutputArchArm" "$OutputPathArm64" "${{ github.event.inputs.release_tag }}"
-
-    - name: Upload deb to release
+        mkdir -p "$GITHUB_WORKSPACE/dist/deb"
+        rsync -av "$HOME/debbuild/" "$GITHUB_WORKSPACE/dist/deb/" || true
+        find "$GITHUB_WORKSPACE/dist/deb" -name "v2rayn_*_amd64.deb" -exec mv {} "$GITHUB_WORKSPACE/dist/deb/v2rayN-linux-64.deb" \; || true
+        find "$GITHUB_WORKSPACE/dist/deb" -name "v2rayn_*_arm64.deb" -exec mv {} "$GITHUB_WORKSPACE/dist/deb/v2rayN-linux-arm64.deb" \; || true
+        echo "==== Dist tree ===="
+        ls -R "$GITHUB_WORKSPACE/dist/deb" || true
+    - name: Upload DEBs to release
       uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.deb
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
-
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh "$OutputArch" "$OutputPath64"
-        ./package-release-zip.sh "$OutputArchArm" "$OutputPathArm64"
-    
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
+      with: { file: "dist/deb/**/*.deb", tag: "${{ env.RELEASE_TAG }}", file_glob: true, prerelease: true }
 
   rpm:
-    needs: build
-    if: |
-      (github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag != '') ||
-      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
-    runs-on: ubuntu-24.04
-    container:
-      image: registry.access.redhat.com/ubi10/ubi
-    env:
-      RELEASE_TAG: ${{ github.event.inputs.release_tag != '' && github.event.inputs.release_tag || github.ref_name }}
-
+    name: build and release rpm x64 & arm64
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-26.04
+    container: registry.access.redhat.com/ubi10/ubi
+    env: { RELEASE_TAG: "${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}" }
     steps:
     - name: Prepare tools (Red Hat)
       shell: bash
       run: |
         set -euo pipefail
-
         . /etc/os-release
         EL_MAJOR="${VERSION_ID%%.*}"
         echo "EL_MAJOR=${EL_MAJOR}"
-
         dnf -y makecache || true
         command -v curl >/dev/null || dnf -y install curl ca-certificates
-
         ARCH="$(uname -m)"
         case "$ARCH" in x86_64|aarch64) ;; *) echo "Unsupported arch: $ARCH"; exit 1 ;; esac
 
         install_epel_from_dir() {
           local base="$1" rpm
           echo "Try: $base"
-
-          rpm="$(
-            {
-              curl -fsSL "$base/Packages/"   2>/dev/null
-              curl -fsSL "$base/Packages/e/" 2>/dev/null | sed 's|href="|href="e/|'
-            } |
-            sed -n 's/.*href="\([^"]*epel-release-[^"]*\.noarch\.rpm\)".*/\1/p' |
-            sort -V | tail -n1
-          )" || true
-
-          if [[ -n "$rpm" ]]; then
-            dnf -y install "$base/Packages/$rpm"
-            return 0
-          fi
-          return 1
+          rpm="$({ curl -fsSL "$base/Packages/" 2>/dev/null; curl -fsSL "$base/Packages/e/" 2>/dev/null | sed 's|href="|href="e/|'; } |
+            sed -n 's/.*href="\([^"]*epel-release-[^"]*\.noarch\.rpm\)".*/\1/p' | sort -V | tail -n1)" || true
+          [[ -n "$rpm" ]] || return 1
+          dnf -y install "$base/Packages/$rpm"
         }
 
         FEDORA="https://dl.fedoraproject.org/pub/epel/epel-release-latest-${EL_MAJOR}.noarch.rpm"
+        ROCKY="https://dl.rockylinux.org/pub/rocky/${EL_MAJOR}/extras/${ARCH}/os"
+        ALMA="https://repo.almalinux.org/almalinux/${EL_MAJOR}/extras/${ARCH}/os"
+
         echo "Try Fedora: $FEDORA"
+        curl -fsSLI "$FEDORA" >/dev/null && dnf -y install "$FEDORA" ||
+          install_epel_from_dir "$ROCKY" ||
+          install_epel_from_dir "$ALMA" ||
+          { echo "EPEL bootstrap failed (Fedora/Rocky/Alma)"; exit 1; }
 
-        if curl -fsSLI "$FEDORA" >/dev/null; then
-          dnf -y install "$FEDORA"
-        else
-          ROCKY="https://dl.rockylinux.org/pub/rocky/${EL_MAJOR}/extras/${ARCH}/os"
-          if install_epel_from_dir "$ROCKY"; then
-            :
-          else
-            ALMA="https://repo.almalinux.org/almalinux/${EL_MAJOR}/extras/${ARCH}/os"
-            if install_epel_from_dir "$ALMA"; then
-              :
-            else
-              echo "EPEL bootstrap failed (Fedora/Rocky/Alma)"
-              exit 1
-            fi
-          fi
-        fi
-
-        dnf -y install sudo git rpm-build rpmdevtools dnf-plugins-core \
-                       rsync findutils tar gzip unzip which
-
+        dnf -y install sudo git rpm-build rpmdevtools dnf-plugins-core rsync findutils tar gzip unzip which
         dnf repolist | grep -i epel || true
-
     - name: Checkout repo (for scripts)
-      uses: actions/checkout@v6.0.2
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'
-
-    - name: Restore build artifacts
-      uses: actions/download-artifact@v8
-      with:
-        name: v2rayN-linux
-        path: ${{ github.workspace }}/v2rayN/Release
-
+      uses: actions/checkout@v7
+      with: { submodules: 'recursive', fetch-depth: '0' }
     - name: Ensure script permissions
       run: chmod 755 package-rhel.sh
-
     - name: Package RPM (RHEL-family)
       run: ./package-rhel.sh "${RELEASE_TAG}" --arch all
-
     - name: Collect RPMs into workspace
       run: |
         mkdir -p "$GITHUB_WORKSPACE/dist/rpm"
@@ -188,17 +115,419 @@ jobs:
         find "$GITHUB_WORKSPACE/dist/rpm" -name "v2rayN-*-1*.aarch64.rpm" -exec mv {} "$GITHUB_WORKSPACE/dist/rpm/v2rayN-linux-rhel-arm64.rpm" \; || true
         echo "==== Dist tree ===="
         ls -R "$GITHUB_WORKSPACE/dist/rpm" || true
-
-    - name: Upload RPM artifacts
-      uses: actions/upload-artifact@v7.0.0
-      with:
-        name: v2rayN-rpm
-        path: dist/rpm/**/*.rpm
-
     - name: Upload RPMs to release
       uses: svenstaro/upload-release-action@v2
-      with:
-        file: dist/rpm/**/*.rpm
-        tag: ${{ env.RELEASE_TAG }}
-        file_glob: true
-        prerelease: true
+      with: { file: "dist/rpm/**/*.rpm", tag: "${{ env.RELEASE_TAG }}", file_glob: true, prerelease: true }
+
+  rpm-riscv64:
+    name: build and release rpm riscv64
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-24.04-riscv
+    container: rockylinux/rockylinux:10
+    env: { RELEASE_TAG: "${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}" }
+    steps:
+    - name: Prepare tools (Red Hat)
+      shell: bash
+      run: |
+        set -euo pipefail
+        dnf -y makecache
+        dnf -y install sudo git rpm-build rpmdevtools dnf-plugins-core rsync findutils tar gzip unzip which jq
+    - name: Checkout repo (for scripts)
+      shell: bash
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
+      run: |
+        set -euo pipefail
+        rm -rf ./*
+        git init .
+        git config --global --add safe.directory "$PWD"
+        git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+        git fetch --depth=1 origin "${GITHUB_SHA}"
+        git checkout FETCH_HEAD
+        git submodule update --init --recursive
+    - name: Ensure script permissions
+      run: chmod 755 package-rhel-riscv.sh
+    - name: Package RPM (RHEL-family)
+      run: ./package-rhel-riscv.sh "${RELEASE_TAG}"
+    - name: Collect RPMs into workspace
+      run: |
+        mkdir -p "$GITHUB_WORKSPACE/dist/rpm-riscv64"
+        rsync -av "$HOME/rpmbuild/RPMS/" "$GITHUB_WORKSPACE/dist/rpm-riscv64/" || true
+        find "$GITHUB_WORKSPACE/dist/rpm-riscv64" -name "*.riscv64.rpm" -exec mv {} "$GITHUB_WORKSPACE/dist/rpm-riscv64/v2rayN-linux-rhel-riscv64.rpm" \; || true
+        echo "==== Dist tree ===="
+        ls -R "$GITHUB_WORKSPACE/dist/rpm-riscv64" || true
+    - name: Upload RPMs to release
+      shell: bash
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
+      run: |
+        set -euo pipefail
+        shopt -s globstar nullglob
+        files=(dist/rpm-riscv64/**/*.rpm)
+        (( ${#files[@]} )) || { echo "No RPMs found."; exit 1; }
+        api="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}"
+        upload_url="$(curl -fsSL -H "Authorization: Bearer ${GITHUB_TOKEN}" "$api" | jq -r '.upload_url // empty' | sed 's/{?name,label}//')"
+        [[ "$upload_url" ]] || { echo "Release upload URL not found: ${RELEASE_TAG}"; exit 1; }
+        for f in "${files[@]}"; do
+          echo "Uploading ${f##*/}"
+          curl -fsSL -X POST \
+            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$f" \
+            "${upload_url}?name=${f##*/}"
+        done
+
+  deb-riscv64:
+    name: build and release deb riscv64
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-24.04-riscv
+    container: debian:13
+    env: { RELEASE_TAG: "${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}" }
+    steps:
+    - name: Prepare tools (Debian)
+      shell: bash
+      run: |
+        set -euo pipefail
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update
+        apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev gcc make libc6-dev libgcc-s1 libstdc++6 zlib1g libatomic1
+    - name: Checkout repo (for scripts)
+      shell: bash
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
+      run: |
+        set -euo pipefail
+        rm -rf ./*
+        git init .
+        git config --global --add safe.directory "$PWD"
+        git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+        git fetch --depth=1 origin "${GITHUB_SHA}"
+        git checkout FETCH_HEAD
+        git submodule update --init --recursive
+    - name: Ensure script permissions
+      run: chmod 755 package-debian-riscv.sh
+    - name: Package DEB (Debian-family)
+      run: ./package-debian-riscv.sh "${RELEASE_TAG}"
+    - name: Collect DEBs into workspace
+      run: |
+        mkdir -p "$GITHUB_WORKSPACE/dist/deb-riscv64"
+        rsync -av "$HOME/debbuild/" "$GITHUB_WORKSPACE/dist/deb-riscv64/" || true
+        find "$GITHUB_WORKSPACE/dist/deb-riscv64" -name "*.deb" -exec mv {} "$GITHUB_WORKSPACE/dist/deb-riscv64/v2rayN-linux-riscv64.deb" \; || true
+        echo "==== Dist tree ===="
+        ls -R "$GITHUB_WORKSPACE/dist/deb-riscv64" || true
+    - name: Upload DEBs to release
+      shell: bash
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
+      run: |
+        set -euo pipefail
+        shopt -s globstar nullglob
+        files=(dist/deb-riscv64/**/*.deb)
+        (( ${#files[@]} )) || { echo "No DEBs found."; exit 1; }
+        api="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}"
+        upload_url="$(curl -fsSL -H "Authorization: Bearer ${GITHUB_TOKEN}" "$api" | jq -r '.upload_url // empty' | sed 's/{?name,label}//')"
+        [[ "$upload_url" ]] || { echo "Release upload URL not found: ${RELEASE_TAG}"; exit 1; }
+        for f in "${files[@]}"; do
+          echo "Uploading ${f##*/}"
+          curl -fsSL -X POST \
+            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+            -H "Content-Type: application/vnd.debian.binary-package" \
+            --data-binary @"$f" \
+            "${upload_url}?name=${f##*/}"
+        done
+
+  deb-loong64:
+    name: build and release deb loong64
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-26.04
+    env:
+      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
+      QCOW2_URL: https://github.com/xujiegb/debian-loong64-qcow2/releases/download/13.5/debian13-loong64.qcow2
+      EFI_CODE_URL: https://github.com/xujiegb/debian-loong64-qcow2/releases/download/13.5/edk2-loongarch64-code.fd
+      EFI_VARS_URL: https://github.com/xujiegb/debian-loong64-qcow2/releases/download/13.5/edk2-loongarch64-vars.fd
+      QCOW2_IMAGE: debian13-loong64.qcow2
+      EFI_CODE: edk2-loongarch64-code.fd
+      EFI_VARS: edk2-loongarch64-vars.fd
+      QEMU_VERSION: 10.2.3
+    steps:
+    - name: Prepare host tools
+      shell: bash
+      run: |
+        set -euo pipefail
+        sudo apt-get update
+        sudo apt-get install -y git rsync qemu-utils qemu-system-common expect wget curl ca-certificates libfdt1 libglib2.0-0 libpixman-1-0 libslirp0 virtiofsd
+        sudo ln -sf /usr/libexec/virtiofsd /usr/local/bin/virtiofsd
+        virtiofsd --version || virtiofsd --help | head
+    - name: Host clone repo
+      shell: bash
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
+      run: |
+        set -euo pipefail
+        rm -rf repo
+        git clone --no-single-branch --tags "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" repo
+    - name: Download QEMU prebuild
+      run: |
+        set -euo pipefail
+        wget -O qemu-linux-x64-v3.tar.gz "https://github.com/xujiegb/qemu-linux-prebuild/releases/download/${QEMU_VERSION}/qemu-linux-x64-v3.tar.gz"
+        tar -xzf qemu-linux-x64-v3.tar.gz
+        mkdir -p "$HOME/qemu-install"
+        rsync -a qemu-linux-x64-v3/ "$HOME/qemu-install/"
+        "$HOME/qemu-install/bin/qemu-system-loongarch64" --version
+    - name: Download loong64 qcow2 and EFI firmware
+      shell: bash
+      run: |
+        set -euo pipefail
+        wget -O "$QCOW2_IMAGE" "$QCOW2_URL"
+        wget -O "$EFI_CODE" "$EFI_CODE_URL"
+        wget -O "$EFI_VARS" "$EFI_VARS_URL"
+        qemu-img info "$QCOW2_IMAGE"
+    - name: Build loong64 DEB in VM through serial console
+      shell: bash
+      timeout-minutes: 180
+      env: { RELEASE_TAG: "${{ env.RELEASE_TAG }}" }
+      run: |
+        set -euo pipefail
+        mkdir -p "$GITHUB_WORKSPACE/dist/deb-loong64"
+
+        export VIRTIOFSD_SOCKET="$RUNNER_TEMP/virtiofs-deb-loong64.sock"
+        rm -f "$VIRTIOFSD_SOCKET"
+
+        sudo virtiofsd --socket-path="$VIRTIOFSD_SOCKET" -o source="$GITHUB_WORKSPACE" -o cache=auto &
+
+        VIRTIOFSD_PID=$!
+        trap 'sudo kill "$VIRTIOFSD_PID" 2>/dev/null || true; rm -f "$VIRTIOFSD_SOCKET"' EXIT
+
+        for i in {1..100}; do
+          [[ -S "$VIRTIOFSD_SOCKET" ]] && break
+          sleep 0.1
+        done
+
+        [[ -S "$VIRTIOFSD_SOCKET" ]] || { echo "virtiofsd socket not created"; exit 1; }
+        sudo chown "$USER:$(id -gn)" "$VIRTIOFSD_SOCKET" || true
+        sudo chmod 660 "$VIRTIOFSD_SOCKET" || true
+        expect <<'EOF'
+        log_user 1
+        set timeout -1
+        set release_tag $env(RELEASE_TAG)
+        set qemu_bin "$env(HOME)/qemu-install/bin/qemu-system-loongarch64"
+        set qemu_rom_dir "$env(HOME)/qemu-install/share/qemu"
+        set virtiofs_socket $env(VIRTIOFSD_SOCKET)
+        set qcow2 $env(QCOW2_IMAGE)
+        set efi_code $env(EFI_CODE)
+        set efi_vars $env(EFI_VARS)
+        proc wait_prompt {} {
+          expect {
+            -re "__CI_PROMPT__# " {}
+            timeout { exit 1 }
+            eof { exit 1 }
+          }
+        }
+        proc run_cmd {cmd} {
+          send -- "$cmd\r"
+          wait_prompt
+        }
+        spawn $qemu_bin \
+          -L $qemu_rom_dir \
+          -machine virt \
+          -accel tcg,thread=multi,tb-size=2048 \
+          -cpu la464 \
+          -m 9216 \
+          -object memory-backend-memfd,id=mem0,size=9216M,share=on \
+          -numa node,memdev=mem0 \
+          -smp 4 \
+          -drive if=pflash,format=raw,unit=0,file=$efi_code,readonly=on \
+          -drive if=pflash,format=raw,unit=1,file=$efi_vars \
+          -device virtio-blk-pci,drive=hd0,bootindex=1 \
+          -drive if=none,media=disk,id=hd0,file=$qcow2,format=qcow2 \
+          -netdev user,id=net0 \
+          -device virtio-net-pci-non-transitional,netdev=net0 \
+          -chardev socket,id=charfs0,path=$virtiofs_socket \
+          -device vhost-user-fs-pci,chardev=charfs0,tag=workspace \
+          -display none \
+          -serial stdio \
+          -monitor none
+        expect -re "login:|debian login:"
+        send -- "root\r"
+        expect -re "Password:|密码:|密码："
+        send -- "password\r"
+        expect {
+          -re "# " {}
+          timeout { exit 1 }
+          eof { exit 1 }
+        }
+        send -- "export TERM=dumb; export PS1='__CI_PROMPT__# '\r"
+        wait_prompt
+        run_cmd "mkdir -p /workspace"
+        run_cmd "mount -t virtiofs workspace /workspace"
+        run_cmd "IFACE=\$(ip -o link show | awk -F': ' '\$2 != \"lo\" {print \$2; exit}') ; ip link set \$IFACE up || true"
+        run_cmd "dhclient \$IFACE || true"
+        run_cmd "printf 'nameserver 10.0.2.3\nnameserver 1.1.1.1\n' >/etc/resolv.conf"
+        run_cmd "apt-get update || apt-get update || apt-get update"
+        run_cmd "DEBIAN_FRONTEND=noninteractive apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev gcc make libc6-dev libgcc-s1 libstdc++6 zlib1g libatomic1 fuse3"
+        run_cmd "rm -rf /root/v2rayN-src"
+        run_cmd "rsync -a --info=progress2 /workspace/repo/ /root/v2rayN-src/"
+        run_cmd "cd /root/v2rayN-src && git config --global --add safe.directory /root/v2rayN-src"
+        run_cmd "cd /root/v2rayN-src && chmod 755 package-debian-loong.sh"
+        send -- "cd /root/v2rayN-src; cat >/tmp/run-loong-build.sh <<'SCRIPT'\nset +e\nset -o pipefail\nbash -x ./package-debian-loong.sh \"\$RELEASE_TAG\" 2>&1 | tee /tmp/build.log\nrc=\$?\nmkdir -p /workspace/dist/deb-loong64\ncp -av /root/debbuild/*.deb /workspace/dist/deb-loong64/ 2>/dev/null || true\necho __BUILD_DONE__\$rc\nSCRIPT\nRELEASE_TAG=\"$release_tag\" bash /tmp/run-loong-build.sh\r"
+        expect {
+          -re "__BUILD_DONE__0" { send -- "poweroff\r" }
+          default { exit 1 }
+        }
+        EOF
+    - name: Collect DEBs
+      shell: bash
+      run: |
+        set -euo pipefail
+        mkdir -p "$GITHUB_WORKSPACE/dist/deb-loong64"
+        find "$GITHUB_WORKSPACE/dist/deb-loong64" -name "*.deb" -exec mv {} "$GITHUB_WORKSPACE/dist/deb-loong64/v2rayN-linux-loong64.deb" \; || true
+        echo "==== Dist tree ===="
+        ls -R "$GITHUB_WORKSPACE/dist/deb-loong64"
+    - name: Upload DEBs to release
+      uses: svenstaro/upload-release-action@v2
+      with: { file: "dist/deb-loong64/**/*.deb", tag: "${{ env.RELEASE_TAG }}", file_glob: true, prerelease: true }
+
+  rpm-loong64:
+    name: build and release rpm loong64
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-26.04
+    env:
+      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
+      QCOW2_URL: https://github.com/xujiegb/fedora-loong64-qcow2/releases/download/43/fedora43-loong64.qcow2
+      EFI_CODE_URL: https://github.com/xujiegb/fedora-loong64-qcow2/releases/download/43/edk2-loongarch64-code.fd
+      EFI_VARS_URL: https://github.com/xujiegb/fedora-loong64-qcow2/releases/download/43/edk2-loongarch64-vars.fd
+      QCOW2_IMAGE: fedora43-loong64.qcow2
+      EFI_CODE: edk2-loongarch64-code.fd
+      EFI_VARS: edk2-loongarch64-vars.fd
+      QEMU_VERSION: 10.2.3
+    steps:
+    - name: Prepare host tools
+      shell: bash
+      run: |
+        set -euo pipefail
+        sudo apt-get update
+        sudo apt-get install -y git rsync qemu-utils qemu-system-common expect wget curl ca-certificates libfdt1 libglib2.0-0 libpixman-1-0 libslirp0 virtiofsd
+        sudo ln -sf /usr/libexec/virtiofsd /usr/local/bin/virtiofsd
+        virtiofsd --version || virtiofsd --help | head
+    - name: Host clone repo
+      shell: bash
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
+      run: |
+        set -euo pipefail
+        rm -rf repo
+        git clone --no-single-branch --tags "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" repo
+    - name: Download QEMU prebuild
+      run: |
+        set -euo pipefail
+        wget -O qemu-linux-x64-v3.tar.gz "https://github.com/xujiegb/qemu-linux-prebuild/releases/download/${QEMU_VERSION}/qemu-linux-x64-v3.tar.gz"
+        tar -xzf qemu-linux-x64-v3.tar.gz
+        mkdir -p "$HOME/qemu-install"
+        rsync -a qemu-linux-x64-v3/ "$HOME/qemu-install/"
+        "$HOME/qemu-install/bin/qemu-system-loongarch64" --version
+    - name: Download loong64 qcow2 and EFI firmware
+      shell: bash
+      run: |
+        set -euo pipefail
+        wget -O "$QCOW2_IMAGE" "$QCOW2_URL"
+        wget -O "$EFI_CODE" "$EFI_CODE_URL"
+        wget -O "$EFI_VARS" "$EFI_VARS_URL"
+        qemu-img info "$QCOW2_IMAGE"
+    - name: Build loong64 RPM in VM through serial console
+      shell: bash
+      timeout-minutes: 180
+      env: { RELEASE_TAG: "${{ env.RELEASE_TAG }}" }
+      run: |
+        set -euo pipefail
+        mkdir -p "$GITHUB_WORKSPACE/dist/rpm-loong64"
+
+        export VIRTIOFSD_SOCKET="$RUNNER_TEMP/virtiofs-rpm-loong64.sock"
+        rm -f "$VIRTIOFSD_SOCKET"
+
+        sudo virtiofsd --socket-path="$VIRTIOFSD_SOCKET" -o source="$GITHUB_WORKSPACE" -o cache=auto &
+
+        VIRTIOFSD_PID=$!
+        trap 'sudo kill "$VIRTIOFSD_PID" 2>/dev/null || true; rm -f "$VIRTIOFSD_SOCKET"' EXIT
+
+        for i in {1..100}; do
+          [[ -S "$VIRTIOFSD_SOCKET" ]] && break
+          sleep 0.1
+        done
+
+        [[ -S "$VIRTIOFSD_SOCKET" ]] || { echo "virtiofsd socket not created"; exit 1; }
+        sudo chown "$USER:$(id -gn)" "$VIRTIOFSD_SOCKET" || true
+        sudo chmod 660 "$VIRTIOFSD_SOCKET" || true
+        expect <<'EOF'
+        log_user 1
+        set timeout -1
+        set release_tag $env(RELEASE_TAG)
+        set qemu_bin "$env(HOME)/qemu-install/bin/qemu-system-loongarch64"
+        set qemu_rom_dir "$env(HOME)/qemu-install/share/qemu"
+        set virtiofs_socket $env(VIRTIOFSD_SOCKET)
+        set qcow2 $env(QCOW2_IMAGE)
+        set efi_code $env(EFI_CODE)
+        set efi_vars $env(EFI_VARS)
+        proc wait_prompt {} {
+          expect {
+            -re "__CI_PROMPT__# " {}
+            timeout { exit 1 }
+            eof { exit 1 }
+          }
+        }
+        proc run_cmd {cmd} {
+          send -- "$cmd\r"
+          wait_prompt
+        }
+        spawn $qemu_bin \
+          -L $qemu_rom_dir \
+          -machine virt \
+          -accel tcg,thread=multi,tb-size=2048 \
+          -cpu la464 \
+          -m 9216 \
+          -object memory-backend-memfd,id=mem0,size=9216M,share=on \
+          -numa node,memdev=mem0 \
+          -smp 4 \
+          -drive if=pflash,format=raw,unit=0,file=$efi_code,readonly=on \
+          -drive if=pflash,format=raw,unit=1,file=$efi_vars \
+          -device virtio-blk-pci,drive=hd0,bootindex=1 \
+          -drive if=none,media=disk,id=hd0,file=$qcow2,format=qcow2 \
+          -netdev user,id=net0 \
+          -device virtio-net-pci-non-transitional,netdev=net0 \
+          -chardev socket,id=charfs0,path=$virtiofs_socket \
+          -device vhost-user-fs-pci,chardev=charfs0,tag=workspace \
+          -display none \
+          -serial stdio \
+          -monitor none
+        expect -re "login:|fedora login:"
+        send -- "root\r"
+        expect -re "Password:|密码:|密码："
+        send -- "password\r"
+        expect {
+          -re "# " {}
+          timeout { exit 1 }
+          eof { exit 1 }
+        }
+        send -- "export TERM=dumb; export PS1='__CI_PROMPT__# '\r"
+        wait_prompt
+        run_cmd "mkdir -p /workspace"
+        run_cmd "mount -t virtiofs workspace /workspace"
+        run_cmd "IFACE=\$(ip -o link show | awk -F': ' '\$2 != \"lo\" {print \$2; exit}') ; ip link set \$IFACE up || true"
+        run_cmd "dhclient \$IFACE || true"
+        run_cmd "printf 'nameserver 10.0.2.3\nnameserver 1.1.1.1\n' >/etc/resolv.conf"
+        run_cmd "dnf -y makecache || dnf -y makecache || dnf -y makecache"
+        run_cmd "dnf -y install sudo git rpm-build rpmdevtools dnf-plugins-core rsync findutils tar gzip unzip which curl jq file ca-certificates fuse3 --nogpgcheck"
+        run_cmd "rm -rf /root/v2rayN-src"
+        run_cmd "rsync -a --info=progress2 /workspace/repo/ /root/v2rayN-src/"
+        run_cmd "cd /root/v2rayN-src && git config --global --add safe.directory /root/v2rayN-src"
+        run_cmd "cd /root/v2rayN-src && chmod 755 package-rhel-loong.sh"
+        send -- "cd /root/v2rayN-src; cat >/tmp/run-loong-rpm-build.sh <<'SCRIPT'\nset +e\nset -o pipefail\nbash -x ./package-rhel-loong.sh \"\$RELEASE_TAG\" 2>&1 | tee /tmp/build.log\nrc=\$?\nmkdir -p /workspace/dist/rpm-loong64\nfind /root/rpmbuild/RPMS -name '*.rpm' -exec cp -av {} /workspace/dist/rpm-loong64/ \\; 2>/dev/null || true\necho __BUILD_DONE__\$rc\nSCRIPT\nRELEASE_TAG=\"$release_tag\" bash /tmp/run-loong-rpm-build.sh\r"
+        expect {
+          -re "__BUILD_DONE__0" { send -- "poweroff\r" }
+          default { exit 1 }
+        }
+        EOF
+    - name: Collect RPMs
+      shell: bash
+      run: |
+        set -euo pipefail
+        mkdir -p "$GITHUB_WORKSPACE/dist/rpm-loong64"
+        find "$GITHUB_WORKSPACE/dist/rpm-loong64" -name "*.loongarch64.rpm" -exec mv {} "$GITHUB_WORKSPACE/dist/rpm-loong64/v2rayN-linux-rhel-loong64.rpm" \; || true
+        echo "==== Dist tree ===="
+        ls -R "$GITHUB_WORKSPACE/dist/rpm-loong64"
+    - name: Upload RPMs to release
+      uses: svenstaro/upload-release-action@v2
+      with: { file: "dist/rpm-loong64/**/*.rpm", tag: "${{ env.RELEASE_TAG }}", file_glob: true, prerelease: true }

.github/workflows/build-osx.yml

@@ -10,78 +10,65 @@ on:
     branches:
       - master
 
-env:
-  OutputArch: "macos-64"
-  OutputArchArm: "macos-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/macos-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/macos-arm64"
+permissions:
+  contents: write
 
 jobs:
   build:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: macos
+
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: macos
+      release_tag: ${{ inputs.release_tag }}
+    
+  dmg:
+    name: package and release macOS dmg
+    if: inputs.release_tag != ''
+    needs: build
     strategy:
       matrix:
-        configuration: [Release]
-
+        arch: [ x64, arm64 ]
     runs-on: macos-latest
-
+    env:
+      Arch: |-
+        ${{
+          case(
+            matrix.arch == 'x64', '64',
+            matrix.arch
+          ) 
+        }} 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6.0.2
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'
+      uses: actions/checkout@v7
 
-    - name: Setup
-      uses: actions/setup-dotnet@v5.2.0
+    - name: Restore build artifacts
+      uses: actions/download-artifact@v8
       with:
-        dotnet-version: '8.0.x'
-
-    - name: Build
-      run: |
-        cd v2rayN 
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r osx-x64   -p:SelfContained=true -o $OutputPath64
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r osx-arm64 -p:SelfContained=true -o $OutputPathArm64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r osx-x64   -p:SelfContained=true -p:PublishTrimmed=true -o $OutputPath64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r osx-arm64 -p:SelfContained=true -p:PublishTrimmed=true -o $OutputPathArm64
-
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v7.0.0
-      with:
-        name: v2rayN-macos
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/macos*
+        name: ${{ matrix.arch }}
+        path: v2rayN-macos-${{ env.Arch }}
     
-    # release osx package
-    - name: Package osx
-      if: github.event.inputs.release_tag != ''
-      run: |
-        brew install create-dmg
-        chmod 755 package-osx.sh
-        ./package-osx.sh $OutputArch $OutputPath64 ${{ github.event.inputs.release_tag }}
-        ./package-osx.sh $OutputArchArm $OutputPathArm64 ${{ github.event.inputs.release_tag }}
+    - name: Setup create-dmg
+      run: brew install create-dmg
+
+    - name: Ensure script permissions
+      run: chmod 755 package-osx.sh
+
+    - name: Package dmg
+      run: ./package-osx.sh macos-$Arch v2rayN-macos-$Arch ${{ inputs.release_tag }}
+
+    - name: Sleep for race condition between matrix jobs
+      run: sleep "$(od -An -N2 -tu2 /dev/urandom | awk 'NR==1{printf "%.2f", $1/5461}')"
     
     - name: Upload dmg to release
       uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
       with:
         file: ${{ github.workspace }}/v2rayN*.dmg
-        tag: ${{ github.event.inputs.release_tag }}
+        tag: ${{ inputs.release_tag }}
         file_glob: true
         prerelease: true
-
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh $OutputArch $OutputPath64
-        ./package-release-zip.sh $OutputArchArm $OutputPathArm64
-    
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true

.github/workflows/build-windows-desktop.yml

@@ -10,62 +10,19 @@ on:
     branches:
       - master
 
-env:
-  OutputArch: "windows-64"
-  OutputArchArm: "windows-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/windows-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/windows-arm64"
+permissions:
+  contents: write
 
 jobs:
   build:
-    strategy:
-      matrix:
-        configuration: [Release]
+    uses: ./.github/workflows/build.yml
+    with:
+      target: windows
 
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v6.0.2
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'
-
-    - name: Setup
-      uses: actions/setup-dotnet@v5.2.0
-      with:
-        dotnet-version: '8.0.x'
-
-    - name: Build
-      run: |
-        cd v2rayN 
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPath64
-        dotnet publish ./v2rayN.Desktop/v2rayN.Desktop.csproj -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPathArm64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPath64
-        dotnet publish ./AmazTool/AmazTool.csproj             -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPathArm64
-
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v7.0.0
-      with:
-        name: v2rayN-windows-desktop
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/windows*
-
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh $OutputArch $OutputPath64
-        mv "v2rayN-${OutputArch}.zip" "v2rayN-${OutputArch}-desktop.zip"
-        ./package-release-zip.sh $OutputArchArm $OutputPathArm64
-        mv "v2rayN-${OutputArchArm}.zip" "v2rayN-${OutputArchArm}-desktop.zip"
-
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: windows-desktop
+      release_tag: ${{ inputs.release_tag }}

.github/workflows/build-windows-x86.yml

@@ -0,0 +1,231 @@
+name: release Windows x86
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        required: false
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  package-x86:
+    name: build and release windows x86 WPF & Avalonia
+    if: inputs.release_tag != ''
+    runs-on: windows-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - flavor: wpf
+            project: ./v2rayN/v2rayN/v2rayN.csproj
+            zip_name: v2rayN-windows-86.zip
+          - flavor: desktop
+            project: ./v2rayN/v2rayN.Desktop/v2rayN.Desktop.csproj
+            zip_name: v2rayN-windows-86-desktop.zip
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Purge SDKs
+        shell: pwsh
+        run: |
+          echo "Before:"
+          dotnet --list-sdks
+          
+          dotnet --list-sdks | % {
+            $_ -match '^\S+\s+\[(.+)\]$' > $null
+            $d = Join-Path $Matches[1] $_.Split()[0]
+            Write-Host "Removing $d"
+            if ($IsWindows) { rm $d -r -fo } else { sudo rm -rf "$d" }
+          }
+
+          echo "After:"
+          dotnet --list-sdks 2>$null; $LASTEXITCODE=0
+
+      - name: Setup .NET 10.0.1xx
+        uses: actions/setup-dotnet@v5.3.0
+        with:
+          dotnet-version: 10.0.1xx
+
+      - name: Publish ${{ matrix.flavor }} win-x86
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          dotnet restore "${{ matrix.project }}" -r win-x86
+
+          dotnet publish "${{ matrix.project }}" `
+            -c Release `
+            -r win-x86 `
+            -p:SelfContained=true `
+            -p:EnableWindowsTargeting=true `
+            -o "publish/${{ matrix.flavor }}"
+
+      - name: Publish AmazTool win-x86
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          dotnet publish "./v2rayN/AmazTool/AmazTool.csproj" `
+            -c Release `
+            -r win-x86 `
+            -p:SelfContained=true `
+            -p:PublishTrimmed=true `
+            -p:EnableWindowsTargeting=true `
+            -o "publish/${{ matrix.flavor }}"
+
+      - name: Detect bundled core versions
+        id: detect-core
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          New-Item -ItemType Directory -Force -Path "tmp/probe" | Out-Null
+
+          Invoke-WebRequest -Uri "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/v2rayN-windows-64/bin/xray/xray.exe" -OutFile "tmp/probe/xray.exe"
+          $xrayOutput = (& "tmp/probe/xray.exe" version) -join "`n"
+          Write-Host $xrayOutput
+
+          $xrayMatch = [regex]::Match($xrayOutput, 'Xray\s+([0-9.]+)')
+          if ($xrayMatch.Success) {
+            $xrayVer = $xrayMatch.Groups[1].Value
+          } else {
+            throw "Failed to detect Xray version"
+          }
+
+          Invoke-WebRequest -Uri "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/v2rayN-windows-64/bin/sing_box/sing-box.exe" -OutFile "tmp/probe/sing-box.exe"
+          $singOutput = (& "tmp/probe/sing-box.exe" version) -join "`n"
+          Write-Host $singOutput
+
+          $singMatch = [regex]::Match($singOutput, 'sing-box version\s+([0-9.]+)')
+          if ($singMatch.Success) {
+            $singVer = $singMatch.Groups[1].Value
+          } else {
+            throw "Failed to detect sing-box version"
+          }
+
+          Write-Host "Bundled Xray version: $xrayVer"
+          Write-Host "Bundled sing-box version: $singVer"
+
+          "xray_version=$xrayVer" >> $env:GITHUB_OUTPUT
+          "sing_version=$singVer" >> $env:GITHUB_OUTPUT
+
+      - name: Download x86 cores and rule assets
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          $headers = @{
+            Authorization = "Bearer $env:GH_TOKEN"
+            Accept = "application/vnd.github+json"
+            "X-GitHub-Api-Version" = "2022-11-28"
+          }
+
+          $root = "publish/${{ matrix.flavor }}"
+          $bin = Join-Path $root "bin"
+          $xrayDir = Join-Path $bin "xray"
+          $singDir = Join-Path $bin "sing_box"
+          $srssDir = Join-Path $bin "srss"
+
+          New-Item -ItemType Directory -Force -Path $xrayDir, $singDir, $srssDir | Out-Null
+
+          $xrayVer = "${{ steps.detect-core.outputs.xray_version }}"
+          $singVer = "${{ steps.detect-core.outputs.sing_version }}"
+
+          $xrayTag = "v$xrayVer"
+          $singTag = "v$singVer"
+
+          $xrayUrl = "https://github.com/autorepobot/Xray-core/releases/download/$xrayTag/Xray-windows-32.zip"
+          $singUrl = "https://github.com/SagerNet/sing-box/releases/download/$singTag/sing-box-$singVer-windows-386.zip"
+
+          Write-Host "Bundled Xray version: $xrayVer"
+          Write-Host "Bundled sing-box version: $singVer"
+          Write-Host "Xray: $xrayUrl"
+          Write-Host "sing-box: $singUrl"
+
+          New-Item -ItemType Directory -Force -Path "tmp" | Out-Null
+
+          Invoke-WebRequest -Uri $xrayUrl -OutFile "tmp/xray.zip"
+          Expand-Archive -Force "tmp/xray.zip" "tmp/xray"
+
+          Get-ChildItem "tmp/xray" -Recurse -Include "*.exe","*.dll" | ForEach-Object {
+            Copy-Item $_.FullName (Join-Path $xrayDir $_.Name) -Force
+          }
+
+          Invoke-WebRequest -Uri $singUrl -OutFile "tmp/sing-box.zip"
+          Expand-Archive -Force "tmp/sing-box.zip" "tmp/sing-box"
+
+          $singExe = Get-ChildItem "tmp/sing-box" -Recurse -Filter "sing-box.exe" | Select-Object -First 1
+          if (-not $singExe) {
+            throw "sing-box.exe not found"
+          }
+
+          Copy-Item $singExe.FullName "$singDir/sing-box.exe" -Force
+
+          $cronet = Get-ChildItem "tmp/sing-box" -Recurse -Filter "libcronet*.dll" | Select-Object -First 1
+          if ($cronet) {
+            Copy-Item $cronet.FullName "$singDir/libcronet.dll" -Force
+          }
+
+          Invoke-WebRequest -Uri "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat" -OutFile "$bin/geosite.dat"
+          Invoke-WebRequest -Uri "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat" -OutFile "$bin/geoip.dat"
+          Invoke-WebRequest -Uri "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat" -OutFile "$bin/geoip-only-cn-private.dat"
+          Invoke-WebRequest -Uri "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb" -OutFile "$bin/Country.mmdb"
+          Invoke-WebRequest -Uri "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb" -OutFile "$bin/geoip.metadb"
+
+          $geoipRules = @(
+            "geoip-private.srs",
+            "geoip-cn.srs",
+            "geoip-facebook.srs",
+            "geoip-fastly.srs",
+            "geoip-google.srs",
+            "geoip-netflix.srs",
+            "geoip-telegram.srs",
+            "geoip-twitter.srs"
+          )
+
+          foreach ($f in $geoipRules) {
+            Invoke-WebRequest -Uri "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geoip/$f" -OutFile "$srssDir/$f"
+          }
+
+          $geositeRules = @(
+            "geosite-cn.srs",
+            "geosite-gfw.srs",
+            "geosite-google.srs",
+            "geosite-greatfire.srs",
+            "geosite-geolocation-cn.srs",
+            "geosite-category-ads-all.srs",
+            "geosite-private.srs"
+          )
+
+          foreach ($f in $geositeRules) {
+            Invoke-WebRequest -Uri "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geosite/$f" -OutFile "$srssDir/$f"
+          }
+
+      - name: Package zip
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          Compress-Archive `
+            -Path "publish/${{ matrix.flavor }}/*" `
+            -DestinationPath "${{ matrix.zip_name }}" `
+            -Force
+
+      - name: Upload zip archive to release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          file: ${{ matrix.zip_name }}
+          tag: ${{ inputs.release_tag }}
+          prerelease: true
+          overwrite: true

.github/workflows/build-windows.yml

@@ -10,57 +10,20 @@ on:
     branches:
       - master
 
-env:
-  OutputArch: "windows-64"
-  OutputArchArm: "windows-arm64"
-  OutputPath64:  "${{ github.workspace }}/v2rayN/Release/windows-64"
-  OutputPathArm64:  "${{ github.workspace }}/v2rayN/Release/windows-arm64"
+permissions:
+  contents: write
 
 jobs:
   build:
-    strategy:
-      matrix:
-        configuration: [Release]
+    uses: ./.github/workflows/build.yml
+    with:
+      target: windows
+      project: ./v2rayN/v2rayN.csproj
 
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v6.0.2
-
-    - name: Setup
-      uses: actions/setup-dotnet@v5.2.0
-      with:
-        dotnet-version: '8.0.x'
-
-    - name: Build
-      run: |
-        cd v2rayN 
-        dotnet publish ./v2rayN/v2rayN.csproj     -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPath64
-        dotnet publish ./v2rayN/v2rayN.csproj     -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -o $OutputPathArm64
-        dotnet publish ./AmazTool/AmazTool.csproj -c Release -r win-x64   -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPath64
-        dotnet publish ./AmazTool/AmazTool.csproj -c Release -r win-arm64 -p:SelfContained=true -p:EnableWindowsTargeting=true -p:PublishTrimmed=true -o $OutputPathArm64
-  
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v7.0.0
-      with:
-        name: v2rayN-windows
-        path: |
-          ${{ github.workspace }}/v2rayN/Release/windows*
-    
-    # release zip archive
-    - name: Package release zip archive
-      if: github.event.inputs.release_tag != ''
-      run: |
-        chmod 755 package-release-zip.sh
-        ./package-release-zip.sh $OutputArch $OutputPath64
-        ./package-release-zip.sh $OutputArchArm $OutputPathArm64
-    
-    - name: Upload zip archive to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/v2rayN*.zip
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
+  release-zip:
+    if: inputs.release_tag != ''
+    needs: build
+    uses: ./.github/workflows/package-zip.yml
+    with:
+      target: windows
+      release_tag: ${{ inputs.release_tag }}

.github/workflows/build.yml

@@ -0,0 +1,87 @@
+name: build
+
+on:
+  workflow_call:
+    inputs:
+      target: # windows linux macos
+        required: true
+        type: string
+      project:
+        required: false
+        type: string
+        default: './v2rayN.Desktop/v2rayN.Desktop.csproj'
+
+jobs:
+  build:
+    name: build x64 arm64
+    strategy:
+      matrix:
+        arch: [ x64, arm64 ]
+    runs-on: |-
+      ${{
+        case(
+          inputs.target == 'macos', 'macos-latest',
+          inputs.target == 'linux', 'ubuntu-24.04',
+          'ubuntu-latest'
+        )
+      }}
+    env:
+      Output: "${{ github.workspace }}/${{ matrix.arch }}"
+      RID: |-
+        ${{
+          case(
+            inputs.target == 'macos', format('osx-{0}', matrix.arch),
+            inputs.target == 'windows', format('win-{0}', matrix.arch),
+            format('{0}-{1}', inputs.target, matrix.arch)
+          )
+        }}
+      Project: ${{ inputs.project }}
+      ExtOpt: |-
+        ${{
+          case(
+            inputs.target == 'windows', '-p:EnableWindowsTargeting=true',
+            ''
+          )
+        }}
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
+      with:
+        submodules: 'recursive'
+        fetch-depth: '0'
+
+    - name: Purge SDKs
+      shell: pwsh
+      run: |
+        echo "Before:"
+        dotnet --list-sdks
+        
+        dotnet --list-sdks | % {
+          $_ -match '^\S+\s+\[(.+)\]$' > $null
+          $d = Join-Path $Matches[1] $_.Split()[0]
+          Write-Host "Removing $d"
+          if ($IsWindows) { rm $d -r -fo } else { sudo rm -rf "$d" }
+        }
+        
+        echo "After:"
+        dotnet --list-sdks 2>$null; $LASTEXITCODE=0
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5.3.0
+      with:
+        dotnet-version: '10.0.1xx'
+
+    - name: Build v2rayN
+      working-directory: ./v2rayN
+      run: dotnet publish $Project -c Release -r $RID -p:SelfContained=true $ExtOpt -o $Output
+
+    - name: Build AmazTool
+      working-directory: ./v2rayN
+      run: dotnet publish ./AmazTool/AmazTool.csproj -c Release -r $RID -p:SelfContained=true -p:PublishTrimmed=true $ExtOpt -o $Output
+
+    - name: Upload build artifacts
+      uses: actions/upload-artifact@v7.0.1
+      with:
+        name: ${{ matrix.arch }}
+        path: ${{ matrix.arch }}

.github/workflows/package-zip.yml

@@ -0,0 +1,67 @@
+name: package and release Zip
+
+on:
+  workflow_call:
+    inputs:
+      release_tag:
+        required: true
+        type: string
+      target: # windows linux macos windows-desktop
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  package:
+    name: package x64 arm64
+    strategy:
+      matrix:
+        arch: [ x64, arm64 ]
+    runs-on: ubuntu-latest
+    env:
+      Target: |- 
+        ${{
+          case(
+            inputs.target == 'windows-desktop', 'windows',
+            inputs.target
+          )
+        }}
+      Arch: |-
+        ${{
+          case(
+            matrix.arch == 'x64', '64',
+            matrix.arch
+          ) 
+        }}
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
+
+    - name: Restore build artifacts
+      uses: actions/download-artifact@v8
+      with:
+        name: ${{ matrix.arch }}
+        path: v2rayN-${{ env.Target }}-${{ env.Arch }}
+    
+    - name: Get v2rayN-core-bin
+      run: wget -nv -O v2rayN-$Target-$Arch.zip "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/v2rayN-$Target-$Arch.zip"
+    
+    - name: Package zip archive
+      run: 7z a -tZip v2rayN-$Target-$Arch.zip v2rayN-$Target-$Arch -mx1
+
+    - name: Rename windows-desktop 
+      if: inputs.target == 'windows-desktop'
+      run: mv "v2rayN-$Target-$Arch.zip" "v2rayN-$Target-$Arch-desktop.zip"
+    
+    - name: Sleep for race condition between matrix jobs
+      run: sleep "$(od -An -N2 -tu2 /dev/urandom | awk 'NR==1{printf "%.2f", $1/5461}')"
+      
+    - name: Upload zip archive to release
+      uses: svenstaro/upload-release-action@v2
+      with:
+        file: ${{ github.workspace }}/v2rayN*.zip
+        tag: ${{ inputs.release_tag }}
+        file_glob: true
+        prerelease: true

.github/workflows/test.yml

@@ -0,0 +1,29 @@
+name: Code Test
+
+on:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - 'v2rayN/ServiceLib/Services/CoreConfig/**'
+      - 'v2rayN/ServiceLib/Handler/Fmt/**'
+      - '.github/workflows/test.yml'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
+      with:
+        submodules: 'recursive'
+        fetch-depth: '0'
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5.3.0
+      with:
+        dotnet-version: '8.0.x'
+
+    - name: Test Code
+      working-directory: ./v2rayN
+      run: dotnet test ./ServiceLib.Tests

.gitmodules

@@ -1,3 +1,6 @@
 [submodule "v2rayN/GlobalHotKeys"]
 	path = v2rayN/GlobalHotKeys
 	url = https://github.com/2dust/GlobalHotKeys
+[submodule "v2rayN/NetBridge"]
+	path = v2rayN/NetBridge
+	url = https://github.com/2dust/NetBridge

package-debian-loong.sh

@@ -0,0 +1,742 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION_ARG=""
+WITH_CORE="both"
+FORCE_NETCORE=0
+BUILD_FROM=""
+XRAY_VER="${XRAY_VER:-}"
+SING_VER="${SING_VER:-}"
+
+MIN_KERNEL="5.10"
+PKGROOT="v2rayN-publish"
+PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+OUTPUT_DIR="${HOME}/debbuild"
+DOTNET_TFM="net10.0"
+DOTNET_LOONGARCH_VERSION="10.0.109"
+DOTNET_LOONGARCH_TAG="v10.0.109-loongarch64"
+DOTNET_LOONGARCH_BASE="https://github.com/loongson/dotnet/releases/download"
+DOTNET_LOONGARCH_FILE="dotnet-sdk-${DOTNET_LOONGARCH_VERSION}-linux-loongarch64.tar.gz"
+DOTNET_SDK_URL="${DOTNET_LOONGARCH_BASE}/${DOTNET_LOONGARCH_TAG}/${DOTNET_LOONGARCH_FILE}"
+
+OS_ID=""
+OS_NAME=""
+OS_VERSION_ID=""
+HOST_ARCH=""
+SCRIPT_DIR=""
+PROJECT=""
+VERSION=""
+
+declare -a BUILT_DEBS=()
+
+die() {
+  echo "$*" >&2
+  exit 1
+}
+
+parse_args() {
+  local first_arg="${1:-}"
+
+  if [[ -n "$first_arg" && "$first_arg" != --* ]]; then
+    VERSION_ARG="$first_arg"
+    shift || true
+  fi
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --with-core)   WITH_CORE="${2:-both}"; shift 2 ;;
+      --xray-ver)    XRAY_VER="${2:-}"; shift 2 ;;
+      --singbox-ver) SING_VER="${2:-}"; shift 2 ;;
+      --netcore)     FORCE_NETCORE=1; shift ;;
+      --buildfrom)   BUILD_FROM="${2:-}"; shift 2 ;;
+      *)
+        [[ -n "${VERSION_ARG:-}" ]] || VERSION_ARG="$1"
+        shift
+        ;;
+    esac
+  done
+
+  if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+    die "You cannot specify both an explicit version and --buildfrom at the same time.
+        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  fi
+}
+
+detect_environment() {
+  local current_kernel=""
+  local lowest=""
+
+  . /etc/os-release
+
+  OS_ID="${ID:-}"
+  OS_NAME="${NAME:-$OS_ID}"
+  OS_VERSION_ID="${VERSION_ID:-}"
+  HOST_ARCH="$(uname -m)"
+
+  case "$OS_ID" in
+    debian)
+      echo "Detected supported system: ${OS_NAME:-$OS_ID} ${OS_VERSION_ID:-}"
+      ;;
+    *)
+      die "Unsupported system: ${OS_NAME:-unknown} (${OS_ID:-unknown}).
+This script only supports: Debian."
+      ;;
+  esac
+
+  case "$HOST_ARCH" in
+    loongarch64) ;;
+    *) die "Only supports loongarch64" ;;
+  esac
+
+  current_kernel="$(uname -r)"
+  lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$current_kernel" | sort -V | head -n1)"
+
+  [[ "$lowest" == "$MIN_KERNEL" ]] || die "Kernel $current_kernel is below $MIN_KERNEL"
+  echo "[OK] Kernel $current_kernel verified."
+}
+
+install_dependencies() {
+  local install_ok=0
+  local tmp_dotnet=""
+
+  mkdir -p "$OUTPUT_DIR"
+
+  if command -v apt-get >/dev/null 2>&1; then
+    sudo apt-get update
+    sudo apt-get -y install \
+      curl unzip tar jq rsync ca-certificates git dpkg-dev fakeroot file \
+      desktop-file-utils xdg-utils wget gcc make pkg-config \
+      libicu-dev libssl-dev libfontconfig1 libfreetype6 zlib1g
+
+    mkdir -p "$HOME/.dotnet"
+    tmp_dotnet="$(mktemp -d)"
+    curl -fL "$DOTNET_SDK_URL" -o "$tmp_dotnet/$DOTNET_LOONGARCH_FILE"
+    tar -C "$HOME/.dotnet" -xzf "$tmp_dotnet/$DOTNET_LOONGARCH_FILE"
+    rm -rf "$tmp_dotnet"
+
+    export PATH="$HOME/.dotnet:$PATH"
+    export DOTNET_ROOT="$HOME/.dotnet"
+
+    mkdir -p "$HOME/.nuget/NuGet"
+
+    cat > "$HOME/.nuget/NuGet/NuGet.Config" <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+    <add key="loongnix" value="https://lnuget.loongnix.cn/v3/index.json" allowInsecureConnections="true" />
+  </packageSources>
+</configuration>
+EOF
+
+    dotnet --info >/dev/null 2>&1 && install_ok=1
+  fi
+
+  if [[ "$install_ok" -ne 1 ]]; then
+    echo "Could not auto-install dependencies for '$OS_ID'. Make sure these are available:"
+    echo "dotnet-loongarch SDK, curl, unzip, tar, rsync, git, gcc, make, dpkg-deb, fakeroot, libicu-dev, libssl-dev"
+    exit 1
+  fi
+}
+
+prepare_workspace() {
+  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+  cd "$SCRIPT_DIR"
+
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+
+  PROJECT="$PROJECT_HINT"
+  [[ -f "$PROJECT" ]] || PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+  [[ -f "$PROJECT" ]] || die "v2rayN.Desktop.csproj not found"
+}
+
+choose_channel() {
+  local ch="latest"
+  local sel=""
+
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0 ;;
+      2) echo "prerelease"; return 0 ;;
+      3) echo "keep"; return 0 ;;
+      *) die "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." ;;
+    esac
+  fi
+
+  if [[ -t 0 ]]; then
+    echo "[?] Choose v2rayN release channel:" >&2
+    echo "    1) Latest (stable)  [default]" >&2
+    echo "    2) Pre-release (preview)" >&2
+    echo "    3) Keep current (do nothing)" >&2
+    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
+    if read -r sel </dev/tty; then
+      case "${sel:-}" in
+        2) ch="prerelease" ;;
+        3) ch="keep" ;;
+      esac
+    fi
+  fi
+
+  echo "$ch"
+}
+
+get_latest_tag_latest() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
+}
+
+get_latest_tag_prerelease() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
+}
+
+sync_submodules() {
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+}
+
+git_try_checkout() {
+  local want="$1"
+  local ref=""
+
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    git fetch --tags --force --prune --depth=1 || true
+    git rev-parse "refs/tags/${want}" >/dev/null 2>&1 && ref="$want"
+
+    if [[ -n "$ref" ]]; then
+      echo "[OK] Found ref '${ref}', checking out..."
+      git checkout -f "$ref"
+      sync_submodules
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+apply_channel_or_keep() {
+  local ch="$1"
+  local tag=""
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+
+  case "$ch" in
+    latest)     tag="$(get_latest_tag_latest || true)" ;;
+    prerelease) tag="$(get_latest_tag_prerelease || true)" ;;
+    *)          die "Failed to resolve latest tag for channel '${ch}'." ;;
+  esac
+
+  [[ -n "$tag" ]] || die "Failed to resolve latest tag for channel '${ch}'."
+
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || die "Failed to checkout '${tag}'."
+  VERSION="${tag#v}"
+}
+
+resolve_version() {
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    if [[ -n "${VERSION_ARG:-}" ]]; then
+      local clean_ver="${VERSION_ARG#v}"
+
+      if git_try_checkout "$clean_ver"; then
+        VERSION="$clean_ver"
+      else
+        echo "[WARN] Tag '${VERSION_ARG}' not found."
+        apply_channel_or_keep "$(choose_channel)"
+      fi
+    else
+      apply_channel_or_keep "$(choose_channel)"
+    fi
+  else
+    echo "Current directory is not a git repo; proceeding on current tree."
+    VERSION="${VERSION_ARG:-0.0.0}"
+  fi
+
+  VERSION="${VERSION#v}"
+  echo "[*] GUI version resolved as: ${VERSION}"
+}
+
+xray_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-loongarch64) echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-loong64.zip" ;;
+    *)                 return 1 ;;
+  esac
+}
+
+singbox_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-loongarch64) echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-loong64.tar.gz" ;;
+    *)                 return 1 ;;
+  esac
+}
+
+bundle_url_for_rid() {
+  local rid="$1"
+
+  case "$rid" in
+    linux-loongarch64) echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-loong64.zip" ;;
+    *)                 return 1 ;;
+  esac
+}
+
+download_xray() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${XRAY_VER:-}"
+  local url=""
+  local tmp=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
+  url="$(xray_url_for_rid "$rid" "$ver")" || { echo "[xray] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download xray: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/xray.zip" || { rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/xray.zip" -d "$tmp" || { rm -rf "$tmp"; return 1; }
+  install -m 755 "$tmp/xray" "$outdir/xray" || { rm -rf "$tmp"; return 1; }
+  rm -rf "$tmp"
+}
+
+download_singbox() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${SING_VER:-}"
+  local url=""
+  local tmp=""
+  local bin=""
+  local cronet=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
+  url="$(singbox_url_for_rid "$rid" "$ver")" || { echo "[sing-box] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download sing-box: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+  tar -C "$tmp" -xzf "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+
+  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+
+  install -m 755 "$bin" "$outdir/sing-box" || { rm -rf "$tmp"; return 1; }
+
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so" || true
+
+  rm -rf "$tmp"
+}
+
+unify_geo_layout() {
+  local outroot="$1"
+  local n
+  local names=(
+    geosite.dat
+    geoip.dat
+    geoip-only-cn-private.dat
+    Country.mmdb
+    geoip.metadb
+  )
+
+  mkdir -p "$outroot/bin"
+
+  for n in "${names[@]}"; do
+    if [[ -f "$outroot/bin/xray/$n" ]]; then
+      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
+    fi
+  done
+}
+
+download_geo_assets() {
+  local outroot="$1"
+  local bin_dir="$outroot/bin"
+  local srss_dir="$bin_dir/srss"
+  local f=""
+
+  mkdir -p "$bin_dir" "$srss_dir"
+
+  echo "[+] Download Xray Geo to ${bin_dir}"
+  curl -fsSL -o "$bin_dir/geosite.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+
+  echo "[+] Download sing-box rule DB & rule-sets"
+  curl -fsSL -o "$bin_dir/geoip.metadb" "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb"
+
+  for f in geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geoip/$f"
+  done
+
+  for f in geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geosite/$f"
+  done
+
+  unify_geo_layout "$outroot"
+}
+
+populate_assets_zip_mode() {
+  local outroot="$1"
+  local rid="$2"
+  local url=""
+  local tmp=""
+  local nested_dir=""
+
+  url="$(bundle_url_for_rid "$rid")" || { echo "[!] Bundle unsupported RID: $rid"; return 1; }
+
+  echo "[+] Try v2rayN bundle archive: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/v2rayn.zip" || { echo "[!] Bundle download failed"; rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/v2rayn.zip" -d "$tmp" || { echo "[!] Bundle unzip failed"; rm -rf "$tmp"; return 1; }
+
+  if [[ -d "$tmp/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$tmp/bin/" "$outroot/bin/"
+  else
+    rsync -a "$tmp/" "$outroot/"
+  fi
+
+  rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
+  find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
+
+  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$nested_dir/bin/" "$outroot/bin/"
+    rm -rf "$nested_dir"
+  fi
+
+  unify_geo_layout "$outroot"
+  rm -rf "$tmp"
+
+  echo "[+] Bundle extracted to $outroot"
+}
+
+populate_assets_netcore_mode() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+    download_xray "$outroot/bin/xray" "$rid" || echo "[!] xray download failed (skipped)"
+  fi
+
+  if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+    download_singbox "$outroot/bin/sing_box" "$rid" || echo "[!] sing-box download failed (skipped)"
+  fi
+
+  download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+}
+
+stage_runtime_assets() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
+    if populate_assets_zip_mode "$outroot" "$rid"; then
+      echo "[*] Using v2rayN bundle archive."
+    else
+      echo "[*] Bundle failed, fallback to separate core + rules."
+      populate_assets_netcore_mode "$outroot" "$rid"
+    fi
+  else
+    echo "[*] --netcore specified: use separate core + rules."
+    populate_assets_netcore_mode "$outroot" "$rid"
+  fi
+}
+
+describe_target() {
+  local short="$1"
+
+  case "$short" in
+    loongarch64) printf '%s\n%s\n' "linux-loongarch64" "loong64" ;;
+    *)           echo "Unknown arch '$short' (use loongarch64)" >&2; return 1 ;;
+  esac
+}
+
+publish_binary() {
+  local rid="$1"
+
+  dotnet clean "$PROJECT" -c Release
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net10.0" || true
+  dotnet restore "$PROJECT"
+  dotnet publish "$PROJECT" -c Release -r "$rid" -p:PublishSingleFile=false -p:SelfContained=true
+}
+
+write_launcher_file() {
+  local stage="$1"
+
+  install -m 755 /dev/stdin "$stage/usr/bin/v2rayn" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+DIR="/opt/v2rayN"
+cd "$DIR"
+
+if [[ -x "$DIR/v2rayN" ]]; then
+  exec "$DIR/v2rayN" "$@"
+fi
+
+for dll in v2rayN.Desktop.dll v2rayN.dll; do
+  if [[ -f "$DIR/$dll" ]]; then
+    exec /usr/bin/dotnet "$DIR/$dll" "$@"
+  fi
+done
+
+echo "v2rayN launcher: no executable found in $DIR" >&2
+ls -l "$DIR" >&2 || true
+exit 1
+EOF
+}
+
+write_desktop_file() {
+  local stage="$1"
+
+  install -m 644 /dev/stdin "$stage/usr/share/applications/v2rayn.desktop" <<'EOF'
+[Desktop Entry]
+Type=Application
+Name=v2rayN
+Comment=v2rayN for Debian GNU Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
+EOF
+}
+
+write_maintainer_scripts() {
+  local debian_dir="$1"
+
+  install -m 755 /dev/stdin "$debian_dir/postinst" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF
+
+  install -m 755 /dev/stdin "$debian_dir/postrm" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF
+}
+
+package_binary() {
+  local short="$1"
+  local rid="$2"
+  local deb_arch="$3"
+  local pubdir=""
+  local workdir=""
+  local stage=""
+  local debian_dir=""
+  local project_dir=""
+  local icon_candidate=""
+  local shlibs_depends=""
+  local extra_depends=""
+  local final_depends=""
+  local multiarch=""
+  local sys_libdir=""
+  local sys_usrlibdir=""
+  local deb_out=""
+
+  pubdir="$(dirname "$PROJECT")/bin/Release/net10.0/${rid}/publish"
+  [[ -d "$pubdir" ]] || { echo "Publish directory not found: $pubdir"; return 1; }
+
+  workdir="$(mktemp -d)"
+  trap '[[ -n "${workdir:-}" ]] && rm -rf "$workdir"' RETURN
+
+  stage="$workdir/${PKGROOT}_${VERSION}_${deb_arch}"
+  debian_dir="$stage/DEBIAN"
+
+  mkdir -p "$stage/opt/v2rayN" "$stage/usr/bin" "$stage/usr/share/applications" "$stage/usr/share/icons/hicolor/256x256/apps" "$debian_dir"
+  cp -a "$pubdir/." "$stage/opt/v2rayN/"
+
+  project_dir="$(cd "$(dirname "$PROJECT")" && pwd)"
+  icon_candidate="$project_dir/v2rayN.png"
+  [[ -f "$icon_candidate" ]] && cp "$icon_candidate" "$stage/usr/share/icons/hicolor/256x256/apps/v2rayn.png" || true
+
+  stage_runtime_assets "$stage/opt/v2rayN" "$rid"
+  write_launcher_file "$stage"
+  write_desktop_file "$stage"
+  write_maintainer_scripts "$debian_dir"
+
+  extra_depends="libc6 (>= 2.34), fontconfig (>= 2.13.1), desktop-file-utils (>= 0.26), xdg-utils (>= 1.1.3), coreutils (>= 8.32), bash (>= 5.1), libfreetype6 (>= 2.11)"
+
+  mkdir -p "$workdir/debian"
+  cat > "$workdir/debian/control" <<EOF
+Source: v2rayn
+Section: net
+Priority: optional
+Maintainer: 2dust <noreply@github.com>
+Standards-Version: 4.7.0
+
+Package: v2rayn
+Architecture: ${deb_arch}
+Description: v2rayN
+EOF
+
+  multiarch="$(dpkg-architecture -a"$deb_arch" -qDEB_HOST_MULTIARCH)"
+  sys_libdir="/lib/$multiarch"
+  sys_usrlibdir="/usr/lib/$multiarch"
+
+  : > "$debian_dir/substvars"
+
+  mapfile -t ELF_FILES < <(
+    find "$stage/opt/v2rayN" -type f \( -name "*.so*" -o -perm -111 \) ! -name 'libcoreclrtraceptprovider.so'
+  )
+
+  if [[ "${#ELF_FILES[@]}" -gt 0 ]]; then
+    (
+      cd "$workdir"
+      dpkg-shlibdeps \
+        -l"$stage/opt/v2rayN" \
+        -l"$sys_libdir" \
+        -l"$sys_usrlibdir" \
+        -T"$debian_dir/substvars" \
+        "${ELF_FILES[@]}"
+    ) >/dev/null 2>&1 || true
+  fi
+
+  shlibs_depends="$(sed -n 's/^shlibs:Depends=//p' "$debian_dir/substvars" | head -n1 || true)"
+
+  if [[ -n "$shlibs_depends" ]]; then
+    shlibs_depends="$(echo "$shlibs_depends" \
+      | sed -E 's/ *\([^)]*\)//g' \
+      | sed -E 's/ *, */, /g' \
+      | sed -E 's/^, *//; s/, *$//')"
+    final_depends="${shlibs_depends}, ${extra_depends}"
+  else
+    final_depends="${extra_depends}"
+  fi
+
+  cat > "$debian_dir/control" <<EOF
+Package: v2rayn
+Version: ${VERSION}
+Architecture: ${deb_arch}
+Maintainer: 2dust <noreply@github.com>
+Homepage: https://github.com/2dust/v2rayN
+Section: net
+Priority: optional
+Depends: ${final_depends}
+Description: v2rayN (Avalonia) GUI client for Linux
+ Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 /
+ Shadowsocks / tuic / WireGuard.
+EOF
+
+  find "$stage/opt/v2rayN" -type d -exec chmod 0755 {} +
+  find "$stage/opt/v2rayN" -type f -exec chmod 0644 {} +
+  [[ -f "$stage/opt/v2rayN/v2rayN" ]] && chmod 0755 "$stage/opt/v2rayN/v2rayN" || true
+
+  deb_out="$OUTPUT_DIR/v2rayn_${VERSION}_${deb_arch}.deb"
+  dpkg-deb --root-owner-group --build "$stage" "$deb_out"
+
+  echo "Build done for $short. DEB at:"
+  echo "  $deb_out"
+  BUILT_DEBS+=("$deb_out")
+}
+
+select_targets() {
+  printf '%s\n' loongarch64
+}
+
+build_one_target() {
+  local short="$1"
+  local meta=()
+  local rid=""
+  local deb_arch=""
+
+  mapfile -t meta < <(describe_target "$short") || return 1
+  rid="${meta[0]}"
+  deb_arch="${meta[1]}"
+
+  echo "[*] Building for target: $short  (RID=$rid, DEB arch=$deb_arch)"
+  publish_binary "$rid"
+  package_binary "$short" "$rid" "$deb_arch"
+}
+
+print_summary() {
+  local pkg=""
+
+  echo ""
+  echo "================ Build Summary ================="
+  if [[ "${#BUILT_DEBS[@]}" -gt 0 ]]; then
+    echo "Output directory: $OUTPUT_DIR"
+    for pkg in "${BUILT_DEBS[@]}"; do
+      echo "$pkg"
+    done
+  else
+    echo "No DEBs detected in summary (check build logs above)."
+  fi
+  echo "==============================================="
+}
+
+main() {
+  local targets=()
+  local arch=""
+
+  parse_args "$@"
+  detect_environment
+  install_dependencies
+  prepare_workspace
+  resolve_version
+
+  mapfile -t targets < <(select_targets)
+
+  for arch in "${targets[@]}"; do
+    build_one_target "$arch"
+  done
+
+  print_summary
+}
+
+main "$@"

package-debian-riscv.sh

@@ -0,0 +1,727 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION_ARG=""
+WITH_CORE="both"
+FORCE_NETCORE=0
+BUILD_FROM=""
+XRAY_VER="${XRAY_VER:-}"
+SING_VER="${SING_VER:-}"
+
+MIN_KERNEL="5.10"
+PKGROOT="v2rayN-publish"
+PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+OUTPUT_DIR="${HOME}/debbuild"
+DOTNET_RISCV_VERSION="10.0.109"
+DOTNET_RISCV_BASE="https://github.com/xujiegb/dotnet-riscv/releases/download"
+DOTNET_RISCV_FILE="dotnet-sdk-${DOTNET_RISCV_VERSION}-linux-riscv64.tar.gz"
+DOTNET_SDK_URL="${DOTNET_RISCV_BASE}/${DOTNET_RISCV_VERSION}/${DOTNET_RISCV_FILE}"
+
+OS_ID=""
+OS_NAME=""
+OS_VERSION_ID=""
+HOST_ARCH=""
+SCRIPT_DIR=""
+PROJECT=""
+VERSION=""
+
+declare -a BUILT_DEBS=()
+
+die() {
+  echo "$*" >&2
+  exit 1
+}
+
+parse_args() {
+  local first_arg="${1:-}"
+
+  if [[ -n "$first_arg" && "$first_arg" != --* ]]; then
+    VERSION_ARG="$first_arg"
+    shift || true
+  fi
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --with-core)   WITH_CORE="${2:-both}"; shift 2 ;;
+      --xray-ver)    XRAY_VER="${2:-}"; shift 2 ;;
+      --singbox-ver) SING_VER="${2:-}"; shift 2 ;;
+      --netcore)     FORCE_NETCORE=1; shift ;;
+      --buildfrom)   BUILD_FROM="${2:-}"; shift 2 ;;
+      *)
+        [[ -n "${VERSION_ARG:-}" ]] || VERSION_ARG="$1"
+        shift
+        ;;
+    esac
+  done
+
+  if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+    die "You cannot specify both an explicit version and --buildfrom at the same time.
+        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  fi
+}
+
+detect_environment() {
+  local current_kernel=""
+  local lowest=""
+
+  . /etc/os-release
+
+  OS_ID="${ID:-}"
+  OS_NAME="${NAME:-$OS_ID}"
+  OS_VERSION_ID="${VERSION_ID:-}"
+  HOST_ARCH="$(uname -m)"
+
+  case "$OS_ID" in
+    debian)
+      echo "Detected supported system: ${OS_NAME:-$OS_ID} ${OS_VERSION_ID:-}"
+      ;;
+    *)
+      die "Unsupported system: ${OS_NAME:-unknown} (${OS_ID:-unknown}).
+This script only supports: Debian."
+      ;;
+  esac
+
+  case "$HOST_ARCH" in
+    riscv64) ;;
+    *) die "Only supports riscv64" ;;
+  esac
+
+  current_kernel="$(uname -r)"
+  lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$current_kernel" | sort -V | head -n1)"
+
+  [[ "$lowest" == "$MIN_KERNEL" ]] || die "Kernel $current_kernel is below $MIN_KERNEL"
+  echo "[OK] Kernel $current_kernel verified."
+}
+
+install_dependencies() {
+  local install_ok=0
+  local tmp_dotnet=""
+
+  mkdir -p "$OUTPUT_DIR"
+
+  if command -v apt-get >/dev/null 2>&1; then
+    sudo apt-get update
+    sudo apt-get -y install \
+      curl unzip tar jq rsync ca-certificates git dpkg-dev fakeroot file \
+      desktop-file-utils xdg-utils wget gcc make pkg-config \
+      libicu-dev libssl-dev libfontconfig1 libfreetype6 zlib1g
+
+    mkdir -p "$HOME/.dotnet"
+    tmp_dotnet="$(mktemp -d)"
+    curl -fL "$DOTNET_SDK_URL" -o "$tmp_dotnet/$DOTNET_RISCV_FILE"
+    tar -C "$HOME/.dotnet" -xzf "$tmp_dotnet/$DOTNET_RISCV_FILE"
+    rm -rf "$tmp_dotnet"
+
+    export PATH="$HOME/.dotnet:$PATH"
+    export DOTNET_ROOT="$HOME/.dotnet"
+
+    dotnet --info >/dev/null 2>&1 && install_ok=1
+  fi
+
+  if [[ "$install_ok" -ne 1 ]]; then
+    echo "Could not auto-install dependencies for '$OS_ID'. Make sure these are available:"
+    echo "dotnet-riscv SDK, curl, unzip, tar, rsync, git, gcc, make, dpkg-deb, fakeroot, libicu-dev, libssl-dev"
+    exit 1
+  fi
+}
+
+prepare_workspace() {
+  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+  cd "$SCRIPT_DIR"
+
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+
+  PROJECT="$PROJECT_HINT"
+  [[ -f "$PROJECT" ]] || PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+  [[ -f "$PROJECT" ]] || die "v2rayN.Desktop.csproj not found"
+}
+
+choose_channel() {
+  local ch="latest"
+  local sel=""
+
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0 ;;
+      2) echo "prerelease"; return 0 ;;
+      3) echo "keep"; return 0 ;;
+      *) die "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." ;;
+    esac
+  fi
+
+  if [[ -t 0 ]]; then
+    echo "[?] Choose v2rayN release channel:" >&2
+    echo "    1) Latest (stable)  [default]" >&2
+    echo "    2) Pre-release (preview)" >&2
+    echo "    3) Keep current (do nothing)" >&2
+    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
+    if read -r sel </dev/tty; then
+      case "${sel:-}" in
+        2) ch="prerelease" ;;
+        3) ch="keep" ;;
+      esac
+    fi
+  fi
+
+  echo "$ch"
+}
+
+get_latest_tag_latest() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
+}
+
+get_latest_tag_prerelease() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
+}
+
+sync_submodules() {
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+}
+
+git_try_checkout() {
+  local want="$1"
+  local ref=""
+
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    git fetch --tags --force --prune --depth=1 || true
+    git rev-parse "refs/tags/${want}" >/dev/null 2>&1 && ref="$want"
+
+    if [[ -n "$ref" ]]; then
+      echo "[OK] Found ref '${ref}', checking out..."
+      git checkout -f "$ref"
+      sync_submodules
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+apply_channel_or_keep() {
+  local ch="$1"
+  local tag=""
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+
+  case "$ch" in
+    latest)     tag="$(get_latest_tag_latest || true)" ;;
+    prerelease) tag="$(get_latest_tag_prerelease || true)" ;;
+    *)          die "Failed to resolve latest tag for channel '${ch}'." ;;
+  esac
+
+  [[ -n "$tag" ]] || die "Failed to resolve latest tag for channel '${ch}'."
+
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || die "Failed to checkout '${tag}'."
+  VERSION="${tag#v}"
+}
+
+resolve_version() {
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    if [[ -n "${VERSION_ARG:-}" ]]; then
+      local clean_ver="${VERSION_ARG#v}"
+
+      if git_try_checkout "$clean_ver"; then
+        VERSION="$clean_ver"
+      else
+        echo "[WARN] Tag '${VERSION_ARG}' not found."
+        apply_channel_or_keep "$(choose_channel)"
+      fi
+    else
+      apply_channel_or_keep "$(choose_channel)"
+    fi
+  else
+    echo "Current directory is not a git repo; proceeding on current tree."
+    VERSION="${VERSION_ARG:-0.0.0}"
+  fi
+
+  VERSION="${VERSION#v}"
+  echo "[*] GUI version resolved as: ${VERSION}"
+}
+
+xray_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-riscv64) echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-riscv64.zip" ;;
+    *)             return 1 ;;
+  esac
+}
+
+singbox_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-riscv64) echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-riscv64.tar.gz" ;;
+    *)             return 1 ;;
+  esac
+}
+
+bundle_url_for_rid() {
+  local rid="$1"
+
+  case "$rid" in
+    linux-riscv64) echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-riscv64.zip" ;;
+    *)             return 1 ;;
+  esac
+}
+
+download_xray() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${XRAY_VER:-}"
+  local url=""
+  local tmp=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
+  url="$(xray_url_for_rid "$rid" "$ver")" || { echo "[xray] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download xray: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/xray.zip" || { rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/xray.zip" -d "$tmp" || { rm -rf "$tmp"; return 1; }
+  install -m 755 "$tmp/xray" "$outdir/xray" || { rm -rf "$tmp"; return 1; }
+  rm -rf "$tmp"
+}
+
+download_singbox() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${SING_VER:-}"
+  local url=""
+  local tmp=""
+  local bin=""
+  local cronet=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
+  url="$(singbox_url_for_rid "$rid" "$ver")" || { echo "[sing-box] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download sing-box: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+  tar -C "$tmp" -xzf "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+
+  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+
+  install -m 755 "$bin" "$outdir/sing-box" || { rm -rf "$tmp"; return 1; }
+
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so" || true
+
+  rm -rf "$tmp"
+}
+
+unify_geo_layout() {
+  local outroot="$1"
+  local n
+  local names=(
+    geosite.dat
+    geoip.dat
+    geoip-only-cn-private.dat
+    Country.mmdb
+    geoip.metadb
+  )
+
+  mkdir -p "$outroot/bin"
+
+  for n in "${names[@]}"; do
+    if [[ -f "$outroot/bin/xray/$n" ]]; then
+      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
+    fi
+  done
+}
+
+download_geo_assets() {
+  local outroot="$1"
+  local bin_dir="$outroot/bin"
+  local srss_dir="$bin_dir/srss"
+  local f=""
+
+  mkdir -p "$bin_dir" "$srss_dir"
+
+  echo "[+] Download Xray Geo to ${bin_dir}"
+  curl -fsSL -o "$bin_dir/geosite.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+
+  echo "[+] Download sing-box rule DB & rule-sets"
+  curl -fsSL -o "$bin_dir/geoip.metadb" "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb"
+
+  for f in geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geoip/$f"
+  done
+
+  for f in geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geosite/$f"
+  done
+
+  unify_geo_layout "$outroot"
+}
+
+populate_assets_zip_mode() {
+  local outroot="$1"
+  local rid="$2"
+  local url=""
+  local tmp=""
+  local nested_dir=""
+
+  url="$(bundle_url_for_rid "$rid")" || { echo "[!] Bundle unsupported RID: $rid"; return 1; }
+
+  echo "[+] Try v2rayN bundle archive: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/v2rayn.zip" || { echo "[!] Bundle download failed"; rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/v2rayn.zip" -d "$tmp" || { echo "[!] Bundle unzip failed"; rm -rf "$tmp"; return 1; }
+
+  if [[ -d "$tmp/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$tmp/bin/" "$outroot/bin/"
+  else
+    rsync -a "$tmp/" "$outroot/"
+  fi
+
+  rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
+  find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
+
+  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$nested_dir/bin/" "$outroot/bin/"
+    rm -rf "$nested_dir"
+  fi
+
+  unify_geo_layout "$outroot"
+  rm -rf "$tmp"
+
+  echo "[+] Bundle extracted to $outroot"
+}
+
+populate_assets_netcore_mode() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+    download_xray "$outroot/bin/xray" "$rid" || echo "[!] xray download failed (skipped)"
+  fi
+
+  if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+    download_singbox "$outroot/bin/sing_box" "$rid" || echo "[!] sing-box download failed (skipped)"
+  fi
+
+  download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+}
+
+stage_runtime_assets() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
+    if populate_assets_zip_mode "$outroot" "$rid"; then
+      echo "[*] Using v2rayN bundle archive."
+    else
+      echo "[*] Bundle failed, fallback to separate core + rules."
+      populate_assets_netcore_mode "$outroot" "$rid"
+    fi
+  else
+    echo "[*] --netcore specified: use separate core + rules."
+    populate_assets_netcore_mode "$outroot" "$rid"
+  fi
+}
+
+describe_target() {
+  local short="$1"
+
+  case "$short" in
+    riscv64) printf '%s\n%s\n' "linux-riscv64" "riscv64" ;;
+    *)       echo "Unknown arch '$short' (use riscv64)" >&2; return 1 ;;
+  esac
+}
+
+publish_binary() {
+  local rid="$1"
+
+  dotnet clean "$PROJECT" -c Release
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net10.0" || true
+  dotnet restore "$PROJECT"
+  dotnet publish "$PROJECT" -c Release -r "$rid" -p:PublishSingleFile=false -p:SelfContained=true
+}
+
+write_launcher_file() {
+  local stage="$1"
+
+  install -m 755 /dev/stdin "$stage/usr/bin/v2rayn" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+DIR="/opt/v2rayN"
+cd "$DIR"
+
+if [[ -x "$DIR/v2rayN" ]]; then
+  exec "$DIR/v2rayN" "$@"
+fi
+
+for dll in v2rayN.Desktop.dll v2rayN.dll; do
+  if [[ -f "$DIR/$dll" ]]; then
+    exec /usr/bin/dotnet "$DIR/$dll" "$@"
+  fi
+done
+
+echo "v2rayN launcher: no executable found in $DIR" >&2
+ls -l "$DIR" >&2 || true
+exit 1
+EOF
+}
+
+write_desktop_file() {
+  local stage="$1"
+
+  install -m 644 /dev/stdin "$stage/usr/share/applications/v2rayn.desktop" <<'EOF'
+[Desktop Entry]
+Type=Application
+Name=v2rayN
+Comment=v2rayN for Debian GNU Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
+EOF
+}
+
+write_maintainer_scripts() {
+  local debian_dir="$1"
+
+  install -m 755 /dev/stdin "$debian_dir/postinst" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF
+
+  install -m 755 /dev/stdin "$debian_dir/postrm" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF
+}
+
+package_binary() {
+  local short="$1"
+  local rid="$2"
+  local deb_arch="$3"
+  local pubdir=""
+  local workdir=""
+  local stage=""
+  local debian_dir=""
+  local project_dir=""
+  local icon_candidate=""
+  local shlibs_depends=""
+  local extra_depends=""
+  local final_depends=""
+  local multiarch=""
+  local sys_libdir=""
+  local sys_usrlibdir=""
+  local deb_out=""
+
+  pubdir="$(dirname "$PROJECT")/bin/Release/net10.0/${rid}/publish"
+  [[ -d "$pubdir" ]] || { echo "Publish directory not found: $pubdir"; return 1; }
+
+  workdir="$(mktemp -d)"
+  trap '[[ -n "${workdir:-}" ]] && rm -rf "$workdir"' RETURN
+
+  stage="$workdir/${PKGROOT}_${VERSION}_${deb_arch}"
+  debian_dir="$stage/DEBIAN"
+
+  mkdir -p "$stage/opt/v2rayN" "$stage/usr/bin" "$stage/usr/share/applications" "$stage/usr/share/icons/hicolor/256x256/apps" "$debian_dir"
+  cp -a "$pubdir/." "$stage/opt/v2rayN/"
+
+  project_dir="$(cd "$(dirname "$PROJECT")" && pwd)"
+  icon_candidate="$project_dir/v2rayN.png"
+  [[ -f "$icon_candidate" ]] && cp "$icon_candidate" "$stage/usr/share/icons/hicolor/256x256/apps/v2rayn.png" || true
+
+  stage_runtime_assets "$stage/opt/v2rayN" "$rid"
+  write_launcher_file "$stage"
+  write_desktop_file "$stage"
+  write_maintainer_scripts "$debian_dir"
+
+  extra_depends="libc6 (>= 2.34), fontconfig (>= 2.13.1), desktop-file-utils (>= 0.26), xdg-utils (>= 1.1.3), coreutils (>= 8.32), bash (>= 5.1), libfreetype6 (>= 2.11)"
+
+  mkdir -p "$workdir/debian"
+  cat > "$workdir/debian/control" <<EOF
+Source: v2rayn
+Section: net
+Priority: optional
+Maintainer: 2dust <noreply@github.com>
+Standards-Version: 4.7.0
+
+Package: v2rayn
+Architecture: ${deb_arch}
+Description: v2rayN
+EOF
+
+  multiarch="$(dpkg-architecture -a"$deb_arch" -qDEB_HOST_MULTIARCH)"
+  sys_libdir="/lib/$multiarch"
+  sys_usrlibdir="/usr/lib/$multiarch"
+
+  : > "$debian_dir/substvars"
+
+  mapfile -t ELF_FILES < <(
+    find "$stage/opt/v2rayN" -type f \( -name "*.so*" -o -perm -111 \) ! -name 'libcoreclrtraceptprovider.so'
+  )
+
+  if [[ "${#ELF_FILES[@]}" -gt 0 ]]; then
+    (
+      cd "$workdir"
+      dpkg-shlibdeps \
+        -l"$stage/opt/v2rayN" \
+        -l"$sys_libdir" \
+        -l"$sys_usrlibdir" \
+        -T"$debian_dir/substvars" \
+        "${ELF_FILES[@]}"
+    ) >/dev/null 2>&1 || true
+  fi
+
+  shlibs_depends="$(sed -n 's/^shlibs:Depends=//p' "$debian_dir/substvars" | head -n1 || true)"
+
+  if [[ -n "$shlibs_depends" ]]; then
+    shlibs_depends="$(echo "$shlibs_depends" \
+      | sed -E 's/ *\([^)]*\)//g' \
+      | sed -E 's/ *, */, /g' \
+      | sed -E 's/^, *//; s/, *$//')"
+    final_depends="${shlibs_depends}, ${extra_depends}"
+  else
+    final_depends="${extra_depends}"
+  fi
+
+  cat > "$debian_dir/control" <<EOF
+Package: v2rayn
+Version: ${VERSION}
+Architecture: ${deb_arch}
+Maintainer: 2dust <noreply@github.com>
+Homepage: https://github.com/2dust/v2rayN
+Section: net
+Priority: optional
+Depends: ${final_depends}
+Description: v2rayN (Avalonia) GUI client for Linux
+ Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 /
+ Shadowsocks / tuic / WireGuard.
+EOF
+
+  find "$stage/opt/v2rayN" -type d -exec chmod 0755 {} +
+  find "$stage/opt/v2rayN" -type f -exec chmod 0644 {} +
+  [[ -f "$stage/opt/v2rayN/v2rayN" ]] && chmod 0755 "$stage/opt/v2rayN/v2rayN" || true
+
+  deb_out="$OUTPUT_DIR/v2rayn_${VERSION}_${deb_arch}.deb"
+  dpkg-deb --root-owner-group --build "$stage" "$deb_out"
+
+  echo "Build done for $short. DEB at:"
+  echo "  $deb_out"
+  BUILT_DEBS+=("$deb_out")
+}
+
+select_targets() {
+  printf '%s\n' riscv64
+}
+
+build_one_target() {
+  local short="$1"
+  local meta=()
+  local rid=""
+  local deb_arch=""
+
+  mapfile -t meta < <(describe_target "$short") || return 1
+  rid="${meta[0]}"
+  deb_arch="${meta[1]}"
+
+  echo "[*] Building for target: $short  (RID=$rid, DEB arch=$deb_arch)"
+  publish_binary "$rid"
+  package_binary "$short" "$rid" "$deb_arch"
+}
+
+print_summary() {
+  local pkg=""
+
+  echo ""
+  echo "================ Build Summary ================="
+  if [[ "${#BUILT_DEBS[@]}" -gt 0 ]]; then
+    echo "Output directory: $OUTPUT_DIR"
+    for pkg in "${BUILT_DEBS[@]}"; do
+      echo "$pkg"
+    done
+  else
+    echo "No DEBs detected in summary (check build logs above)."
+  fi
+  echo "==============================================="
+}
+
+main() {
+  local targets=()
+  local arch=""
+
+  parse_args "$@"
+  detect_environment
+  install_dependencies
+  prepare_workspace
+  resolve_version
+
+  mapfile -t targets < <(select_targets)
+
+  for arch in "${targets[@]}"; do
+    build_one_target "$arch"
+  done
+
+  print_summary
+}
+
+main "$@"

package-debian.sh

@@ -1,70 +1,756 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -euo pipefail
 
-Arch="$1"
-OutputPath="$2"
-Version="$3"
+VERSION_ARG=""
+WITH_CORE="both"
+FORCE_NETCORE=0
+ARCH_OVERRIDE=""
+BUILD_FROM=""
+XRAY_VER="${XRAY_VER:-}"
+SING_VER="${SING_VER:-}"
 
-FileName="v2rayN-${Arch}.zip"
-wget -nv -O $FileName "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/$FileName"
-7z x $FileName
-cp -rf v2rayN-${Arch}/* $OutputPath
+MIN_KERNEL="6.12"
+PKGROOT="v2rayN-publish"
+PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+OUTPUT_DIR="${HOME}/debbuild"
 
-PackagePath="v2rayN-Package-${Arch}"
-mkdir -p "${PackagePath}/DEBIAN"
-mkdir -p "${PackagePath}/opt"
-cp -rf $OutputPath "${PackagePath}/opt/v2rayN"
-echo "When this file exists, app will not store configs under this folder" > "${PackagePath}/opt/v2rayN/NotStoreConfigHere.txt"
+OS_ID=""
+OS_NAME=""
+OS_VERSION_ID=""
+HOST_ARCH=""
+SCRIPT_DIR=""
+PROJECT=""
+VERSION=""
 
-if [ $Arch = "linux-64" ]; then
-    Arch2="amd64"
-else
-    Arch2="arm64"
+declare -a BUILT_DEBS=()
+
+die() {
+  echo "$*" >&2
+  exit 1
+}
+
+parse_args() {
+  local first_arg="${1:-}"
+
+  if [[ -n "$first_arg" && "$first_arg" != --* ]]; then
+    VERSION_ARG="$first_arg"
+    shift || true
+  fi
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --with-core)   WITH_CORE="${2:-both}"; shift 2 ;;
+      --xray-ver)    XRAY_VER="${2:-}"; shift 2 ;;
+      --singbox-ver) SING_VER="${2:-}"; shift 2 ;;
+      --netcore)     FORCE_NETCORE=1; shift ;;
+      --arch)        ARCH_OVERRIDE="${2:-}"; shift 2 ;;
+      --buildfrom)   BUILD_FROM="${2:-}"; shift 2 ;;
+      *)
+        [[ -n "${VERSION_ARG:-}" ]] || VERSION_ARG="$1"
+        shift
+        ;;
+    esac
+  done
+
+  if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+    die "You cannot specify both an explicit version and --buildfrom at the same time.
+        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  fi
+}
+
+detect_environment() {
+  local current_kernel=""
+  local lowest=""
+
+  . /etc/os-release
+
+  OS_ID="${ID:-}"
+  OS_NAME="${NAME:-$OS_ID}"
+  OS_VERSION_ID="${VERSION_ID:-}"
+  HOST_ARCH="$(uname -m)"
+
+  case "$OS_ID" in
+    debian)
+      echo "Detected supported system: ${OS_NAME:-$OS_ID} ${OS_VERSION_ID:-}"
+      ;;
+    *)
+      die "Unsupported system: ${OS_NAME:-unknown} (${OS_ID:-unknown}).
+This script only supports: Debian."
+      ;;
+  esac
+
+  case "$HOST_ARCH" in
+    x86_64|aarch64) ;;
+    *) die "Only supports aarch64 / x86_64" ;;
+  esac
+
+  current_kernel="$(uname -r)"
+  lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$current_kernel" | sort -V | head -n1)"
+
+  [[ "$lowest" == "$MIN_KERNEL" ]] || die "Kernel $current_kernel is below $MIN_KERNEL"
+  echo "[OK] Kernel $current_kernel verified."
+}
+
+install_dependencies() {
+  local install_ok=0
+  local foreign_arch=""
+
+  mkdir -p "$OUTPUT_DIR"
+
+  if command -v apt-get >/dev/null 2>&1; then
+    sudo apt-get update
+    sudo apt-get -y install \
+      curl unzip tar jq rsync ca-certificates git dpkg-dev fakeroot file \
+      desktop-file-utils xdg-utils wget
+
+    case "$HOST_ARCH" in
+      aarch64) foreign_arch="amd64" ;;
+      x86_64)  foreign_arch="arm64" ;;
+      *)       die "Only supports aarch64 / x86_64" ;;
+    esac
+
+    sudo dpkg --add-architecture "$foreign_arch" || true
+    sudo apt-get update
+    sudo apt-get -y install \
+      "libc6:${foreign_arch}" \
+      "libgcc-s1:${foreign_arch}" \
+      "libstdc++6:${foreign_arch}" \
+      "zlib1g:${foreign_arch}" \
+      "libfontconfig1:${foreign_arch}"
+
+    wget -q https://dot.net/v1/dotnet-install.sh
+    chmod +x dotnet-install.sh
+    ./dotnet-install.sh --channel 10.0.1xx --install-dir "$HOME/.dotnet"
+
+    export PATH="$HOME/.dotnet:$PATH"
+    export DOTNET_ROOT="$HOME/.dotnet"
+
+    dotnet --info >/dev/null 2>&1 && install_ok=1
+  fi
+
+  if [[ "$install_ok" -ne 1 ]]; then
+    echo "Could not auto-install dependencies for '$OS_ID'. Make sure these are available:"
+    echo "dotnet-sdk 10.x, curl, unzip, tar, rsync, git, dpkg-deb, desktop-file-utils, xdg-utils"
+    exit 1
+  fi
+}
+
+prepare_workspace() {
+  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+  cd "$SCRIPT_DIR"
+
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+
+  PROJECT="$PROJECT_HINT"
+  [[ -f "$PROJECT" ]] || PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+  [[ -f "$PROJECT" ]] || die "v2rayN.Desktop.csproj not found"
+}
+
+choose_channel() {
+  local ch="latest"
+  local sel=""
+
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0 ;;
+      2) echo "prerelease"; return 0 ;;
+      3) echo "keep"; return 0 ;;
+      *) die "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." ;;
+    esac
+  fi
+
+  if [[ -t 0 ]]; then
+    echo "[?] Choose v2rayN release channel:" >&2
+    echo "    1) Latest (stable)  [default]" >&2
+    echo "    2) Pre-release (preview)" >&2
+    echo "    3) Keep current (do nothing)" >&2
+    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
+    if read -r sel </dev/tty; then
+      case "${sel:-}" in
+        2) ch="prerelease" ;;
+        3) ch="keep" ;;
+      esac
+    fi
+  fi
+
+  echo "$ch"
+}
+
+get_latest_tag_latest() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
+}
+
+get_latest_tag_prerelease() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
+}
+
+sync_submodules() {
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+}
+
+git_try_checkout() {
+  local want="$1"
+  local ref=""
+
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    git fetch --tags --force --prune --depth=1 || true
+    git rev-parse "refs/tags/${want}" >/dev/null 2>&1 && ref="$want"
+
+    if [[ -n "$ref" ]]; then
+      echo "[OK] Found ref '${ref}', checking out..."
+      git checkout -f "$ref"
+      sync_submodules
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+apply_channel_or_keep() {
+  local ch="$1"
+  local tag=""
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+
+  case "$ch" in
+    latest)     tag="$(get_latest_tag_latest || true)" ;;
+    prerelease) tag="$(get_latest_tag_prerelease || true)" ;;
+    *)          die "Failed to resolve latest tag for channel '${ch}'." ;;
+  esac
+
+  [[ -n "$tag" ]] || die "Failed to resolve latest tag for channel '${ch}'."
+
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || die "Failed to checkout '${tag}'."
+  VERSION="${tag#v}"
+}
+
+resolve_version() {
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    if [[ -n "${VERSION_ARG:-}" ]]; then
+      local clean_ver="${VERSION_ARG#v}"
+
+      if git_try_checkout "$clean_ver"; then
+        VERSION="$clean_ver"
+      else
+        echo "[WARN] Tag '${VERSION_ARG}' not found."
+        apply_channel_or_keep "$(choose_channel)"
+      fi
+    else
+      apply_channel_or_keep "$(choose_channel)"
+    fi
+  else
+    echo "Current directory is not a git repo; proceeding on current tree."
+    VERSION="${VERSION_ARG:-0.0.0}"
+  fi
+
+  VERSION="${VERSION#v}"
+  echo "[*] GUI version resolved as: ${VERSION}"
+}
+
+xray_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-x64)   echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-64.zip" ;;
+    linux-arm64) echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-arm64-v8a.zip" ;;
+    *)           return 1 ;;
+  esac
+}
+
+singbox_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-x64)   echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-amd64.tar.gz" ;;
+    linux-arm64) echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-arm64.tar.gz" ;;
+    *)           return 1 ;;
+  esac
+}
+
+bundle_url_for_rid() {
+  local rid="$1"
+
+  case "$rid" in
+    linux-x64)   echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-64.zip" ;;
+    linux-arm64) echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-arm64.zip" ;;
+    *)           return 1 ;;
+  esac
+}
+
+download_xray() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${XRAY_VER:-}"
+  local url=""
+  local tmp=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
+  url="$(xray_url_for_rid "$rid" "$ver")" || { echo "[xray] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download xray: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/xray.zip" || { rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/xray.zip" -d "$tmp" || { rm -rf "$tmp"; return 1; }
+  install -m 755 "$tmp/xray" "$outdir/xray" || { rm -rf "$tmp"; return 1; }
+  rm -rf "$tmp"
+}
+
+download_singbox() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${SING_VER:-}"
+  local url=""
+  local tmp=""
+  local bin=""
+  local cronet=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
+  url="$(singbox_url_for_rid "$rid" "$ver")" || { echo "[sing-box] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download sing-box: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+  tar -C "$tmp" -xzf "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+
+  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+
+  install -m 755 "$bin" "$outdir/sing-box" || { rm -rf "$tmp"; return 1; }
+
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so" || true
+
+  rm -rf "$tmp"
+}
+
+unify_geo_layout() {
+  local outroot="$1"
+  local n
+  local names=(
+    geosite.dat
+    geoip.dat
+    geoip-only-cn-private.dat
+    Country.mmdb
+    geoip.metadb
+  )
+
+  mkdir -p "$outroot/bin"
+
+  for n in "${names[@]}"; do
+    if [[ -f "$outroot/bin/xray/$n" ]]; then
+      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
+    fi
+  done
+}
+
+download_geo_assets() {
+  local outroot="$1"
+  local bin_dir="$outroot/bin"
+  local srss_dir="$bin_dir/srss"
+  local f=""
+
+  mkdir -p "$bin_dir" "$srss_dir"
+
+  echo "[+] Download Xray Geo to ${bin_dir}"
+  curl -fsSL -o "$bin_dir/geosite.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+
+  echo "[+] Download sing-box rule DB & rule-sets"
+  curl -fsSL -o "$bin_dir/geoip.metadb" "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb"
+
+  for f in geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geoip/$f"
+  done
+
+  for f in geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geosite/$f"
+  done
+
+  unify_geo_layout "$outroot"
+}
+
+populate_assets_zip_mode() {
+  local outroot="$1"
+  local rid="$2"
+  local url=""
+  local tmp=""
+  local nested_dir=""
+
+  url="$(bundle_url_for_rid "$rid")" || { echo "[!] Bundle unsupported RID: $rid"; return 1; }
+
+  echo "[+] Try v2rayN bundle archive: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/v2rayn.zip" || { echo "[!] Bundle download failed"; rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/v2rayn.zip" -d "$tmp" || { echo "[!] Bundle unzip failed"; rm -rf "$tmp"; return 1; }
+
+  if [[ -d "$tmp/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$tmp/bin/" "$outroot/bin/"
+  else
+    rsync -a "$tmp/" "$outroot/"
+  fi
+
+  rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
+  find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
+
+  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$nested_dir/bin/" "$outroot/bin/"
+    rm -rf "$nested_dir"
+  fi
+
+  unify_geo_layout "$outroot"
+  rm -rf "$tmp"
+
+  echo "[+] Bundle extracted to $outroot"
+}
+
+populate_assets_netcore_mode() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+    download_xray "$outroot/bin/xray" "$rid" || echo "[!] xray download failed (skipped)"
+  fi
+
+  if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+    download_singbox "$outroot/bin/sing_box" "$rid" || echo "[!] sing-box download failed (skipped)"
+  fi
+
+  download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+}
+
+stage_runtime_assets() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
+    if populate_assets_zip_mode "$outroot" "$rid"; then
+      echo "[*] Using v2rayN bundle bin assets."
+    else
+      echo "[*] Bundle failed, fallback to separate core + rules."
+      populate_assets_netcore_mode "$outroot" "$rid"
+    fi
+  else
+    echo "[*] --netcore specified: use separate core + rules."
+    populate_assets_netcore_mode "$outroot" "$rid"
+  fi
+}
+
+describe_target() {
+  local short="$1"
+
+  case "$short" in
+    x64)   printf '%s\n%s\n' "linux-x64" "amd64" ;;
+    arm64) printf '%s\n%s\n' "linux-arm64" "arm64" ;;
+    *)     echo "Unknown arch '$short' (use x64|arm64)" >&2; return 1 ;;
+  esac
+}
+
+publish_binary() {
+  local rid="$1"
+
+  dotnet clean "$PROJECT" -c Release
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net10.0" || true
+  dotnet restore "$PROJECT"
+  dotnet publish "$PROJECT" -c Release -r "$rid" -p:PublishSingleFile=false -p:SelfContained=true
+}
+
+write_launcher_file() {
+  local stage="$1"
+
+  install -m 755 /dev/stdin "$stage/usr/bin/v2rayn" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+DIR="/opt/v2rayN"
+cd "$DIR"
+
+if [[ -x "$DIR/v2rayN" ]]; then
+  exec "$DIR/v2rayN" "$@"
 fi
-echo $Arch2
 
-# basic
-cat >"${PackagePath}/DEBIAN/control" <<-EOF
-Package: v2rayN
-Version: $Version
-Architecture: $Arch2
-Maintainer: https://github.com/2dust/v2rayN
-Depends: libc6 (>= 2.34), fontconfig (>= 2.13.1), desktop-file-utils (>= 0.26), xdg-utils (>= 1.1.3), coreutils (>= 8.32), bash (>= 5.1), libfreetype6 (>= 2.11)
-Description: A GUI client for Windows and Linux, support Xray core and sing-box-core and others
+for dll in v2rayN.Desktop.dll v2rayN.dll; do
+  if [[ -f "$DIR/$dll" ]]; then
+    exec /usr/bin/dotnet "$DIR/$dll" "$@"
+  fi
+done
+
+echo "v2rayN launcher: no executable found in $DIR" >&2
+ls -l "$DIR" >&2 || true
+exit 1
 EOF
+}
 
-mkdir -p "${PackagePath}/usr/share/applications"
-cat >"${PackagePath}/usr/share/applications/v2rayN.desktop" <<-EOF
+write_desktop_file() {
+  local stage="$1"
+
+  install -m 644 /dev/stdin "$stage/usr/share/applications/v2rayn.desktop" <<'EOF'
 [Desktop Entry]
-Name=v2rayN
-Comment=A GUI client for Windows and Linux, support Xray core and sing-box-core and others
-Exec=/opt/v2rayN/v2rayN
-Icon=/opt/v2rayN/v2rayN.png
-Terminal=false
 Type=Application
-Categories=Network;Application;
+Name=v2rayN
+Comment=v2rayN for Debian GNU Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
 EOF
+}
 
-cat >"${PackagePath}/DEBIAN/postinst" <<-'EOF'
+write_maintainer_scripts() {
+  local debian_dir="$1"
+
+  install -m 755 /dev/stdin "$debian_dir/postinst" <<'EOF'
+#!/bin/sh
 set -e
-update-desktop-database || true
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
 exit 0
 EOF
 
-sudo chmod 0755 "${PackagePath}/DEBIAN/postinst"
-sudo chmod 0755 "${PackagePath}/opt/v2rayN/v2rayN"
-sudo chmod 0755 "${PackagePath}/opt/v2rayN/AmazTool"
+  install -m 755 /dev/stdin "$debian_dir/postrm" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF
+}
 
-# Patch
-# set owner to root:root
-sudo chown -R root:root "${PackagePath}"
-# set all directories to 755 (readable & traversable by all users)
-sudo find "${PackagePath}/opt/v2rayN" -type d -exec chmod 755 {} +
-# set all regular files to 644 (readable by all users)
-sudo find "${PackagePath}/opt/v2rayN" -type f -exec chmod 644 {} +
-# ensure main binaries are 755 (executable by all users)
-sudo chmod 755 "${PackagePath}/opt/v2rayN/v2rayN" 2>/dev/null || true
-sudo chmod 755 "${PackagePath}/opt/v2rayN/AmazTool" 2>/dev/null || true
+package_binary() {
+  local short="$1"
+  local rid="$2"
+  local deb_arch="$3"
+  local pubdir=""
+  local workdir=""
+  local stage=""
+  local debian_dir=""
+  local project_dir=""
+  local icon_candidate=""
+  local shlibs_depends=""
+  local extra_depends=""
+  local final_depends=""
+  local multiarch=""
+  local sys_libdir=""
+  local sys_usrlibdir=""
+  local deb_out=""
 
-# build deb package
-sudo dpkg-deb -Zxz --build $PackagePath
-sudo mv "${PackagePath}.deb" "v2rayN-${Arch}.deb"
+  pubdir="$(dirname "$PROJECT")/bin/Release/net10.0/${rid}/publish"
+  [[ -d "$pubdir" ]] || { echo "Publish directory not found: $pubdir"; return 1; }
+
+  workdir="$(mktemp -d)"
+  trap '[[ -n "${workdir:-}" ]] && rm -rf "$workdir"' RETURN
+
+  stage="$workdir/${PKGROOT}_${VERSION}_${deb_arch}"
+  debian_dir="$stage/DEBIAN"
+
+  mkdir -p "$stage/opt/v2rayN" "$stage/usr/bin" "$stage/usr/share/applications" "$stage/usr/share/icons/hicolor/256x256/apps" "$debian_dir"
+  cp -a "$pubdir/." "$stage/opt/v2rayN/"
+
+  project_dir="$(cd "$(dirname "$PROJECT")" && pwd)"
+  icon_candidate="$project_dir/v2rayN.png"
+  [[ -f "$icon_candidate" ]] && cp "$icon_candidate" "$stage/usr/share/icons/hicolor/256x256/apps/v2rayn.png" || true
+
+  stage_runtime_assets "$stage/opt/v2rayN" "$rid"
+  write_launcher_file "$stage"
+  write_desktop_file "$stage"
+  write_maintainer_scripts "$debian_dir"
+
+  extra_depends="libc6 (>= 2.34), fontconfig (>= 2.13.1), desktop-file-utils (>= 0.26), xdg-utils (>= 1.1.3), coreutils (>= 8.32), bash (>= 5.1), libfreetype6 (>= 2.11)"
+
+  mkdir -p "$workdir/debian"
+  cat > "$workdir/debian/control" <<EOF
+Source: v2rayn
+Section: net
+Priority: optional
+Maintainer: 2dust <noreply@github.com>
+Standards-Version: 4.7.0
+
+Package: v2rayn
+Architecture: ${deb_arch}
+Description: v2rayN
+EOF
+
+  multiarch="$(dpkg-architecture -a"$deb_arch" -qDEB_HOST_MULTIARCH)"
+  sys_libdir="/lib/$multiarch"
+  sys_usrlibdir="/usr/lib/$multiarch"
+
+  : > "$debian_dir/substvars"
+
+  mapfile -t ELF_FILES < <(
+    find "$stage/opt/v2rayN" -type f \( -name "*.so*" -o -perm -111 \) ! -name 'libcoreclrtraceptprovider.so'
+  )
+
+  if [[ "${#ELF_FILES[@]}" -gt 0 ]]; then
+    (
+      cd "$workdir"
+      dpkg-shlibdeps \
+        -l"$stage/opt/v2rayN" \
+        -l"$sys_libdir" \
+        -l"$sys_usrlibdir" \
+        -T"$debian_dir/substvars" \
+        "${ELF_FILES[@]}"
+    ) >/dev/null 2>&1 || true
+  fi
+
+  shlibs_depends="$(sed -n 's/^shlibs:Depends=//p' "$debian_dir/substvars" | head -n1 || true)"
+
+  if [[ -n "$shlibs_depends" ]]; then
+    shlibs_depends="$(echo "$shlibs_depends" \
+      | sed -E 's/ *\([^)]*\)//g' \
+      | sed -E 's/ *, */, /g' \
+      | sed -E 's/^, *//; s/, *$//')"
+    final_depends="${shlibs_depends}, ${extra_depends}"
+  else
+    final_depends="${extra_depends}"
+  fi
+
+  cat > "$debian_dir/control" <<EOF
+Package: v2rayn
+Version: ${VERSION}
+Architecture: ${deb_arch}
+Maintainer: 2dust <noreply@github.com>
+Homepage: https://github.com/2dust/v2rayN
+Section: net
+Priority: optional
+Depends: ${final_depends}
+Description: v2rayN (Avalonia) GUI client for Linux
+ Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 /
+ Shadowsocks / tuic / WireGuard.
+EOF
+
+  find "$stage/opt/v2rayN" -type d -exec chmod 0755 {} +
+  find "$stage/opt/v2rayN" -type f -exec chmod 0644 {} +
+  [[ -f "$stage/opt/v2rayN/v2rayN" ]] && chmod 0755 "$stage/opt/v2rayN/v2rayN" || true
+
+  deb_out="$OUTPUT_DIR/v2rayn_${VERSION}_${deb_arch}.deb"
+  dpkg-deb --root-owner-group --build "$stage" "$deb_out"
+
+  echo "Build done for $short. DEB at:"
+  echo "  $deb_out"
+  BUILT_DEBS+=("$deb_out")
+}
+
+select_targets() {
+  case "${ARCH_OVERRIDE:-}" in
+    all)           printf '%s\n' x64 arm64 ;;
+    x64|amd64)     printf '%s\n' x64 ;;
+    arm64|aarch64) printf '%s\n' arm64 ;;
+    "")
+      case "$HOST_ARCH" in
+        x86_64)  printf '%s\n' x64 ;;
+        aarch64) printf '%s\n' arm64 ;;
+        *)       return 1 ;;
+      esac
+      ;;
+    *)
+      echo "Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all." >&2
+      return 1
+      ;;
+  esac
+}
+
+build_one_target() {
+  local short="$1"
+  local meta=()
+  local rid=""
+  local deb_arch=""
+
+  mapfile -t meta < <(describe_target "$short") || return 1
+  rid="${meta[0]}"
+  deb_arch="${meta[1]}"
+
+  echo "[*] Building for target: $short  (RID=$rid, DEB arch=$deb_arch)"
+  publish_binary "$rid"
+  package_binary "$short" "$rid" "$deb_arch"
+}
+
+print_summary() {
+  local pkg=""
+
+  echo ""
+  echo "================ Build Summary ================="
+  if [[ "${#BUILT_DEBS[@]}" -gt 0 ]]; then
+    echo "Output directory: $OUTPUT_DIR"
+    for pkg in "${BUILT_DEBS[@]}"; do
+      echo "$pkg"
+    done
+  else
+    echo "No DEBs detected in summary (check build logs above)."
+  fi
+  echo "==============================================="
+}
+
+main() {
+  local targets=()
+  local arch=""
+
+  parse_args "$@"
+  detect_environment
+  install_dependencies
+  prepare_workspace
+  resolve_version
+
+  mapfile -t targets < <(select_targets)
+
+  for arch in "${targets[@]}"; do
+    build_one_target "$arch"
+  done
+
+  print_summary
+}
+
+main "$@"

package-osx.sh

@@ -22,7 +22,17 @@ cat >"$PackagePath/v2rayN.app/Contents/Info.plist" <<-EOF
 <plist version="1.0">
 <dict>
   <key>CFBundleDevelopmentRegion</key>
-  <string>English</string>
+  <string>en</string>
+  <key>CFBundleLocalizations</key>
+  <array>
+    <string>zh-Hans</string>
+    <string>zh-Hant</string>
+    <string>en</string>
+    <string>fa</string>
+    <string>fr</string>
+    <string>ru</string>
+    <string>hu</string>
+  </array>
   <key>CFBundleDisplayName</key>
   <string>v2rayN</string>
   <key>CFBundleExecutable</key>

package-release-zip.sh

@@ -1,15 +0,0 @@
-#!/bin/bash
-
-Arch="$1"
-OutputPath="$2"
-
-OutputArch="v2rayN-${Arch}"
-FileName="v2rayN-${Arch}.zip"
-
-wget -nv -O $FileName "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/$FileName"
-
-ZipPath64="./$OutputArch"
-mkdir $ZipPath64
-
-cp -rf $OutputPath "$ZipPath64/$OutputArch"
-7z a -tZip $FileName "$ZipPath64/$OutputArch" -mx1

package-rhel-loong.sh

@@ -0,0 +1,709 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION_ARG=""
+WITH_CORE="both"
+FORCE_NETCORE=0
+BUILD_FROM=""
+XRAY_VER="${XRAY_VER:-}"
+SING_VER="${SING_VER:-}"
+
+MIN_KERNEL="5.10"
+PKGROOT="v2rayN-publish"
+PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+RPM_TOPDIR="${HOME}/rpmbuild"
+DOTNET_LOONGARCH_VERSION="10.0.109"
+DOTNET_LOONGARCH_TAG="v10.0.109-loongarch64"
+DOTNET_LOONGARCH_BASE="https://github.com/loongson/dotnet/releases/download"
+DOTNET_LOONGARCH_FILE="dotnet-sdk-${DOTNET_LOONGARCH_VERSION}-linux-loongarch64.tar.gz"
+DOTNET_SDK_URL="${DOTNET_LOONGARCH_BASE}/${DOTNET_LOONGARCH_TAG}/${DOTNET_LOONGARCH_FILE}"
+
+OS_ID=""
+OS_NAME=""
+OS_VERSION_ID=""
+HOST_ARCH=""
+SCRIPT_DIR=""
+PROJECT=""
+VERSION=""
+
+declare -a BUILT_RPMS=()
+
+die() {
+  echo "$*" >&2
+  exit 1
+}
+
+parse_args() {
+  local first_arg="${1:-}"
+
+  if [[ -n "$first_arg" && "$first_arg" != --* ]]; then
+    VERSION_ARG="$first_arg"
+    shift || true
+  fi
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --with-core)   WITH_CORE="${2:-both}"; shift 2 ;;
+      --xray-ver)    XRAY_VER="${2:-}"; shift 2 ;;
+      --singbox-ver) SING_VER="${2:-}"; shift 2 ;;
+      --netcore)     FORCE_NETCORE=1; shift ;;
+      --buildfrom)   BUILD_FROM="${2:-}"; shift 2 ;;
+      *)
+        [[ -n "${VERSION_ARG:-}" ]] || VERSION_ARG="$1"
+        shift
+        ;;
+    esac
+  done
+
+  if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+    die "You cannot specify both an explicit version and --buildfrom at the same time.
+        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  fi
+}
+
+detect_environment() {
+  local current_kernel=""
+  local lowest=""
+
+  . /etc/os-release
+
+  OS_ID="${ID:-}"
+  OS_NAME="${NAME:-$OS_ID}"
+  OS_VERSION_ID="${VERSION_ID:-}"
+  HOST_ARCH="$(uname -m)"
+
+  case "$OS_ID" in
+    rhel|rocky|almalinux|fedora|centos)
+      echo "Detected supported system: ${OS_NAME:-$OS_ID} ${OS_VERSION_ID:-}"
+      ;;
+    *)
+      die "Unsupported system: ${OS_NAME:-unknown} (${OS_ID:-unknown}).
+This script only supports: RHEL / Rocky / AlmaLinux / Fedora / CentOS."
+      ;;
+  esac
+
+  case "$HOST_ARCH" in
+    loongarch64) ;;
+    *) die "Only supports loongarch64" ;;
+  esac
+
+  current_kernel="$(uname -r)"
+  lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$current_kernel" | sort -V | head -n1)"
+
+  [[ "$lowest" == "$MIN_KERNEL" ]] || die "Kernel $current_kernel is below $MIN_KERNEL"
+  echo "[OK] Kernel $current_kernel verified."
+}
+
+install_dependencies() {
+  local install_ok=0
+  local tmp_dotnet=""
+
+  if command -v dnf >/dev/null 2>&1; then
+    sudo dnf -y --nogpgcheck install \
+      rpm-build rpmdevtools curl unzip tar jq rsync git python3 \
+      glibc-devel kernel-headers libatomic file ca-certificates libicu \
+      && install_ok=1
+
+    mkdir -p "$HOME/.dotnet"
+    tmp_dotnet="$(mktemp -d)"
+    curl -fL "$DOTNET_SDK_URL" -o "$tmp_dotnet/$DOTNET_LOONGARCH_FILE"
+    tar -C "$HOME/.dotnet" -xzf "$tmp_dotnet/$DOTNET_LOONGARCH_FILE"
+    rm -rf "$tmp_dotnet"
+
+    export PATH="$HOME/.dotnet:$PATH"
+    export DOTNET_ROOT="$HOME/.dotnet"
+
+    mkdir -p "$HOME/.nuget/NuGet"
+
+    cat > "$HOME/.nuget/NuGet/NuGet.Config" <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+    <add key="loongnix" value="https://lnuget.loongnix.cn/v3/index.json" allowInsecureConnections="true" />
+  </packageSources>
+</configuration>
+EOF
+
+    dotnet --info >/dev/null 2>&1 || install_ok=0
+  fi
+
+  if [[ "$install_ok" -ne 1 ]]; then
+    echo "Could not auto-install dependencies for '$OS_ID'. Make sure these are available:"
+    echo "dotnet-loongarch SDK, curl, unzip, tar, rsync, git, python3, rpm, rpmdevtools, rpm-build (on Red Hat branch)"
+    exit 1
+  fi
+}
+
+prepare_workspace() {
+  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+  cd "$SCRIPT_DIR"
+
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+
+  PROJECT="$PROJECT_HINT"
+  [[ -f "$PROJECT" ]] || PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+  [[ -f "$PROJECT" ]] || die "v2rayN.Desktop.csproj not found"
+}
+
+choose_channel() {
+  local ch="latest"
+  local sel=""
+
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0 ;;
+      2) echo "prerelease"; return 0 ;;
+      3) echo "keep"; return 0 ;;
+      *) die "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." ;;
+    esac
+  fi
+
+  if [[ -t 0 ]]; then
+    echo "[?] Choose v2rayN release channel:" >&2
+    echo "    1) Latest (stable)  [default]" >&2
+    echo "    2) Pre-release (preview)" >&2
+    echo "    3) Keep current (do nothing)" >&2
+    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
+    if read -r sel </dev/tty; then
+      case "${sel:-}" in
+        2) ch="prerelease" ;;
+        3) ch="keep" ;;
+      esac
+    fi
+  fi
+
+  echo "$ch"
+}
+
+get_latest_tag_latest() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
+}
+
+get_latest_tag_prerelease() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
+}
+
+sync_submodules() {
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+}
+
+git_try_checkout() {
+  local want="$1"
+  local ref=""
+
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    git fetch --tags --force --prune --depth=1 || true
+    git rev-parse "refs/tags/${want}" >/dev/null 2>&1 && ref="$want"
+
+    if [[ -n "$ref" ]]; then
+      echo "[OK] Found ref '${ref}', checking out..."
+      git checkout -f "$ref"
+      sync_submodules
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+apply_channel_or_keep() {
+  local ch="$1"
+  local tag=""
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+
+  case "$ch" in
+    latest)     tag="$(get_latest_tag_latest || true)" ;;
+    prerelease) tag="$(get_latest_tag_prerelease || true)" ;;
+    *)          die "Failed to resolve latest tag for channel '${ch}'." ;;
+  esac
+
+  [[ -n "$tag" ]] || die "Failed to resolve latest tag for channel '${ch}'."
+
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || die "Failed to checkout '${tag}'."
+  VERSION="${tag#v}"
+}
+
+resolve_version() {
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    if [[ -n "${VERSION_ARG:-}" ]]; then
+      local clean_ver="${VERSION_ARG#v}"
+
+      if git_try_checkout "$clean_ver"; then
+        VERSION="$clean_ver"
+      else
+        echo "[WARN] Tag '${VERSION_ARG}' not found."
+        apply_channel_or_keep "$(choose_channel)"
+      fi
+    else
+      apply_channel_or_keep "$(choose_channel)"
+    fi
+  else
+    echo "Current directory is not a git repo; proceeding on current tree."
+    VERSION="${VERSION_ARG:-0.0.0}"
+  fi
+
+  VERSION="${VERSION#v}"
+  echo "[*] GUI version resolved as: ${VERSION}"
+}
+
+xray_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-loongarch64) echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-loong64.zip" ;;
+    *)                 return 1 ;;
+  esac
+}
+
+singbox_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-loongarch64) echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-loong64.tar.gz" ;;
+    *)                 return 1 ;;
+  esac
+}
+
+bundle_url_for_rid() {
+  local rid="$1"
+
+  case "$rid" in
+    linux-loongarch64) echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-loong64.zip" ;;
+    *)                 return 1 ;;
+  esac
+}
+
+download_xray() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${XRAY_VER:-}"
+  local url=""
+  local tmp=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
+  url="$(xray_url_for_rid "$rid" "$ver")" || { echo "[xray] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download xray: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/xray.zip" || { rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/xray.zip" -d "$tmp" || { rm -rf "$tmp"; return 1; }
+  install -m 755 "$tmp/xray" "$outdir/xray" || { rm -rf "$tmp"; return 1; }
+  rm -rf "$tmp"
+}
+
+download_singbox() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${SING_VER:-}"
+  local url=""
+  local tmp=""
+  local bin=""
+  local cronet=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
+  url="$(singbox_url_for_rid "$rid" "$ver")" || { echo "[sing-box] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download sing-box: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+  tar -C "$tmp" -xzf "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+
+  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+
+  install -m 755 "$bin" "$outdir/sing-box" || { rm -rf "$tmp"; return 1; }
+
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so" || true
+
+  rm -rf "$tmp"
+}
+
+unify_geo_layout() {
+  local outroot="$1"
+  local n
+  local names=(
+    geosite.dat
+    geoip.dat
+    geoip-only-cn-private.dat
+    Country.mmdb
+    geoip.metadb
+  )
+
+  mkdir -p "$outroot/bin"
+
+  for n in "${names[@]}"; do
+    if [[ -f "$outroot/bin/xray/$n" ]]; then
+      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
+    fi
+  done
+}
+
+download_geo_assets() {
+  local outroot="$1"
+  local bin_dir="$outroot/bin"
+  local srss_dir="$bin_dir/srss"
+  local f=""
+
+  mkdir -p "$bin_dir" "$srss_dir"
+
+  echo "[+] Download Xray Geo to ${bin_dir}"
+  curl -fsSL -o "$bin_dir/geosite.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+
+  echo "[+] Download sing-box rule DB & rule-sets"
+  curl -fsSL -o "$bin_dir/geoip.metadb" "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb"
+
+  for f in geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geoip/$f"
+  done
+
+  for f in geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geosite/$f"
+  done
+
+  unify_geo_layout "$outroot"
+}
+
+populate_assets_zip_mode() {
+  local outroot="$1"
+  local rid="$2"
+  local url=""
+  local tmp=""
+  local nested_dir=""
+
+  url="$(bundle_url_for_rid "$rid")" || { echo "[!] Bundle unsupported RID: $rid"; return 1; }
+
+  echo "[+] Try v2rayN bundle archive: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/v2rayn.zip" || { echo "[!] Bundle download failed"; rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/v2rayn.zip" -d "$tmp" || { echo "[!] Bundle unzip failed"; rm -rf "$tmp"; return 1; }
+
+  if [[ -d "$tmp/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$tmp/bin/" "$outroot/bin/"
+  else
+    rsync -a "$tmp/" "$outroot/"
+  fi
+
+  rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
+  find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
+
+  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$nested_dir/bin/" "$outroot/bin/"
+    rm -rf "$nested_dir"
+  fi
+
+  unify_geo_layout "$outroot"
+  rm -rf "$tmp"
+
+  echo "[+] Bundle extracted to $outroot"
+}
+
+populate_assets_netcore_mode() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+    download_xray "$outroot/bin/xray" "$rid" || echo "[!] xray download failed (skipped)"
+  fi
+
+  if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+    download_singbox "$outroot/bin/sing_box" "$rid" || echo "[!] sing-box download failed (skipped)"
+  fi
+
+  download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+}
+
+stage_runtime_assets() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
+    if populate_assets_zip_mode "$outroot" "$rid"; then
+      echo "[*] Using v2rayN bundle archive."
+    else
+      echo "[*] Bundle failed, fallback to separate core + rules."
+      populate_assets_netcore_mode "$outroot" "$rid"
+    fi
+  else
+    echo "[*] --netcore specified: use separate core + rules."
+    populate_assets_netcore_mode "$outroot" "$rid"
+  fi
+}
+
+describe_target() {
+  local short="$1"
+
+  case "$short" in
+    loongarch64) printf '%s\n%s\n%s\n' "linux-loongarch64" "loongarch64" "loongarch64" ;;
+    *)           echo "Unknown arch '$short' (use loongarch64)" >&2; return 1 ;;
+  esac
+}
+
+publish_binary() {
+  local rid="$1"
+
+  dotnet clean "$PROJECT" -c Release
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net10.0" || true
+  dotnet restore "$PROJECT"
+  dotnet publish "$PROJECT" -c Release -r "$rid" -p:PublishSingleFile=false -p:SelfContained=true
+}
+
+write_spec_file() {
+  local specfile="$1"
+
+  cat > "$specfile" <<'SPEC'
+%global debug_package %{nil}
+%undefine _debuginfo_subpackages
+%undefine _debugsource_packages
+%global __requires_exclude ^liblttng-ust\.so\..*$
+
+Name:           v2rayN
+Version:        __VERSION__
+Release:        1%{?dist}
+Summary:        v2rayN (Avalonia) GUI client for Linux
+License:        GPL-3.0-only
+URL:            https://github.com/2dust/v2rayN
+BugURL:         https://github.com/2dust/v2rayN/issues
+ExclusiveArch:  loongarch64
+Source0:        __PKGROOT__.tar.gz
+
+Requires:       cairo, pango, openssl, mesa-libEGL, mesa-libGL
+Requires:       glibc >= 2.34
+Requires:       fontconfig >= 2.13.1
+Requires:       desktop-file-utils >= 0.26
+Requires:       xdg-utils >= 1.1.3
+Requires:       coreutils >= 8.32
+Requires:       bash >= 5.1
+Requires:       freetype >= 2.10
+
+%description
+v2rayN Linux for Red Hat Enterprise Linux
+Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 / Shadowsocks / tuic / WireGuard
+Support Red Hat Enterprise Linux / Fedora Linux / Rocky Linux / AlmaLinux / CentOS
+For more information, Please visit our website
+https://github.com/2dust/v2rayN
+
+%prep
+%setup -q -n __PKGROOT__
+
+%build
+
+%install
+install -dm0755 %{buildroot}/opt/v2rayN
+cp -a * %{buildroot}/opt/v2rayN/
+
+find %{buildroot}/opt/v2rayN -type d -exec chmod 0755 {} +
+find %{buildroot}/opt/v2rayN -type f -exec chmod 0644 {} +
+[ -f %{buildroot}/opt/v2rayN/v2rayN ] && chmod 0755 %{buildroot}/opt/v2rayN/v2rayN || :
+
+install -dm0755 %{buildroot}%{_bindir}
+install -m0755 /dev/stdin %{buildroot}%{_bindir}/v2rayn << 'EOF'
+#!/usr/bin/bash
+set -euo pipefail
+DIR="/opt/v2rayN"
+
+if [[ -x "$DIR/v2rayN" ]]; then exec "$DIR/v2rayN" "$@"; fi
+
+for dll in v2rayN.Desktop.dll v2rayN.dll; do
+  if [[ -f "$DIR/$dll" ]]; then exec /usr/bin/dotnet "$DIR/$dll" "$@"; fi
+done
+
+echo "v2rayN launcher: no executable found in $DIR" >&2
+ls -l "$DIR" >&2 || true
+exit 1
+EOF
+
+install -dm0755 %{buildroot}%{_datadir}/applications
+install -m0644 /dev/stdin %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
+[Desktop Entry]
+Type=Application
+Name=v2rayN
+Comment=v2rayN for Red Hat Enterprise Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
+EOF
+
+install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
+install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
+
+%post
+/usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
+/usr/bin/gtk-update-icon-cache -f %{_datadir}/icons/hicolor >/dev/null 2>&1 || true
+
+%postun
+/usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
+/usr/bin/gtk-update-icon-cache -f %{_datadir}/icons/hicolor >/dev/null 2>&1 || true
+
+%files
+%{_bindir}/v2rayn
+/opt/v2rayN
+%{_datadir}/applications/v2rayn.desktop
+%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
+SPEC
+
+  sed -i "s/__VERSION__/${VERSION}/g" "$specfile"
+  sed -i "s/__PKGROOT__/${PKGROOT}/g" "$specfile"
+}
+
+package_binary() {
+  local short="$1"
+  local rid="$2"
+  local rpm_target="$3"
+  local archdir="$4"
+  local pubdir=""
+  local workdir=""
+  local specfile=""
+  local sourcedir=""
+  local specdir=""
+  local project_dir=""
+  local icon_candidate=""
+  local f=""
+
+  pubdir="$(dirname "$PROJECT")/bin/Release/net10.0/${rid}/publish"
+  [[ -d "$pubdir" ]] || { echo "Publish directory not found: $pubdir"; return 1; }
+
+  workdir="$(mktemp -d)"
+  trap '[[ -n "${workdir:-}" ]] && rm -rf "$workdir"' RETURN
+
+  mkdir -p "$workdir/$PKGROOT"
+  cp -a "$pubdir/." "$workdir/$PKGROOT/"
+
+  project_dir="$(cd "$(dirname "$PROJECT")" && pwd)"
+  icon_candidate="$project_dir/v2rayN.png"
+  [[ -f "$icon_candidate" ]] || { echo "Required icon not found: $icon_candidate"; return 1; }
+  cp "$icon_candidate" "$workdir/$PKGROOT/v2rayn.png"
+
+  stage_runtime_assets "$workdir/$PKGROOT" "$rid"
+
+  rpmdev-setuptree
+  sourcedir="${RPM_TOPDIR}/SOURCES"
+  specdir="${RPM_TOPDIR}/SPECS"
+  specfile="${specdir}/v2rayN.spec"
+
+  mkdir -p "$sourcedir" "$specdir"
+  tar -C "$workdir" -czf "$sourcedir/$PKGROOT.tar.gz" "$PKGROOT"
+
+  write_spec_file "$specfile"
+  rpmbuild -ba "$specfile" --target "$rpm_target"
+
+  echo "Build done for $short. RPM at:"
+  for f in "${RPM_TOPDIR}/RPMS/${archdir}/v2rayN-${VERSION}-1"*.rpm; do
+    [[ -e "$f" ]] || continue
+    echo "  $f"
+    BUILT_RPMS+=("$f")
+  done
+}
+
+select_targets() {
+  printf '%s\n' loongarch64
+}
+
+build_one_target() {
+  local short="$1"
+  local meta=()
+  local rid=""
+  local rpm_target=""
+  local archdir=""
+
+  mapfile -t meta < <(describe_target "$short") || return 1
+  rid="${meta[0]}"
+  rpm_target="${meta[1]}"
+  archdir="${meta[2]}"
+
+  echo "[*] Building for target: $short  (RID=$rid, RPM --target $rpm_target)"
+  publish_binary "$rid"
+  package_binary "$short" "$rid" "$rpm_target" "$archdir"
+}
+
+print_summary() {
+  local rp=""
+
+  echo ""
+  echo "================ Build Summary ================"
+  if [[ "${#BUILT_RPMS[@]}" -gt 0 ]]; then
+    for rp in "${BUILT_RPMS[@]}"; do
+      echo "$rp"
+    done
+  else
+    echo "No RPMs detected in summary (check build logs above)."
+  fi
+  echo "=============================================="
+}
+
+main() {
+  local targets=()
+  local arch=""
+
+  parse_args "$@"
+  detect_environment
+  install_dependencies
+  prepare_workspace
+  resolve_version
+
+  mapfile -t targets < <(select_targets)
+
+  for arch in "${targets[@]}"; do
+    build_one_target "$arch"
+  done
+
+  print_summary
+}
+
+main "$@"

package-rhel-riscv.sh

@@ -0,0 +1,695 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION_ARG=""
+WITH_CORE="both"
+FORCE_NETCORE=0
+BUILD_FROM=""
+XRAY_VER="${XRAY_VER:-}"
+SING_VER="${SING_VER:-}"
+
+MIN_KERNEL="5.10"
+PKGROOT="v2rayN-publish"
+PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+RPM_TOPDIR="${HOME}/rpmbuild"
+DOTNET_RISCV_VERSION="10.0.109"
+DOTNET_RISCV_BASE="https://github.com/xujiegb/dotnet-riscv/releases/download"
+DOTNET_RISCV_FILE="dotnet-sdk-${DOTNET_RISCV_VERSION}-linux-riscv64.tar.gz"
+DOTNET_SDK_URL="${DOTNET_RISCV_BASE}/${DOTNET_RISCV_VERSION}/${DOTNET_RISCV_FILE}"
+
+OS_ID=""
+OS_NAME=""
+OS_VERSION_ID=""
+HOST_ARCH=""
+SCRIPT_DIR=""
+PROJECT=""
+VERSION=""
+
+declare -a BUILT_RPMS=()
+
+die() {
+  echo "$*" >&2
+  exit 1
+}
+
+parse_args() {
+  local first_arg="${1:-}"
+
+  if [[ -n "$first_arg" && "$first_arg" != --* ]]; then
+    VERSION_ARG="$first_arg"
+    shift || true
+  fi
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --with-core)   WITH_CORE="${2:-both}"; shift 2 ;;
+      --xray-ver)    XRAY_VER="${2:-}"; shift 2 ;;
+      --singbox-ver) SING_VER="${2:-}"; shift 2 ;;
+      --netcore)     FORCE_NETCORE=1; shift ;;
+      --buildfrom)   BUILD_FROM="${2:-}"; shift 2 ;;
+      *)
+        [[ -n "${VERSION_ARG:-}" ]] || VERSION_ARG="$1"
+        shift
+        ;;
+    esac
+  done
+
+  if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+    die "You cannot specify both an explicit version and --buildfrom at the same time.
+        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  fi
+}
+
+detect_environment() {
+  local current_kernel=""
+  local lowest=""
+
+  . /etc/os-release
+
+  OS_ID="${ID:-}"
+  OS_NAME="${NAME:-$OS_ID}"
+  OS_VERSION_ID="${VERSION_ID:-}"
+  HOST_ARCH="$(uname -m)"
+
+  case "$OS_ID" in
+    rhel|rocky|almalinux|fedora|centos)
+      echo "Detected supported system: ${OS_NAME:-$OS_ID} ${OS_VERSION_ID:-}"
+      ;;
+    *)
+      die "Unsupported system: ${OS_NAME:-unknown} (${OS_ID:-unknown}).
+This script only supports: RHEL / Rocky / AlmaLinux / Fedora / CentOS."
+      ;;
+  esac
+
+  case "$HOST_ARCH" in
+    riscv64) ;;
+    *) die "Only supports riscv64" ;;
+  esac
+
+  current_kernel="$(uname -r)"
+  lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$current_kernel" | sort -V | head -n1)"
+
+  [[ "$lowest" == "$MIN_KERNEL" ]] || die "Kernel $current_kernel is below $MIN_KERNEL"
+  echo "[OK] Kernel $current_kernel verified."
+}
+
+install_dependencies() {
+  local install_ok=0
+  local tmp_dotnet=""
+
+  if command -v dnf >/dev/null 2>&1; then
+    sudo dnf -y install \
+      rpm-build rpmdevtools curl unzip tar jq rsync git python3 \
+      glibc-devel kernel-headers libatomic file ca-certificates libicu \
+      && install_ok=1
+
+    mkdir -p "$HOME/.dotnet"
+    tmp_dotnet="$(mktemp -d)"
+    curl -fL "$DOTNET_SDK_URL" -o "$tmp_dotnet/$DOTNET_RISCV_FILE"
+    tar -C "$HOME/.dotnet" -xzf "$tmp_dotnet/$DOTNET_RISCV_FILE"
+    rm -rf "$tmp_dotnet"
+
+    export PATH="$HOME/.dotnet:$PATH"
+    export DOTNET_ROOT="$HOME/.dotnet"
+
+    dotnet --info >/dev/null 2>&1 || install_ok=0
+  fi
+
+  if [[ "$install_ok" -ne 1 ]]; then
+    echo "Could not auto-install dependencies for '$OS_ID'. Make sure these are available:"
+    echo "dotnet-riscv SDK, curl, unzip, tar, rsync, git, python3, rpm, rpmdevtools, rpm-build (on Red Hat branch)"
+    exit 1
+  fi
+}
+
+prepare_workspace() {
+  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+  cd "$SCRIPT_DIR"
+
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+
+  PROJECT="$PROJECT_HINT"
+  [[ -f "$PROJECT" ]] || PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+  [[ -f "$PROJECT" ]] || die "v2rayN.Desktop.csproj not found"
+}
+
+choose_channel() {
+  local ch="latest"
+  local sel=""
+
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0 ;;
+      2) echo "prerelease"; return 0 ;;
+      3) echo "keep"; return 0 ;;
+      *) die "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." ;;
+    esac
+  fi
+
+  if [[ -t 0 ]]; then
+    echo "[?] Choose v2rayN release channel:" >&2
+    echo "    1) Latest (stable)  [default]" >&2
+    echo "    2) Pre-release (preview)" >&2
+    echo "    3) Keep current (do nothing)" >&2
+    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
+    if read -r sel </dev/tty; then
+      case "${sel:-}" in
+        2) ch="prerelease" ;;
+        3) ch="keep" ;;
+      esac
+    fi
+  fi
+
+  echo "$ch"
+}
+
+get_latest_tag_latest() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
+}
+
+get_latest_tag_prerelease() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
+}
+
+sync_submodules() {
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+}
+
+git_try_checkout() {
+  local want="$1"
+  local ref=""
+
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    git fetch --tags --force --prune --depth=1 || true
+    git rev-parse "refs/tags/${want}" >/dev/null 2>&1 && ref="$want"
+
+    if [[ -n "$ref" ]]; then
+      echo "[OK] Found ref '${ref}', checking out..."
+      git checkout -f "$ref"
+      sync_submodules
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+apply_channel_or_keep() {
+  local ch="$1"
+  local tag=""
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+
+  case "$ch" in
+    latest)     tag="$(get_latest_tag_latest || true)" ;;
+    prerelease) tag="$(get_latest_tag_prerelease || true)" ;;
+    *)          die "Failed to resolve latest tag for channel '${ch}'." ;;
+  esac
+
+  [[ -n "$tag" ]] || die "Failed to resolve latest tag for channel '${ch}'."
+
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || die "Failed to checkout '${tag}'."
+  VERSION="${tag#v}"
+}
+
+resolve_version() {
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    if [[ -n "${VERSION_ARG:-}" ]]; then
+      local clean_ver="${VERSION_ARG#v}"
+
+      if git_try_checkout "$clean_ver"; then
+        VERSION="$clean_ver"
+      else
+        echo "[WARN] Tag '${VERSION_ARG}' not found."
+        apply_channel_or_keep "$(choose_channel)"
+      fi
+    else
+      apply_channel_or_keep "$(choose_channel)"
+    fi
+  else
+    echo "Current directory is not a git repo; proceeding on current tree."
+    VERSION="${VERSION_ARG:-0.0.0}"
+  fi
+
+  VERSION="${VERSION#v}"
+  echo "[*] GUI version resolved as: ${VERSION}"
+}
+
+xray_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-riscv64) echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-riscv64.zip" ;;
+    *)             return 1 ;;
+  esac
+}
+
+singbox_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-riscv64) echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-riscv64.tar.gz" ;;
+    *)             return 1 ;;
+  esac
+}
+
+bundle_url_for_rid() {
+  local rid="$1"
+
+  case "$rid" in
+    linux-riscv64) echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-riscv64.zip" ;;
+    *)             return 1 ;;
+  esac
+}
+
+download_xray() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${XRAY_VER:-}"
+  local url=""
+  local tmp=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
+  url="$(xray_url_for_rid "$rid" "$ver")" || { echo "[xray] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download xray: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/xray.zip" || { rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/xray.zip" -d "$tmp" || { rm -rf "$tmp"; return 1; }
+  install -m 755 "$tmp/xray" "$outdir/xray" || { rm -rf "$tmp"; return 1; }
+  rm -rf "$tmp"
+}
+
+download_singbox() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${SING_VER:-}"
+  local url=""
+  local tmp=""
+  local bin=""
+  local cronet=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
+  url="$(singbox_url_for_rid "$rid" "$ver")" || { echo "[sing-box] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download sing-box: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+  tar -C "$tmp" -xzf "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+
+  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+
+  install -m 755 "$bin" "$outdir/sing-box" || { rm -rf "$tmp"; return 1; }
+
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so" || true
+
+  rm -rf "$tmp"
+}
+
+unify_geo_layout() {
+  local outroot="$1"
+  local n
+  local names=(
+    geosite.dat
+    geoip.dat
+    geoip-only-cn-private.dat
+    Country.mmdb
+    geoip.metadb
+  )
+
+  mkdir -p "$outroot/bin"
+
+  for n in "${names[@]}"; do
+    if [[ -f "$outroot/bin/xray/$n" ]]; then
+      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
+    fi
+  done
+}
+
+download_geo_assets() {
+  local outroot="$1"
+  local bin_dir="$outroot/bin"
+  local srss_dir="$bin_dir/srss"
+  local f=""
+
+  mkdir -p "$bin_dir" "$srss_dir"
+
+  echo "[+] Download Xray Geo to ${bin_dir}"
+  curl -fsSL -o "$bin_dir/geosite.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+
+  echo "[+] Download sing-box rule DB & rule-sets"
+  curl -fsSL -o "$bin_dir/geoip.metadb" "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb"
+
+  for f in geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geoip/$f"
+  done
+
+  for f in geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geosite/$f"
+  done
+
+  unify_geo_layout "$outroot"
+}
+
+populate_assets_zip_mode() {
+  local outroot="$1"
+  local rid="$2"
+  local url=""
+  local tmp=""
+  local nested_dir=""
+
+  url="$(bundle_url_for_rid "$rid")" || { echo "[!] Bundle unsupported RID: $rid"; return 1; }
+
+  echo "[+] Try v2rayN bundle archive: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/v2rayn.zip" || { echo "[!] Bundle download failed"; rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/v2rayn.zip" -d "$tmp" || { echo "[!] Bundle unzip failed"; rm -rf "$tmp"; return 1; }
+
+  if [[ -d "$tmp/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$tmp/bin/" "$outroot/bin/"
+  else
+    rsync -a "$tmp/" "$outroot/"
+  fi
+
+  rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
+  find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
+
+  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$nested_dir/bin/" "$outroot/bin/"
+    rm -rf "$nested_dir"
+  fi
+
+  unify_geo_layout "$outroot"
+  rm -rf "$tmp"
+
+  echo "[+] Bundle extracted to $outroot"
+}
+
+populate_assets_netcore_mode() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+    download_xray "$outroot/bin/xray" "$rid" || echo "[!] xray download failed (skipped)"
+  fi
+
+  if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+    download_singbox "$outroot/bin/sing_box" "$rid" || echo "[!] sing-box download failed (skipped)"
+  fi
+
+  download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+}
+
+stage_runtime_assets() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
+    if populate_assets_zip_mode "$outroot" "$rid"; then
+      echo "[*] Using v2rayN bundle archive."
+    else
+      echo "[*] Bundle failed, fallback to separate core + rules."
+      populate_assets_netcore_mode "$outroot" "$rid"
+    fi
+  else
+    echo "[*] --netcore specified: use separate core + rules."
+    populate_assets_netcore_mode "$outroot" "$rid"
+  fi
+}
+
+describe_target() {
+  local short="$1"
+
+  case "$short" in
+    riscv64) printf '%s\n%s\n%s\n' "linux-riscv64" "riscv64" "riscv64" ;;
+    *)       echo "Unknown arch '$short' (use riscv64)" >&2; return 1 ;;
+  esac
+}
+
+publish_binary() {
+  local rid="$1"
+
+  dotnet clean "$PROJECT" -c Release
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net10.0" || true
+  dotnet restore "$PROJECT"
+  dotnet publish "$PROJECT" -c Release -r "$rid" -p:PublishSingleFile=false -p:SelfContained=true
+}
+
+write_spec_file() {
+  local specfile="$1"
+
+  cat > "$specfile" <<'SPEC'
+%global debug_package %{nil}
+%undefine _debuginfo_subpackages
+%undefine _debugsource_packages
+%global __requires_exclude ^liblttng-ust\.so\..*$
+
+Name:           v2rayN
+Version:        __VERSION__
+Release:        1%{?dist}
+Summary:        v2rayN (Avalonia) GUI client for Linux
+License:        GPL-3.0-only
+URL:            https://github.com/2dust/v2rayN
+BugURL:         https://github.com/2dust/v2rayN/issues
+ExclusiveArch:  riscv64
+Source0:        __PKGROOT__.tar.gz
+
+Requires:       cairo, pango, openssl, mesa-libEGL, mesa-libGL
+Requires:       glibc >= 2.34
+Requires:       fontconfig >= 2.13.1
+Requires:       desktop-file-utils >= 0.26
+Requires:       xdg-utils >= 1.1.3
+Requires:       coreutils >= 8.32
+Requires:       bash >= 5.1
+Requires:       freetype >= 2.10
+
+%description
+v2rayN Linux for Red Hat Enterprise Linux
+Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 / Shadowsocks / tuic / WireGuard
+Support Red Hat Enterprise Linux / Fedora Linux / Rocky Linux / AlmaLinux / CentOS
+For more information, Please visit our website
+https://github.com/2dust/v2rayN
+
+%prep
+%setup -q -n __PKGROOT__
+
+%build
+
+%install
+install -dm0755 %{buildroot}/opt/v2rayN
+cp -a * %{buildroot}/opt/v2rayN/
+
+find %{buildroot}/opt/v2rayN -type d -exec chmod 0755 {} +
+find %{buildroot}/opt/v2rayN -type f -exec chmod 0644 {} +
+[ -f %{buildroot}/opt/v2rayN/v2rayN ] && chmod 0755 %{buildroot}/opt/v2rayN/v2rayN || :
+
+install -dm0755 %{buildroot}%{_bindir}
+install -m0755 /dev/stdin %{buildroot}%{_bindir}/v2rayn << 'EOF'
+#!/usr/bin/bash
+set -euo pipefail
+DIR="/opt/v2rayN"
+
+if [[ -x "$DIR/v2rayN" ]]; then exec "$DIR/v2rayN" "$@"; fi
+
+for dll in v2rayN.Desktop.dll v2rayN.dll; do
+  if [[ -f "$DIR/$dll" ]]; then exec /usr/bin/dotnet "$DIR/$dll" "$@"; fi
+done
+
+echo "v2rayN launcher: no executable found in $DIR" >&2
+ls -l "$DIR" >&2 || true
+exit 1
+EOF
+
+install -dm0755 %{buildroot}%{_datadir}/applications
+install -m0644 /dev/stdin %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
+[Desktop Entry]
+Type=Application
+Name=v2rayN
+Comment=v2rayN for Red Hat Enterprise Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
+EOF
+
+install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
+install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
+
+%post
+/usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
+/usr/bin/gtk-update-icon-cache -f %{_datadir}/icons/hicolor >/dev/null 2>&1 || true
+
+%postun
+/usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
+/usr/bin/gtk-update-icon-cache -f %{_datadir}/icons/hicolor >/dev/null 2>&1 || true
+
+%files
+%{_bindir}/v2rayn
+/opt/v2rayN
+%{_datadir}/applications/v2rayn.desktop
+%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
+SPEC
+
+  sed -i "s/__VERSION__/${VERSION}/g" "$specfile"
+  sed -i "s/__PKGROOT__/${PKGROOT}/g" "$specfile"
+}
+
+package_binary() {
+  local short="$1"
+  local rid="$2"
+  local rpm_target="$3"
+  local archdir="$4"
+  local pubdir=""
+  local workdir=""
+  local specfile=""
+  local sourcedir=""
+  local specdir=""
+  local project_dir=""
+  local icon_candidate=""
+  local f=""
+
+  pubdir="$(dirname "$PROJECT")/bin/Release/net10.0/${rid}/publish"
+  [[ -d "$pubdir" ]] || { echo "Publish directory not found: $pubdir"; return 1; }
+
+  workdir="$(mktemp -d)"
+  trap '[[ -n "${workdir:-}" ]] && rm -rf "$workdir"' RETURN
+
+  mkdir -p "$workdir/$PKGROOT"
+  cp -a "$pubdir/." "$workdir/$PKGROOT/"
+
+  project_dir="$(cd "$(dirname "$PROJECT")" && pwd)"
+  icon_candidate="$project_dir/v2rayN.png"
+  [[ -f "$icon_candidate" ]] || { echo "Required icon not found: $icon_candidate"; return 1; }
+  cp "$icon_candidate" "$workdir/$PKGROOT/v2rayn.png"
+
+  stage_runtime_assets "$workdir/$PKGROOT" "$rid"
+
+  rpmdev-setuptree
+  sourcedir="${RPM_TOPDIR}/SOURCES"
+  specdir="${RPM_TOPDIR}/SPECS"
+  specfile="${specdir}/v2rayN.spec"
+
+  mkdir -p "$sourcedir" "$specdir"
+  tar -C "$workdir" -czf "$sourcedir/$PKGROOT.tar.gz" "$PKGROOT"
+
+  write_spec_file "$specfile"
+  rpmbuild -ba "$specfile" --target "$rpm_target"
+
+  echo "Build done for $short. RPM at:"
+  for f in "${RPM_TOPDIR}/RPMS/${archdir}/v2rayN-${VERSION}-1"*.rpm; do
+    [[ -e "$f" ]] || continue
+    echo "  $f"
+    BUILT_RPMS+=("$f")
+  done
+}
+
+select_targets() {
+  printf '%s\n' riscv64
+}
+
+build_one_target() {
+  local short="$1"
+  local meta=()
+  local rid=""
+  local rpm_target=""
+  local archdir=""
+
+  mapfile -t meta < <(describe_target "$short") || return 1
+  rid="${meta[0]}"
+  rpm_target="${meta[1]}"
+  archdir="${meta[2]}"
+
+  echo "[*] Building for target: $short  (RID=$rid, RPM --target $rpm_target)"
+  publish_binary "$rid"
+  package_binary "$short" "$rid" "$rpm_target" "$archdir"
+}
+
+print_summary() {
+  local rp=""
+
+  echo ""
+  echo "================ Build Summary ================"
+  if [[ "${#BUILT_RPMS[@]}" -gt 0 ]]; then
+    for rp in "${BUILT_RPMS[@]}"; do
+      echo "$rp"
+    done
+  else
+    echo "No RPMs detected in summary (check build logs above)."
+  fi
+  echo "=============================================="
+}
+
+main() {
+  local targets=()
+  local arch=""
+
+  parse_args "$@"
+  detect_environment
+  install_dependencies
+  prepare_workspace
+  resolve_version
+
+  mapfile -t targets < <(select_targets)
+
+  for arch in "${targets[@]}"; do
+    build_one_target "$arch"
+  done
+
+  print_summary
+}
+
+main "$@"

package-rhel.sh

@@ -1,115 +1,138 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Require Red Hat base branch
-. /etc/os-release
+VERSION_ARG=""
+WITH_CORE="both"
+FORCE_NETCORE=0
+ARCH_OVERRIDE=""
+BUILD_FROM=""
+XRAY_VER="${XRAY_VER:-}"
+SING_VER="${SING_VER:-}"
 
-case "${ID:-}" in
-  rhel|rocky|almalinux|fedora|centos)
-    echo "Detected supported system: ${NAME:-$ID} ${VERSION_ID:-}"
-    ;;
-  *)
-    echo "Unsupported system: ${NAME:-unknown} (${ID:-unknown})."
-    echo "This script only supports: RHEL / Rocky / AlmaLinux / Fedora / CentOS."
-    exit 1
-    ;;
-esac
+MIN_KERNEL="6.12"
+PKGROOT="v2rayN-publish"
+PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+RPM_TOPDIR="${HOME}/rpmbuild"
 
-# Kernel version
-MIN_KERNEL="6.11"
-CURRENT_KERNEL="$(uname -r)"
+OS_ID=""
+OS_NAME=""
+OS_VERSION_ID=""
+HOST_ARCH=""
+SCRIPT_DIR=""
+PROJECT=""
+VERSION=""
+BUILT_ALL=0
 
-lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$CURRENT_KERNEL" | sort -V | head -n1)"
+declare -a BUILT_RPMS=()
 
-if [[ "$lowest" != "$MIN_KERNEL" ]]; then
-    echo "Kernel $CURRENT_KERNEL is below $MIN_KERNEL"
-    exit 1
-fi
-
-echo "[OK] Kernel $CURRENT_KERNEL verified."
-
-# Config & Parse arguments
-VERSION_ARG="${1:-}"     # Pass version number like 7.13.8, or leave empty
-WITH_CORE="both"         # Default: bundle both xray+sing-box
-FORCE_NETCORE=0          # --netcore => skip archive bundle, use separate downloads
-ARCH_OVERRIDE=""         # --arch x64|arm64|all (optional compile target)
-BUILD_FROM=""            # --buildfrom 1|2|3 to select channel non-interactively
-
-# If the first argument starts with --, do not treat it as a version number
-if [[ "${VERSION_ARG:-}" == --* ]]; then
-  VERSION_ARG=""
-fi
-# Take the first non --* argument as version, discard it
-if [[ -n "${VERSION_ARG:-}" ]]; then shift || true; fi
-
-# Parse remaining optional arguments
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --with-core)     WITH_CORE="${2:-both}"; shift 2;;
-    --xray-ver)      XRAY_VER="${2:-}"; shift 2;;
-    --singbox-ver)   SING_VER="${2:-}"; shift 2;;
-    --netcore)       FORCE_NETCORE=1; shift;;
-    --arch)          ARCH_OVERRIDE="${2:-}"; shift 2;;
-    --buildfrom)     BUILD_FROM="${2:-}"; shift 2;;
-    *)
-      if [[ -z "${VERSION_ARG:-}" ]]; then VERSION_ARG="$1"; fi
-      shift;;
-  esac
-done
-
-# Conflict: version number AND --buildfrom cannot be used together
-if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
-  echo "You cannot specify both an explicit version and --buildfrom at the same time."
-  echo "        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+die() {
+  echo "$*" >&2
   exit 1
-fi
+}
 
-# Check and install dependencies
-host_arch="$(uname -m)"
-[[ "$host_arch" == "aarch64" || "$host_arch" == "x86_64" ]] || { echo "Only supports aarch64 / x86_64"; exit 1; }
+parse_args() {
+  local first_arg="${1:-}"
 
-install_ok=0
-
-if command -v dnf >/dev/null 2>&1; then
-  sudo dnf -y install rpm-build rpmdevtools curl unzip tar jq rsync dotnet-sdk-8.0 \
-    && install_ok=1
-fi
-
-if [[ "$install_ok" -ne 1 ]]; then
-  echo "Could not auto-install dependencies for '$ID'. Make sure these are available:"
-  echo "dotnet-sdk 8.x, curl, unzip, tar, rsync, rpm, rpmdevtools, rpm-build (on Red Hat branch)"
-fi
-
-# Root directory
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-cd "$SCRIPT_DIR"
-
-# Git submodules (best effort)
-if [[ -f .gitmodules ]]; then
-  git submodule sync --recursive || true
-  git submodule update --init --recursive || true
-fi
-
-# Locate project
-PROJECT="v2rayN.Desktop/v2rayN.Desktop.csproj"
-if [[ ! -f "$PROJECT" ]]; then
-  PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
-fi
-[[ -f "$PROJECT" ]] || { echo "v2rayN.Desktop.csproj not found"; exit 1; }
-
-choose_channel() {
-  # If --buildfrom provided, map it directly and skip interaction.
-  if [[ -n "${BUILD_FROM:-}" ]]; then
-    case "$BUILD_FROM" in
-      1) echo "latest"; return 0;;
-      2) echo "prerelease"; return 0;;
-      3) echo "keep"; return 0;;
-      *) echo "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." >&2; exit 1;;
-    esac
+  if [[ -n "$first_arg" && "$first_arg" != --* ]]; then
+    VERSION_ARG="$first_arg"
+    shift || true
   fi
 
-  # Print menu to stderr and read from /dev/tty so stdout only carries the token.
-  local ch="latest" sel=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --with-core)   WITH_CORE="${2:-both}"; shift 2 ;;
+      --xray-ver)    XRAY_VER="${2:-}"; shift 2 ;;
+      --singbox-ver) SING_VER="${2:-}"; shift 2 ;;
+      --netcore)     FORCE_NETCORE=1; shift ;;
+      --arch)        ARCH_OVERRIDE="${2:-}"; shift 2 ;;
+      --buildfrom)   BUILD_FROM="${2:-}"; shift 2 ;;
+      *)
+        [[ -n "${VERSION_ARG:-}" ]] || VERSION_ARG="$1"
+        shift
+        ;;
+    esac
+  done
+
+  if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+    die "You cannot specify both an explicit version and --buildfrom at the same time.
+        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  fi
+}
+
+detect_environment() {
+  local current_kernel=""
+  local lowest=""
+
+  . /etc/os-release
+
+  OS_ID="${ID:-}"
+  OS_NAME="${NAME:-$OS_ID}"
+  OS_VERSION_ID="${VERSION_ID:-}"
+  HOST_ARCH="$(uname -m)"
+
+  case "$OS_ID" in
+    rhel|rocky|almalinux|fedora|centos)
+      echo "Detected supported system: ${OS_NAME:-$OS_ID} ${OS_VERSION_ID:-}"
+      ;;
+    *)
+      die "Unsupported system: ${OS_NAME:-unknown} (${OS_ID:-unknown}).
+This script only supports: RHEL / Rocky / AlmaLinux / Fedora / CentOS."
+      ;;
+  esac
+
+  case "$HOST_ARCH" in
+    x86_64|aarch64) ;;
+    *) die "Only supports aarch64 / x86_64" ;;
+  esac
+
+  current_kernel="$(uname -r)"
+  lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$current_kernel" | sort -V | head -n1)"
+
+  [[ "$lowest" == "$MIN_KERNEL" ]] || die "Kernel $current_kernel is below $MIN_KERNEL"
+  echo "[OK] Kernel $current_kernel verified."
+}
+
+install_dependencies() {
+  local install_ok=0
+
+  if command -v dnf >/dev/null 2>&1; then
+    sudo dnf -y install rpm-build rpmdevtools curl unzip tar jq rsync dotnet-sdk-10.0 \
+      && install_ok=1
+  fi
+
+  if [[ "$install_ok" -ne 1 ]]; then
+    echo "Could not auto-install dependencies for '$OS_ID'. Make sure these are available:"
+    echo "dotnet-sdk 10.x, curl, unzip, tar, rsync, rpm, rpmdevtools, rpm-build (on Red Hat branch)"
+    exit 1
+  fi
+}
+
+prepare_workspace() {
+  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+  cd "$SCRIPT_DIR"
+
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+
+  PROJECT="$PROJECT_HINT"
+  [[ -f "$PROJECT" ]] || PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+  [[ -f "$PROJECT" ]] || die "v2rayN.Desktop.csproj not found"
+}
+
+choose_channel() {
+  local ch="latest"
+  local sel=""
+
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0 ;;
+      2) echo "prerelease"; return 0 ;;
+      3) echo "keep"; return 0 ;;
+      *) die "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." ;;
+    esac
+  fi
 
   if [[ -t 0 ]]; then
     echo "[?] Choose v2rayN release channel:" >&2
@@ -141,29 +164,35 @@ get_latest_tag_prerelease() {
     | sed 's/^v//'
 }
 
+sync_submodules() {
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+}
+
 git_try_checkout() {
-  # Try a series of refs and checkout when found.
-  local want="$1" ref=""
+  local want="$1"
+  local ref=""
+
   if git rev-parse --git-dir >/dev/null 2>&1; then
     git fetch --tags --force --prune --depth=1 || true
-    if git rev-parse "refs/tags/${want}" >/dev/null 2>&1; then
-      ref="${want}"
-    fi
+    git rev-parse "refs/tags/${want}" >/dev/null 2>&1 && ref="$want"
+
     if [[ -n "$ref" ]]; then
       echo "[OK] Found ref '${ref}', checking out..."
-      git checkout -f "${ref}"
-      if [[ -f .gitmodules ]]; then
-        git submodule sync --recursive || true
-        git submodule update --init --recursive || true
-      fi
+      git checkout -f "$ref"
+      sync_submodules
       return 0
     fi
   fi
+
   return 1
 }
 
 apply_channel_or_keep() {
-  local ch="$1" tag
+  local ch="$1"
+  local tag=""
 
   if [[ "$ch" == "keep" ]]; then
     echo "[*] Keep current repository state (no checkout)."
@@ -173,96 +202,154 @@ apply_channel_or_keep() {
   fi
 
   echo "[*] Resolving ${ch} tag from GitHub releases..."
-  if [[ "$ch" == "prerelease" ]]; then
-    tag="$(get_latest_tag_prerelease || true)"
-  else
-    tag="$(get_latest_tag_latest || true)"
-  fi
 
-  [[ -n "$tag" ]] || { echo "Failed to resolve latest tag for channel '${ch}'."; exit 1; }
+  case "$ch" in
+    latest)     tag="$(get_latest_tag_latest || true)" ;;
+    prerelease) tag="$(get_latest_tag_prerelease || true)" ;;
+    *)          die "Failed to resolve latest tag for channel '${ch}'." ;;
+  esac
+
+  [[ -n "$tag" ]] || die "Failed to resolve latest tag for channel '${ch}'."
+
   echo "[*] Latest tag for '${ch}': ${tag}"
-  git_try_checkout "$tag" || { echo "Failed to checkout '${tag}'."; exit 1; }
+  git_try_checkout "$tag" || die "Failed to checkout '${tag}'."
   VERSION="${tag#v}"
 }
 
-if git rev-parse --git-dir >/dev/null 2>&1; then
-  if [[ -n "${VERSION_ARG:-}" ]]; then
-    clean_ver="${VERSION_ARG#v}"
-    if git_try_checkout "$clean_ver"; then
-      VERSION="$clean_ver"
+resolve_version() {
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    if [[ -n "${VERSION_ARG:-}" ]]; then
+      local clean_ver="${VERSION_ARG#v}"
+
+      if git_try_checkout "$clean_ver"; then
+        VERSION="$clean_ver"
+      else
+        echo "[WARN] Tag '${VERSION_ARG}' not found."
+        apply_channel_or_keep "$(choose_channel)"
+      fi
     else
-      echo "[WARN] Tag '${VERSION_ARG}' not found."
-      ch="$(choose_channel)"
-      apply_channel_or_keep "$ch"
+      apply_channel_or_keep "$(choose_channel)"
     fi
   else
-    ch="$(choose_channel)"
-    apply_channel_or_keep "$ch"
+    echo "Current directory is not a git repo; proceeding on current tree."
+    VERSION="${VERSION_ARG:-0.0.0}"
   fi
-else
-  echo "Current directory is not a git repo; proceeding on current tree."
-  VERSION="${VERSION_ARG:-0.0.0}"
-fi
 
-VERSION="${VERSION#v}"
-echo "[*] GUI version resolved as: ${VERSION}"
+  VERSION="${VERSION#v}"
+  echo "[*] GUI version resolved as: ${VERSION}"
+}
+
+xray_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-x64)   echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-64.zip" ;;
+    linux-arm64) echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-arm64-v8a.zip" ;;
+    *)           return 1 ;;
+  esac
+}
+
+singbox_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-x64)   echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-amd64.tar.gz" ;;
+    linux-arm64) echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-arm64.tar.gz" ;;
+    *)           return 1 ;;
+  esac
+}
+
+bundle_url_for_rid() {
+  local rid="$1"
+
+  case "$rid" in
+    linux-x64)   echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-64.zip" ;;
+    linux-arm64) echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-arm64.zip" ;;
+    *)           return 1 ;;
+  esac
+}
 
-# Helpers for core
 download_xray() {
-  # Download Xray core
-  local outdir="$1" ver="${XRAY_VER:-}" url tmp zipname="xray.zip"
+  local outdir="$1"
+  local rid="$2"
+  local ver="${XRAY_VER:-}"
+  local url=""
+  local tmp=""
+
   mkdir -p "$outdir"
+
   if [[ -z "$ver" ]]; then
     ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
-        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
   fi
+
   [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
-  if [[ "$RID_DIR" == "linux-arm64" ]]; then
-    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-arm64-v8a.zip"
-  else
-    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-64.zip"
-  fi
+  url="$(xray_url_for_rid "$rid" "$ver")" || { echo "[xray] Unsupported RID: $rid"; return 1; }
+
   echo "[+] Download xray: $url"
-  tmp="$(mktemp -d)"; trap '[[ -n "${tmp:-}" ]] && rm -rf "$tmp"' RETURN
-  curl -fL "$url" -o "$tmp/$zipname"
-  unzip -q "$tmp/$zipname" -d "$tmp"
-  install -Dm755 "$tmp/xray" "$outdir/xray"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/xray.zip" || { rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/xray.zip" -d "$tmp" || { rm -rf "$tmp"; return 1; }
+  install -m 755 "$tmp/xray" "$outdir/xray" || { rm -rf "$tmp"; return 1; }
+  rm -rf "$tmp"
 }
 
 download_singbox() {
-  # Download sing-box
-  local outdir="$1" ver="${SING_VER:-}" url tmp tarname="singbox.tar.gz" bin
+  local outdir="$1"
+  local rid="$2"
+  local ver="${SING_VER:-}"
+  local url=""
+  local tmp=""
+  local bin=""
+  local cronet=""
+
   mkdir -p "$outdir"
+
   if [[ -z "$ver" ]]; then
     ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
-        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
   fi
+
   [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
-  if [[ "$RID_DIR" == "linux-arm64" ]]; then
-    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-arm64.tar.gz"
-  else
-    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-amd64.tar.gz"
-  fi
+  url="$(singbox_url_for_rid "$rid" "$ver")" || { echo "[sing-box] Unsupported RID: $rid"; return 1; }
+
   echo "[+] Download sing-box: $url"
-  tmp="$(mktemp -d)"; trap '[[ -n "${tmp:-}" ]] && rm -rf "$tmp"' RETURN
-  curl -fL "$url" -o "$tmp/$tarname"
-  tar -C "$tmp" -xzf "$tmp/$tarname"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+  tar -C "$tmp" -xzf "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+
   bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
-  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; return 1; }
-  install -Dm755 "$bin" "$outdir/sing-box"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+
+  install -m 755 "$bin" "$outdir/sing-box" || { rm -rf "$tmp"; return 1; }
+
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so" || true
+
+  rm -rf "$tmp"
 }
 
-# Move geo files to outroot/bin
 unify_geo_layout() {
   local outroot="$1"
-  mkdir -p "$outroot/bin"
-  local names=( \
-    "geosite.dat" \
-    "geoip.dat" \
-    "geoip-only-cn-private.dat" \
-    "Country.mmdb" \
-    "geoip.metadb" \
+  local n
+  local names=(
+    geosite.dat
+    geoip.dat
+    geoip-only-cn-private.dat
+    Country.mmdb
+    geoip.metadb
   )
+
+  mkdir -p "$outroot/bin"
+
   for n in "${names[@]}"; do
     if [[ -f "$outroot/bin/xray/$n" ]]; then
       mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
@@ -270,58 +357,48 @@ unify_geo_layout() {
   done
 }
 
-# Download geo/rule assets
 download_geo_assets() {
   local outroot="$1"
   local bin_dir="$outroot/bin"
   local srss_dir="$bin_dir/srss"
+  local f=""
+
   mkdir -p "$bin_dir" "$srss_dir"
 
   echo "[+] Download Xray Geo to ${bin_dir}"
-  curl -fsSL -o "$bin_dir/geosite.dat" \
-    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
-  curl -fsSL -o "$bin_dir/geoip.dat" \
-    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
-  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" \
-    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
-  curl -fsSL -o "$bin_dir/Country.mmdb" \
-    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+  curl -fsSL -o "$bin_dir/geosite.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
 
   echo "[+] Download sing-box rule DB & rule-sets"
-  curl -fsSL -o "$bin_dir/geoip.metadb" \
-    "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb" || true
+  curl -fsSL -o "$bin_dir/geoip.metadb" "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb"
 
-  for f in \
-    geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs \
-    geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
-    curl -fsSL -o "$srss_dir/$f" \
-      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geoip/$f" || true
+  for f in geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geoip/$f"
   done
-  for f in \
-    geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs \
-    geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
-    curl -fsSL -o "$srss_dir/$f" \
-      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geosite/$f" || true
+
+  for f in geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geosite/$f"
   done
 
-  # Unify to bin
   unify_geo_layout "$outroot"
 }
 
-# Prefer the prebuilt v2rayN core bundle; then unify geo layout
-download_v2rayn_bundle() {
+populate_assets_zip_mode() {
   local outroot="$1"
+  local rid="$2"
   local url=""
-  if [[ "$RID_DIR" == "linux-arm64" ]]; then
-    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-arm64.zip"
-  else
-    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-64.zip"
-  fi
+  local tmp=""
+  local nested_dir=""
+
+  url="$(bundle_url_for_rid "$rid")" || { echo "[!] Bundle unsupported RID: $rid"; return 1; }
+
   echo "[+] Try v2rayN bundle archive: $url"
-  local tmp zipname
-  tmp="$(mktemp -d)"; zipname="$tmp/v2rayn.zip"
-  curl -fL "$url" -o "$zipname" || { echo "[!] Bundle download failed"; return 1; }
-  unzip -q "$zipname" -d "$tmp" || { echo "[!] Bundle unzip failed"; return 1; }
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/v2rayn.zip" || { echo "[!] Bundle download failed"; rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/v2rayn.zip" -d "$tmp" || { echo "[!] Bundle unzip failed"; rm -rf "$tmp"; return 1; }
 
   if [[ -d "$tmp/bin" ]]; then
     mkdir -p "$outroot/bin"
@@ -333,7 +410,6 @@ download_v2rayn_bundle() {
   rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
   find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
 
-  local nested_dir
   nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
   if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
     mkdir -p "$outroot/bin"
@@ -341,123 +417,86 @@ download_v2rayn_bundle() {
     rm -rf "$nested_dir"
   fi
 
-  # Unify to bin/
   unify_geo_layout "$outroot"
+  rm -rf "$tmp"
 
   echo "[+] Bundle extracted to $outroot"
 }
 
-# ===== Build results collection for --arch all ========================================
-BUILT_RPMS=()     # Will collect absolute paths of built RPMs
-BUILT_ALL=0       # Flag to know if we should print the final summary
+populate_assets_netcore_mode() {
+  local outroot="$1"
+  local rid="$2"
 
-# ===== Build (single-arch) function ====================================================
-build_for_arch() {
-  # $1: target short arch: x64 | arm64
-  local short="$1"
-  local rid rpm_target archdir
-  case "$short" in
-    x64)   rid="linux-x64";   rpm_target="x86_64"; archdir="x86_64" ;;
-    arm64) rid="linux-arm64"; rpm_target="aarch64"; archdir="aarch64" ;;
-    *) echo "Unknown arch '$short' (use x64|arm64)"; return 1;;
-  esac
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
 
-  echo "[*] Building for target: $short  (RID=$rid, RPM --target $rpm_target)"
+  if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+    download_xray "$outroot/bin/xray" "$rid" || echo "[!] xray download failed (skipped)"
+  fi
 
-  # .NET publish (self-contained) for this RID
-  dotnet clean "$PROJECT" -c Release
-  rm -rf "$(dirname "$PROJECT")/bin/Release/net8.0" || true
+  if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+    download_singbox "$outroot/bin/sing_box" "$rid" || echo "[!] sing-box download failed (skipped)"
+  fi
 
-  dotnet restore "$PROJECT"
-  dotnet publish "$PROJECT" \
-    -c Release -r "$rid" \
-    -p:PublishSingleFile=false \
-    -p:SelfContained=true
+  download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+}
 
-  # Per-arch variables (scoped)
-  local RID_DIR="$rid"
-  local PUBDIR
-  PUBDIR="$(dirname "$PROJECT")/bin/Release/net8.0/${RID_DIR}/publish"
-  [[ -d "$PUBDIR" ]]
+stage_runtime_assets() {
+  local outroot="$1"
+  local rid="$2"
 
-  # Make RID_DIR visible to download helpers (they read this var)
-  export RID_DIR
-
-  # Per-arch working area
-  local PKGROOT="v2rayN-publish"
-  local WORKDIR
-  WORKDIR="$(mktemp -d)"
-  trap '[[ -n "${WORKDIR:-}" ]] && rm -rf "$WORKDIR"' RETURN
-
-  # rpmbuild topdir selection
-  local TOPDIR SPECDIR SOURCEDIR
-  rpmdev-setuptree
-  TOPDIR="${HOME}/rpmbuild"
-  SPECDIR="${TOPDIR}/SPECS"
-  SOURCEDIR="${TOPDIR}/SOURCES"
-
-  # Stage publish content
-  mkdir -p "$WORKDIR/$PKGROOT"
-  cp -a "$PUBDIR/." "$WORKDIR/$PKGROOT/"
-
-  # Optional icon
-  local ICON_CANDIDATE
-  ICON_CANDIDATE="$(dirname "$PROJECT")/../v2rayN.Desktop/v2rayN.png"
-  [[ -f "$ICON_CANDIDATE" ]] && cp "$ICON_CANDIDATE" "$WORKDIR/$PKGROOT/v2rayn.png" || true
-
-  # Prepare bin structure
-  mkdir -p "$WORKDIR/$PKGROOT/bin/xray" "$WORKDIR/$PKGROOT/bin/sing_box"
-
-  # Bundle / cores per-arch
-  fetch_separate_cores_and_rules() {
-    local outroot="$1"
-
-    if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
-      download_xray "$outroot/bin/xray" || echo "[!] xray download failed (skipped)"
-    fi
-    if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
-      download_singbox "$outroot/bin/sing_box" || echo "[!] sing-box download failed (skipped)"
-    fi
-    download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
-  }
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
 
   if [[ "$FORCE_NETCORE" -eq 0 ]]; then
-    if download_v2rayn_bundle "$WORKDIR/$PKGROOT"; then
+    if populate_assets_zip_mode "$outroot" "$rid"; then
       echo "[*] Using v2rayN bundle archive."
     else
       echo "[*] Bundle failed, fallback to separate core + rules."
-      fetch_separate_cores_and_rules "$WORKDIR/$PKGROOT"
+      populate_assets_netcore_mode "$outroot" "$rid"
     fi
   else
     echo "[*] --netcore specified: use separate core + rules."
-    fetch_separate_cores_and_rules "$WORKDIR/$PKGROOT"
+    populate_assets_netcore_mode "$outroot" "$rid"
   fi
+}
 
-  # Tarball
-  mkdir -p "$SOURCEDIR"
-  tar -C "$WORKDIR" -czf "$SOURCEDIR/$PKGROOT.tar.gz" "$PKGROOT"
+describe_target() {
+  local short="$1"
 
-  # SPEC
-  local SPECFILE="$SPECDIR/v2rayN.spec"
-  mkdir -p "$SPECDIR"
-  cat > "$SPECFILE" <<'SPEC'
+  case "$short" in
+    x64)   printf '%s\n%s\n%s\n' "linux-x64" "x86_64" "x86_64" ;;
+    arm64) printf '%s\n%s\n%s\n' "linux-arm64" "aarch64" "aarch64" ;;
+    *)     echo "Unknown arch '$short' (use x64|arm64)" >&2; return 1 ;;
+  esac
+}
+
+publish_binary() {
+  local rid="$1"
+
+  dotnet clean "$PROJECT" -c Release
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net10.0" || true
+  dotnet restore "$PROJECT"
+  dotnet publish "$PROJECT" -c Release -r "$rid" -p:PublishSingleFile=false -p:SelfContained=true
+}
+
+write_spec_file() {
+  local specfile="$1"
+
+  cat > "$specfile" <<'SPEC'
 %global debug_package %{nil}
 %undefine _debuginfo_subpackages
 %undefine _debugsource_packages
-# Ignore outdated LTTng dependencies incorrectly reported by the .NET runtime (to avoid installation failures)
 %global __requires_exclude ^liblttng-ust\.so\..*$
 
 Name:           v2rayN
 Version:        __VERSION__
 Release:        1%{?dist}
-Summary:        v2rayN (Avalonia) GUI client for Linux (x86_64/aarch64)
+Summary:        v2rayN (Avalonia) GUI client for Linux
 License:        GPL-3.0-only
 URL:            https://github.com/2dust/v2rayN
 BugURL:         https://github.com/2dust/v2rayN/issues
 ExclusiveArch:  aarch64 x86_64
 Source0:        __PKGROOT__.tar.gz
 
-# Runtime dependencies (Avalonia / X11 / Fonts / GL)
 Requires:       cairo, pango, openssl, mesa-libEGL, mesa-libGL
 Requires:       glibc >= 2.34
 Requires:       fontconfig >= 2.13.1
@@ -478,23 +517,23 @@ https://github.com/2dust/v2rayN
 %setup -q -n __PKGROOT__
 
 %build
-# no build
 
 %install
 install -dm0755 %{buildroot}/opt/v2rayN
 cp -a * %{buildroot}/opt/v2rayN/
 
-# Launcher (prefer native ELF first, then DLL fallback)
+find %{buildroot}/opt/v2rayN -type d -exec chmod 0755 {} +
+find %{buildroot}/opt/v2rayN -type f -exec chmod 0644 {} +
+[ -f %{buildroot}/opt/v2rayN/v2rayN ] && chmod 0755 %{buildroot}/opt/v2rayN/v2rayN || :
+
 install -dm0755 %{buildroot}%{_bindir}
-cat > %{buildroot}%{_bindir}/v2rayn << 'EOF'
+install -m0755 /dev/stdin %{buildroot}%{_bindir}/v2rayn << 'EOF'
 #!/usr/bin/bash
 set -euo pipefail
 DIR="/opt/v2rayN"
 
-# Prefer native apphost
 if [[ -x "$DIR/v2rayN" ]]; then exec "$DIR/v2rayN" "$@"; fi
 
-# DLL fallback
 for dll in v2rayN.Desktop.dll v2rayN.dll; do
   if [[ -f "$DIR/$dll" ]]; then exec /usr/bin/dotnet "$DIR/$dll" "$@"; fi
 done
@@ -503,11 +542,9 @@ echo "v2rayN launcher: no executable found in $DIR" >&2
 ls -l "$DIR" >&2 || true
 exit 1
 EOF
-chmod 0755 %{buildroot}%{_bindir}/v2rayn
 
-# Desktop file
 install -dm0755 %{buildroot}%{_datadir}/applications
-cat > %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
+install -m0644 /dev/stdin %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
 [Desktop Entry]
 Type=Application
 Name=v2rayN
@@ -518,11 +555,8 @@ Terminal=false
 Categories=Network;
 EOF
 
-# Icon
-if [ -f "%{_builddir}/__PKGROOT__/v2rayn.png" ]; then
-  install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
-  install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
-fi
+install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
+install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
 
 %post
 /usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
@@ -539,45 +573,129 @@ fi
 %{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
 SPEC
 
-  # Replace placeholders
-  sed -i "s/__VERSION__/${VERSION}/g" "$SPECFILE"
-  sed -i "s/__PKGROOT__/${PKGROOT}/g" "$SPECFILE"
+  sed -i "s/__VERSION__/${VERSION}/g" "$specfile"
+  sed -i "s/__PKGROOT__/${PKGROOT}/g" "$specfile"
+}
 
-  # Build RPM for this arch
-  rpmbuild -ba "$SPECFILE" --target "$rpm_target"
+package_binary() {
+  local short="$1"
+  local rid="$2"
+  local rpm_target="$3"
+  local archdir="$4"
+  local pubdir=""
+  local workdir=""
+  local specfile=""
+  local sourcedir=""
+  local specdir=""
+  local project_dir=""
+  local icon_candidate=""
+  local f=""
+
+  pubdir="$(dirname "$PROJECT")/bin/Release/net10.0/${rid}/publish"
+  [[ -d "$pubdir" ]] || { echo "Publish directory not found: $pubdir"; return 1; }
+
+  workdir="$(mktemp -d)"
+  trap '[[ -n "${workdir:-}" ]] && rm -rf "$workdir"' RETURN
+
+  mkdir -p "$workdir/$PKGROOT"
+  cp -a "$pubdir/." "$workdir/$PKGROOT/"
+
+  project_dir="$(cd "$(dirname "$PROJECT")" && pwd)"
+  icon_candidate="$project_dir/v2rayN.png"
+  [[ -f "$icon_candidate" ]] || { echo "Required icon not found: $icon_candidate"; return 1; }
+  cp "$icon_candidate" "$workdir/$PKGROOT/v2rayn.png"
+
+  stage_runtime_assets "$workdir/$PKGROOT" "$rid"
+
+  rpmdev-setuptree
+  sourcedir="${RPM_TOPDIR}/SOURCES"
+  specdir="${RPM_TOPDIR}/SPECS"
+  specfile="${specdir}/v2rayN.spec"
+
+  mkdir -p "$sourcedir" "$specdir"
+  tar -C "$workdir" -czf "$sourcedir/$PKGROOT.tar.gz" "$PKGROOT"
+
+  write_spec_file "$specfile"
+  rpmbuild -ba "$specfile" --target "$rpm_target"
 
   echo "Build done for $short. RPM at:"
-  local f
-  for f in "${TOPDIR}/RPMS/${archdir}/v2rayN-${VERSION}-1"*.rpm; do
+  for f in "${RPM_TOPDIR}/RPMS/${archdir}/v2rayN-${VERSION}-1"*.rpm; do
     [[ -e "$f" ]] || continue
     echo "  $f"
     BUILT_RPMS+=("$f")
   done
 }
 
-# ===== Arch selection and build orchestration =========================================
-case "${ARCH_OVERRIDE:-}" in
-  all)           targets=(x64 arm64); BUILT_ALL=1 ;;
-  x64|amd64)     targets=(x64) ;;
-  arm64|aarch64) targets=(arm64) ;;
-  "")            targets=($([[ "$host_arch" == "aarch64" ]] && echo arm64 || echo x64)) ;;
-  *)             echo "Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all."; exit 1 ;;
-esac
+select_targets() {
+  case "${ARCH_OVERRIDE:-}" in
+    all)           printf '%s\n' x64 arm64 ;;
+    x64|amd64)     printf '%s\n' x64 ;;
+    arm64|aarch64) printf '%s\n' arm64 ;;
+    "")
+      case "$HOST_ARCH" in
+        x86_64)  printf '%s\n' x64 ;;
+        aarch64) printf '%s\n' arm64 ;;
+        *)       return 1 ;;
+      esac
+      ;;
+    *)
+      echo "Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all." >&2
+      return 1
+      ;;
+  esac
+}
 
-for arch in "${targets[@]}"; do
-  build_for_arch "$arch"
-done
+build_one_target() {
+  local short="$1"
+  local meta=()
+  local rid=""
+  local rpm_target=""
+  local archdir=""
 
-# Print Both arches information
-if [[ "$BUILT_ALL" -eq 1 ]]; then
-  echo ""
-  echo "================ Build Summary (both architectures) ================"
-  if [[ "${#BUILT_RPMS[@]}" -gt 0 ]]; then
-    for rp in "${BUILT_RPMS[@]}"; do
-      echo "$rp"
-    done
-  else
-    echo "No RPMs detected in summary (check build logs above)."
+  mapfile -t meta < <(describe_target "$short") || return 1
+  rid="${meta[0]}"
+  rpm_target="${meta[1]}"
+  archdir="${meta[2]}"
+
+  echo "[*] Building for target: $short  (RID=$rid, RPM --target $rpm_target)"
+  publish_binary "$rid"
+  package_binary "$short" "$rid" "$rpm_target" "$archdir"
+}
+
+print_summary() {
+  if [[ "$BUILT_ALL" -eq 1 ]]; then
+    local rp=""
+    echo ""
+    echo "================ Build Summary (both architectures) ================"
+    if [[ "${#BUILT_RPMS[@]}" -gt 0 ]]; then
+      for rp in "${BUILT_RPMS[@]}"; do
+        echo "$rp"
+      done
+    else
+      echo "No RPMs detected in summary (check build logs above)."
+    fi
+    echo "===================================================================="
   fi
-  echo "===================================================================="
-fi
+}
+
+main() {
+  local targets=()
+  local arch=""
+
+  parse_args "$@"
+  detect_environment
+  install_dependencies
+  prepare_workspace
+  resolve_version
+
+  mapfile -t targets < <(select_targets)
+  [[ "${ARCH_OVERRIDE:-}" == "all" ]] && BUILT_ALL=1 || BUILT_ALL=0
+
+  for arch in "${targets[@]}"; do
+    build_one_target "$arch"
+  done
+
+  print_summary
+}
+
+main "$@"

v2rayN/Directory.Build.props

@@ -1,14 +1,13 @@
 <Project>
 
     <PropertyGroup>
-        <Version>7.19.4</Version>
+        <Version>7.23.0</Version>
     </PropertyGroup>
 
     <PropertyGroup>
-        <TargetFramework>net8.0</TargetFramework>
+        <TargetFramework>net10.0</TargetFramework>
         <TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>
         <CheckForOverflowUnderflow>true</CheckForOverflowUnderflow>
-        <NoWarn>CA1031;CS1591;NU1507;CA1416;IDE0058;IDE0053;IDE0200</NoWarn>
         <Nullable>annotations</Nullable>
         <ImplicitUsings>enable</ImplicitUsings>
         <Authors>2dust</Authors>

v2rayN/Directory.Packages.props

@@ -1,32 +1,39 @@
 <Project>
-  <PropertyGroup>
-    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
-    <CentralPackageVersionOverrideEnabled>false</CentralPackageVersionOverrideEnabled>
-  </PropertyGroup>
-  <ItemGroup>
-    <PackageVersion Include="Avalonia.AvaloniaEdit" Version="11.4.1" />
-    <PackageVersion Include="Avalonia.Controls.DataGrid" Version="11.3.12" />
-    <PackageVersion Include="Avalonia.Desktop" Version="11.3.12" />
-    <PackageVersion Include="Avalonia.Diagnostics" Version="11.3.12" />
-    <PackageVersion Include="ReactiveUI.Avalonia" Version="11.4.12" />
-    <PackageVersion Include="CliWrap" Version="3.10.0" />
-    <PackageVersion Include="Downloader" Version="5.1.0" />
-    <PackageVersion Include="H.NotifyIcon.Wpf" Version="2.4.1" />
-    <PackageVersion Include="MaterialDesignThemes" Version="5.3.0" />
-    <PackageVersion Include="MessageBox.Avalonia" Version="3.3.1.1" />
-    <PackageVersion Include="QRCoder" Version="1.7.0" />
-    <PackageVersion Include="ReactiveUI" Version="23.1.8" />
-    <PackageVersion Include="ReactiveUI.Fody" Version="19.5.41" />
-    <PackageVersion Include="ReactiveUI.WPF" Version="23.1.8" />
-    <PackageVersion Include="Semi.Avalonia" Version="11.3.7.3" />
-    <PackageVersion Include="Semi.Avalonia.AvaloniaEdit" Version="11.2.0.2" />
-    <PackageVersion Include="Semi.Avalonia.DataGrid" Version="11.3.7.3" />
-    <PackageVersion Include="NLog" Version="6.1.1" />
-    <PackageVersion Include="sqlite-net-pcl" Version="1.9.172" />
-    <PackageVersion Include="TaskScheduler" Version="2.12.2" />
-    <PackageVersion Include="WebDav.Client" Version="2.9.0" />
-    <PackageVersion Include="YamlDotNet" Version="16.3.0" />
-    <PackageVersion Include="ZXing.Net.Bindings.SkiaSharp" Version="0.16.14" />
-  </ItemGroup>
-</Project>
+    <PropertyGroup>
+        <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+        <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
+        <CentralPackageVersionOverrideEnabled>false</CentralPackageVersionOverrideEnabled>
+    </PropertyGroup>
+    <ItemGroup>
+        <PackageVersion Include="Avalonia.AvaloniaEdit" Version="11.4.1" />
+        <PackageVersion Include="Avalonia.Controls.DataGrid" Version="11.3.13" />
+        <PackageVersion Include="Avalonia.Desktop" Version="11.3.17" />
+        <PackageVersion Include="Avalonia.Diagnostics" Version="11.3.17" />
+        <PackageVersion Include="AwesomeAssertions" Version="9.4.0" />
+        <PackageVersion Include="DialogHost.Avalonia" Version="0.11.0" />
+        <PackageVersion Include="IPNetwork2" Version="4.3.0" />
+        <PackageVersion Include="ReactiveUI.Avalonia" Version="11.4.13" />
+        <PackageVersion Include="CliWrap" Version="3.10.1" />
+        <PackageVersion Include="Downloader" Version="5.7.0" />
+        <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.6.0" />
+        <PackageVersion Include="H.NotifyIcon.Wpf" Version="2.4.1" />
+        <PackageVersion Include="MaterialDesignThemes" Version="5.3.2" />
+        <PackageVersion Include="QRCoder" Version="1.8.0" />
+        <PackageVersion Include="ReactiveUI" Version="23.2.28" />
+        <PackageVersion Include="ReactiveUI.Fody" Version="19.5.41" />
+        <PackageVersion Include="ReactiveUI.WPF" Version="23.2.28" />
+        <PackageVersion Include="Semi.Avalonia" Version="11.3.14" />
+        <PackageVersion Include="Semi.Avalonia.AvaloniaEdit" Version="11.2.0.2" />
+        <PackageVersion Include="Semi.Avalonia.DataGrid" Version="11.3.7.3" />
+        <PackageVersion Include="NLog" Version="6.1.3" />
+        <PackageVersion Include="sqlite-net-e" Version="1.11.0" />
+        <PackageVersion Include="Repobot.SQLite.Unofficial" Version="3.53.2" />
+        <PackageVersion Include="TaskScheduler" Version="2.12.2" />
+        <PackageVersion Include="WebDav.Client" Version="2.9.0" />
+        <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
+        <PackageVersion Include="xunit.v3" Version="3.2.2" />
+        <PackageVersion Include="YamlDotNet" Version="18.0.0" />
+        <PackageVersion Include="ZXing.Net.Bindings.SkiaSharp" Version="0.16.22" />
+        <PackageVersion Include="SkiaSharp.NativeAssets.Linux" Version="3.119.4" />
+    </ItemGroup>
+</Project>

v2rayN/ServiceLib.Tests/CoreConfig/Context/CoreConfigContextBuilderTests.cs

@@ -0,0 +1,114 @@
+using AwesomeAssertions;
+using ServiceLib.Enums;
+using ServiceLib.Handler.Builder;
+using ServiceLib.Helper;
+using ServiceLib.Models;
+using Xunit;
+
+namespace ServiceLib.Tests.CoreConfig.Context;
+
+public class CoreConfigContextBuilderTests
+{
+    [Fact]
+    public async Task ResolveNodeAsync_DirectCycleDependency_ShouldFailWithCycleError()
+    {
+        var config = CoreConfigTestFactory.CreateConfig();
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var groupAId = NewId("group-a");
+        var groupBId = NewId("group-b");
+        var groupA = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupAId, "group-a", [groupBId]);
+        var groupB = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupBId, "group-b", [groupAId]);
+
+        await UpsertProfilesAsync(groupA, groupB);
+
+        var context = CoreConfigTestFactory.CreateContext(config, groupA, ECoreType.Xray);
+        context.AllProxiesMap.Clear();
+
+        var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
+
+        validatorResult.Success.Should().BeFalse();
+        validatorResult.Errors.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+        context.AllProxiesMap.Should().NotContainKey(groupA.IndexId);
+        context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+    }
+
+    [Fact]
+    public async Task ResolveNodeAsync_IndirectCycleDependency_ShouldFailWithCycleError()
+    {
+        var config = CoreConfigTestFactory.CreateConfig();
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var groupAId = NewId("group-a");
+        var groupBId = NewId("group-b");
+        var groupCId = NewId("group-c");
+        var groupA = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupAId, "group-a", [groupBId]);
+        var groupB = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupBId, "group-b", [groupCId]);
+        var groupC = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupCId, "group-c", [groupAId]);
+
+        await UpsertProfilesAsync(groupA, groupB, groupC);
+
+        var context = CoreConfigTestFactory.CreateContext(config, groupA, ECoreType.Xray);
+        context.AllProxiesMap.Clear();
+
+        var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
+
+        validatorResult.Success.Should().BeFalse();
+        validatorResult.Errors.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+        context.AllProxiesMap.Should().NotContainKey(groupA.IndexId);
+        context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+        context.AllProxiesMap.Should().NotContainKey(groupC.IndexId);
+    }
+
+    [Fact]
+    public async Task ResolveNodeAsync_CycleWithValidBranch_ShouldSkipCycleAndKeepValidChild()
+    {
+        var config = CoreConfigTestFactory.CreateConfig();
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var groupAId = NewId("group-a");
+        var groupBId = NewId("group-b");
+        var leafId = NewId("leaf");
+        var groupA = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupAId, "group-a", [groupBId, leafId]);
+        var groupB = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, groupBId, "group-b", [groupAId]);
+        var leaf = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, leafId, "leaf");
+
+        await UpsertProfilesAsync(groupA, groupB, leaf);
+
+        var context = CoreConfigTestFactory.CreateContext(config, groupA, ECoreType.Xray);
+        context.AllProxiesMap.Clear();
+
+        var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
+
+        validatorResult.Success.Should().BeTrue();
+        validatorResult.Errors.Should().BeEmpty();
+        validatorResult.Warnings.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+
+        context.AllProxiesMap.Should().ContainKey(leaf.IndexId);
+        context.AllProxiesMap.Should().ContainKey(groupA.IndexId);
+        context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+        groupA.GetProtocolExtra().ChildItems.Should().Be(leaf.IndexId);
+    }
+
+    private static string NewId(string prefix)
+    {
+        return $"{prefix}-{Guid.NewGuid():N}";
+    }
+
+    private static bool ContainsCycleDependencyMessage(string message)
+    {
+        return message.Contains("cycle dependency", StringComparison.OrdinalIgnoreCase)
+               || message.Contains("循环依赖", StringComparison.Ordinal)
+               || message.Contains("循環依賴", StringComparison.Ordinal)
+               || message.Contains("циклическую зависимость", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static async Task UpsertProfilesAsync(params ProfileItem[] profiles)
+    {
+        SQLiteHelper.Instance.CreateTable<ProfileItem>();
+        foreach (var profile in profiles)
+        {
+            await SQLiteHelper.Instance.ReplaceAsync(profile);
+        }
+    }
+}

v2rayN/ServiceLib.Tests/CoreConfig/CoreConfigTestFactory.cs

@@ -0,0 +1,217 @@
+using System.Reflection;
+using ServiceLib.Enums;
+using ServiceLib.Manager;
+using ServiceLib.Models;
+
+namespace ServiceLib.Tests.CoreConfig;
+
+internal static class CoreConfigTestFactory
+{
+    public static void BindAppManagerConfig(Config config)
+    {
+        var field = typeof(AppManager).GetField("_config", BindingFlags.Instance | BindingFlags.NonPublic);
+        field?.SetValue(AppManager.Instance, config);
+    }
+
+    public static Config CreateConfig(ECoreType vmessCoreType = ECoreType.Xray)
+    {
+        return new Config
+        {
+            CoreBasicItem = new CoreBasicItem { Loglevel = "warning" },
+            TunModeItem = new TunModeItem { EnableTun = false, IcmpRouting = "default" },
+            KcpItem = new KcpItem(),
+            GrpcItem = new GrpcItem(),
+            RoutingBasicItem =
+                new RoutingBasicItem
+                {
+                    DomainStrategy = Global.AsIs,
+                    DomainStrategy4Singbox = string.Empty,
+                    RoutingIndexId = string.Empty,
+                },
+            GuiItem = new GUIItem { EnableStatistics = false, DisplayRealTimeSpeed = false, EnableLog = false },
+            MsgUIItem = new MsgUIItem(),
+            UiItem =
+                new UIItem
+                {
+                    CurrentLanguage = "en",
+                    CurrentFontFamily = "sans",
+                    MainColumnItem = [],
+                    WindowSizeItem = []
+                },
+            ConstItem = new ConstItem(),
+            SpeedTestItem = new SpeedTestItem
+            {
+                SpeedPingTestUrl = Global.SpeedPingTestUrls.First(),
+                SpeedTestUrl = Global.SpeedTestUrls.First(),
+                SpeedTestTimeout = 10,
+                MixedConcurrencyCount = 1,
+                IPAPIUrl = string.Empty,
+            },
+            Mux4RayItem = new Mux4RayItem { Concurrency = 8, XudpConcurrency = 16, XudpProxyUDP443 = "reject" },
+            Mux4SboxItem = new Mux4SboxItem { Protocol = Global.SingboxMuxs.First(), MaxConnections = 8 },
+            HysteriaItem = new HysteriaItem { UpMbps = 100, DownMbps = 100 },
+            ClashUIItem = new ClashUIItem { ConnectionsColumnItem = [] },
+            SystemProxyItem =
+                new SystemProxyItem
+                {
+                    SystemProxyExceptions = string.Empty,
+                    SystemProxyAdvancedProtocol = string.Empty
+                },
+            WebDavItem = new WebDavItem(),
+            CheckUpdateItem = new CheckUpdateItem(),
+            Fragment4RayItem = new Fragment4RayItem { Packets = "tlshello", Length = "100-200", Interval = "10-20" },
+            Inbound =
+            [
+                new InItem
+                {
+                    Protocol = nameof(EInboundProtocol.socks),
+                    LocalPort = 10808,
+                    UdpEnabled = true,
+                    SniffingEnabled = true,
+                    RouteOnly = false,
+                    DestOverride = ["http", "tls"],
+                }
+            ],
+            GlobalHotkeys = [],
+            CoreTypeItem =
+            [
+                new CoreTypeItem { ConfigType = EConfigType.VMess, CoreType = vmessCoreType }
+            ],
+            SimpleDNSItem = new SimpleDNSItem
+            {
+                BootstrapDNS = Global.DomainPureIPDNSAddress.FirstOrDefault(),
+                ServeStale = false,
+                ParallelQuery = false,
+                Strategy4Freedom = Global.AsIs,
+                Strategy4Proxy = Global.AsIs,
+            },
+            IndexId = string.Empty,
+            SubIndexId = string.Empty,
+        };
+    }
+
+    public static ProfileItem CreateVmessNode(ECoreType coreType, string indexId = "node-1", string remarks = "demo")
+    {
+        var node = new ProfileItem
+        {
+            IndexId = indexId,
+            ConfigType = EConfigType.VMess,
+            CoreType = coreType,
+            Remarks = remarks,
+            Address = "example.com",
+            Port = 443,
+            Password = Guid.NewGuid().ToString(),
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+            Subid = string.Empty,
+        };
+
+        node.SetProtocolExtra(node.GetProtocolExtra() with { AlterId = "0", VmessSecurity = Global.DefaultSecurity, });
+
+        return node;
+    }
+
+    public static ProfileItem CreateSocksNode(ECoreType coreType, string indexId = "node-socks-1",
+        string remarks = "demo-socks")
+    {
+        return new ProfileItem
+        {
+            IndexId = indexId,
+            ConfigType = EConfigType.SOCKS,
+            CoreType = coreType,
+            Remarks = remarks,
+            Address = "127.0.0.1",
+            Port = 1080,
+            Password = "pass",
+            Username = "user",
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+            Subid = string.Empty,
+        };
+    }
+
+    public static ProfileItem CreatePolicyGroupNode(ECoreType coreType, string indexId, string remarks,
+        IEnumerable<string> childIndexIds)
+    {
+        var node = new ProfileItem
+        {
+            IndexId = indexId,
+            ConfigType = EConfigType.PolicyGroup,
+            CoreType = coreType,
+            Remarks = remarks,
+        };
+        node.SetProtocolExtra(node.GetProtocolExtra() with
+        {
+            GroupType = nameof(EConfigType.PolicyGroup),
+            ChildItems = string.Join(",", childIndexIds),
+        });
+
+        return node;
+    }
+
+    public static ProfileItem CreateProxyChainNode(ECoreType coreType, string indexId, string remarks,
+        IEnumerable<string> childIndexIds)
+    {
+        var node = new ProfileItem
+        {
+            IndexId = indexId,
+            ConfigType = EConfigType.ProxyChain,
+            CoreType = coreType,
+            Remarks = remarks,
+        };
+        node.SetProtocolExtra(node.GetProtocolExtra() with
+        {
+            GroupType = nameof(EConfigType.ProxyChain),
+            ChildItems = string.Join(",", childIndexIds),
+        });
+
+        return node;
+    }
+
+    public static CoreConfigContext CreateContext(Config config, ProfileItem node, ECoreType runCoreType)
+    {
+        return new CoreConfigContext
+        {
+            Node = node,
+            RunCoreType = runCoreType,
+            AppConfig = config,
+            RoutingItem = new RoutingItem
+            {
+                Id = "r1",
+                Remarks = "default",
+                RuleSet = "[]",
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            },
+            RawDnsItem = null,
+            SimpleDnsItem = config.SimpleDNSItem,
+            AllProxiesMap = new Dictionary<string, ProfileItem> { [node.IndexId] = node },
+            FullConfigTemplate = null,
+            IsTunEnabled = config.TunModeItem.EnableTun,
+            ProtectDomainList = [],
+        };
+    }
+
+    public static Config CreateConfigWithDirectExpectedIPs(ECoreType coreType,
+        string directExpectedIPs = "192.168.0.0/16,geoip:cn")
+    {
+        var config = CreateConfig(coreType);
+        config.SimpleDNSItem.DirectExpectedIPs = directExpectedIPs;
+        return config;
+    }
+
+    public static Config CreateConfigWithBootstrapDNS(ECoreType coreType, string bootstrapDns = "8.8.8.8")
+    {
+        var config = CreateConfig(coreType);
+        config.SimpleDNSItem.BootstrapDNS = bootstrapDns;
+        return config;
+    }
+
+    public static Config CreateConfigWithTunRouteExcludeAddress(ECoreType coreType)
+    {
+        var config = CreateConfig(coreType);
+        config.TunModeItem.EnableTun = true;
+        config.TunModeItem.RouteExcludeAddress = ["10.0.0.1/32", "192.168.1.0/24", "fc00::/7"];
+        return config;
+    }
+}

v2rayN/ServiceLib.Tests/CoreConfig/Singbox/CoreConfigSingboxServiceTests.cs

@@ -0,0 +1,560 @@
+using AwesomeAssertions;
+using ServiceLib.Common;
+using ServiceLib.Enums;
+using ServiceLib.Manager;
+using ServiceLib.Models;
+using ServiceLib.Services.CoreConfig;
+using Xunit;
+
+namespace ServiceLib.Tests.CoreConfig.Singbox;
+
+public class CoreConfigSingboxServiceTests
+{
+    [Fact]
+    public void GenerateClientConfigContent_ShouldGenerateBasicProxyConfig()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box);
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        result.Data.Should().NotBeNull();
+
+        var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString());
+        singboxConfig.Should().NotBeNull();
+        singboxConfig!.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "socks");
+        singboxConfig.inbounds.Should().Contain(i => i.type == nameof(EInboundProtocol.mixed));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_TunWithLoopbackPreSocks_ShouldKeepMixedInbound()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box);
+        node.Address = Global.Loopback;
+        node.Port = 1080;
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            IsTunEnabled = true,
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.inbounds.Should().Contain(i =>
+            i.type == nameof(EInboundProtocol.mixed)
+            && i.listen == Global.Loopback
+            && i.listen_port == AppManager.Instance.GetLocalPort(EInboundProtocol.socks));
+        cfg.inbounds.Should().Contain(i => i.type == "tun");
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_BindInterface_ShouldUseDialBindInterface()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.CoreBasicItem.BindInterface = "eth0";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.sing_box);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            IsTunEnabled = true,
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var proxy = cfg.outbounds.First(o => o.tag == Global.ProxyTag);
+
+        proxy.bind_interface.Should().Be("eth0");
+        proxy.detour.Should().BeNullOrEmpty();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroup_ShouldExpandChildrenAndBuildSelector()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.sing_box, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChain_ShouldBuildDetourChain()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.sing_box, "c1", "chain",
+            [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "socks");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o =>
+            o.tag == Global.ProxyTag &&
+            (o.detour ?? string.Empty).StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroupWithProxyChain_ShouldBuildCombinedOutbounds()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n3", "node-3");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.sing_box, "c1", "chain",
+            [n1.IndexId, n2.IndexId]);
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.sing_box, "g1", "group",
+            [chain.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[chain.IndexId] = chain;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChainWithPolicyGroup_ShouldBuildClonedChainBranches()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n3", "node-3");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.sing_box, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.sing_box, "c1", "chain",
+            [group.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.sing_box);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[group.IndexId] = group;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-2-", StringComparison.Ordinal));
+
+        var proxyCloneCount = cfg.outbounds.Count(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal));
+        proxyCloneCount.Should().Be(2);
+
+        var allCloneDetoursPointToGroupBranches = cfg.outbounds
+            .Where(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal))
+            .All(o => (o.detour ?? string.Empty).StartsWith("chain-proxy-1-group-", StringComparison.Ordinal));
+        allCloneDetoursPointToGroupBranches.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_DirectAndBlock_ShouldApplyRules()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-1",
+                Remarks = "split-direct-block",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["full:direct.example.com"],
+                    },
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.BlockTag,
+                        Domain = ["full:block.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasDirectRule = cfg.route.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("direct.example.com")
+            && r.outbound == Global.DirectTag);
+        hasDirectRule.Should().BeTrue();
+
+        var hasBlockRule = cfg.route.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("block.example.com")
+            && r.action == "reject");
+        hasBlockRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_ByRemark_ShouldGenerateTargetOutbound()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var routeNode = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-route", "route-node");
+
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-2",
+                Remarks = "split-remark",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = routeNode.Remarks,
+                        Domain = ["full:route.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+        context.AllProxiesMap[$"remark:{routeNode.Remarks}"] = routeNode;
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var expectedPrefix = $"{routeNode.IndexId}-{Global.ProxyTag}-{routeNode.Remarks}";
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith(expectedPrefix, StringComparison.Ordinal));
+
+        var hasRouteRule = cfg.route.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("route.example.com")
+            && (r.outbound ?? string.Empty).StartsWith(expectedPrefix, StringComparison.Ordinal));
+        hasRouteRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_ShouldApplyGeoipAndCidrToDirectDnsRule()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(
+            ECoreType.sing_box,
+            "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-expected",
+                Remarks = "dns-direct-expected",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:cn"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasExpectedRule = cfg.dns.rules?.Any(r =>
+            r.server == Global.SingboxDirectDNSTag
+            && r.ip_cidr?.Contains("192.168.0.0/16") == true
+            && r.rule_set?.Contains("geosite-cn") == true
+            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
+
+        hasExpectedRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_BootstrapDNS_ShouldConfigurePureIPResolver()
+    {
+        var bootstrapDns = "8.8.8.8";
+        var config = CoreConfigTestFactory.CreateConfigWithBootstrapDNS(ECoreType.sing_box, bootstrapDns);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box);
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        config.SimpleDNSItem.BootstrapDNS.Should().Be(bootstrapDns);
+
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var bootstrapServer = cfg.dns.servers?.FirstOrDefault(s => s.tag == Global.SingboxLocalDNSTag);
+        bootstrapServer.Should().NotBeNull();
+        (bootstrapServer?.server ?? string.Empty).Should().Contain(bootstrapDns);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DnsFallback_LastRuleDirect_ShouldUseDirectFinalDns()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.SimpleDNSItem.DirectDNS = "1.1.1.1";
+        config.SimpleDNSItem.RemoteDNS = "9.9.9.9";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-direct-final",
+                Remarks = "direct-final",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Ip = ["0.0.0.0/0"],
+                        Port = "0-65535",
+                        Network = "tcp,udp",
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.dns.final.Should().Be(Global.SingboxDirectDNSTag);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_NonMatchingRegion_ShouldNotApplyExpectedRule()
+    {
+        var config =
+            CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.sing_box, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-unmatched",
+                Remarks = "dns-direct-unmatched",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:us"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasExpectedRule = cfg.dns.rules?.Any(r =>
+            r.server == Global.SingboxDirectDNSTag
+            && r.ip_cidr?.Contains("192.168.0.0/16") == true
+            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
+        hasExpectedRule.Should().BeFalse();
+    }
+
+    [Theory]
+    [InlineData("geosite:cn", "geosite-cn")]
+    [InlineData("geosite:geolocation-cn", "geosite-geolocation-cn")]
+    [InlineData("geosite:tld-cn", "geosite-tld-cn")]
+    public void GenerateClientConfigContent_DirectExpectedIPs_RegionVariant_ShouldApplyExpectedRule(string domainTag,
+        string expectedRuleSetTag)
+    {
+        var config =
+            CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.sing_box, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-variant",
+                Remarks = "dns-direct-variant",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true, RuleType = ERuleType.DNS, OutboundTag = Global.DirectTag, Domain = [domainTag],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hasExpectedRule = cfg.dns.rules?.Any(r =>
+            r.server == Global.SingboxDirectDNSTag
+            && r.ip_cidr?.Contains("192.168.0.0/16") == true
+            && r.rule_set?.Contains(expectedRuleSetTag) == true
+            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
+        hasExpectedRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_Hosts_ShouldPopulateHostsServerAndDomainResolver()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.SimpleDNSItem.Hosts = "resolver.example 1.1.1.1";
+        config.SimpleDNSItem.DirectDNS = "https://resolver.example/dns-query";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box);
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        var hostsServer = cfg.dns.servers.FirstOrDefault(s => s.tag == Global.SingboxHostsDNSTag);
+        hostsServer.Should().NotBeNull();
+        hostsServer!.predefined.Should().ContainKey("resolver.example");
+        hostsServer.predefined!["resolver.example"].Should().Contain("1.1.1.1");
+
+        var directServer = cfg.dns.servers.FirstOrDefault(s => s.tag == Global.SingboxDirectDNSTag);
+        directServer.Should().NotBeNull();
+        directServer!.domain_resolver.Should().Be(Global.SingboxHostsDNSTag);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RawDnsEnabled_ShouldUseCustomDnsAndInjectLocalResolver()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var rawDns = new Dns4Sbox
+        {
+            servers =
+            [
+                new Server4Sbox { tag = "remote", type = "udp", server = "8.8.8.8", detour = Global.ProxyTag, }
+            ],
+            rules = [],
+        };
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RawDnsItem = new DNSItem
+            {
+                Id = "dns-raw-1",
+                Remarks = "raw",
+                Enabled = true,
+                CoreType = ECoreType.sing_box,
+                NormalDNS = JsonUtils.Serialize(rawDns),
+                DomainDNSAddress = "1.1.1.1",
+            }
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        cfg.dns.servers.Should().Contain(s => s.tag == "remote" && s.type == "udp" && s.server == "8.8.8.8");
+        cfg.dns.servers.Should().Contain(s => s.tag == Global.SingboxLocalDNSTag);
+        cfg.dns.rules.Should().Contain(r => r.clash_mode == nameof(ERuleMode.Global));
+        cfg.dns.rules.Should().Contain(r => r.clash_mode == nameof(ERuleMode.Direct));
+    }
+}

v2rayN/ServiceLib.Tests/CoreConfig/V2ray/CoreConfigV2rayServiceTests.cs

@@ -0,0 +1,562 @@
+using AwesomeAssertions;
+using ServiceLib.Common;
+using ServiceLib.Enums;
+using ServiceLib.Models;
+using ServiceLib.Services.CoreConfig;
+using Xunit;
+
+namespace ServiceLib.Tests.CoreConfig.V2ray;
+
+public class CoreConfigV2rayServiceTests
+{
+    [Fact]
+    public void GenerateClientConfigContent_ShouldGenerateBasicProxyConfig()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        result.Data.Should().NotBeNull();
+
+        var v2rayConfig = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString());
+        v2rayConfig.Should().NotBeNull();
+        v2rayConfig!.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.protocol == "vmess");
+        v2rayConfig.inbounds.Should().Contain(i => i.protocol == nameof(EInboundProtocol.mixed));
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroup_ShouldExpandChildrenAndBuildBalancer()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+        cfg.routing.balancers.Should().NotBeNull();
+        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChain_ShouldBuildDialerProxyChain()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.Xray, "c1", "chain", [n1.IndexId, n2.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        var hasDialerChain = cfg.outbounds.Any(o =>
+            o.tag == Global.ProxyTag
+            && o.streamSettings is not null
+            && o.streamSettings.sockopt is not null
+            && (o.streamSettings.sockopt.dialerProxy ?? string.Empty).StartsWith("chain-proxy-1-",
+                StringComparison.Ordinal));
+        hasDialerChain.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_PolicyGroupWithProxyChain_ShouldBuildCombinedOutbounds()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n3", "node-3");
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.Xray, "c1", "chain", [n1.IndexId, n2.IndexId]);
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "g1", "group",
+            [chain.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, group, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[chain.IndexId] = chain;
+        context.AllProxiesMap[group.IndexId] = group;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+        cfg.routing.balancers.Should().NotBeNull();
+        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_ProxyChainWithPolicyGroup_ShouldBuildClonedChainBranches()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var n1 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n1", "node-1");
+        var n2 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n2", "node-2");
+        var n3 = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n3", "node-3");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "g1", "group",
+            [n1.IndexId, n2.IndexId]);
+        var chain = CoreConfigTestFactory.CreateProxyChainNode(ECoreType.Xray, "c1", "chain",
+            [group.IndexId, n3.IndexId]);
+
+        var context = CoreConfigTestFactory.CreateContext(config, chain, ECoreType.Xray);
+        context.AllProxiesMap[n1.IndexId] = n1;
+        context.AllProxiesMap[n2.IndexId] = n2;
+        context.AllProxiesMap[n3.IndexId] = n3;
+        context.AllProxiesMap[group.IndexId] = group;
+        context.AllProxiesMap[chain.IndexId] = chain;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-1-", StringComparison.Ordinal));
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-2-", StringComparison.Ordinal));
+
+        var proxyCloneCount = cfg.outbounds.Count(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal));
+        proxyCloneCount.Should().Be(2);
+
+        var allCloneDialersPointToGroupBranches = cfg.outbounds
+            .Where(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal))
+            .All(o => (o.streamSettings?.sockopt?.dialerProxy ?? string.Empty).StartsWith("chain-proxy-1-group-",
+                StringComparison.Ordinal));
+        allCloneDialersPointToGroupBranches.Should().BeTrue();
+
+        cfg.routing.balancers.Should().NotBeNull();
+        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_DirectAndBlock_ShouldApplyRules()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-1",
+                Remarks = "split-direct-block",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["full:direct.example.com"],
+                    },
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.BlockTag,
+                        Domain = ["full:block.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+
+        var hasDirectRule = cfg.routing.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("full:direct.example.com")
+            && r.outboundTag == Global.DirectTag);
+        hasDirectRule.Should().BeTrue();
+
+        var hasBlockRule = cfg.routing.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("full:block.example.com")
+            && r.outboundTag == Global.BlockTag);
+        hasBlockRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RoutingSplit_ByRemark_ShouldGenerateTargetOutbound()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var routeNode = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "n-route", "route-node");
+
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-split-2",
+                Remarks = "split-remark",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = routeNode.Remarks,
+                        Domain = ["full:route.example.com"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+        context.AllProxiesMap[$"remark:{routeNode.Remarks}"] = routeNode;
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var expectedPrefix = $"{routeNode.IndexId}-{Global.ProxyTag}-{routeNode.Remarks}";
+
+        cfg.outbounds.Should().Contain(o => o.tag.StartsWith(expectedPrefix, StringComparison.Ordinal));
+        var hasRouteRule = cfg.routing.rules.Any(r =>
+            r.domain != null
+            && r.domain.Contains("full:route.example.com")
+            && (r.outboundTag ?? string.Empty).StartsWith(expectedPrefix, StringComparison.Ordinal));
+        hasRouteRule.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_ShouldApplyExpectedIPsToDirectDnsServer()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-expected",
+                Remarks = "dns-direct-expected",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:cn"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasExpectedServer = dnsServers.Any(s =>
+            (s.tag ?? string.Empty).StartsWith(Global.DirectDnsTag, StringComparison.Ordinal)
+            && s.domains?.Contains("geosite:cn") == true
+            && s.expectedIPs?.Contains("192.168.0.0/16") == true
+            && s.expectedIPs?.Contains("geoip:cn") == true);
+        hasExpectedServer.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_BootstrapDNS_ShouldApplyToDnsServerDomains()
+    {
+        var bootstrapDns = "8.8.8.8";
+        var config = CoreConfigTestFactory.CreateConfigWithBootstrapDNS(ECoreType.Xray, bootstrapDns);
+        config.SimpleDNSItem.DirectDNS = "https://dns-direct.example/dns-query";
+        config.SimpleDNSItem.RemoteDNS = "https://dns-remote.example/dns-query";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasBootstrapServer = dnsServers.Any(s =>
+            s.address == bootstrapDns
+            && s.domains?.Contains("full:dns-direct.example") == true
+            && s.domains?.Contains("full:dns-remote.example") == true);
+        hasBootstrapServer.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DnsFallback_LastRuleDirect_ShouldUseDirectDnsServers()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        config.SimpleDNSItem.DirectDNS = "1.1.1.1";
+        config.SimpleDNSItem.RemoteDNS = "9.9.9.9";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-direct-final",
+                Remarks = "direct-final",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.Routing,
+                        OutboundTag = Global.DirectTag,
+                        Ip = ["0.0.0.0/0"],
+                        Port = "0-65535",
+                        Network = "tcp,udp",
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasDirectFallback = dnsServers.Any(s =>
+            (s.tag ?? string.Empty).StartsWith(Global.DirectDnsTag, StringComparison.Ordinal)
+            && s.address == "1.1.1.1");
+        hasDirectFallback.Should().BeTrue();
+
+        var hasRemoteFallback = dnsServers.Any(s => s.address == "9.9.9.9");
+        hasRemoteFallback.Should().BeFalse();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_DirectExpectedIPs_NonMatchingRegion_ShouldNotApplyExpectedIPs()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-unmatched",
+                Remarks = "dns-direct-unmatched",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:us"],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasExpectedIPs = dnsServers.Any(s =>
+            s.expectedIPs?.Contains("192.168.0.0/16") == true
+            || s.expectedIPs?.Contains("geoip:cn") == true);
+        hasExpectedIPs.Should().BeFalse();
+    }
+
+    [Theory]
+    [InlineData("geosite:cn")]
+    [InlineData("geosite:geolocation-cn")]
+    [InlineData("geosite:tld-cn")]
+    public void GenerateClientConfigContent_DirectExpectedIPs_RegionVariant_ShouldApplyExpectedIPs(string domainTag)
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-variant",
+                Remarks = "dns-direct-variant",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true, RuleType = ERuleType.DNS, OutboundTag = Global.DirectTag, Domain = [domainTag],
+                    }
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+        var dnsServers = dns.servers
+            .Select(s => JsonUtils.Deserialize<DnsServer4Ray>(JsonUtils.Serialize(s)))
+            .Where(s => s is not null)
+            .Cast<DnsServer4Ray>()
+            .ToList();
+
+        var hasExpectedServer = dnsServers.Any(s =>
+            (s.tag ?? string.Empty).StartsWith(Global.DirectDnsTag, StringComparison.Ordinal)
+            && s.domains?.Contains(domainTag) == true
+            && s.expectedIPs?.Contains("192.168.0.0/16") == true
+            && s.expectedIPs?.Contains("geoip:cn") == true);
+        hasExpectedServer.Should().BeTrue();
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_Hosts_ShouldPopulateDnsHosts()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        config.SimpleDNSItem.Hosts = "resolver.example 1.1.1.1";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        dns.hosts.Should().NotBeNull();
+        dns.hosts!.Should().ContainKey("resolver.example");
+        JsonUtils.Serialize(dns.hosts!["resolver.example"]).Should().Contain("1.1.1.1");
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_RawDnsEnabled_ShouldUseCustomDnsConfig()
+    {
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray) with
+        {
+            RawDnsItem = new DNSItem
+            {
+                Id = "dns-raw-1",
+                Remarks = "raw",
+                Enabled = true,
+                CoreType = ECoreType.Xray,
+                NormalDNS = "{\"servers\":[\"8.8.8.8\"],\"hosts\":{\"raw.example\":\"1.1.1.1\"}}",
+                DomainStrategy4Freedom = "UseIPv4",
+            }
+        };
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
+
+        JsonUtils.Serialize(dns.servers).Should().Contain("8.8.8.8");
+        dns.hosts.Should().NotBeNull();
+        dns.hosts!.Should().ContainKey("raw.example");
+        JsonUtils.Serialize(dns.hosts!["raw.example"]).Should().Contain("1.1.1.1");
+
+        var directOutbound = cfg.outbounds.FirstOrDefault(o => o.tag == Global.DirectTag && o.protocol == "freedom");
+        directOutbound.Should().NotBeNull();
+        directOutbound!.settings.domainStrategy.Should().Be("UseIPv4");
+    }
+
+    [Fact]
+    public void GenerateClientConfigContent_TunRouteExcludeAddress()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithTunRouteExcludeAddress(ECoreType.Xray);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue();
+
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var tunInbound = cfg.inbounds.FirstOrDefault(i => i.protocol == "tun");
+
+        tunInbound.Should().NotBeNull();
+
+        tunInbound!.settings.autoSystemRoutingTable.Should().NotContain("0.0.0.0/0");
+        tunInbound!.settings.autoSystemRoutingTable.Should().Contain("10.0.0.0/32");
+        tunInbound!.settings.autoSystemRoutingTable.Should().Contain("10.0.0.2/31");
+    }
+}

v2rayN/ServiceLib.Tests/Fmt/FmtHandlerTests.cs

@@ -0,0 +1,173 @@
+using AwesomeAssertions;
+using ServiceLib.Enums;
+using ServiceLib.Handler.Fmt;
+using ServiceLib.Models;
+using Xunit;
+
+namespace ServiceLib.Tests.Fmt;
+
+public class FmtHandlerTests
+{
+    [Fact]
+    public void GetShareUriAndResolveConfig_Vmess_ShouldRoundTripBasicFields()
+    {
+        var source = CreateVmessProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.VMess);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Password.Should().Be(source.Password);
+        resolved.GetProtocolExtra().AlterId.Should().Be(source.GetProtocolExtra().AlterId);
+    }
+
+    [Fact]
+    public void GetShareUriAndResolveConfig_Vless_ShouldRoundTripBasicFields()
+    {
+        var source = CreateVlessProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.VLESS);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Password.Should().Be(source.Password);
+        resolved.GetProtocolExtra().VlessEncryption.Should().Be(Global.None);
+    }
+
+    [Fact]
+    public void GetShareUriAndResolveConfig_Shadowsocks_ShouldRoundTripBasicFields()
+    {
+        var source = CreateShadowsocksProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.Shadowsocks);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Password.Should().Be(source.Password);
+        resolved.GetProtocolExtra().SsMethod.Should().Be(source.GetProtocolExtra().SsMethod);
+    }
+
+    [Fact]
+    public void GetShareUriAndResolveConfig_Socks_ShouldRoundTripBasicFields()
+    {
+        var source = CreateSocksProfile();
+
+        var resolved = ExportThenImport(source);
+
+        resolved.ConfigType.Should().Be(EConfigType.SOCKS);
+        resolved.Remarks.Should().Be(source.Remarks);
+        resolved.Address.Should().Be(source.Address);
+        resolved.Port.Should().Be(source.Port);
+        resolved.Username.Should().Be(source.Username);
+        resolved.Password.Should().Be(source.Password);
+    }
+
+    [Fact]
+    public void ResolveConfig_UnsupportedProtocol_ShouldReturnNull()
+    {
+        var resolved = FmtHandler.ResolveConfig("not-a-share-uri", out var msg);
+
+        resolved.Should().BeNull();
+        msg.Should().NotBeNullOrWhiteSpace();
+    }
+
+    [Fact]
+    public void GetShareUri_UnsupportedConfigType_ShouldReturnNull()
+    {
+        var item = new ProfileItem { ConfigType = EConfigType.PolicyGroup, Remarks = "group", };
+
+        var uri = FmtHandler.GetShareUri(item);
+
+        uri.Should().BeNull();
+    }
+
+    private static ProfileItem ExportThenImport(ProfileItem source)
+    {
+        var uri = FmtHandler.GetShareUri(source);
+
+        uri.Should().NotBeNullOrWhiteSpace();
+        uri!.StartsWith(Global.ProtocolShares[source.ConfigType], StringComparison.OrdinalIgnoreCase).Should()
+            .BeTrue();
+
+        var resolved = FmtHandler.ResolveConfig(uri, out var msg);
+
+        resolved.Should().NotBeNull($"uri: {uri}, msg: {msg}");
+        return resolved!;
+    }
+
+    private static ProfileItem CreateVmessProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.VMess,
+            Remarks = "vmess demo",
+            Address = "example.com",
+            Port = 443,
+            Password = Guid.NewGuid().ToString(),
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { AlterId = "0", VmessSecurity = Global.DefaultSecurity, });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateVlessProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.VLESS,
+            Remarks = "vless demo",
+            Address = "vless.example",
+            Port = 8443,
+            Password = Guid.NewGuid().ToString(),
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { VlessEncryption = Global.None, });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateShadowsocksProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.Shadowsocks,
+            Remarks = "ss demo",
+            Address = "1.2.3.4",
+            Port = 8388,
+            Password = "pass123",
+            Network = nameof(ETransport.raw),
+            StreamSecurity = string.Empty,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { SsMethod = "aes-128-gcm", });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateSocksProfile()
+    {
+        return new ProfileItem
+        {
+            ConfigType = EConfigType.SOCKS,
+            Remarks = "socks demo",
+            Address = "127.0.0.1",
+            Port = 1080,
+            Username = "user",
+            Password = "pass",
+        };
+    }
+}

v2rayN/ServiceLib.Tests/Fmt/InnerFmtTests.cs

@@ -0,0 +1,37 @@
+using AwesomeAssertions;
+using ServiceLib.Enums;
+using ServiceLib.Handler.Fmt;
+using ServiceLib.Tests.CoreConfig;
+using Xunit;
+
+namespace ServiceLib.Tests.Fmt;
+
+public class InnerFmtTests
+{
+    [Fact]
+    public void ToUriAndResolve_ShouldRoundTripPolicyGroupReferences()
+    {
+        var childA = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "child-a", "child-a");
+        var childB = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "child-b", "child-b");
+        var group = CoreConfigTestFactory.CreatePolicyGroupNode(ECoreType.Xray, "group-1", "group-1",
+            [childA.IndexId, childB.IndexId]);
+        group.SetProtocolExtra(group.GetProtocolExtra() with { SubChildItems = "original-sub" });
+
+        var uri = InnerFmt.ToUri([group, childA, childB]);
+
+        uri.Should().NotBeNullOrWhiteSpace();
+
+        var resolved = InnerFmt.Resolve(uri!, "sub-123");
+
+        resolved.Should().NotBeNull();
+        resolved.Should().HaveCount(3);
+
+        var resolvedGroup = resolved!.Single(x => x.Remarks == group.Remarks);
+        var resolvedChildA = resolved.Single(x => x.Remarks == childA.Remarks);
+        var resolvedChildB = resolved.Single(x => x.Remarks == childB.Remarks);
+
+        resolvedGroup.ConfigType.Should().Be(EConfigType.PolicyGroup);
+        resolvedGroup.GetProtocolExtra().SubChildItems.Should().Be("sub-123");
+        resolvedGroup.GetProtocolExtra().ChildItems.Should().Be($"{resolvedChildA.IndexId},{resolvedChildB.IndexId}");
+    }
+}

v2rayN/ServiceLib.Tests/Fmt/WireguardFmtTests.cs

@@ -0,0 +1,47 @@
+using AwesomeAssertions;
+using ServiceLib.Handler.Fmt;
+using Xunit;
+
+namespace ServiceLib.Tests.Fmt;
+
+public class WireguardFmtTests
+{
+    [Fact]
+    public void ResolveConfig_ShouldParsePeersAndIgnoreInlineComments()
+    {
+        const string config =
+            """
+            [Interface]
+            PrivateKey = interface-private-key
+            Address = 10.0.0.2/32, fd00::2/128 ; inline comment
+            MTU = 1420
+
+            [Peer]
+            PublicKey = peer-public-key
+            PresharedKey = peer-preshared-key
+            Reserved = 1, 2, 3 # inline comment
+            Endpoint = [2001:db8::1]:51820 # inline comment
+
+            [Peer]
+            PublicKey = peer-public-key-2
+            Endpoint = example.com:12345
+            """;
+
+        var resolved = WireguardFmt.ResolveConfig(config);
+
+        resolved.Should().NotBeNull();
+        resolved.Should().HaveCount(2);
+
+        var first = resolved![0];
+        first.Address.Should().Be("2001:db8::1");
+        first.Port.Should().Be(51820);
+        first.Password.Should().Be("interface-private-key");
+        first.GetProtocolExtra().WgReserved.Should().Be("1, 2, 3");
+        first.GetProtocolExtra().WgInterfaceAddress.Should().Be("10.0.0.2/32, fd00::2/128");
+        first.GetProtocolExtra().WgMtu.Should().Be(1420);
+
+        var second = resolved[1];
+        second.Address.Should().Be("example.com");
+        second.Port.Should().Be(12345);
+    }
+}

v2rayN/ServiceLib.Tests/GlobalUsings.cs

@@ -0,0 +1,40 @@
+global using System.Collections.Concurrent;
+global using System.Diagnostics;
+global using System.Net;
+global using System.Net.NetworkInformation;
+global using System.Net.Sockets;
+global using System.Reactive;
+global using System.Reactive.Disposables;
+global using System.Reactive.Linq;
+global using System.Reflection;
+global using System.Runtime.InteropServices;
+global using System.Security.Cryptography;
+global using System.Text;
+global using System.Text.Encodings.Web;
+global using System.Text.Json;
+global using System.Text.Json.Nodes;
+global using System.Text.Json.Serialization;
+global using System.Text.RegularExpressions;
+global using DynamicData;
+global using DynamicData.Binding;
+global using ReactiveUI;
+global using ReactiveUI.Fody.Helpers;
+global using ServiceLib.Base;
+global using ServiceLib.Common;
+global using ServiceLib.Enums;
+global using ServiceLib.Events;
+global using ServiceLib.Handler;
+global using ServiceLib.Handler.Builder;
+global using ServiceLib.Handler.Fmt;
+global using ServiceLib.Handler.SysProxy;
+global using ServiceLib.Helper;
+global using ServiceLib.Manager;
+global using ServiceLib.Models.CoreConfigs;
+global using ServiceLib.Models.Configs;
+global using ServiceLib.Models.Dto;
+global using ServiceLib.Models.Entities;
+global using ServiceLib.Resx;
+global using ServiceLib.Services;
+global using ServiceLib.Services.CoreConfig;
+global using ServiceLib.Services.Statistics;
+global using SQLite;

v2rayN/ServiceLib.Tests/ServiceLib.Tests.csproj

@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="AwesomeAssertions" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="xunit.runner.visualstudio">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+    <PackageReference Include="xunit.v3" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\ServiceLib\ServiceLib.csproj" />
+  </ItemGroup>
+
+</Project>

v2rayN/ServiceLib.UdpTest/GlobalUsings.cs

@@ -0,0 +1,5 @@
+global using System.Buffers.Binary;
+global using System.Diagnostics;
+global using System.Net;
+global using System.Net.Sockets;
+global using System.Text;

v2rayN/ServiceLib.UdpTest/ServiceLib.UdpTest.csproj

@@ -0,0 +1,7 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+      <OutputType>Library</OutputType>
+  </PropertyGroup>
+
+</Project>

v2rayN/ServiceLib.UdpTest/Socks5UdpChannel.cs

@@ -0,0 +1,420 @@
+namespace ServiceLib.UdpTest;
+
+public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposable
+{
+    private TcpClient _tcpClient;
+    private UdpClient _udpClient;
+    private IPEndPoint _relayEndPoint;
+
+    private bool _initialized = false;
+
+    /// <summary>
+    /// Send UDP data to a remote endpoint (IP address)
+    /// </summary>
+    public async Task SendAsync(IPEndPoint remote, byte[] data)
+    {
+        var addrData = new Socks5AddressData
+        {
+            AddressType = remote.Address.AddressFamily == AddressFamily.InterNetwork
+                ? Socks5AddressData.AddrTypeIPv4
+                : Socks5AddressData.AddrTypeIPv6,
+            Host = remote.Address.ToString(),
+            Port = (ushort)remote.Port
+        };
+        var packet = BuildSocks5UdpPacket(addrData, data);
+        await _udpClient.SendAsync(packet, packet.Length, _relayEndPoint);
+    }
+
+    /// <summary>
+    /// Send UDP data to a remote endpoint (domain name or IP address)
+    /// </summary>
+    /// <param name="host">Domain name or IP address</param>
+    /// <param name="port">Port number</param>
+    /// <param name="data">Data to send</param>
+    public async Task SendAsync(string host, ushort port, byte[] data)
+    {
+        var addrData = new Socks5AddressData();
+
+        // Try to parse as IP address first
+        if (IPAddress.TryParse(host, out var ipAddr))
+        {
+            addrData.AddressType = ipAddr.AddressFamily == AddressFamily.InterNetwork
+                ? Socks5AddressData.AddrTypeIPv4
+                : Socks5AddressData.AddrTypeIPv6;
+            addrData.Host = ipAddr.ToString();
+        }
+        else
+        {
+            // Treat as domain name
+            addrData.AddressType = Socks5AddressData.AddrTypeDomain;
+            addrData.Host = host;
+        }
+
+        addrData.Port = port;
+
+        var packet = BuildSocks5UdpPacket(addrData, data);
+        await _udpClient.SendAsync(packet, packet.Length, _relayEndPoint);
+    }
+
+    /// <summary>
+    /// Receive UDP data from remote endpoint
+    /// </summary>
+    /// <param name="cancellationToken">Cancellation token to cancel the receive operation</param>
+    /// <returns>Remote endpoint information and received data</returns>
+    public async Task<(Socks5RemoteEndpoint Remote, byte[] Data)> ReceiveAsync(
+        CancellationToken cancellationToken = default)
+    {
+        var result = await _udpClient.ReceiveAsync(cancellationToken).ConfigureAwait(false);
+        var (remote, payload) = ParseSocks5UdpPacket(result.Buffer);
+        return (remote, payload);
+    }
+
+    /// <summary>
+    /// Represents a remote endpoint that can be either an IP address or a domain name
+    /// </summary>
+    public class Socks5RemoteEndpoint(string host, ushort port, bool isDomain)
+    {
+        public string Host { get; set; } = host;
+        public ushort Port { get; set; } = port;
+        public bool IsDomain { get; set; } = isDomain;
+    }
+
+    private static byte[] BuildSocks5UdpPacket(Socks5AddressData addressData, byte[] data)
+    {
+        using var ms = new MemoryStream();
+
+        // RSV (2 bytes) + FRAG (1 byte) - Reserved and Fragment fields
+        ms.WriteByte(0x00);
+        ms.WriteByte(0x00);
+        ms.WriteByte(0x00);
+
+        // Write address (ATYP + address + port)
+        ms.Write(addressData.ToBytes());
+
+        // User data payload
+        ms.Write(data);
+
+        return ms.ToArray();
+    }
+
+    private static (Socks5RemoteEndpoint Remote, byte[] Data) ParseSocks5UdpPacket(byte[] packet)
+    {
+        if (packet.Length < 10) // Minimum length: RSV(2) + FRAG(1) + ATYP(1) + IPv4(4) + Port(2) = 10
+        {
+            throw new ArgumentException("Invalid SOCKS5 UDP packet: too short");
+        }
+
+        var offset = 0;
+
+        // RSV (2 bytes) - Reserved field, skip
+        offset += 2;
+
+        // FRAG (1 byte) - Fragment number, currently only support 0 (no fragmentation)
+        var frag = packet[offset++];
+        if (frag != 0x00)
+        {
+            throw new NotSupportedException("SOCKS5 UDP fragmentation is not supported");
+        }
+
+        // ATYP (1 byte) - Address type
+        var addressType = packet[offset++];
+
+        string host;
+        int addressLength;
+        bool isDomain;
+
+        switch (addressType)
+        {
+            case Socks5AddressData.AddrTypeIPv4:
+                if (packet.Length < offset + 4)
+                {
+                    throw new ArgumentException("Invalid SOCKS5 UDP packet: IPv4 address incomplete");
+                }
+
+                var ipv4Bytes = new byte[4];
+                Array.Copy(packet, offset, ipv4Bytes, 0, 4);
+                host = new IPAddress(ipv4Bytes).ToString();
+                addressLength = 4;
+                isDomain = false;
+                break;
+
+            case Socks5AddressData.AddrTypeIPv6:
+                if (packet.Length < offset + 16)
+                {
+                    throw new ArgumentException("Invalid SOCKS5 UDP packet: IPv6 address incomplete");
+                }
+
+                var ipv6Bytes = new byte[16];
+                Array.Copy(packet, offset, ipv6Bytes, 0, 16);
+                host = new IPAddress(ipv6Bytes).ToString();
+                addressLength = 16;
+                isDomain = false;
+                break;
+
+            case Socks5AddressData.AddrTypeDomain:
+                if (packet.Length < offset + 1)
+                {
+                    throw new ArgumentException("Invalid SOCKS5 UDP packet: domain length missing");
+                }
+
+                var domainLength = packet[offset++];
+                if (packet.Length < offset + domainLength)
+                {
+                    throw new ArgumentException("Invalid SOCKS5 UDP packet: domain incomplete");
+                }
+
+                host = Encoding.ASCII.GetString(packet, offset, domainLength);
+                addressLength = domainLength;
+                isDomain = true;
+                break;
+
+            default:
+                throw new NotSupportedException($"Unsupported SOCKS5 address type: {addressType}");
+        }
+
+        offset += addressLength;
+
+        // Port (2 bytes, big-endian)
+        if (packet.Length < offset + 2)
+        {
+            throw new ArgumentException("Invalid SOCKS5 UDP packet: port incomplete");
+        }
+
+        var port = BinaryPrimitives.ReadUInt16BigEndian(packet.AsSpan(offset, 2));
+        offset += 2;
+
+        // Data (remaining bytes)
+        var dataLength = packet.Length - offset;
+        var data = new byte[dataLength];
+        if (dataLength > 0)
+        {
+            Array.Copy(packet, offset, data, 0, dataLength);
+        }
+
+        // Create remote endpoint without DNS resolution
+        var remote = new Socks5RemoteEndpoint(host, port, isDomain);
+        return (remote, data);
+    }
+
+    public void Dispose()
+    {
+        _tcpClient.Dispose();
+        _udpClient.Dispose();
+    }
+
+    #region SOCKS5 Connection Handling
+
+    private const byte Socks5Version = 0x05;
+    private const byte SocksCmdUdpAssociate = 0x03;
+
+    public async Task<bool> EstablishUdpAssociationAsync(CancellationToken cancellationToken)
+    {
+        if (_initialized)
+        {
+            Dispose();
+            _initialized = false;
+        }
+
+        _udpClient = new UdpClient(new IPEndPoint(IPAddress.Any, 0));
+        _tcpClient = new TcpClient();
+        try
+        {
+            await _tcpClient.ConnectAsync(socks5Host, socks5TcpPort, cancellationToken).ConfigureAwait(false);
+        }
+        catch (SocketException)
+        {
+            return false;
+        }
+
+        var tcpControlStream = _tcpClient.GetStream();
+
+        byte[] handshakeRequest = [Socks5Version, 0x01, 0x00];
+        await tcpControlStream.WriteAsync(handshakeRequest, cancellationToken).ConfigureAwait(false);
+        var handshakeResponse = new byte[2];
+        if (await tcpControlStream.ReadAsync(handshakeResponse, cancellationToken).ConfigureAwait(false) < 2 ||
+            handshakeResponse[0] != Socks5Version || handshakeResponse[1] != 0x00)
+        {
+            return false;
+        }
+
+        var clientAddrForSocks = new Socks5AddressData
+        {
+            AddressType = Socks5AddressData.AddrTypeIPv4,
+            Host = "0.0.0.0",
+            Port = 0
+        };
+        using var udpAssociateReqMs = new MemoryStream();
+        udpAssociateReqMs.WriteByte(Socks5Version);
+        udpAssociateReqMs.WriteByte(SocksCmdUdpAssociate);
+        udpAssociateReqMs.WriteByte(0x00);
+        udpAssociateReqMs.Write(clientAddrForSocks.ToBytes());
+        await tcpControlStream.WriteAsync(udpAssociateReqMs.ToArray(), cancellationToken).ConfigureAwait(false);
+
+        var verRepRsv = new byte[3];
+        if (await tcpControlStream.ReadAsync(verRepRsv, cancellationToken).ConfigureAwait(false) < 3 ||
+            verRepRsv[0] != Socks5Version || verRepRsv[1] != 0x00)
+        {
+            return false;
+        }
+
+        var proxyRelaySocksAddr =
+            await Socks5AddressData.ParseAsync(tcpControlStream, cancellationToken).ConfigureAwait(false);
+        if (proxyRelaySocksAddr == null || !IPAddress.TryParse(proxyRelaySocksAddr.Host, out var proxyRelayIp))
+        {
+            return false;
+        }
+
+        _relayEndPoint = new IPEndPoint(proxyRelayIp, proxyRelaySocksAddr.Port);
+        _initialized = true;
+        return true;
+    }
+
+    #endregion SOCKS5 Connection Handling
+
+    #region SOCKS5 Address Handling
+
+    private class Socks5AddressData
+    {
+        public const byte AddrTypeIPv4 = 0x01;
+        public const byte AddrTypeDomain = 0x03;
+        public const byte AddrTypeIPv6 = 0x04;
+
+        public byte AddressType { get; set; }
+        public string Host { get; set; } = string.Empty;
+        public ushort Port { get; set; }
+
+        public byte[] ToBytes()
+        {
+            using var ms = new MemoryStream();
+            ms.WriteByte(AddressType);
+            switch (AddressType)
+            {
+                case AddrTypeIPv4:
+                    if (IPAddress.TryParse(Host, out var ip) && ip.AddressFamily == AddressFamily.InterNetwork)
+                    {
+                        ms.Write(ip.GetAddressBytes(), 0, 4);
+                    }
+                    else
+                    {
+                        ms.Write([0, 0, 0, 0]);
+                    }
+
+                    break;
+
+                case AddrTypeDomain:
+                    if (string.IsNullOrEmpty(Host))
+                    {
+                        ms.WriteByte(0);
+                    }
+                    else
+                    {
+                        var domainBytes = Encoding.ASCII.GetBytes(Host);
+                        ms.WriteByte((byte)domainBytes.Length);
+                        ms.Write(domainBytes);
+                    }
+
+                    break;
+
+                case AddrTypeIPv6:
+                    if (IPAddress.TryParse(Host, out var ip6) && ip6.AddressFamily == AddressFamily.InterNetworkV6)
+                    {
+                        ms.Write(ip6.GetAddressBytes(), 0, 16);
+                    }
+                    else
+                    {
+                        ms.Write(new byte[16]);
+                    }
+
+                    break;
+
+                default:
+                    throw new NotSupportedException($"SOCKS5 address type {AddressType} not supported.");
+            }
+
+            var portBytes = new byte[2];
+            BinaryPrimitives.WriteUInt16BigEndian(portBytes, Port);
+            ms.Write(portBytes);
+            return ms.ToArray();
+        }
+
+        public static async Task<Socks5AddressData?> ParseAsync(Stream stream, CancellationToken ct)
+        {
+            var addr = new Socks5AddressData();
+            var typeByte = new byte[1];
+            try
+            {
+                if (await stream.ReadAsync(typeByte.AsMemory(0, 1), ct).ConfigureAwait(false) < 1)
+                {
+                    return null;
+                }
+
+                addr.AddressType = typeByte[0];
+                switch (addr.AddressType)
+                {
+                    case AddrTypeIPv4:
+                        var ipv4Bytes = new byte[4];
+                        if (await stream.ReadAsync(ipv4Bytes.AsMemory(0, 4), ct).ConfigureAwait(false) < 4)
+                        {
+                            return null;
+                        }
+
+                        addr.Host = new IPAddress(ipv4Bytes).ToString();
+                        break;
+
+                    case AddrTypeDomain:
+                        var lenByte = new byte[1];
+                        if (await stream.ReadAsync(lenByte.AsMemory(0, 1), ct).ConfigureAwait(false) < 1)
+                        {
+                            return null;
+                        }
+
+                        if (lenByte[0] == 0)
+                        {
+                            addr.Host = string.Empty;
+                        }
+                        else
+                        {
+                            var domainBytes = new byte[lenByte[0]];
+                            if (await stream.ReadAsync(domainBytes.AsMemory(0, domainBytes.Length), ct)
+                                    .ConfigureAwait(false) < domainBytes.Length)
+                            {
+                                return null;
+                            }
+
+                            addr.Host = Encoding.ASCII.GetString(domainBytes);
+                        }
+
+                        break;
+
+                    case AddrTypeIPv6:
+                        var ipv6Bytes = new byte[16];
+                        if (await stream.ReadAsync(ipv6Bytes.AsMemory(0, 16), ct).ConfigureAwait(false) < 16)
+                        {
+                            return null;
+                        }
+
+                        addr.Host = new IPAddress(ipv6Bytes).ToString();
+                        break;
+
+                    default:
+                        return null;
+                }
+
+                var portBytes = new byte[2];
+                if (await stream.ReadAsync(portBytes.AsMemory(0, 2), ct).ConfigureAwait(false) < 2)
+                {
+                    return null;
+                }
+
+                addr.Port = BinaryPrimitives.ReadUInt16BigEndian(portBytes);
+                return addr;
+            }
+            catch (Exception ex) when (ex is IOException or ObjectDisposedException)
+            {
+                return null;
+            }
+        }
+    }
+
+    #endregion SOCKS5 Address Handling
+}

v2rayN/ServiceLib.UdpTest/Tester/DnsService.cs

@@ -0,0 +1,77 @@
+namespace ServiceLib.UdpTest.Tester;
+
+public class DnsService : IUdpTest
+{
+    private const int DnsDefaultPort = 53;
+    private const string DnsDefaultServer = "8.8.8.8"; // Google Public DNS
+
+    private static readonly byte[] DnsQueryPacket =
+    [
+        // Header: ID=0x1234, Standard query with RD set, QDCOUNT=1
+        0x12, 0x34, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00,
+        // Question: www.google.com, Type A, Class IN
+        0x03, 0x77, 0x77, 0x77, 0x06, 0x67, 0x6F, 0x6F,
+        0x67, 0x6C, 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
+        0x00, 0x01, 0x00, 0x01
+    ];
+
+    public byte[] BuildUdpRequestPacket()
+    {
+        return (byte[])DnsQueryPacket.Clone();
+    }
+
+    public bool VerifyAndExtractUdpResponse(byte[] dnsResponseBytes)
+    {
+        if (dnsResponseBytes.Length < 12)
+        {
+            return false;
+        }
+
+        try
+        {
+            // Check transaction ID (should match 0x1234)
+            var transactionId = BinaryPrimitives.ReadUInt16BigEndian(dnsResponseBytes.AsSpan(0, 2));
+            if (transactionId != 0x1234)
+            {
+                return false;
+            }
+
+            // Check flags - should be a response (QR=1)
+            var flags = BinaryPrimitives.ReadUInt16BigEndian(dnsResponseBytes.AsSpan(2, 2));
+            if ((flags & 0x8000) == 0)
+            {
+                return false; // Not a response
+            }
+
+            // Check response code (RCODE) - should be 0 (no error)
+            if ((flags & 0x000F) != 0)
+            {
+                return false; // DNS error
+            }
+
+            // Check answer count
+            var answerCount = BinaryPrimitives.ReadUInt16BigEndian(dnsResponseBytes.AsSpan(6, 2));
+            if (answerCount == 0)
+            {
+                return false; // No answers
+            }
+
+            return true;
+        }
+        catch
+        {
+            return false;
+        }
+    }
+
+    public ushort GetDefaultTargetPort()
+    {
+        return DnsDefaultPort;
+    }
+
+    public string GetDefaultTargetHost()
+    {
+        return DnsDefaultServer;
+    }
+}

v2rayN/ServiceLib.UdpTest/Tester/IUdpTest.cs

@@ -0,0 +1,12 @@
+namespace ServiceLib.UdpTest.Tester;
+
+public interface IUdpTest
+{
+    public byte[] BuildUdpRequestPacket();
+
+    public bool VerifyAndExtractUdpResponse(byte[] udpResponseBytes);
+
+    public ushort GetDefaultTargetPort();
+
+    public string GetDefaultTargetHost();
+}

v2rayN/ServiceLib.UdpTest/Tester/McBeService.cs

@@ -0,0 +1,84 @@
+namespace ServiceLib.UdpTest.Tester;
+
+public class McBeService : IUdpTest
+{
+    private const int McBeDefaultPort = 19132;
+    private const string McBeDefaultServer = "pms.mc-complex.com";
+
+    // 0x01 | client alive time in ms (unsigned long long) | magic | client GUID
+    private static readonly byte[] McBeQueryPacket =
+    [
+        // 0x01
+        0x01,
+        // Client alive time (1000 ms)
+        0x27, 0xC4, 0x15, 0x00, 0x00, 0x00, 0x00, 0x00,
+        // Magic
+        0x00, 0xFF, 0xFF, 0x00, 0xFE, 0xFE, 0xFE, 0xFE,
+        0xFD, 0xFD, 0xFD, 0xFD, 0x12, 0x34, 0x56, 0x78,
+        // Client GUID (random 16 bytes)
+        0x66, 0x0E, 0xAB, 0xBC, 0x61, 0x0D, 0x1F, 0x4E,
+        0xA4, 0x40, 0x8C, 0x65, 0xC1, 0xBE, 0xF5, 0x4B
+    ];
+
+    private static readonly byte[] McBeMagicBytes =
+    [
+        0x00, 0xFF, 0xFF, 0x00, 0xFE, 0xFE, 0xFE, 0xFE,
+        0xFD, 0xFD, 0xFD, 0xFD, 0x12, 0x34, 0x56, 0x78
+    ];
+
+    private static readonly List<string> ValidGameModes =
+    [
+        "Survival",
+        "Creative",
+        "Adventure",
+        "Spectator"
+    ];
+
+    public byte[] BuildUdpRequestPacket()
+    {
+        return (byte[])McBeQueryPacket.Clone();
+    }
+
+    public bool VerifyAndExtractUdpResponse(byte[] mcbeResponseBytes)
+    {
+        // 0x1c | client alive time in ms (recorded from previous ping) |
+        // server GUID | Magic | string length | Edition
+        //
+        // Edition Example:
+        //
+        // MCPE;Dedicated Server;527;1.19.1;0;10;13253860892328930865;Bedrock level;Survival;1;19132;19133;
+        if (mcbeResponseBytes.Length < 48)
+        {
+            return false;
+        }
+        if (mcbeResponseBytes[0] != 0x1C)
+        {
+            return false; // Invalid packet type
+        }
+        var pongMagic = mcbeResponseBytes.Skip(17).Take(16).ToArray();
+        if (!pongMagic.SequenceEqual(McBeMagicBytes))
+        {
+            return false; // Magic bytes do not match
+        }
+        var stringLength = (ushort)((mcbeResponseBytes[33] << 8) | mcbeResponseBytes[34]);
+        var stringData = Encoding.UTF8.GetString(mcbeResponseBytes.Skip(35).Take(stringLength).ToArray());
+        var stringParts = stringData.Split(';');
+        // check Game Mode str
+        var gameMode = stringParts.Length > 8 ? stringParts[8] : "";
+        if (!ValidGameModes.Contains(gameMode))
+        {
+            return false; // Invalid game mode
+        }
+        return true;
+    }
+
+    public ushort GetDefaultTargetPort()
+    {
+        return McBeDefaultPort;
+    }
+
+    public string GetDefaultTargetHost()
+    {
+        return McBeDefaultServer;
+    }
+}

v2rayN/ServiceLib.UdpTest/Tester/NtpService.cs

@@ -0,0 +1,37 @@
+namespace ServiceLib.UdpTest.Tester;
+
+public class NtpService : IUdpTest
+{
+    private const int NtpDefaultPort = 123;
+    private const string NtpDefaultServer = "pool.ntp.org";
+
+    public byte[] BuildUdpRequestPacket()
+    {
+        var ntpReq = new byte[48];
+        ntpReq[0] = 0x23; // LI=0, VN=4, Mode=3
+        return ntpReq;
+    }
+
+    public bool VerifyAndExtractUdpResponse(byte[] ntpResponseBytes)
+    {
+        if (ntpResponseBytes.Length < 48)
+        {
+            return false;
+        }
+        if ((ntpResponseBytes[0] & 0x07) != 4)
+        {
+            return false;
+        }
+        return true;
+    }
+
+    public ushort GetDefaultTargetPort()
+    {
+        return NtpDefaultPort;
+    }
+
+    public string GetDefaultTargetHost()
+    {
+        return NtpDefaultServer;
+    }
+}

v2rayN/ServiceLib.UdpTest/Tester/StunService.cs

@@ -0,0 +1,52 @@
+namespace ServiceLib.UdpTest.Tester;
+
+public class StunService : IUdpTest
+{
+    private const int StunDefaultPort = 3478;
+    private const string StunDefaultServer = "stun.voztovoice.org";
+
+    private static readonly byte[] StunBindingRequestPacket =
+    [
+        // STUN Binding Request
+        0x00, 0x01, // Message Type: Binding Request (0x0001)
+        0x00, 0x00, // Message Length: 0 (no attributes)
+        0x21, 0x12, 0xA4, 0x42, // Magic Cookie: 0x2112A442
+        // Transaction ID: 96 bits (12 bytes) random
+        0x66, 0x0E, 0xAB, 0xBC, 0x61, 0x0D,
+        0xA4, 0x40, 0x8C, 0x65, 0xC1, 0xBE,
+    ];
+
+    public byte[] BuildUdpRequestPacket()
+    {
+        return (byte[])StunBindingRequestPacket.Clone();
+    }
+
+    public bool VerifyAndExtractUdpResponse(byte[] stunResponseBytes)
+    {
+        if (stunResponseBytes.Length < 20)
+        {
+            return false;
+        }
+
+        if (stunResponseBytes.Length >= 2)
+        {
+            var messageType = (stunResponseBytes[0] << 8) | stunResponseBytes[1];
+            if (messageType is 0x0101 or 0x0111)
+            {
+                return true;
+            }
+        }
+
+        return true;
+    }
+
+    public ushort GetDefaultTargetPort()
+    {
+        return StunDefaultPort;
+    }
+
+    public string GetDefaultTargetHost()
+    {
+        return StunDefaultServer;
+    }
+}

v2rayN/ServiceLib.UdpTest/UdpTestService.cs

@@ -0,0 +1,154 @@
+using ServiceLib.UdpTest.Tester;
+
+namespace ServiceLib.UdpTest;
+
+public class UdpTestService
+{
+    private const string DefaultUdpTestType = "ntp";
+    private readonly IUdpTest _udpTest;
+
+    private static readonly IReadOnlyDictionary<string, Func<IUdpTest>> UdpTestFactories =
+        new Dictionary<string, Func<IUdpTest>>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["ntp"] = () => new NtpService(),
+            ["dns"] = () => new DnsService(),
+            ["stun"] = () => new StunService(),
+            ["mcbe"] = () => new McBeService(),
+        };
+
+    private UdpTestService(IUdpTest udpTest)
+    {
+        _udpTest = udpTest;
+    }
+
+    public static UdpTestService Create(string? udpTestType)
+    {
+        if (string.IsNullOrEmpty(udpTestType))
+        {
+            return new UdpTestService(UdpTestFactories[DefaultUdpTestType]());
+        }
+
+        return UdpTestFactories.TryGetValue(udpTestType, out var factory)
+            ? new UdpTestService(factory())
+            : new UdpTestService(UdpTestFactories[DefaultUdpTestType]());
+    }
+
+    public static UdpTestService CreateFromTarget(string? udpTestTarget, out string targetServerHost)
+    {
+        var parts = udpTestTarget?.Split(':', 2);
+        var udpTestType = parts?.Length > 0 ? parts[0] : DefaultUdpTestType;
+
+        var udpService = Create(udpTestType);
+        targetServerHost = parts?.Length > 1 && !string.IsNullOrEmpty(parts[1])
+            ? parts[1]
+            : udpService._udpTest.GetDefaultTargetHost();
+
+        return udpService;
+    }
+
+    private (string host, ushort port) ParseHostAndPort(string targetServerHost)
+    {
+        if (string.IsNullOrEmpty(targetServerHost))
+        {
+            return (_udpTest.GetDefaultTargetHost(), _udpTest.GetDefaultTargetPort());
+        }
+
+        // Handle IPv6 format: [::1]:port or [2001:db8::1]:port
+        if (targetServerHost.StartsWith('['))
+        {
+            var closeBracketIndex = targetServerHost.IndexOf(']');
+            if (closeBracketIndex > 0)
+            {
+                var host = targetServerHost.Substring(1, closeBracketIndex - 1);
+                if (closeBracketIndex < targetServerHost.Length - 1 && targetServerHost[closeBracketIndex + 1] == ':')
+                {
+                    var portStr = targetServerHost.Substring(closeBracketIndex + 2);
+                    if (ushort.TryParse(portStr, out var port))
+                    {
+                        return (host, port);
+                    }
+                }
+                return (host, _udpTest.GetDefaultTargetPort());
+            }
+        }
+
+        // Handle IPv4 or domain format: 1.1.1.1:53 or exam.com:333
+        var lastColonIndex = targetServerHost.LastIndexOf(':');
+        if (lastColonIndex > 0)
+        {
+            var host = targetServerHost.Substring(0, lastColonIndex);
+            var portStr = targetServerHost.Substring(lastColonIndex + 1);
+            if (ushort.TryParse(portStr, out var port))
+            {
+                return (host, port);
+            }
+        }
+
+        // No port specified, use default
+        return (targetServerHost, _udpTest.GetDefaultTargetPort());
+    }
+
+    public async Task<TimeSpan> SendUdpRequestAsync(string targetServerHost, int socks5Port, TimeSpan operationTimeout)
+    {
+        using var cts = new CancellationTokenSource(operationTimeout);
+        var cancellationToken = cts.Token;
+        var udpRequestPacket = _udpTest.BuildUdpRequestPacket();
+        if (udpRequestPacket == null || udpRequestPacket.Length == 0)
+        {
+            throw new InvalidOperationException("Failed to build UDP request packet.");
+        }
+        using var channel = new Socks5UdpChannel("127.0.0.1", socks5Port);
+        if (!await channel.EstablishUdpAssociationAsync(cancellationToken).ConfigureAwait(false))
+        {
+            throw new Exception("Failed to establish UDP association with SOCKS5 proxy.");
+        }
+
+        var (targetHost, targetPort) = ParseHostAndPort(targetServerHost);
+
+        byte[] udpReceiveResult = null;
+
+        // Get minimum round trip time from two attempts
+        var roundTripTime = TimeSpan.MaxValue;
+
+        for (var attempt = 0; attempt < 2; attempt++)
+        {
+            try
+            {
+                var stopwatch = new Stopwatch();
+                stopwatch.Start();
+                await channel.SendAsync(targetHost, targetPort, udpRequestPacket).ConfigureAwait(false);
+                var (_, receiveResult) = await channel.ReceiveAsync(cancellationToken).ConfigureAwait(false);
+                stopwatch.Stop();
+
+                udpReceiveResult = receiveResult;
+
+                var currentRoundTripTime = stopwatch.Elapsed;
+                if (currentRoundTripTime < roundTripTime)
+                {
+                    roundTripTime = currentRoundTripTime;
+                }
+            }
+            catch
+            {
+                if (attempt == 1 && roundTripTime == TimeSpan.MaxValue)
+                {
+                    throw;
+                }
+            }
+        }
+
+        if ((udpReceiveResult?.Length ?? 0) < 4 + 1 + 4 + 2)
+        {
+            throw new Exception("Received NTP response is too short.");
+        }
+
+        if (udpReceiveResult != null && _udpTest.VerifyAndExtractUdpResponse(udpReceiveResult))
+        {
+            return roundTripTime;
+        }
+        else
+        {
+            throw new Exception("Failed to verify and extract UDP response.");
+        }
+    }
+}

v2rayN/ServiceLib/Common/CountryExtension.cs

@@ -0,0 +1,92 @@
+namespace ServiceLib.Common;
+
+/// <summary>
+/// Extension methods for country code utilities
+/// </summary>
+public static class CountryExtension
+{
+    /// <summary>
+    /// Country code to emoji flag mapping for common countries
+    /// </summary>
+    private static readonly Dictionary<string, string> CountryEmojiMap = new(StringComparer.OrdinalIgnoreCase)
+    {
+        // Asia
+        { "CN", "🇨🇳" }, // China
+        { "HK", "🇭🇰" }, // Hong Kong
+        { "TW", "🇹🇼" }, // Taiwan
+        { "JP", "🇯🇵" }, // Japan
+        { "SG", "🇸🇬" }, // Singapore
+        { "KR", "🇰🇷" }, // South Korea
+        { "TH", "🇹🇭" }, // Thailand
+        { "VN", "🇻🇳" }, // Vietnam
+        { "ID", "🇮🇩" }, // Indonesia
+        { "PH", "🇵🇭" }, // Philippines
+        { "MY", "🇲🇾" }, // Malaysia
+        { "IN", "🇮🇳" }, // India
+        { "PK", "🇵🇰" }, // Pakistan
+        { "BD", "🇧🇩" }, // Bangladesh
+        { "LK", "🇱🇰" }, // Sri Lanka
+        { "KH", "🇰🇭" }, // Cambodia
+        { "LA", "🇱🇦" }, // Laos
+        { "MM", "🇲🇲" }, // Myanmar
+
+        // Americas
+        { "US", "🇺🇸" }, // United States
+        { "CA", "🇨🇦" }, // Canada
+        { "MX", "🇲🇽" }, // Mexico
+        { "BR", "🇧🇷" }, // Brazil
+        { "AR", "🇦🇷" }, // Argentina
+        { "CL", "🇨🇱" }, // Chile
+        { "CO", "🇨🇴" }, // Colombia
+
+        // Europe
+        { "GB", "🇬🇧" }, // United Kingdom
+        { "DE", "🇩🇪" }, // Germany
+        { "FR", "🇫🇷" }, // France
+        { "IT", "🇮🇹" }, // Italy
+        { "ES", "🇪🇸" }, // Spain
+        { "RU", "🇷🇺" }, // Russia
+        { "NL", "🇳🇱" }, // Netherlands
+        { "CH", "🇨🇭" }, // Switzerland
+        { "SE", "🇸🇪" }, // Sweden
+        { "NO", "🇳🇴" }, // Norway
+        { "DK", "🇩🇰" }, // Denmark
+        { "FI", "🇫🇮" }, // Finland
+        { "PL", "🇵🇱" }, // Poland
+        { "CZ", "🇨🇿" }, // Czech Republic
+        { "AT", "🇦🇹" }, // Austria
+        { "GR", "🇬🇷" }, // Greece
+        { "PT", "🇵🇹" }, // Portugal
+        { "TR", "🇹🇷" }, // Turkey
+        { "UA", "🇺🇦" }, // Ukraine
+        { "RO", "🇷🇴" }, // Romania
+
+        // Middle East & Central Asia
+        { "AE", "🇦🇪" }, // United Arab Emirates
+        { "SA", "🇸🇦" }, // Saudi Arabia
+        { "IL", "🇮🇱" }, // Israel
+        { "KZ", "🇰🇿" }, // Kazakhstan
+
+        // Oceania
+        { "AU", "🇦🇺" }, // Australia
+        { "NZ", "🇳🇿" }, // New Zealand
+
+        // Africa
+        { "ZA", "🇿🇦" }, // South Africa
+        { "EG", "🇪🇬" }, // Egypt
+    };
+
+    /// <summary>
+    /// Converts country code to flag emoji using predefined mapping
+    /// Example: "US" -> "🇺🇸", "CN" -> "🇨🇳"
+    /// </summary>
+    public static string? CountryToEmoji(this string? countryCode)
+    {
+        if (countryCode.IsNullOrEmpty())
+        {
+            return null;
+        }
+
+        return CountryEmojiMap.GetValueOrDefault(countryCode);
+    }
+}

v2rayN/ServiceLib/Common/Extension.cs

@@ -47,7 +47,7 @@ public static class Extension
 
     public static string TrimEx(this string? value)
     {
-        return value == null ? string.Empty : value.Trim();
+        return value?.Trim() ?? string.Empty;
     }
 
     public static string RemovePrefix(this string value, char prefix)
@@ -118,4 +118,20 @@ public static class Extension
             destination.Add(item);
         }
     }
+
+    /// <summary>
+    /// Replace all cross-platform newline characters with the specified string
+    /// </summary>
+    public static string ReplaceLineBreaks(this string input, string replacement)
+    {
+        if (string.IsNullOrEmpty(input))
+        {
+            return input;
+        }
+
+        // You must replace \r\n first, and then replace the single characters \r and \n.
+        return input.Replace("\r\n", replacement)
+                    .Replace("\r", replacement)
+                    .Replace("\n", replacement);
+    }
 }

v2rayN/ServiceLib/Common/FileUtils.cs

@@ -202,7 +202,7 @@ public static class FileUtils
         }
     }
 
-    public static void DeleteExpiredFiles(string sourceDir, DateTime dtLine)
+    public static void DeleteExpiredFiles(string sourceDir, DateTime dtLine, string? contains = null)
     {
         try
         {
@@ -214,6 +214,10 @@ public static class FileUtils
                 {
                     continue;
                 }
+                if (contains.IsNotEmpty() && !file.Name.Contains(contains))
+                {
+                    continue;
+                }
                 file.Delete();
             }
         }

v2rayN/ServiceLib/Common/JsonUtils.cs

@@ -17,6 +17,13 @@ public class JsonUtils
         Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
     };
 
+    private static readonly JsonSerializerOptions _defaultSerializeNoIndentedOptions = new()
+    {
+        WriteIndented = false,
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+    };
+
     private static readonly JsonSerializerOptions _nullValueSerializeOptions = new()
     {
         WriteIndented = true,
@@ -24,6 +31,13 @@ public class JsonUtils
         Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
     };
 
+    private static readonly JsonSerializerOptions _nullValueSerializeNoIndentedOptions = new()
+    {
+        WriteIndented = false,
+        DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+    };
+
     private static readonly JsonDocumentOptions _defaultDocumentOptions = new()
     {
         CommentHandling = JsonCommentHandling.Skip
@@ -104,7 +118,13 @@ public class JsonUtils
             {
                 return result;
             }
-            var options = nullValue ? _nullValueSerializeOptions : _defaultSerializeOptions;
+            var options = (nullValue, indented) switch
+            {
+                (true, true) => _nullValueSerializeOptions,
+                (true, false) => _nullValueSerializeNoIndentedOptions,
+                (false, true) => _defaultSerializeOptions,
+                _ => _defaultSerializeNoIndentedOptions
+            };
             result = JsonSerializer.Serialize(obj, options);
         }
         catch (Exception ex)

v2rayN/ServiceLib/Common/ProcUtils.cs

@@ -46,7 +46,7 @@ public static class ProcUtils
         return null;
     }
 
-    public static void RebootAsAdmin(bool blAdmin = true)
+    public static bool RebootAsAdmin(bool blAdmin = true)
     {
         try
         {
@@ -58,11 +58,12 @@ public static class ProcUtils
                 FileName = Utils.GetExePath().AppendQuotes(),
                 Verb = blAdmin ? "runas" : null,
             };
-            _ = Process.Start(startInfo);
+            return Process.Start(startInfo) != null;
         }
         catch (Exception ex)
         {
             Logging.SaveLog(_tag, ex);
+            return false;
         }
     }
 }

v2rayN/ServiceLib/Common/Utils.cs

@@ -51,7 +51,7 @@ public class Utils
 
         try
         {
-            str = str.Replace(Environment.NewLine, string.Empty);
+            str = str.ReplaceLineBreaks(string.Empty);
             return new List<string>(str.Split(',', StringSplitOptions.RemoveEmptyEntries));
         }
         catch (Exception ex)
@@ -114,9 +114,7 @@ public class Utils
             }
 
             plainText = plainText.Trim()
-                .Replace(Environment.NewLine, "")
-                .Replace("\n", "")
-                .Replace("\r", "")
+                .ReplaceLineBreaks("")
                 .Replace('_', '/')
                 .Replace('-', '+')
                 .Replace(" ", "");
@@ -321,7 +319,9 @@ public class Utils
             return text;
         }
 
-        return text.Replace("，", ",").Replace(Environment.NewLine, ",");
+        return text.Replace("，", ",")
+                    .Replace(" ", "")
+                    .ReplaceLineBreaks(",");
     }
 
     public static List<string> GetEnumNames<TEnum>() where TEnum : Enum
@@ -522,6 +522,23 @@ public class Utils
         return false;
     }
 
+    public static bool IsIpv4(string? ip)
+    {
+        if (ip.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        ip = ip.Trim();
+        if (!IPAddress.TryParse(ip, out var address))
+        {
+            return false;
+        }
+
+        return address.AddressFamily == AddressFamily.InterNetwork
+               && ip.Count(c => c == '.') == 3;
+    }
+
     public static bool IsIpAddress(string? ip)
     {
         if (ip.IsNullOrEmpty())
@@ -699,6 +716,18 @@ public class Utils
         return (endpoints, connections);
     }
 
+    public static bool IsLocalIP(string ipAddress)
+    {
+        if (!IPAddress.TryParse(ipAddress, out var targetAddress))
+        {
+            return false;
+        }
+
+        return NetworkInterface.GetAllNetworkInterfaces()
+               .SelectMany(ni => ni.GetIPProperties().UnicastAddresses)
+               .Any(ua => ua.Address.Equals(targetAddress));
+    }
+
     #endregion Speed Test
 
     #region Miscellaneous
@@ -847,15 +876,25 @@ public class Utils
 
     public static Dictionary<string, string> GetSystemHosts()
     {
-        var hosts = GetSystemHosts(@"C:\Windows\System32\drivers\etc\hosts");
-        var hostsIcs = GetSystemHosts(@"C:\Windows\System32\drivers\etc\hosts.ics");
-
-        foreach (var (key, value) in hostsIcs)
+        if (IsWindows())
         {
-            hosts[key] = value;
+            var hosts = GetSystemHosts(@"C:\Windows\System32\drivers\etc\hosts");
+            var hostsIcs = GetSystemHosts(@"C:\Windows\System32\drivers\etc\hosts.ics");
+
+            foreach (var (key, value) in hostsIcs)
+            {
+                hosts[key] = value;
+            }
+
+            return hosts;
         }
 
-        return hosts;
+        if (IsLinux() || IsMacOS())
+        {
+            return GetSystemHosts("/etc/hosts");
+        }
+
+        return new Dictionary<string, string>();
     }
 
     public static async Task<string?> GetCliWrapOutput(string filePath, string? arg)
@@ -1097,12 +1136,16 @@ public class Utils
 
     #region Platform
 
+    [SupportedOSPlatformGuard("windows")]
     public static bool IsWindows() => OperatingSystem.IsWindows();
 
+    [SupportedOSPlatformGuard("linux")]
     public static bool IsLinux() => OperatingSystem.IsLinux();
 
+    [SupportedOSPlatformGuard("macos")]
     public static bool IsMacOS() => OperatingSystem.IsMacOS();
 
+    [UnsupportedOSPlatformGuard("windows")]
     public static bool IsNonWindows() => !OperatingSystem.IsWindows();
 
     public static string GetExeName(string name)
@@ -1197,6 +1240,16 @@ public class Utils
     }
 
     public static bool SetUnixFileMode(string? fileName)
+    {
+        if (IsWindows())
+        {
+            return false;
+        }
+        return SetUnixFileModeInternal(fileName);
+    }
+
+    [UnsupportedOSPlatform("windows")]
+    private static bool SetUnixFileModeInternal(string? fileName)
     {
         try
         {

v2rayN/ServiceLib/Common/WindowsUtils.cs

@@ -2,6 +2,7 @@ using Microsoft.Win32;
 
 namespace ServiceLib.Common;
 
+[SupportedOSPlatform("windows")]
 internal static class WindowsUtils
 {
     private static readonly string _tag = "WindowsUtils";
@@ -53,19 +54,23 @@ internal static class WindowsUtils
 
     public static async Task RemoveTunDevice()
     {
-        try
+        var tunNameList = new List<string> { "wintunsingbox_tun", "xray_tun" };
+        foreach (var tunName in tunNameList)
         {
-            var sum = MD5.HashData(Encoding.UTF8.GetBytes("wintunsingbox_tun"));
-            var guid = new Guid(sum);
-            var pnpUtilPath = @"C:\Windows\System32\pnputil.exe";
-            var arg = $$""" /remove-device  "SWD\Wintun\{{{guid}}}" """;
+            try
+            {
+                var sum = MD5.HashData(Encoding.UTF8.GetBytes(tunName));
+                var guid = new Guid(sum);
+                var pnpUtilPath = @"C:\Windows\System32\pnputil.exe";
+                var arg = $$""" /remove-device  "SWD\Wintun\{{{guid}}}" """;
 
-            // Try to remove the device
-            _ = await Utils.GetCliWrapOutput(pnpUtilPath, arg);
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
+                // Try to remove the device
+                _ = await Utils.GetCliWrapOutput(pnpUtilPath, arg);
+            }
+            catch (Exception ex)
+            {
+                Logging.SaveLog(_tag, ex);
+            }
         }
     }
 }

v2rayN/ServiceLib/Enums/EConfigType.cs

@@ -13,6 +13,7 @@ public enum EConfigType
     WireGuard = 9,
     HTTP = 10,
     Anytls = 11,
+    Naive = 12,
     PolicyGroup = 101,
     ProxyChain = 102,
 }

v2rayN/ServiceLib/Enums/EServerColName.cs

@@ -12,6 +12,7 @@ public enum EServerColName
     SubRemarks,
     DelayVal,
     SpeedVal,
+    IpInfo,
 
     TodayDown,
     TodayUp,

v2rayN/ServiceLib/Enums/ESpeedActionType.cs

@@ -4,6 +4,7 @@ public enum ESpeedActionType
 {
     Tcping,
     Realping,
+    UdpTest,
     Speedtest,
     Mixedtest,
     FastRealping

v2rayN/ServiceLib/Enums/ETransport.cs

@@ -2,7 +2,7 @@ namespace ServiceLib.Enums;
 
 public enum ETransport
 {
-    tcp,
+    raw,
     kcp,
     ws,
     httpupgrade,

v2rayN/ServiceLib/Events/AppEvents.cs

@@ -7,6 +7,7 @@ public static class AppEvents
     public static readonly EventChannel<Unit> AddServerViaScanRequested = new();
     public static readonly EventChannel<Unit> AddServerViaClipboardRequested = new();
     public static readonly EventChannel<bool> SubscriptionsUpdateRequested = new();
+    public static readonly EventChannel<bool> HasUpdateNotified = new();
 
     public static readonly EventChannel<Unit> ProfilesRefreshRequested = new();
     public static readonly EventChannel<Unit> SubscriptionsRefreshRequested = new();

v2rayN/ServiceLib/Global.cs

@@ -24,6 +24,8 @@ public class Global
     public const string V2raySampleHttpResponseFileName = NamespaceSample + "SampleHttpResponse";
     public const string V2raySampleInbound = NamespaceSample + "SampleInbound";
     public const string V2raySampleOutbound = NamespaceSample + "SampleOutbound";
+    public const string V2raySampleTunInbound = NamespaceSample + "SampleTunInbound";
+    public const string V2raySampleTunRules = NamespaceSample + "SampleTunRules";
     public const string SingboxSampleOutbound = NamespaceSample + "SingboxSampleOutbound";
     public const string CustomRoutingFileName = NamespaceSample + "custom_routing_";
     public const string TunSingboxDNSFileName = NamespaceSample + "tun_singbox_dns";
@@ -42,15 +44,18 @@ public class Global
     public const string SingboxFakeIPFilterFileName = NamespaceSample + "singbox_fakeip_filter";
 
     public const string DefaultSecurity = "auto";
-    public const string DefaultNetwork = "tcp";
-    public const string TcpHeaderHttp = "http";
+    public const string DefaultNetwork = "raw";
+    public const string RawHeaderHttp = "http";
     public const string None = "none";
+    public const string RawNetworkAlias = "tcp";
+    public const string DefaultXhttpMode = "auto";
     public const string ProxyTag = "proxy";
     public const string DirectTag = "direct";
     public const string BlockTag = "block";
+    public const string DnsOutboundTag = "dns";
     public const string DnsTag = "dns-module";
     public const string DirectDnsTag = "direct-dns";
-    public const string BalancerTagSuffix = "-round";
+    public const string BalancerTagSuffix = "-balancer";
     public const string StreamSecurity = "tls";
     public const string StreamSecurityReality = "reality";
     public const string Loopback = "127.0.0.1";
@@ -59,9 +64,12 @@ public class Global
     public const string HttpsProtocol = "https://";
     public const string SocksProtocol = "socks://";
     public const string Socks5Protocol = "socks5://";
+    public const string InnerUriProtocol = "v2rayn://";
     public const string AsIs = "AsIs";
     public const string IPIfNonMatch = "IPIfNonMatch";
     public const string IPOnDemand = "IPOnDemand";
+    public const string GeoSitePrefix = "geosite:";
+    public const string GeoIPPrefix = "geoip:";
 
     public const string UserEMail = "t@t.tt";
     public const string AutoRunRegPath = @"Software\Microsoft\Windows\CurrentVersion\Run";
@@ -82,6 +90,8 @@ public class Global
     public const string XrayLocalCert = "XRAY_LOCATION_CERT";
     public const int SpeedTestPageSize = 1000;
     public const string LinuxBash = "/bin/bash";
+    public const string StringTrue = "true";
+    public const string StringFalse = "false";
 
     public const string SingboxDirectDNSTag = "direct_dns";
     public const string SingboxRemoteDNSTag = "remote_dns";
@@ -89,7 +99,7 @@ public class Global
     public const string SingboxHostsDNSTag = "hosts_dns";
     public const string SingboxFakeDNSTag = "fake_dns";
 
-    public const int Hysteria2DefaultHopInt = 10;
+    public const int Hysteria2DefaultHopInt = 30;
 
     public const string PolicyGroupExcludeKeywords = @"剩余|过期|到期|重置|[Rr]emaining|[Ee]xpir|[Rr]eset";
 
@@ -141,14 +151,19 @@ public class Global
     public static readonly List<string> SpeedTestUrls =
     [
         @"https://cachefly.cachefly.net/50mb.test",
+        @"https://cachefly.cachefly.net/100mb.test",
+        @"https://cachefly.cachefly.net/1mb.test",
+        @"https://cachefly.cachefly.net/10mb.test",
         @"https://speed.cloudflare.com/__down?bytes=10000000",
         @"https://speed.cloudflare.com/__down?bytes=50000000",
-        @"https://speed.cloudflare.com/__down?bytes=100000000",
+        @"https://speed.cloudflare.com/__down?bytes=99999999",
     ];
 
     public static readonly List<string> SpeedPingTestUrls =
     [
         @"https://www.google.com/generate_204",
+        @"https://www.youtube.com/generate_204",
+        @"https://www.googlevideo.com/generate_204",
         @"https://www.gstatic.com/generate_204",
         @"https://www.apple.com/library/test/success.html",
         @"http://www.msftconnecttest.com/connecttest.txt"
@@ -182,17 +197,27 @@ public class Global
         @"https://raw.githubusercontent.com/Chocolate4U/Iran-v2ray-rules/main/v2rayN/"
     ];
 
-    public static readonly Dictionary<string, string> UserAgentTexts = new()
+    public static readonly Dictionary<string, string> RawHttpUserAgentTexts = new()
     {
         {"chrome","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36" },
         {"firefox","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0" },
         {"safari","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15" },
         {"edge","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.70" },
-        {"none",""}
+        {"none",""},
+        {"golang","Go-http-client/1.1"},
+        {"curl","curl/7.68.0"},
     };
 
     public const string Hysteria2ProtocolShare = "hy2://";
 
+    public const string NaiveHttpsProtocolShare = "naive+https://";
+
+    public const string NaiveQuicProtocolShare = "naive+quic://";
+
+    public const string SOCKS5Protocol = "socks5://";
+
+    public const string SOCKS4Protocol = "socks4://";
+
     public static readonly Dictionary<EConfigType, string> ProtocolShares = new()
     {
         { EConfigType.VMess, "vmess://" },
@@ -203,7 +228,8 @@ public class Global
         { EConfigType.Hysteria2, "hysteria2://" },
         { EConfigType.TUIC, "tuic://" },
         { EConfigType.WireGuard, "wireguard://" },
-        { EConfigType.Anytls, "anytls://" }
+        { EConfigType.Anytls, "anytls://" },
+        { EConfigType.Naive, "naive://" }
     };
 
     public static readonly Dictionary<EConfigType, string> ProtocolTypes = new()
@@ -217,7 +243,8 @@ public class Global
         { EConfigType.Hysteria2, "hysteria2" },
         { EConfigType.TUIC, "tuic" },
         { EConfigType.WireGuard, "wireguard" },
-        { EConfigType.Anytls, "anytls" }
+        { EConfigType.Anytls, "anytls" },
+        { EConfigType.Naive, "naive" }
     };
 
     public static readonly List<string> VmessSecurities =
@@ -285,14 +312,12 @@ public class Global
 
     public static readonly List<string> Networks =
     [
-        "tcp",
-        "kcp",
-        "ws",
-        "httpupgrade",
+        "raw",
         "xhttp",
-        "h2",
-        "quic",
-        "grpc"
+        "kcp",
+        "grpc",
+        "ws",
+        "httpupgrade"
     ];
 
     public static readonly List<string> KcpHeaderTypes =
@@ -307,12 +332,12 @@ public class Global
 
     public static readonly Dictionary<string, string> KcpHeaderMaskMap = new()
     {
-        { "srtp", "header-srtp" },
-        { "utp", "header-utp" },
-        { "wechat-video", "header-wechat" },
-        { "dtls", "header-dtls" },
-        { "wireguard", "header-wireguard" },
-        { "dns", "header-dns" }
+        { "srtp", "srtp" },
+        { "utp", "utp" },
+        { "wechat-video", "wechat" },
+        { "dtls", "dtls" },
+        { "wireguard", "wireguard" },
+        { "dns", "dns" }
     };
 
     public static readonly List<string> CoreTypes =
@@ -342,6 +367,7 @@ public class Global
         EConfigType.Hysteria2,
         EConfigType.TUIC,
         EConfigType.Anytls,
+        EConfigType.Naive,
         EConfigType.WireGuard,
         EConfigType.SOCKS,
         EConfigType.HTTP,
@@ -384,9 +410,9 @@ public class Global
     [
         "chrome",
         "firefox",
-        "safari",
         "edge",
-        "none"
+        "curl",
+        "golang",
     ];
 
     public static readonly List<string> XhttpMode =
@@ -397,13 +423,6 @@ public class Global
         "stream-one"
     ];
 
-    public static readonly List<string> AllowInsecure =
-    [
-        "true",
-        "false",
-        ""
-    ];
-
     public static readonly List<string> DomainStrategy =
     [
         "AsIs",
@@ -417,11 +436,12 @@ public class Global
 
     public static readonly List<string> DomainDirectDNSAddress =
     [
-        "https://dns.alidns.com/dns-query",
-        "https://doh.pub/dns-query",
-        "https://dns.alidns.com/dns-query,https://doh.pub/dns-query",
-        "223.5.5.5",
         "119.29.29.29",
+        "223.5.5.5",
+        "119.29.29.29,223.5.5.5,https://doh.pub/dns-query",
+        "https://doh.pub/dns-query",
+        "https://dns.alidns.com/dns-query",
+        "https://doh.pub/dns-query,https://dns.alidns.com/dns-query",
         "localhost"
     ];
 
@@ -433,7 +453,7 @@ public class Global
         "https://dns.cloudflare.com/dns-query",
         "https://doh.dns.sb/dns-query",
         "https://doh.opendns.com/dns-query",
-        "https://common.dot.dns.yandex.net",
+        "https://common.dot.dns.yandex.net/dns-query",
         "8.8.8.8",
         "1.1.1.1",
         "185.222.222.222",
@@ -443,8 +463,8 @@ public class Global
 
     public static readonly List<string> DomainPureIPDNSAddress =
     [
-        "223.5.5.5",
         "119.29.29.29",
+        "223.5.5.5",
         "localhost"
     ];
 
@@ -453,10 +473,11 @@ public class Global
         "zh-Hans",
         "zh-Hant",
         "en",
-        "fa-Ir",
+        "fa",
         "fr",
         "ru",
-        "hu"
+        "hu",
+        "id"
     ];
 
     public static readonly List<string> Alpns =
@@ -489,6 +510,7 @@ public class Global
 
     public static readonly List<string> InboundTags =
     [
+        "tun",
         "socks",
         "socks2",
         "socks3"
@@ -498,6 +520,7 @@ public class Global
     [
         "http",
         "tls",
+        "quic",
         "bittorrent"
     ];
 
@@ -515,7 +538,6 @@ public class Global
         "tls",
         "quic",
         "fakedns",
-        "fakedns+others"
     ];
 
     public static readonly List<int> TunMtus =
@@ -558,6 +580,14 @@ public class Global
         "bbr"
     ];
 
+    public static readonly List<string> NaiveCongestionControls =
+    [
+        "bbr",
+        "bbr2",
+        "cubic",
+        "reno"
+    ];
+
     public static readonly List<string> allowSelectType =
     [
         "selector",
@@ -619,6 +649,24 @@ public class Global
         @""
     ];
 
+    public static readonly List<string> UdpTestTargets =
+    [
+        "ntp:pool.ntp.org",
+        "ntp:time.google.com",
+        "dns:1.1.1.1",
+        "dns:8.8.8.8",
+        "dns:dns.google",
+        "stun:stun.voztovoice.org",
+        "stun:stun.cloudflare.com",
+        "stun:stun.l.google.com:19302",
+        "mcbe:pms.mc-complex.com",
+        "mcbe:bedrock.opblocks.com",
+        "mcbe:opsucht.net",
+        "mcbe:play.craftersmc.net",
+        "mcbe:mps.lemoncloud.net",
+        "mcbe:bedrock.talonmc.net",
+    ];
+
     public static readonly List<string> OutboundTags =
     [
         ProxyTag,
@@ -633,15 +681,15 @@ public class Global
         { "one.one.one.one", ["1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001"] },
         { "1dot1dot1dot1.cloudflare-dns.com", ["1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001"] },
         { "cloudflare-dns.com", ["104.16.249.249", "104.16.248.249", "2606:4700::6810:f8f9", "2606:4700::6810:f9f9"] },
-        { "dns.cloudflare.com", ["104.16.132.229", "104.16.133.229", "2606:4700::6810:84e5", "2606:4700::6810:85e5"] },
+        { "dns.cloudflare.com", ["162.159.61.8", "172.64.41.8", "2a06:98c1:52::8", "2803:f800:53::8"] },
         { "dot.pub", ["1.12.12.12", "120.53.53.53"] },
         { "doh.pub", ["1.12.12.12", "120.53.53.53"] },
         { "dns.quad9.net", ["9.9.9.9", "149.112.112.112", "2620:fe::fe", "2620:fe::9"] },
         { "dns.yandex.net", ["77.88.8.8", "77.88.8.1", "2a02:6b8::feed:0ff", "2a02:6b8:0:1::feed:0ff"] },
-        { "dns.sb", ["185.222.222.222", "2a09::"] },
+        { "dns.sb", ["45.11.45.11", "185.222.222.222", "2a09::", "2a11::"] },
         { "dns.umbrella.com", ["208.67.220.220", "208.67.222.222", "2620:119:35::35", "2620:119:53::53"] },
         { "dns.sse.cisco.com", ["208.67.220.220", "208.67.222.222", "2620:119:35::35", "2620:119:53::53"] },
-        { "engage.cloudflareclient.com", ["162.159.192.1"] }
+        { "engage.cloudflareclient.com", ["162.159.192.1", "2606:4700:d0::a29f:c001"] }
     };
 
     public static readonly List<string> ExpectedIPs =
@@ -652,12 +700,13 @@ public class Global
         ""
     ];
 
-    public static readonly List<string> EchForceQuerys =
+    public static readonly List<string> TunIcmpRoutingPolicies =
     [
-        "none",
-        "half",
-        "full",
-        ""
+        "rule",
+        "direct",
+        "unreachable",
+        "drop",
+        "reply",
     ];
 
     #endregion const

v2rayN/ServiceLib/GlobalUsings.cs

@@ -8,6 +8,7 @@ global using System.Reactive.Disposables;
 global using System.Reactive.Linq;
 global using System.Reflection;
 global using System.Runtime.InteropServices;
+global using System.Runtime.Versioning;
 global using System.Security.Cryptography;
 global using System.Text;
 global using System.Text.Encodings.Web;
@@ -29,7 +30,10 @@ global using ServiceLib.Handler.Fmt;
 global using ServiceLib.Handler.SysProxy;
 global using ServiceLib.Helper;
 global using ServiceLib.Manager;
-global using ServiceLib.Models;
+global using ServiceLib.Models.CoreConfigs;
+global using ServiceLib.Models.Configs;
+global using ServiceLib.Models.Dto;
+global using ServiceLib.Models.Entities;
 global using ServiceLib.Resx;
 global using ServiceLib.Services;
 global using ServiceLib.Services.CoreConfig;

v2rayN/ServiceLib/Handler/AutoStartupHandler.cs

@@ -41,6 +41,7 @@ public static class AutoStartupHandler
 
     #region Windows
 
+    [SupportedOSPlatform("windows")]
     private static async Task ClearTaskWindows()
     {
         var autoRunName = GetAutoRunNameWindows();
@@ -53,6 +54,7 @@ public static class AutoStartupHandler
         await Task.CompletedTask;
     }
 
+    [SupportedOSPlatform("windows")]
     private static async Task SetTaskWindows()
     {
         try
@@ -82,6 +84,7 @@ public static class AutoStartupHandler
     /// <param name="fileName"></param>
     /// <param name="description"></param>
     /// <exception cref="ArgumentNullException"></exception>
+    [SupportedOSPlatform("windows")]
     public static void AutoStartTaskService(string taskName, string fileName, string description)
     {
         if (taskName.IsNullOrEmpty())
@@ -108,7 +111,8 @@ public static class AutoStartupHandler
         task.Settings.RunOnlyIfIdle = false;
         task.Settings.IdleSettings.StopOnIdleEnd = false;
         task.Settings.ExecutionTimeLimit = TimeSpan.Zero;
-        task.Triggers.Add(new Microsoft.Win32.TaskScheduler.LogonTrigger { UserId = logonUser, Delay = TimeSpan.FromSeconds(30) });
+        task.Settings.Priority = ProcessPriorityClass.Normal;
+        task.Triggers.Add(new Microsoft.Win32.TaskScheduler.LogonTrigger { UserId = logonUser });
         task.Principal.RunLevel = Microsoft.Win32.TaskScheduler.TaskRunLevel.Highest;
         task.Actions.Add(new Microsoft.Win32.TaskScheduler.ExecAction(fileName.AppendQuotes(), null, Path.GetDirectoryName(fileName)));
 
@@ -124,6 +128,7 @@ public static class AutoStartupHandler
 
     #region Linux
 
+    [SupportedOSPlatform("linux")]
     private static async Task ClearTaskLinux()
     {
         try
@@ -137,6 +142,7 @@ public static class AutoStartupHandler
         await Task.CompletedTask;
     }
 
+    [SupportedOSPlatform("linux")]
     private static async Task SetTaskLinux()
     {
         try
@@ -157,6 +163,7 @@ public static class AutoStartupHandler
         }
     }
 
+    [SupportedOSPlatform("linux")]
     private static string GetHomePathLinux()
     {
         var homePath = Path.Combine(Utils.GetHomePath(), ".config", "autostart", $"{Global.AppName}.desktop");
@@ -168,6 +175,7 @@ public static class AutoStartupHandler
 
     #region macOS
 
+    [SupportedOSPlatform("macos")]
     private static async Task ClearTaskOSX()
     {
         try
@@ -187,6 +195,7 @@ public static class AutoStartupHandler
         }
     }
 
+    [SupportedOSPlatform("macos")]
     private static async Task SetTaskOSX()
     {
         try
@@ -204,6 +213,7 @@ public static class AutoStartupHandler
         }
     }
 
+    [SupportedOSPlatform("macos")]
     private static string GetLaunchAgentPathMacOS()
     {
         var homePath = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
@@ -212,6 +222,7 @@ public static class AutoStartupHandler
         return launchAgentPath;
     }
 
+    [SupportedOSPlatform("macos")]
     private static string GenerateLaunchAgentPlist()
     {
         var exePath = Utils.GetExePath();

v2rayN/ServiceLib/Handler/Builder/CoreConfigContextBuilder.cs

@@ -6,8 +6,8 @@ public record CoreConfigContextBuilderResult(CoreConfigContext Context, NodeVali
 }
 
 /// <summary>
-/// Holds the results of a full context build, including the main context and an optional
-/// pre-socks context (e.g. for TUN protection or pre-socks chaining).
+///     Holds the results of a full context build, including the main context and an optional
+///     pre-socks context (e.g. for TUN protection or pre-socks chaining).
 /// </summary>
 public record CoreConfigContextBuilderAllResult(
     CoreConfigContextBuilderResult MainResult,
@@ -17,38 +17,25 @@ public record CoreConfigContextBuilderAllResult(
     public bool Success => MainResult.Success && (PreSocksResult?.Success ?? true);
 
     /// <summary>
-    /// Merges all errors and warnings from the main result and the optional pre-socks result
-    /// into a single <see cref="NodeValidatorResult"/> for unified notification.
+    ///     Merges all errors and warnings from the main result and the optional pre-socks result
+    ///     into a single <see cref="NodeValidatorResult" /> for unified notification.
     /// </summary>
     public NodeValidatorResult CombinedValidatorResult => new(
         [.. MainResult.ValidatorResult.Errors, .. PreSocksResult?.ValidatorResult.Errors ?? []],
         [.. MainResult.ValidatorResult.Warnings, .. PreSocksResult?.ValidatorResult.Warnings ?? []]);
-
-    /// <summary>
-    /// The main context with TunProtectSsPort/ProxyRelaySsPort and ProtectDomainList merged in
-    /// from the pre-socks result (if any). Pass this to the core runner.
-    /// </summary>
-    public CoreConfigContext ResolvedMainContext => PreSocksResult is not null
-        ? MainResult.Context with
-        {
-            TunProtectSsPort = PreSocksResult.Context.TunProtectSsPort,
-            ProxyRelaySsPort = PreSocksResult.Context.ProxyRelaySsPort,
-            ProtectDomainList = [.. MainResult.Context.ProtectDomainList ?? [], .. PreSocksResult.Context.ProtectDomainList ?? []],
-        }
-        : MainResult.Context;
 }
 
 public class CoreConfigContextBuilder
 {
     /// <summary>
-    /// Builds a <see cref="CoreConfigContext"/> for the given node, resolves its proxy map,
-    /// and processes outbound nodes referenced by routing rules.
+    ///     Builds a <see cref="CoreConfigContext" /> for the given node, resolves its proxy map,
+    ///     and processes outbound nodes referenced by routing rules.
     /// </summary>
     public static async Task<CoreConfigContextBuilderResult> Build(Config config, ProfileItem node)
     {
         var runCoreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
         var coreType = runCoreType == ECoreType.sing_box ? ECoreType.sing_box : ECoreType.Xray;
-        var context = new CoreConfigContext()
+        var context = new CoreConfigContext
         {
             Node = node,
             RunCoreType = runCoreType,
@@ -58,10 +45,10 @@ public class CoreConfigContextBuilder
             IsTunEnabled = config.TunModeItem.EnableTun,
             SimpleDnsItem = config.SimpleDNSItem,
             ProtectDomainList = [],
-            TunProtectSsPort = 0,
-            ProxyRelaySsPort = 0,
             RawDnsItem = await AppManager.Instance.GetDNSItem(coreType),
             RoutingItem = await ConfigHandler.GetDefaultRouting(config),
+            IsWindows = Utils.IsWindows(),
+            IsMacOS = Utils.IsMacOS(),
         };
         var validatorResult = NodeValidatorResult.Empty();
         var (actNode, nodeValidatorResult) = await ResolveNodeAsync(context, node);
@@ -74,7 +61,8 @@ public class CoreConfigContextBuilder
         if (!(context.RoutingItem?.RuleSet.IsNullOrEmpty() ?? true))
         {
             var rules = JsonUtils.Deserialize<List<RulesItem>>(context.RoutingItem?.RuleSet) ?? [];
-            foreach (var ruleItem in rules.Where(ruleItem => ruleItem.Enabled && !Global.OutboundTags.Contains(ruleItem.OutboundTag)))
+            foreach (var ruleItem in rules.Where(ruleItem =>
+                         ruleItem.Enabled && !Global.OutboundTags.Contains(ruleItem.OutboundTag)))
             {
                 if (ruleItem.OutboundTag.IsNullOrEmpty())
                 {
@@ -85,7 +73,8 @@ public class CoreConfigContextBuilder
                 var ruleOutboundNode = await AppManager.Instance.GetProfileItemViaRemarks(ruleItem.OutboundTag);
                 if (ruleOutboundNode == null)
                 {
-                    validatorResult.Warnings.Add(string.Format(ResUI.MsgRoutingRuleOutboundNodeNotFound, ruleItem.Remarks, ruleItem.OutboundTag));
+                    validatorResult.Warnings.Add(string.Format(ResUI.MsgRoutingRuleOutboundNodeNotFound,
+                        ruleItem.Remarks, ruleItem.OutboundTag));
                     ruleItem.OutboundTag = Global.ProxyTag;
                     continue;
                 }
@@ -96,7 +85,8 @@ public class CoreConfigContextBuilder
                 if (!ruleNodeValidatorResult.Success)
                 {
                     validatorResult.Warnings.AddRange(ruleNodeValidatorResult.Errors.Select(e =>
-                        string.Format(ResUI.MsgRoutingRuleOutboundNodeError, ruleItem.Remarks, ruleItem.OutboundTag, e)));
+                        string.Format(ResUI.MsgRoutingRuleOutboundNodeError, ruleItem.Remarks, ruleItem.OutboundTag,
+                            e)));
                     ruleItem.OutboundTag = Global.ProxyTag;
                     continue;
                 }
@@ -104,14 +94,28 @@ public class CoreConfigContextBuilder
                 context.AllProxiesMap[$"remark:{ruleItem.OutboundTag}"] = actRuleNode;
             }
         }
+        if (context.IsTunEnabled && context.AppConfig.TunModeItem.RouteExcludeAddress is { Count: > 0 })
+        {
+            foreach (var addr in context.AppConfig.TunModeItem.RouteExcludeAddress)
+            {
+                try
+                {
+                    IPNetwork2.Parse(addr);
+                }
+                catch
+                {
+                    validatorResult.Errors.Add(string.Format(ResUI.MsgTunRouteExcludeInvalidAddress, addr));
+                }
+            }
+        }
 
         return new CoreConfigContextBuilderResult(context, validatorResult);
     }
 
     /// <summary>
-    /// Builds the main <see cref="CoreConfigContext"/> for <paramref name="node"/> and, when
-    /// the main build succeeds, also builds the optional pre-socks context required for TUN
-    /// protection or pre-socks proxy chaining.
+    ///     Builds the main <see cref="CoreConfigContext" /> for <paramref name="node" /> and, when
+    ///     the main build succeeds, also builds the optional pre-socks context required for TUN
+    ///     protection or pre-socks proxy chaining.
     /// </summary>
     public static async Task<CoreConfigContextBuilderAllResult> BuildAll(Config config, ProfileItem node)
     {
@@ -122,12 +126,40 @@ public class CoreConfigContextBuilder
         }
 
         var preResult = await BuildPreSocksIfNeeded(mainResult.Context);
-        return new CoreConfigContextBuilderAllResult(mainResult, preResult);
+        if (preResult is null)
+        {
+            return new CoreConfigContextBuilderAllResult(mainResult, null);
+        }
+
+        var resolvedMainResult = mainResult with
+        {
+            Context = mainResult.Context with
+            {
+                IsTunEnabled = false,
+                // main core doesn't handle tun directly when pre-socks is used
+                ProtectDomainList = [.. mainResult.Context.ProtectDomainList, .. preResult.Context.ProtectDomainList],
+            },
+        };
+        if (mainResult.Context.IsTunEnabled
+            && mainResult.Context.AppConfig.TunModeItem.StrictRoute)
+        {
+            var appConfig = JsonUtils.DeepCopy(mainResult.Context.AppConfig);
+            appConfig.CoreBasicItem.BindInterface = string.Empty;
+            appConfig.CoreBasicItem.SendThrough = string.Empty;
+            resolvedMainResult = resolvedMainResult with
+            {
+                Context = resolvedMainResult.Context with
+                {
+                    AppConfig = appConfig,
+                },
+            };
+        }
+        return new CoreConfigContextBuilderAllResult(resolvedMainResult, preResult);
     }
 
     /// <summary>
-    /// Determines whether a pre-socks context is required for <paramref name="nodeContext"/>
-    /// and, if so, builds and returns it. Returns <c>null</c> when no pre-socks core is needed.
+    ///     Determines whether a pre-socks context is required for <paramref name="nodeContext" />
+    ///     and, if so, builds and returns it. Returns <c>null</c> when no pre-socks core is needed.
     /// </summary>
     private static async Task<CoreConfigContextBuilderResult?> BuildPreSocksIfNeeded(CoreConfigContext nodeContext)
     {
@@ -143,47 +175,18 @@ public class CoreConfigContextBuilder
             {
                 Context = preSocksResult.Context with
                 {
-                    ProtectDomainList = [.. nodeContext.ProtectDomainList ?? [], .. preSocksResult.Context.ProtectDomainList ?? []],
-                }
+                    ProtectDomainList =
+                    [.. nodeContext.ProtectDomainList ?? [], .. preSocksResult.Context.ProtectDomainList ?? []],
+                },
             };
         }
 
-        if (!nodeContext.IsTunEnabled
-            || coreType != ECoreType.Xray
-            || node.ConfigType == EConfigType.Custom)
-        {
-            return null;
-        }
-
-        var tunProtectSsPort = Utils.GetFreePort();
-        var proxyRelaySsPort = Utils.GetFreePort();
-        var preItem = new ProfileItem()
-        {
-            CoreType = ECoreType.sing_box,
-            ConfigType = EConfigType.Shadowsocks,
-            Address = Global.Loopback,
-            Port = proxyRelaySsPort,
-            Password = Global.None,
-        };
-        preItem.SetProtocolExtra(preItem.GetProtocolExtra() with
-        {
-            SsMethod = Global.None,
-        });
-        var preResult2 = await Build(nodeContext.AppConfig, preItem);
-        return preResult2 with
-        {
-            Context = preResult2.Context with
-            {
-                ProtectDomainList = [.. nodeContext.ProtectDomainList ?? [], .. preResult2.Context.ProtectDomainList ?? []],
-                TunProtectSsPort = tunProtectSsPort,
-                ProxyRelaySsPort = proxyRelaySsPort,
-            }
-        };
+        return null;
     }
 
     /// <summary>
-    /// Resolves a node into the context, optionally wrapping it in a subscription-level proxy chain.
-    /// Returns the effective (possibly replaced) node and the validation result.
+    ///     Resolves a node into the context, optionally wrapping it in a subscription-level proxy chain.
+    ///     Returns the effective (possibly replaced) node and the validation result.
     /// </summary>
     public static async Task<(ProfileItem, NodeValidatorResult)> ResolveNodeAsync(CoreConfigContext context,
         ProfileItem node,
@@ -218,12 +221,13 @@ public class CoreConfigContextBuilder
     }
 
     /// <summary>
-    /// If the node's subscription defines prev/next profiles, creates a virtual
-    /// <see cref="EConfigType.ProxyChain"/> node that wraps them together.
-    /// Returns <c>null</c> as the chain item when no chain is needed.
-    /// Any warnings (e.g. missing prev/next profile) are returned in the validator result.
+    ///     If the node's subscription defines prev/next profiles, creates a virtual
+    ///     <see cref="EConfigType.ProxyChain" /> node that wraps them together.
+    ///     Returns <c>null</c> as the chain item when no chain is needed.
+    ///     Any warnings (e.g. missing prev/next profile) are returned in the validator result.
     /// </summary>
-    private static async Task<(ProfileItem? ChainNode, NodeValidatorResult ValidatorResult)> BuildSubscriptionChainNodeAsync(ProfileItem node)
+    private static async Task<(ProfileItem? ChainNode, NodeValidatorResult ValidatorResult)>
+        BuildSubscriptionChainNodeAsync(ProfileItem node)
     {
         var result = NodeValidatorResult.Empty();
 
@@ -264,7 +268,7 @@ public class CoreConfigContextBuilder
         }
 
         // Build new proxy chain node
-        var chainNode = new ProfileItem()
+        var chainNode = new ProfileItem
         {
             IndexId = $"inner-{Utils.GetGuid(false)}",
             ConfigType = EConfigType.ProxyChain,
@@ -282,8 +286,8 @@ public class CoreConfigContextBuilder
     }
 
     /// <summary>
-    /// Dispatches registration to either <see cref="RegisterGroupNodeAsync"/> or
-    /// <see cref="RegisterSingleNodeAsync"/> based on the node's config type.
+    ///     Dispatches registration to either <see cref="RegisterGroupNodeAsync" /> or
+    ///     <see cref="RegisterSingleNodeAsync" /> based on the node's config type.
     /// </summary>
     private static async Task<NodeValidatorResult> RegisterNodeAsync(CoreConfigContext context, ProfileItem node)
     {
@@ -291,15 +295,12 @@ public class CoreConfigContextBuilder
         {
             return await RegisterGroupNodeAsync(context, node);
         }
-        else
-        {
-            return RegisterSingleNodeAsync(context, node);
-        }
+        return RegisterSingleNodeAsync(context, node);
     }
 
     /// <summary>
-    /// Validates a single (non-group) node and, on success, adds it to the proxy map
-    /// and records any domain addresses that should bypass the proxy.
+    ///     Validates a single (non-group) node and, on success, adds it to the proxy map
+    ///     and records any domain addresses that should bypass the proxy.
     /// </summary>
     private static NodeValidatorResult RegisterSingleNodeAsync(CoreConfigContext context, ProfileItem node)
     {
@@ -309,6 +310,11 @@ public class CoreConfigContextBuilder
         }
 
         var nodeValidatorResult = NodeValidator.Validate(node, context.RunCoreType);
+        var msgs = new List<string>([.. nodeValidatorResult.Errors, .. nodeValidatorResult.Warnings]);
+        if (msgs.Count > 0)
+        {
+            Logging.SaveLog($"{node.Remarks}: {string.Join("; ", msgs)}");
+        }
         if (!nodeValidatorResult.Success)
         {
             return nodeValidatorResult;
@@ -322,6 +328,7 @@ public class CoreConfigContextBuilder
             context.ProtectDomainList.Add(address);
         }
 
+        // ech query server name protect
         if (!node.EchConfigList.IsNullOrEmpty())
         {
             var echQuerySni = node.Sni;
@@ -338,12 +345,27 @@ public class CoreConfigContextBuilder
             }
         }
 
+        // xhttp downloadSettings address protect
+        var xhttpExtra = node.GetTransportExtra().XhttpExtra;
+        if (!string.IsNullOrEmpty(xhttpExtra)
+            && JsonUtils.ParseJson(xhttpExtra) is JsonObject extra
+            && extra.TryGetPropertyValue("downloadSettings", out var dsNode)
+            && dsNode is JsonObject downloadSettings
+            && downloadSettings.TryGetPropertyValue("address", out var dAddrNode)
+            && dAddrNode is JsonValue dAddrValue
+            && dAddrValue.TryGetValue(out string? dAddr)
+            && !string.IsNullOrEmpty(dAddr)
+            && Utils.IsDomain(dAddr))
+        {
+            context.ProtectDomainList.Add(dAddr);
+        }
+
         return nodeValidatorResult;
     }
 
     /// <summary>
-    /// Entry point for registering a group node. Initialises the visited/ancestor sets
-    /// and delegates to <see cref="TraverseGroupNodeAsync"/>.
+    ///     Entry point for registering a group node. Initialises the visited/ancestor sets
+    ///     and delegates to <see cref="TraverseGroupNodeAsync" />.
     /// </summary>
     private static async Task<NodeValidatorResult> RegisterGroupNodeAsync(CoreConfigContext context,
         ProfileItem node)
@@ -359,9 +381,9 @@ public class CoreConfigContextBuilder
     }
 
     /// <summary>
-    /// Recursively walks the children of a group node, registering valid leaf nodes
-    /// and nested groups. Detects cycles via <paramref name="ancestorsGroup"/> and
-    /// deduplicates shared nodes via <paramref name="globalVisitedGroup"/>.
+    ///     Recursively walks the children of a group node, registering valid leaf nodes
+    ///     and nested groups. Detects cycles via <paramref name="ancestorsGroup" /> and
+    ///     deduplicates shared nodes via <paramref name="globalVisitedGroup" />.
     /// </summary>
     private static async Task<NodeValidatorResult> TraverseGroupNodeAsync(
         CoreConfigContext context,
@@ -425,13 +447,10 @@ public class CoreConfigContextBuilder
             childNodeValidatorResult.Errors.Add(string.Format(ResUI.MsgGroupNoValidChildNode, node.Remarks));
             return childNodeValidatorResult;
         }
-        else
-        {
-            childNodeValidatorResult.Warnings.AddRange(childNodeValidatorResult.Errors);
-            childNodeValidatorResult.Errors.Clear();
-        }
+        childNodeValidatorResult.Warnings.AddRange(childNodeValidatorResult.Errors);
+        childNodeValidatorResult.Errors.Clear();
 
-        node.SetProtocolExtra(node.GetProtocolExtra() with { ChildItems = Utils.List2String(childIndexIdList), });
+        node.SetProtocolExtra(node.GetProtocolExtra() with { ChildItems = Utils.List2String(childIndexIdList) });
         context.AllProxiesMap[node.IndexId] = node;
         return childNodeValidatorResult;
     }

v2rayN/ServiceLib/Handler/Builder/NodeValidator.cs

@@ -20,7 +20,7 @@ public class NodeValidator
         [EConfigType.VMess, EConfigType.VLESS, EConfigType.Trojan, EConfigType.Shadowsocks];
 
     private static readonly HashSet<string> SingboxShadowsocksAllowedTransports =
-        [nameof(ETransport.tcp), nameof(ETransport.ws), nameof(ETransport.quic)];
+        [nameof(ETransport.raw), nameof(ETransport.ws)];
 
     public static NodeValidatorResult Validate(ProfileItem item, ECoreType coreType)
     {
@@ -29,35 +29,6 @@ public class NodeValidator
         return v.ToResult();
     }
 
-    private class ValidationContext
-    {
-        public List<string> Errors { get; } = [];
-        public List<string> Warnings { get; } = [];
-
-        public void Error(string message)
-        {
-            Errors.Add(message);
-        }
-
-        public void Warning(string message)
-        {
-            Warnings.Add(message);
-        }
-
-        public void Assert(bool condition, string errorMsg)
-        {
-            if (!condition)
-            {
-                Error(errorMsg);
-            }
-        }
-
-        public NodeValidatorResult ToResult()
-        {
-            return new NodeValidatorResult(Errors, Warnings);
-        }
-    }
-
     private static void ValidateNodeAndCoreSupport(ProfileItem item, ECoreType coreType, ValidationContext v)
     {
         if (item.ConfigType is EConfigType.Custom)
@@ -126,6 +97,21 @@ public class NodeValidator
                 break;
         }
 
+        if (coreType is ECoreType.Xray
+            && (protocolExtra.Flow ?? string.Empty).StartsWith("xtls", StringComparison.OrdinalIgnoreCase)
+            && item.MuxEnabled == true)
+        {
+            v.Warning(string.Format(ResUI.MsgOptionsConflict, "XTLS", "Mux.Cool"));
+        }
+
+        if (item.GetNetwork() is nameof(ETransport.ws)
+            && item.EchConfigList.IsNullOrEmpty()
+            && item.GetAlpn()?.FirstOrDefault() == "h3")
+        {
+            v.Warning(
+                "WebSocket but ALPN is set to h3, the core may ignore the ALPN setting or cause unexpected issues.");
+        }
+
         // TLS & Security
         if (item.StreamSecurity == Global.StreamSecurity)
         {
@@ -134,6 +120,25 @@ public class NodeValidator
             {
                 v.Error(string.Format(ResUI.MsgInvalidProperty, "TLS Certificate"));
             }
+
+            // Check for deprecated allowInsecure property when TLS is enabled
+            if (item.GetAllowInsecure()
+                && item.Cert.IsNullOrEmpty()
+                && item.CertSha.IsNullOrEmpty())
+            {
+                v.Warning(ResUI.MsgAllowInsecureDeprecated);
+            }
+
+            if ((coreType == ECoreType.Xray
+                && item.GetAllowInsecure()
+                && item.Cert.IsNullOrEmpty()
+                && item.CertSha.IsNullOrEmpty())
+                || (coreType == ECoreType.sing_box
+                    && item.GetAllowInsecure()
+                    && item.Cert.IsNullOrEmpty()))
+            {
+                v.Warning("Insecure configuration detected: AllowInsecure is enabled but no certificate is provided. This may cause MITM attacks.");
+            }
         }
 
         if (item.StreamSecurity == Global.StreamSecurityReality)
@@ -141,13 +146,22 @@ public class NodeValidator
             v.Assert(!item.PublicKey.IsNullOrEmpty(), string.Format(ResUI.MsgInvalidProperty, "PublicKey"));
         }
 
-        if (item.Network == nameof(ETransport.xhttp) && !item.Extra.IsNullOrEmpty())
+        var transport = item.GetTransportExtra();
+        if (item.Network == nameof(ETransport.xhttp) && !transport.XhttpExtra.IsNullOrEmpty())
         {
-            if (JsonUtils.ParseJson(item.Extra) is null)
+            if (JsonUtils.ParseJson(transport.XhttpExtra) is not JsonObject)
             {
                 v.Error(string.Format(ResUI.MsgInvalidProperty, "XHTTP Extra"));
             }
         }
+
+        if (!item.Finalmask.IsNullOrEmpty())
+        {
+            if (JsonUtils.ParseJson(item.Finalmask) is not JsonObject)
+            {
+                v.Error(string.Format(ResUI.MsgInvalidProperty, "Finalmask"));
+            }
+        }
     }
 
     private static string? ValidateSingboxTransport(EConfigType configType, string net)
@@ -159,7 +173,7 @@ public class NodeValidator
         }
 
         // sing-box does not support non-tcp transports for protocols other than vmess/trojan/vless/shadowsocks
-        if (!SingboxTransportSupportedProtocols.Contains(configType) && net != nameof(ETransport.tcp))
+        if (!SingboxTransportSupportedProtocols.Contains(configType) && net != nameof(ETransport.raw))
         {
             return string.Format(ResUI.MsgCoreNotSupportProtocolTransport,
                 nameof(ECoreType.sing_box), configType.ToString(), net);
@@ -174,4 +188,33 @@ public class NodeValidator
 
         return null;
     }
+
+    private class ValidationContext
+    {
+        public List<string> Errors { get; } = [];
+        public List<string> Warnings { get; } = [];
+
+        public void Error(string message)
+        {
+            Errors.Add(message);
+        }
+
+        public void Warning(string message)
+        {
+            Warnings.Add(message);
+        }
+
+        public void Assert(bool condition, string errorMsg)
+        {
+            if (!condition)
+            {
+                Error(errorMsg);
+            }
+        }
+
+        public NodeValidatorResult ToResult()
+        {
+            return new NodeValidatorResult(Errors, Warnings);
+        }
+    }
 }

v2rayN/ServiceLib/Handler/ConfigHandler.cs

@@ -39,15 +39,14 @@ public static class ConfigHandler
         {
             LogEnabled = false,
             Loglevel = "warning",
-            MuxEnabled = false,
         };
 
         if (config.Inbound == null)
         {
-            config.Inbound = new List<InItem>();
+            config.Inbound = [];
             InItem inItem = new()
             {
-                Protocol = EInboundProtocol.socks.ToString(),
+                Protocol = nameof(EInboundProtocol.socks),
                 LocalPort = 10808,
                 UdpEnabled = true,
                 SniffingEnabled = true,
@@ -60,7 +59,7 @@ public static class ConfigHandler
         {
             if (config.Inbound.Count > 0)
             {
-                config.Inbound.First().Protocol = EInboundProtocol.socks.ToString();
+                config.Inbound.First().Protocol = nameof(EInboundProtocol.socks);
             }
         }
 
@@ -76,10 +75,11 @@ public static class ConfigHandler
             Tti = 50,
             UplinkCapacity = 12,
             DownlinkCapacity = 100,
-            ReadBufferSize = 2,
-            WriteBufferSize = 2,
-            Congestion = false
+            CwndMultiplier = 1,
+            MaxSendingWindow = 2 * 1024 * 1024,
         };
+        config.KcpItem.CwndMultiplier = config.KcpItem.CwndMultiplier <= 0 ? 1 : config.KcpItem.CwndMultiplier;
+        config.KcpItem.MaxSendingWindow = config.KcpItem.MaxSendingWindow <= 0 ? (2 * 1024 * 1024) : config.KcpItem.MaxSendingWindow;
         config.GrpcItem ??= new GrpcItem
         {
             IdleTimeout = 60,
@@ -91,13 +91,15 @@ public static class ConfigHandler
         {
             EnableTun = false,
             Mtu = 9000,
+            IcmpRouting = Global.TunIcmpRoutingPolicies.First(),
+            EnableLegacyProtect = false,
         };
         config.GuiItem ??= new();
         config.MsgUIItem ??= new();
 
         config.UiItem ??= new();
-        config.UiItem.MainColumnItem ??= new();
-        config.UiItem.WindowSizeItem ??= new();
+        config.UiItem.MainColumnItem ??= [];
+        config.UiItem.WindowSizeItem ??= [];
 
         if (config.UiItem.CurrentLanguage.IsNullOrEmpty())
         {
@@ -131,6 +133,10 @@ public static class ConfigHandler
         {
             config.SpeedTestItem.MixedConcurrencyCount = 5;
         }
+        if (config.SpeedTestItem.UdpTestTarget.IsNullOrEmpty())
+        {
+            config.SpeedTestItem.UdpTestTarget = Global.UdpTestTargets.First();
+        }
 
         config.Mux4RayItem ??= new()
         {
@@ -151,17 +157,21 @@ public static class ConfigHandler
             DownMbps = 100
         };
         config.ClashUIItem ??= new();
-        config.ClashUIItem.ConnectionsColumnItem ??= new();
+        config.ClashUIItem.ConnectionsColumnItem ??= [];
         config.SystemProxyItem ??= new();
         config.WebDavItem ??= new();
         config.CheckUpdateItem ??= new();
+        config.NetBridgeItem ??= new()
+        {
+            RuleProcess = string.Empty
+        };
         config.Fragment4RayItem ??= new()
         {
             Packets = "tlshello",
-            Length = "100-200",
+            Length = "50-100",
             Interval = "10-20"
         };
-        config.GlobalHotkeys ??= new();
+        config.GlobalHotkeys ??= [];
 
         if (config.SystemProxyItem.SystemProxyExceptions.IsNullOrEmpty())
         {
@@ -233,9 +243,6 @@ public static class ConfigHandler
             item.Password = profileItem.Password;
 
             item.Network = profileItem.Network;
-            item.HeaderType = profileItem.HeaderType;
-            item.RequestHost = profileItem.RequestHost;
-            item.Path = profileItem.Path;
 
             item.StreamSecurity = profileItem.StreamSecurity;
             item.Sni = profileItem.Sni;
@@ -247,14 +254,14 @@ public static class ConfigHandler
             item.ShortId = profileItem.ShortId;
             item.SpiderX = profileItem.SpiderX;
             item.Mldsa65Verify = profileItem.Mldsa65Verify;
-            item.Extra = profileItem.Extra;
             item.MuxEnabled = profileItem.MuxEnabled;
             item.Cert = profileItem.Cert;
             item.CertSha = profileItem.CertSha;
             item.EchConfigList = profileItem.EchConfigList;
-            item.EchForceQuery = profileItem.EchForceQuery;
+            item.VerifyPeerCertByName = profileItem.VerifyPeerCertByName;
             item.Finalmask = profileItem.Finalmask;
             item.ProtoExtra = profileItem.ProtoExtra;
+            item.TransportExtra = profileItem.TransportExtra;
         }
 
         var ret = item.ConfigType switch
@@ -269,6 +276,7 @@ public static class ConfigHandler
             EConfigType.TUIC => await AddTuicServer(config, item),
             EConfigType.WireGuard => await AddWireguardServer(config, item),
             EConfigType.Anytls => await AddAnytlsServer(config, item),
+            EConfigType.Naive => await AddNaiveServer(config, item),
             _ => -1,
         };
         return ret;
@@ -293,9 +301,6 @@ public static class ConfigHandler
             VmessSecurity = profileItem.GetProtocolExtra().VmessSecurity?.TrimEx()
         });
         profileItem.Network = profileItem.Network.TrimEx();
-        profileItem.HeaderType = profileItem.HeaderType.TrimEx();
-        profileItem.RequestHost = profileItem.RequestHost.TrimEx();
-        profileItem.Path = profileItem.Path.TrimEx();
         profileItem.StreamSecurity = profileItem.StreamSecurity.TrimEx();
 
         if (!Global.VmessSecurities.Contains(profileItem.GetProtocolExtra().VmessSecurity))
@@ -703,10 +708,12 @@ public static class ConfigHandler
     public static async Task<int> AddHysteria2Server(Config config, ProfileItem profileItem, bool toFile = true)
     {
         profileItem.ConfigType = EConfigType.Hysteria2;
-        //profileItem.CoreType = ECoreType.sing_box;
 
         profileItem.Address = profileItem.Address.TrimEx();
         profileItem.Password = profileItem.Password.TrimEx();
+        profileItem.Fingerprint = string.Empty;
+        profileItem.Alpn = string.Empty;
+        //profileItem.Alpn = "h3";
         profileItem.Network = string.Empty;
 
         if (profileItem.StreamSecurity.IsNullOrEmpty())
@@ -746,11 +753,14 @@ public static class ConfigHandler
         profileItem.Username = profileItem.Username.TrimEx();
         profileItem.Password = profileItem.Password.TrimEx();
         profileItem.Network = string.Empty;
+        profileItem.Fingerprint = string.Empty;
 
-        if (!Global.TuicCongestionControls.Contains(profileItem.HeaderType))
+        var congestionControl = profileItem.GetProtocolExtra().CongestionControl;
+        if (!Global.TuicCongestionControls.Contains(congestionControl))
         {
-            profileItem.HeaderType = Global.TuicCongestionControls.FirstOrDefault()!;
+            congestionControl = Global.TuicCongestionControls.FirstOrDefault()!;
         }
+        profileItem.SetProtocolExtra(profileItem.GetProtocolExtra() with { CongestionControl = congestionControl });
 
         if (profileItem.StreamSecurity.IsNullOrEmpty())
         {
@@ -784,12 +794,30 @@ public static class ConfigHandler
 
         profileItem.Address = profileItem.Address.TrimEx();
         profileItem.Password = profileItem.Password.TrimEx();
+        var wgReserved = profileItem.GetProtocolExtra().WgReserved?.TrimEx();
+        if (!wgReserved.IsNullOrEmpty()
+            && !wgReserved.Contains(','))
+        {
+            // Base64 format, convert to standard format
+            try
+            {
+                var bytes = Convert.FromBase64String(wgReserved);
+                var reserved = new byte[3];
+                Array.Copy(bytes, reserved, Math.Min(bytes.Length, 3));
+
+                wgReserved = string.Join(", ", reserved);
+            }
+            catch
+            {
+                // If conversion fails, keep the original value
+            }
+        }
         profileItem.SetProtocolExtra(profileItem.GetProtocolExtra() with
         {
             WgPublicKey = profileItem.GetProtocolExtra().WgPublicKey?.TrimEx(),
             WgPresharedKey = profileItem.GetProtocolExtra().WgPresharedKey?.TrimEx(),
             WgInterfaceAddress = profileItem.GetProtocolExtra().WgInterfaceAddress?.TrimEx(),
-            WgReserved = profileItem.GetProtocolExtra().WgReserved?.TrimEx(),
+            WgReserved = wgReserved,
             WgMtu = profileItem.GetProtocolExtra().WgMtu is null or <= 0 ? Global.TunMtus.First() : profileItem.GetProtocolExtra().WgMtu,
         });
 
@@ -804,7 +832,7 @@ public static class ConfigHandler
     }
 
     /// <summary>
-    /// Add or edit a Anytls server
+    /// Add or edit an Anytls server
     /// Validates and processes Anytls-specific settings
     /// </summary>
     /// <param name="config">Current configuration</param>
@@ -831,6 +859,38 @@ public static class ConfigHandler
         return 0;
     }
 
+    /// <summary>
+    /// Add or edit a Naive server
+    /// Validates and processes Naive-specific settings
+    /// </summary>
+    /// <param name="config">Current configuration</param>
+    /// <param name="profileItem">Naive profile to add</param>
+    /// <param name="toFile">Whether to save to file</param>
+    /// <returns>0 if successful, -1 if failed</returns>
+    public static async Task<int> AddNaiveServer(Config config, ProfileItem profileItem, bool toFile = true)
+    {
+        profileItem.ConfigType = EConfigType.Naive;
+        profileItem.CoreType = ECoreType.sing_box;
+
+        profileItem.Address = profileItem.Address.TrimEx();
+        profileItem.Username = profileItem.Username.TrimEx();
+        profileItem.Password = profileItem.Password.TrimEx();
+        profileItem.Fingerprint = string.Empty;
+        profileItem.Alpn = string.Empty;
+        profileItem.Network = string.Empty;
+        profileItem.AllowInsecure = string.Empty;
+        if (profileItem.StreamSecurity.IsNullOrEmpty())
+        {
+            profileItem.StreamSecurity = Global.StreamSecurity;
+        }
+        if (profileItem.Password.IsNullOrEmpty())
+        {
+            return -1;
+        }
+        await AddServerCommon(config, profileItem, toFile);
+        return 0;
+    }
+
     /// <summary>
     /// Sort the server list by the specified column
     /// Updates the sort order in the profile extension data
@@ -867,6 +927,7 @@ public static class ConfigHandler
                               Delay = t33?.Delay ?? 0,
                               Speed = t33?.Speed ?? 0,
                               Sort = t33?.Sort ?? 0,
+                              IpInfo = t33?.IpInfo ?? string.Empty,
                               TodayDown = (t22?.TodayDown ?? 0).ToString("D16"),
                               TodayUp = (t22?.TodayUp ?? 0).ToString("D16"),
                               TotalDown = (t22?.TotalDown ?? 0).ToString("D16"),
@@ -887,6 +948,7 @@ public static class ConfigHandler
                 EServerColName.StreamSecurity => lstProfile.OrderBy(t => t.StreamSecurity).ToList(),
                 EServerColName.DelayVal => lstProfile.OrderBy(t => t.Delay).ToList(),
                 EServerColName.SpeedVal => lstProfile.OrderBy(t => t.Speed).ToList(),
+                EServerColName.IpInfo => lstProfile.OrderBy(t => t.IpInfo).ToList(),
                 EServerColName.SubRemarks => lstProfile.OrderBy(t => t.Subid).ToList(),
                 EServerColName.TodayDown => lstProfile.OrderBy(t => t.TodayDown).ToList(),
                 EServerColName.TodayUp => lstProfile.OrderBy(t => t.TodayUp).ToList(),
@@ -907,6 +969,7 @@ public static class ConfigHandler
                 EServerColName.StreamSecurity => lstProfile.OrderByDescending(t => t.StreamSecurity).ToList(),
                 EServerColName.DelayVal => lstProfile.OrderByDescending(t => t.Delay).ToList(),
                 EServerColName.SpeedVal => lstProfile.OrderByDescending(t => t.Speed).ToList(),
+                EServerColName.IpInfo => lstProfile.OrderByDescending(t => t.IpInfo).ToList(),
                 EServerColName.SubRemarks => lstProfile.OrderByDescending(t => t.Subid).ToList(),
                 EServerColName.TodayDown => lstProfile.OrderByDescending(t => t.TodayDown).ToList(),
                 EServerColName.TodayUp => lstProfile.OrderByDescending(t => t.TodayUp).ToList(),
@@ -962,9 +1025,6 @@ public static class ConfigHandler
         profileItem.Address = profileItem.Address.TrimEx();
         profileItem.Password = profileItem.Password.TrimEx();
         profileItem.Network = profileItem.Network.TrimEx();
-        profileItem.HeaderType = profileItem.HeaderType.TrimEx();
-        profileItem.RequestHost = profileItem.RequestHost.TrimEx();
-        profileItem.Path = profileItem.Path.TrimEx();
         profileItem.StreamSecurity = profileItem.StreamSecurity.TrimEx();
 
         var vlessEncryption = profileItem.GetProtocolExtra().VlessEncryption?.TrimEx();
@@ -1000,8 +1060,8 @@ public static class ConfigHandler
             return new Tuple<int, int>(0, 0);
         }
 
-        List<ProfileItem> lstKeep = new();
-        List<ProfileItem> lstRemove = new();
+        List<ProfileItem> lstKeep = [];
+        List<ProfileItem> lstRemove = [];
         if (!config.GuiItem.KeepOlderDedupl)
         {
             lstProfile.Reverse();
@@ -1009,13 +1069,19 @@ public static class ConfigHandler
 
         foreach (var item in lstProfile)
         {
-            if (!lstKeep.Exists(i => CompareProfileItem(i, item, false)))
+            if (item.IsComplex())
             {
                 lstKeep.Add(item);
+                continue;
+            }
+
+            if (lstKeep.Exists(i => CompareProfileItem(i, item, false)))
+            {
+                lstRemove.Add(item);
             }
             else
             {
-                lstRemove.Add(item);
+                lstKeep.Add(item);
             }
         }
         await RemoveServers(config, lstRemove);
@@ -1033,7 +1099,7 @@ public static class ConfigHandler
     /// <returns>0 if successful</returns>
     public static async Task<int> AddServerCommon(Config config, ProfileItem profileItem, bool toFile = true)
     {
-        profileItem.ConfigVersion = 3;
+        profileItem.ConfigVersion = 4;
 
         if (profileItem.StreamSecurity.IsNotEmpty())
         {
@@ -1044,10 +1110,6 @@ public static class ConfigHandler
             }
             else
             {
-                if (profileItem.AllowInsecure.IsNullOrEmpty())
-                {
-                    profileItem.AllowInsecure = config.CoreBasicItem.DefAllowInsecure.ToString().ToLower();
-                }
                 if (profileItem.Fingerprint.IsNullOrEmpty() && profileItem.StreamSecurity == Global.StreamSecurityReality)
                 {
                     profileItem.Fingerprint = config.CoreBasicItem.DefFingerprint;
@@ -1077,7 +1139,8 @@ public static class ConfigHandler
 
         if (toFile)
         {
-            profileItem.SetProtocolExtra();
+            //profileItem.SetProtocolExtra();
+            profileItem.SetProtocolExtra(profileItem.GetProtocolExtra());
             await SQLiteHelper.Instance.ReplaceAsync(profileItem);
         }
         return 0;
@@ -1100,18 +1163,28 @@ public static class ConfigHandler
 
         var oProtocolExtra = o.GetProtocolExtra();
         var nProtocolExtra = n.GetProtocolExtra();
+        var oTransport = o.GetTransportExtra();
+        var nTransport = n.GetTransportExtra();
 
         return o.ConfigType == n.ConfigType
                && AreEqual(o.Address, n.Address)
                && o.Port == n.Port
                && AreEqual(o.Password, n.Password)
+               && AreEqual(o.Username, n.Username)
                && AreEqual(oProtocolExtra.VlessEncryption, nProtocolExtra.VlessEncryption)
                && AreEqual(oProtocolExtra.SsMethod, nProtocolExtra.SsMethod)
                && AreEqual(oProtocolExtra.VmessSecurity, nProtocolExtra.VmessSecurity)
                && AreEqual(o.Network, n.Network)
-               && AreEqual(o.HeaderType, n.HeaderType)
-               && AreEqual(o.RequestHost, n.RequestHost)
-               && AreEqual(o.Path, n.Path)
+               && AreEqual(oTransport.RawHeaderType, nTransport.RawHeaderType)
+               && AreEqual(oTransport.Host, nTransport.Host)
+               && AreEqual(oTransport.Path, nTransport.Path)
+               && AreEqual(oTransport.XhttpMode, nTransport.XhttpMode)
+               && AreEqual(oTransport.XhttpExtra, nTransport.XhttpExtra)
+               && AreEqual(oTransport.GrpcAuthority, nTransport.GrpcAuthority)
+               && AreEqual(oTransport.GrpcServiceName, nTransport.GrpcServiceName)
+               && AreEqual(oTransport.GrpcMode, nTransport.GrpcMode)
+               && AreEqual(oTransport.KcpHeaderType, nTransport.KcpHeaderType)
+               && AreEqual(oTransport.KcpSeed, nTransport.KcpSeed)
                && (o.ConfigType == EConfigType.Trojan || o.StreamSecurity == n.StreamSecurity)
                && AreEqual(oProtocolExtra.Flow, nProtocolExtra.Flow)
                && AreEqual(oProtocolExtra.SalamanderPass, nProtocolExtra.SalamanderPass)
@@ -1380,19 +1453,34 @@ public static class ConfigHandler
     /// <returns>A SOCKS profile item or null if not needed</returns>
     public static ProfileItem? GetPreSocksItem(Config config, ProfileItem node, ECoreType coreType)
     {
-        if (node.ConfigType != EConfigType.Custom || !(node.PreSocksPort > 0))
-        {
-            return null;
-        }
         ProfileItem? itemSocks = null;
-        var preCoreType = AppManager.Instance.RunningCoreType = config.TunModeItem.EnableTun ? ECoreType.sing_box : ECoreType.Xray;
-        itemSocks = new ProfileItem()
+        var enableLegacyProtect = config.TunModeItem.EnableLegacyProtect
+                                  || Utils.IsNonWindows();
+        if (node.ConfigType != EConfigType.Custom
+            && coreType != ECoreType.sing_box
+            && config.TunModeItem.EnableTun
+            && enableLegacyProtect)
         {
-            CoreType = preCoreType,
-            ConfigType = EConfigType.SOCKS,
-            Address = Global.Loopback,
-            Port = node.PreSocksPort.Value,
-        };
+            itemSocks = new ProfileItem()
+            {
+                CoreType = ECoreType.sing_box,
+                ConfigType = EConfigType.SOCKS,
+                Address = Global.Loopback,
+                Port = AppManager.Instance.GetLocalPort(EInboundProtocol.socks)
+            };
+        }
+        else if (node.ConfigType == EConfigType.Custom
+            && node.PreSocksPort is > 0 and <= 65535)
+        {
+            var preCoreType = config.TunModeItem.EnableTun ? ECoreType.sing_box : ECoreType.Xray;
+            itemSocks = new ProfileItem()
+            {
+                CoreType = preCoreType,
+                ConfigType = EConfigType.SOCKS,
+                Address = Global.Loopback,
+                Port = node.PreSocksPort.Value,
+            };
+        }
         return itemSocks;
     }
 
@@ -1443,15 +1531,13 @@ public static class ConfigHandler
         }
 
         var subFilter = string.Empty;
-        //remove sub items
         if (isSub && subid.IsNotEmpty())
         {
-            await RemoveServersViaSubid(config, subid, isSub);
             subFilter = (await AppManager.Instance.GetSubItem(subid))?.Filter ?? "";
         }
 
         var countServers = 0;
-        List<ProfileItem> lstAdd = new();
+        List<ProfileItem> lstAdd = [];
         var arrData = strData.Split(Environment.NewLine.ToCharArray()).Where(t => !t.IsNullOrEmpty());
         if (isSub)
         {
@@ -1496,6 +1582,7 @@ public static class ConfigHandler
                 EConfigType.TUIC => await AddTuicServer(config, profileItem, false),
                 EConfigType.WireGuard => await AddWireguardServer(config, profileItem, false),
                 EConfigType.Anytls => await AddAnytlsServer(config, profileItem, false),
+                EConfigType.Naive => await AddNaiveServer(config, profileItem, false),
                 _ => -1,
             };
 
@@ -1546,12 +1633,8 @@ public static class ConfigHandler
         {
             lstProfiles = V2rayFmt.ResolveFullArray(strData, subRemarks);
         }
-        if (lstProfiles != null && lstProfiles.Count > 0)
+        if (lstProfiles is { Count: > 0 })
         {
-            if (isSub && subid.IsNotEmpty())
-            {
-                await RemoveServersViaSubid(config, subid, isSub);
-            }
             var count = 0;
             foreach (var it in lstProfiles)
             {
@@ -1571,40 +1654,23 @@ public static class ConfigHandler
 
         ProfileItem? profileItem = null;
         //Is sing-box configuration
-        if (profileItem is null)
-        {
-            profileItem = SingboxFmt.ResolveFull(strData, subRemarks);
-        }
+        profileItem ??= SingboxFmt.ResolveFull(strData, subRemarks);
         //Is v2ray configuration
-        if (profileItem is null)
-        {
-            profileItem = V2rayFmt.ResolveFull(strData, subRemarks);
-        }
+        profileItem ??= V2rayFmt.ResolveFull(strData, subRemarks);
         //Is Html Page
         if (profileItem is null && HtmlPageFmt.IsHtmlPage(strData))
         {
             return -1;
         }
         //Is Clash configuration
-        if (profileItem is null)
-        {
-            profileItem = ClashFmt.ResolveFull(strData, subRemarks);
-        }
+        profileItem ??= ClashFmt.ResolveFull(strData, subRemarks);
         //Is hysteria configuration
-        if (profileItem is null)
-        {
-            profileItem = Hysteria2Fmt.ResolveFull2(strData, subRemarks);
-        }
+        profileItem ??= Hysteria2Fmt.ResolveFull2(strData, subRemarks);
         if (profileItem is null || profileItem.Address.IsNullOrEmpty())
         {
             return -1;
         }
 
-        if (isSub && subid.IsNotEmpty())
-        {
-            await RemoveServersViaSubid(config, subid, isSub);
-        }
-
         profileItem.Subid = subid;
         profileItem.IsSub = isSub;
         profileItem.PreSocksPort = preSocksPort;
@@ -1634,11 +1700,6 @@ public static class ConfigHandler
             return -1;
         }
 
-        if (isSub && subid.IsNotEmpty())
-        {
-            await RemoveServersViaSubid(config, subid, isSub);
-        }
-
         var lstSsServer = ShadowsocksFmt.ResolveSip008(strData);
         if (lstSsServer?.Count > 0)
         {
@@ -1659,6 +1720,86 @@ public static class ConfigHandler
         return -1;
     }
 
+    private static async Task<int> AddBatchServers4Wireguard(Config config, string strData, string subid, bool isSub)
+    {
+        if (strData.IsNullOrEmpty())
+        {
+            return -1;
+        }
+        if (!(strData.Contains("[Interface]", StringComparison.OrdinalIgnoreCase)
+              && strData.Contains("[Peer]", StringComparison.OrdinalIgnoreCase)))
+        {
+            return -1;
+        }
+        var lstServer = WireguardFmt.ResolveConfig(strData);
+        if (lstServer?.Count > 0)
+        {
+            var counter = 0;
+            foreach (var item in lstServer)
+            {
+                item.Subid = subid;
+                item.IsSub = isSub;
+                if (await AddWireguardServer(config, item) == 0)
+                {
+                    counter++;
+                }
+            }
+            await SaveConfig(config);
+            return counter;
+        }
+        return -1;
+    }
+
+    private static async Task<int> AddBatchServers4InnerUri(Config config, string strData, string subid, bool isSub)
+    {
+        if (strData.IsNullOrEmpty())
+        {
+            return -1;
+        }
+
+        var lstServer = InnerFmt.Resolve(strData, subid);
+        if (lstServer?.Count > 0)
+        {
+            var counter = 0;
+            List<ProfileItem> lstAdd = [];
+            foreach (var profileItem in lstServer)
+            {
+                profileItem.Subid = subid;
+                profileItem.IsSub = isSub;
+
+                var addStatus = profileItem.ConfigType switch
+                {
+                    EConfigType.VMess => await AddVMessServer(config, profileItem, false),
+                    EConfigType.Shadowsocks => await AddShadowsocksServer(config, profileItem, false),
+                    EConfigType.HTTP => await AddHttpServer(config, profileItem, false),
+                    EConfigType.SOCKS => await AddSocksServer(config, profileItem, false),
+                    EConfigType.Trojan => await AddTrojanServer(config, profileItem, false),
+                    EConfigType.VLESS => await AddVlessServer(config, profileItem, false),
+                    EConfigType.Hysteria2 => await AddHysteria2Server(config, profileItem, false),
+                    EConfigType.TUIC => await AddTuicServer(config, profileItem, false),
+                    EConfigType.WireGuard => await AddWireguardServer(config, profileItem, false),
+                    EConfigType.Anytls => await AddAnytlsServer(config, profileItem, false),
+                    EConfigType.Naive => await AddNaiveServer(config, profileItem, false),
+                    EConfigType.PolicyGroup or EConfigType.ProxyChain => await AddServerCommon(config, profileItem, false),
+                    _ => -1,
+                };
+                if (addStatus == 0)
+                {
+                    counter++;
+                    lstAdd.Add(profileItem);
+                }
+            }
+            if (lstAdd.Count > 0)
+            {
+                await SQLiteHelper.Instance.InsertAllAsync(lstAdd);
+            }
+            await SaveConfig(config);
+            return counter;
+        }
+
+        return -1;
+    }
+
     /// <summary>
     /// Main entry point for adding batch servers from various formats
     /// Tries different parsing methods to import as many servers as possible
@@ -1680,6 +1821,7 @@ public static class ConfigHandler
         {
             lstOriSub = await AppManager.Instance.ProfileItems(subid);
             activeProfile = lstOriSub?.FirstOrDefault(t => t.IndexId == config.IndexId);
+            await RemoveServersViaSubid(config, subid, true);
         }
 
         var counter = 0;
@@ -1701,6 +1843,38 @@ public static class ConfigHandler
             counter = await AddBatchServers4SsSIP008(config, strData, subid, isSub);
         }
 
+        //maybe wireguard config
+        if (counter < 1)
+        {
+            counter = await AddBatchServers4Wireguard(config, strData, subid, isSub);
+        }
+
+        //May be standard uri mixed with internal uri
+        var innerUriCount = 0;
+        if (Utils.IsBase64String(strData))
+        {
+            innerUriCount = await AddBatchServers4InnerUri(config, Utils.Base64Decode(strData), subid, isSub);
+        }
+        if (innerUriCount < 1)
+        {
+            innerUriCount = await AddBatchServers4InnerUri(config, strData, subid, isSub);
+        }
+        if (innerUriCount < 1)
+        {
+            innerUriCount = await AddBatchServers4InnerUri(config, Utils.Base64Decode(strData), subid, isSub);
+        }
+        if (innerUriCount > 0)
+        {
+            if (counter > 0)
+            {
+                counter += innerUriCount;
+            }
+            else
+            {
+                counter = innerUriCount;
+            }
+        }
+
         //maybe other sub
         if (counter < 1)
         {
@@ -1881,6 +2055,12 @@ public static class ConfigHandler
         await SQLiteHelper.Instance.DeleteAsync(item);
         await RemoveServersViaSubid(config, id, false);
 
+        if (item.Id == config.SubIndexId)
+        {
+            var subs = await AppManager.Instance.SubItems();
+            config.SubIndexId = subs.LastOrDefault()?.Id;
+        }
+
         return 0;
     }
 

v2rayN/ServiceLib/Handler/ConnectionHandler.cs

@@ -4,53 +4,41 @@ public static class ConnectionHandler
 {
     private static readonly string _tag = "ConnectionHandler";
 
+    /// <summary>
+    /// Runs ping and IP checks and returns a formatted result string.
+    /// </summary>
     public static async Task<string> RunAvailabilityCheck()
     {
         var time = await GetRealPingTimeInfo();
-        var ip = time > 0 ? await GetIPInfo() ?? Global.None : Global.None;
+        var ip = time > 0 ? await GetIPInfo() : Global.None;
 
         return string.Format(ResUI.TestMeOutput, time, ip);
     }
 
+    /// <summary>
+    /// Gets IP information using the default local proxy.
+    /// </summary>
     private static async Task<string?> GetIPInfo()
     {
-        var url = AppManager.Instance.Config.SpeedTestItem.IPAPIUrl;
-        if (url.IsNullOrEmpty())
-        {
-            return null;
-        }
+        var webProxy = await GetWebProxy();
 
-        var downloadHandle = new DownloadService();
-        var result = await downloadHandle.TryDownloadString(url, true, "");
-        if (result == null)
-        {
-            return null;
-        }
-
-        var ipInfo = JsonUtils.Deserialize<IPAPIInfo>(result);
-        if (ipInfo == null)
-        {
-            return null;
-        }
-
-        var ip = ipInfo.ip ?? ipInfo.clientIp ?? ipInfo.ip_addr ?? ipInfo.query;
-        var country = ipInfo.country_code ?? ipInfo.country ?? ipInfo.countryCode ?? ipInfo.location?.country_code;
-
-        return $"({country ?? "unknown"}) {ip}";
+        var ipInfo = await GetIPInfo(webProxy);
+        return ipInfo?.ToString() ?? Global.None;
     }
 
+    /// <summary>
+    /// Measures real ping time using configured test URL.
+    /// </summary>
     private static async Task<int> GetRealPingTimeInfo()
     {
         var responseTime = -1;
         try
         {
-            var port = AppManager.Instance.GetLocalPort(EInboundProtocol.socks);
-            var webProxy = new WebProxy($"socks5://{Global.Loopback}:{port}");
-            var url = AppManager.Instance.Config.SpeedTestItem.SpeedPingTestUrl;
+            var webProxy = await GetWebProxy();
 
             for (var i = 0; i < 2; i++)
             {
-                responseTime = await GetRealPingTime(url, webProxy, 10);
+                responseTime = await GetRealPingTime(webProxy, 10);
                 if (responseTime > 0)
                 {
                     break;
@@ -66,8 +54,21 @@ public static class ConnectionHandler
         return responseTime;
     }
 
-    public static async Task<int> GetRealPingTime(string url, IWebProxy? webProxy, int downloadTimeout)
+    /// <summary>
+    /// Creates local SOCKS proxy instance.
+    /// </summary>
+    private static async Task<WebProxy?> GetWebProxy()
     {
+        var port = AppManager.Instance.GetLocalPort(EInboundProtocol.socks);
+        return new WebProxy($"socks5://{Global.Loopback}:{port}");
+    }
+
+    /// <summary>
+    /// Measures response time by sending HTTP requests through proxy.
+    /// </summary>
+    public static async Task<int> GetRealPingTime(IWebProxy? webProxy, int downloadTimeout)
+    {
+        var url = AppManager.Instance.Config.SpeedTestItem.SpeedPingTestUrl;
         var responseTime = -1;
         try
         {
@@ -79,14 +80,14 @@ public static class ConnectionHandler
                 UseProxy = webProxy != null
             });
 
-            List<int> oneTime = new();
+            List<int> oneTime = [];
             for (var i = 0; i < 2; i++)
             {
                 var timer = Stopwatch.StartNew();
                 await client.GetAsync(url, cts.Token).ConfigureAwait(false);
                 timer.Stop();
                 oneTime.Add((int)timer.Elapsed.TotalMilliseconds);
-                await Task.Delay(100);
+                await Task.Delay(100, cts.Token);
             }
             responseTime = oneTime.Where(x => x > 0).OrderBy(x => x).FirstOrDefault();
         }
@@ -95,4 +96,41 @@ public static class ConnectionHandler
         }
         return responseTime;
     }
+
+    /// <summary>
+    /// Gets IP and country information through specified proxy.
+    /// </summary>
+    public static async Task<IpInfoResult?> GetIPInfo(IWebProxy? webProxy)
+    {
+        try
+        {
+            var url = AppManager.Instance.Config.SpeedTestItem.IPAPIUrl;
+            if (url.IsNullOrEmpty())
+            {
+                return null;
+            }
+
+            var downloadHandle = new DownloadService();
+            var result = await downloadHandle.TryDownloadString(url, webProxy, "");
+            if (result == null)
+            {
+                return null;
+            }
+
+            var ipInfo = JsonUtils.Deserialize<IPAPIInfo>(result);
+            if (ipInfo == null)
+            {
+                return null;
+            }
+
+            var ip = ipInfo.ip ?? ipInfo.clientIp ?? ipInfo.ip_addr ?? ipInfo.query;
+            var country = ipInfo.country_code ?? ipInfo.country ?? ipInfo.countryCode ?? ipInfo.location?.country_code ?? "unknown";
+
+            return new IpInfoResult(country, ip);
+        }
+        catch
+        {
+            return null;
+        }
+    }
 }

v2rayN/ServiceLib/Handler/Fmt/BaseFmt.cs

@@ -6,6 +6,8 @@ public class BaseFmt
 {
     private static readonly string[] _allowInsecureArray = new[] { "insecure", "allowInsecure", "allow_insecure" };
 
+    private static string UrlEncodeSafe(string? value) => Utils.UrlEncode(value ?? string.Empty);
+
     protected static string GetIpv6(string address)
     {
         if (Utils.IsIpv6(address))
@@ -21,6 +23,8 @@ public class BaseFmt
 
     protected static int ToUriQuery(ProfileItem item, string? securityDef, ref Dictionary<string, string> dicQuery)
     {
+        var transport = item.GetTransportExtra();
+
         if (item.StreamSecurity.IsNotEmpty())
         {
             dicQuery.Add("security", item.StreamSecurity);
@@ -69,6 +73,10 @@ public class BaseFmt
         {
             dicQuery.Add("ech", Utils.UrlEncode(item.EchConfigList));
         }
+        if (item.VerifyPeerCertByName.IsNotEmpty())
+        {
+            dicQuery.Add("vcn", Utils.UrlEncode(item.VerifyPeerCertByName));
+        }
         if (item.CertSha.IsNotEmpty())
         {
             dicQuery.Add("pcs", Utils.UrlEncode(item.CertSha));
@@ -87,54 +95,69 @@ public class BaseFmt
             dicQuery.Add("fm", Utils.UrlEncode(finalmask));
         }
 
-        dicQuery.Add("type", item.Network.IsNotEmpty() ? item.Network : nameof(ETransport.tcp));
-
-        switch (item.Network)
+        var network = item.GetNetwork();
+        if (!Global.Networks.Contains(network))
         {
-            case nameof(ETransport.tcp):
-                dicQuery.Add("headerType", item.HeaderType.IsNotEmpty() ? item.HeaderType : Global.None);
-                if (item.RequestHost.IsNotEmpty())
+            network = nameof(ETransport.raw);
+        }
+
+        //dicQuery.Add("type", network);
+        dicQuery.Add("type", network == nameof(ETransport.raw) ? Global.RawNetworkAlias : network);
+
+        switch (network)
+        {
+            case nameof(ETransport.raw):
+                dicQuery.Add("headerType", transport.RawHeaderType.IsNotEmpty() ? transport.RawHeaderType : Global.None);
+                if (transport.Host.IsNotEmpty())
                 {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
+                    dicQuery.Add("host", UrlEncodeSafe(transport.Host));
+                }
+                if (transport.Path.IsNotEmpty())
+                {
+                    dicQuery.Add("path", UrlEncodeSafe(transport.Path));
                 }
                 break;
 
             case nameof(ETransport.kcp):
-                dicQuery.Add("headerType", item.HeaderType.IsNotEmpty() ? item.HeaderType : Global.None);
-                if (item.Path.IsNotEmpty())
+                dicQuery.Add("headerType", transport.KcpHeaderType.IsNotEmpty() ? transport.KcpHeaderType : Global.None);
+                if (transport.KcpSeed.IsNotEmpty())
                 {
-                    dicQuery.Add("seed", Utils.UrlEncode(item.Path));
+                    dicQuery.Add("seed", UrlEncodeSafe(transport.KcpSeed));
+                }
+                if (transport.KcpMtu > 0)
+                {
+                    dicQuery.Add("mtu", transport.KcpMtu.ToString());
                 }
                 break;
 
             case nameof(ETransport.ws):
             case nameof(ETransport.httpupgrade):
-                if (item.RequestHost.IsNotEmpty())
+                if (transport.Host.IsNotEmpty())
                 {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
+                    dicQuery.Add("host", UrlEncodeSafe(transport.Host));
                 }
-                if (item.Path.IsNotEmpty())
+                if (transport.Path.IsNotEmpty())
                 {
-                    dicQuery.Add("path", Utils.UrlEncode(item.Path));
+                    dicQuery.Add("path", UrlEncodeSafe(transport.Path));
                 }
                 break;
 
             case nameof(ETransport.xhttp):
-                if (item.RequestHost.IsNotEmpty())
+                if (transport.Host.IsNotEmpty())
                 {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
+                    dicQuery.Add("host", UrlEncodeSafe(transport.Host));
                 }
-                if (item.Path.IsNotEmpty())
+                if (transport.Path.IsNotEmpty())
                 {
-                    dicQuery.Add("path", Utils.UrlEncode(item.Path));
+                    dicQuery.Add("path", UrlEncodeSafe(transport.Path));
                 }
-                if (item.HeaderType.IsNotEmpty() && Global.XhttpMode.Contains(item.HeaderType))
+                if (transport.XhttpMode.IsNotEmpty() && Global.XhttpMode.Contains(transport.XhttpMode))
                 {
-                    dicQuery.Add("mode", Utils.UrlEncode(item.HeaderType));
+                    dicQuery.Add("mode", UrlEncodeSafe(transport.XhttpMode));
                 }
-                if (item.Extra.IsNotEmpty())
+                if (transport.XhttpExtra.IsNotEmpty())
                 {
-                    var node = JsonUtils.ParseJson(item.Extra);
+                    var node = JsonUtils.ParseJson(transport.XhttpExtra);
                     var extra = node != null
                         ? JsonUtils.Serialize(node, new JsonSerializerOptions
                         {
@@ -142,38 +165,19 @@ public class BaseFmt
                             DefaultIgnoreCondition = JsonIgnoreCondition.Never,
                             Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
                         })
-                        : item.Extra;
-                    dicQuery.Add("extra", Utils.UrlEncode(extra));
+                        : transport.XhttpExtra;
+                    dicQuery.Add("extra", UrlEncodeSafe(extra));
                 }
                 break;
 
-            case nameof(ETransport.http):
-            case nameof(ETransport.h2):
-                dicQuery["type"] = nameof(ETransport.http);
-                if (item.RequestHost.IsNotEmpty())
-                {
-                    dicQuery.Add("host", Utils.UrlEncode(item.RequestHost));
-                }
-                if (item.Path.IsNotEmpty())
-                {
-                    dicQuery.Add("path", Utils.UrlEncode(item.Path));
-                }
-                break;
-
-            case nameof(ETransport.quic):
-                dicQuery.Add("headerType", item.HeaderType.IsNotEmpty() ? item.HeaderType : Global.None);
-                dicQuery.Add("quicSecurity", Utils.UrlEncode(item.RequestHost));
-                dicQuery.Add("key", Utils.UrlEncode(item.Path));
-                break;
-
             case nameof(ETransport.grpc):
-                if (item.Path.IsNotEmpty())
+                if (transport.GrpcServiceName.IsNotEmpty())
                 {
-                    dicQuery.Add("authority", Utils.UrlEncode(item.RequestHost));
-                    dicQuery.Add("serviceName", Utils.UrlEncode(item.Path));
-                    if (item.HeaderType is Global.GrpcGunMode or Global.GrpcMultiMode)
+                    dicQuery.Add("authority", UrlEncodeSafe(transport.GrpcAuthority));
+                    dicQuery.Add("serviceName", UrlEncodeSafe(transport.GrpcServiceName));
+                    if (transport.GrpcMode is Global.GrpcGunMode or Global.GrpcMultiMode)
                     {
-                        dicQuery.Add("mode", Utils.UrlEncode(item.HeaderType));
+                        dicQuery.Add("mode", UrlEncodeSafe(transport.GrpcMode));
                     }
                 }
                 break;
@@ -199,7 +203,7 @@ public class BaseFmt
 
     private static int ToUriQueryAllowInsecure(ProfileItem item, ref Dictionary<string, string> dicQuery)
     {
-        if (item.AllowInsecure.Equals(Global.AllowInsecure.First()))
+        if (item.GetAllowInsecure())
         {
             // Add two for compatibility
             dicQuery.Add("insecure", "1");
@@ -216,6 +220,8 @@ public class BaseFmt
 
     protected static int ResolveUriQuery(NameValueCollection query, ref ProfileItem item)
     {
+        var transport = item.GetTransportExtra();
+
         item.StreamSecurity = GetQueryValue(query, "security");
         item.Sni = GetQueryValue(query, "sni");
         item.Alpn = GetQueryDecoded(query, "alpn");
@@ -225,6 +231,7 @@ public class BaseFmt
         item.SpiderX = GetQueryDecoded(query, "spx");
         item.Mldsa65Verify = GetQueryDecoded(query, "pqv");
         item.EchConfigList = GetQueryDecoded(query, "ech");
+        item.VerifyPeerCertByName = GetQueryDecoded(query, "vcn");
         item.CertSha = GetQueryDecoded(query, "pcs");
 
         var finalmaskDecoded = GetQueryDecoded(query, "fm");
@@ -247,47 +254,68 @@ public class BaseFmt
 
         if (_allowInsecureArray.Any(k => GetQueryDecoded(query, k) == "1"))
         {
-            item.AllowInsecure = Global.AllowInsecure.First();
+            item.AllowInsecure = Global.StringTrue;
         }
         else if (_allowInsecureArray.Any(k => GetQueryDecoded(query, k) == "0"))
         {
-            item.AllowInsecure = Global.AllowInsecure.Skip(1).First();
+            item.AllowInsecure = Global.StringFalse;
         }
         else
         {
             item.AllowInsecure = string.Empty;
         }
 
-        item.Network = GetQueryValue(query, "type", nameof(ETransport.tcp));
+        var net = GetQueryValue(query, "type", nameof(ETransport.raw));
+        if (net == Global.RawNetworkAlias)
+        {
+            net = nameof(ETransport.raw);
+        }
+        if (!Global.Networks.Contains(net))
+        {
+            net = nameof(ETransport.raw);
+        }
+
+        item.Network = net;
         switch (item.Network)
         {
-            case nameof(ETransport.tcp):
-                item.HeaderType = GetQueryValue(query, "headerType", Global.None);
-                item.RequestHost = GetQueryDecoded(query, "host");
+            case nameof(ETransport.raw):
+                transport = transport with
+                {
+                    RawHeaderType = GetQueryValue(query, "headerType", Global.None),
+                    Host = GetQueryDecoded(query, "host"),
+                    Path = GetQueryDecoded(query, "path"),
+                };
                 break;
 
             case nameof(ETransport.kcp):
-                item.HeaderType = GetQueryValue(query, "headerType", Global.None);
-                item.Path = GetQueryDecoded(query, "seed");
+                var kcpSeed = GetQueryDecoded(query, "seed");
+                var kcpMtuStr = GetQueryValue(query, "mtu");
+                var kcpMtu = int.TryParse(kcpMtuStr, out var mtu) ? mtu : 0;
+                transport = transport with
+                {
+                    KcpHeaderType = GetQueryValue(query, "headerType", Global.None),
+                    KcpSeed = kcpSeed,
+                    KcpMtu = kcpMtu > 0 ? mtu : null,
+                };
                 break;
 
             case nameof(ETransport.ws):
             case nameof(ETransport.httpupgrade):
-                item.RequestHost = GetQueryDecoded(query, "host");
-                item.Path = GetQueryDecoded(query, "path", "/");
+                transport = transport with
+                {
+                    Host = GetQueryDecoded(query, "host"),
+                    Path = GetQueryDecoded(query, "path", "/"),
+                };
                 break;
 
             case nameof(ETransport.xhttp):
-                item.RequestHost = GetQueryDecoded(query, "host");
-                item.Path = GetQueryDecoded(query, "path", "/");
-                item.HeaderType = GetQueryDecoded(query, "mode");
-                var extraDecoded = GetQueryDecoded(query, "extra");
-                if (extraDecoded.IsNotEmpty())
+                var xhttpExtra = GetQueryDecoded(query, "extra");
+                if (xhttpExtra.IsNotEmpty())
                 {
-                    var node = JsonUtils.ParseJson(extraDecoded);
+                    var node = JsonUtils.ParseJson(xhttpExtra);
                     if (node != null)
                     {
-                        extraDecoded = JsonUtils.Serialize(node, new JsonSerializerOptions
+                        xhttpExtra = JsonUtils.Serialize(node, new JsonSerializerOptions
                         {
                             WriteIndented = true,
                             DefaultIgnoreCondition = JsonIgnoreCondition.Never,
@@ -295,31 +323,32 @@ public class BaseFmt
                         });
                     }
                 }
-                item.Extra = extraDecoded;
-                break;
 
-            case nameof(ETransport.http):
-            case nameof(ETransport.h2):
-                item.Network = nameof(ETransport.h2);
-                item.RequestHost = GetQueryDecoded(query, "host");
-                item.Path = GetQueryDecoded(query, "path", "/");
-                break;
-
-            case nameof(ETransport.quic):
-                item.HeaderType = GetQueryValue(query, "headerType", Global.None);
-                item.RequestHost = GetQueryValue(query, "quicSecurity", Global.None);
-                item.Path = GetQueryDecoded(query, "key");
+                transport = transport with
+                {
+                    Host = GetQueryDecoded(query, "host"),
+                    Path = GetQueryDecoded(query, "path", "/"),
+                    XhttpMode = GetQueryDecoded(query, "mode"),
+                    XhttpExtra = xhttpExtra,
+                };
                 break;
 
             case nameof(ETransport.grpc):
-                item.RequestHost = GetQueryDecoded(query, "authority");
-                item.Path = GetQueryDecoded(query, "serviceName");
-                item.HeaderType = GetQueryDecoded(query, "mode", Global.GrpcGunMode);
+                transport = transport with
+                {
+                    GrpcAuthority = GetQueryDecoded(query, "authority"),
+                    GrpcServiceName = GetQueryDecoded(query, "serviceName"),
+                    GrpcMode = GetQueryDecoded(query, "mode", Global.GrpcGunMode),
+                };
                 break;
 
             default:
+                item.Network = nameof(ETransport.raw);
                 break;
         }
+
+        item.SetTransportExtra(transport);
+
         return 0;
     }
 

v2rayN/ServiceLib/Handler/Fmt/FmtHandler.cs

@@ -19,6 +19,7 @@ public class FmtHandler
                 EConfigType.TUIC => TuicFmt.ToUri(item),
                 EConfigType.WireGuard => WireguardFmt.ToUri(item),
                 EConfigType.Anytls => AnytlsFmt.ToUri(item),
+                EConfigType.Naive => NaiveFmt.ToUri(item),
                 _ => null,
             };
 
@@ -52,7 +53,9 @@ public class FmtHandler
             {
                 return ShadowsocksFmt.Resolve(str, out msg);
             }
-            else if (str.StartsWith(Global.ProtocolShares[EConfigType.SOCKS]))
+            else if (str.StartsWith(Global.ProtocolShares[EConfigType.SOCKS])
+                    || str.StartsWith(Global.SOCKS5Protocol)
+                    || str.StartsWith(Global.SOCKS4Protocol))
             {
                 return SocksFmt.Resolve(str, out msg);
             }
@@ -64,7 +67,8 @@ public class FmtHandler
             {
                 return VLESSFmt.Resolve(str, out msg);
             }
-            else if (str.StartsWith(Global.ProtocolShares[EConfigType.Hysteria2]) || str.StartsWith(Global.Hysteria2ProtocolShare))
+            else if (str.StartsWith(Global.ProtocolShares[EConfigType.Hysteria2])
+                    || str.StartsWith(Global.Hysteria2ProtocolShare))
             {
                 return Hysteria2Fmt.Resolve(str, out msg);
             }
@@ -80,6 +84,12 @@ public class FmtHandler
             {
                 return AnytlsFmt.Resolve(str, out msg);
             }
+            else if (str.StartsWith(Global.ProtocolShares[EConfigType.Naive])
+                     || str.StartsWith(Global.NaiveHttpsProtocolShare)
+                     || str.StartsWith(Global.NaiveQuicProtocolShare))
+            {
+                return NaiveFmt.Resolve(str, out msg);
+            }
             else
             {
                 msg = ResUI.NonvmessOrssProtocol;

v2rayN/ServiceLib/Handler/Fmt/InnerFmt.cs

@@ -0,0 +1,302 @@
+namespace ServiceLib.Handler.Fmt;
+
+public class InnerFmt
+{
+    private static readonly Lazy<string> SessionSalt = new(() => Utils.GetGuid(false));
+
+    public static List<ProfileItem>? Resolve(string strData, string subid)
+    {
+        var list = new List<ProfileItem>();
+        // Overwrite externally imported indexIds to avoid possible sources of attacks
+        var indexIdMap = new Dictionary<string, string>();
+        using (var reader = new StringReader(strData))
+        {
+            while (reader.ReadLine() is { } line)
+            {
+                if (line.IsNullOrEmpty())
+                {
+                    continue;
+                }
+                var trimmedLine = line.Trim();
+                if (!trimmedLine.StartsWith(Global.InnerUriProtocol, StringComparison.OrdinalIgnoreCase))
+                {
+                    continue;
+                }
+                var profileItem = ResolveSingle(trimmedLine);
+                if (profileItem is null)
+                {
+                    continue;
+                }
+                if (profileItem.ConfigType == EConfigType.Custom)
+                {
+                    // Unsupported, also to avoid possible sources of attacks, skip it
+                    continue;
+                }
+                // overwrite indexId
+                var newIndexId = Utils.GetGuid(false);
+                if (!profileItem.IndexId.IsNullOrEmpty())
+                {
+                    // Ignore duplicated indexId
+                    indexIdMap[profileItem.IndexId] = newIndexId;
+                }
+                profileItem.IndexId = newIndexId;
+                list.Add(profileItem);
+            }
+        }
+        // For group-type profile items, also overwrite the ChildItems and ChildSubId
+        var emptyGroupProfileList = new List<ProfileItem>();
+        foreach (var item in list.Where(i => i.ConfigType.IsGroupType()))
+        {
+            var protocolExtra = item.GetProtocolExtra();
+            // Only allow "self" as a special value for SubChildItems to avoid possible sources of attacks,
+            // which means it will be replaced with the subid, otherwise set it to null
+            //if (!protocolExtra.SubChildItems.IsNullOrEmpty())
+            if (protocolExtra.SubChildItems == "self")
+            {
+                protocolExtra = protocolExtra with
+                {
+                    SubChildItems = subid
+                };
+            }
+            else
+            {
+                protocolExtra = protocolExtra with
+                {
+                    SubChildItems = null
+                };
+            }
+            if (Utils.String2List(protocolExtra.ChildItems) is { Count: > 0 } childIndexIds)
+            {
+                var newChildIndexIds = childIndexIds
+                    .Select(id => indexIdMap.GetValueOrDefault(id, null))
+                    .Where(id => !id.IsNullOrEmpty())
+                    .ToList();
+                protocolExtra = protocolExtra with
+                {
+                    ChildItems = Utils.List2String(newChildIndexIds)
+                };
+            }
+            else
+            {
+                protocolExtra = protocolExtra with
+                {
+                    ChildItems = null
+                };
+            }
+            item.SetProtocolExtra(protocolExtra);
+            if (protocolExtra.SubChildItems.IsNullOrEmpty()
+                && protocolExtra.ChildItems.IsNullOrEmpty())
+            {
+                emptyGroupProfileList.Add(item);
+            }
+        }
+        // Remove empty group profile items
+        list.RemoveAll(emptyGroupProfileList.Contains);
+        return list;
+    }
+
+    public static string? ToUri(List<ProfileItem> items)
+    {
+        var sb = new StringBuilder();
+        foreach (var item in items)
+        {
+            if (item.ConfigType == EConfigType.Custom)
+            {
+                continue;
+            }
+            var itemClone = JsonUtils.DeepCopy(item);
+            if (itemClone is null)
+            {
+                continue;
+            }
+            // overwrite indexId
+            var originalIndexId = itemClone.IndexId;
+            var newIndexId = GetReproducibleExportId(originalIndexId);
+            itemClone.IndexId = newIndexId;
+            if (itemClone.ConfigType.IsGroupType())
+            {
+                var protocolExtra = itemClone.GetProtocolExtra();
+                if (!protocolExtra.SubChildItems.IsNullOrEmpty())
+                {
+                    protocolExtra = protocolExtra with
+                    {
+                        SubChildItems = "self"
+                    };
+                }
+                if (Utils.String2List(protocolExtra.ChildItems) is { Count: > 0 } childIndexIds)
+                {
+                    var newChildIndexIds = childIndexIds
+                        .Select(GetReproducibleExportId)
+                        .Where(id => !id.IsNullOrEmpty())
+                        .ToList();
+                    protocolExtra = protocolExtra with
+                    {
+                        ChildItems = Utils.List2String(newChildIndexIds)
+                    };
+                }
+                itemClone.SetProtocolExtra(protocolExtra);
+            }
+            var uri = ToUriSingle(itemClone);
+            if (!uri.IsNullOrEmpty())
+            {
+                sb.AppendLine(uri);
+            }
+        }
+        return sb.Length > 0 ? sb.ToString() : null;
+    }
+
+    private static ProfileItem? ResolveSingle(string str)
+    {
+        // format: v2rayn://vless/{url-safe base64 encoded_string}
+        var parsedUri = Utils.TryUri(str);
+        if (parsedUri is null)
+        {
+            return null;
+        }
+        var segment = parsedUri.AbsolutePath.TrimStart('/');
+        var decodedResult = Utils.Base64Decode(segment);
+        var jsonNode = JsonUtils.ParseJson(decodedResult);
+        if (jsonNode is not JsonObject jsonObj)
+        {
+            return null;
+        }
+        // flatten
+        // move jsonObj.ProtoExtraObj to jsonObj.ProtoExtra (string)
+        // move jsonObj.TransportExtraObj to jsonObj.TransportExtra (string)
+        if (jsonObj.TryGetPropertyValue("ProtoExtraObj", out var protoExtraNode)
+            && protoExtraNode is JsonObject protoExtraObj)
+        {
+            jsonObj["ProtoExtra"] = JsonUtils.Serialize(protoExtraObj, false);
+            jsonObj.Remove("ProtoExtraObj");
+        }
+        if (jsonObj.TryGetPropertyValue("TransportExtraObj", out var transportExtraNode)
+            && transportExtraNode is JsonObject transportExtraObj)
+        {
+            jsonObj["TransportExtra"] = JsonUtils.Serialize(transportExtraObj, false);
+            jsonObj.Remove("TransportExtraObj");
+        }
+        var profileItem = JsonUtils.Deserialize<ProfileItem>(JsonUtils.Serialize(jsonObj, false));
+        if (profileItem is null)
+        {
+            return null;
+        }
+        if (profileItem.ConfigVersion != 4)
+        {
+            return null;
+        }
+        // Check Enum.IsDefined
+        if (!Enum.IsDefined(profileItem.ConfigType))
+        {
+            return null;
+        }
+        if (profileItem.CoreType is not (null or ECoreType.Xray or ECoreType.sing_box))
+        {
+            return null;
+        }
+        var protocolExtra = profileItem.GetProtocolExtra();
+        var multipleLoad = protocolExtra.MultipleLoad;
+        if (multipleLoad is not null && !Enum.IsDefined(typeof(EMultipleLoad), multipleLoad))
+        {
+            return null;
+        }
+        return profileItem;
+    }
+
+    private static string? ToUriSingle(ProfileItem item)
+    {
+        var jsonNode = JsonUtils.ParseJson(JsonUtils.Serialize(item, false));
+        if (jsonNode is not JsonObject jsonObj)
+        {
+            return null;
+        }
+        // unflatten
+        // move jsonObj.ProtoExtra (string) to jsonObj.ProtoExtraObj
+        // move jsonObj.TransportExtra (string) to jsonObj.TransportExtraObj
+        if (jsonObj.TryGetPropertyValue("ProtoExtra", out var protoExtraNode)
+            && protoExtraNode is JsonValue protoExtraValue
+            && protoExtraValue.TryGetValue<string>(out var protoExtraStr)
+            && !protoExtraStr.IsNullOrEmpty()
+            && JsonUtils.ParseJson(protoExtraStr) is JsonObject protoExtraObj)
+        {
+            jsonObj["ProtoExtraObj"] = protoExtraObj;
+            jsonObj.Remove("ProtoExtra");
+        }
+        if (jsonObj.TryGetPropertyValue("TransportExtra", out var transportExtraNode)
+            && transportExtraNode is JsonValue transportExtraValue
+            && transportExtraValue.TryGetValue<string>(out var transportExtraStr)
+            && !transportExtraStr.IsNullOrEmpty()
+            && JsonUtils.ParseJson(transportExtraStr) is JsonObject transportExtraObj)
+        {
+            jsonObj["TransportExtraObj"] = transportExtraObj;
+            jsonObj.Remove("TransportExtra");
+        }
+        // remove subid and isSub
+        jsonObj.Remove("Subid");
+        jsonObj.Remove("IsSub");
+        // Remove empty properties to reduce the length of the exported string
+        RemoveEmptyJson(jsonObj);
+        var jsonStr = JsonUtils.Serialize(jsonObj, false);
+        var encodedStr = Utils.Base64Encode(jsonStr).Replace('+', '-').Replace('/', '_').Replace("=", "");
+        return $"{Global.InnerUriProtocol}{item.ConfigType.ToString().ToLower()}/{encodedStr}";
+    }
+
+    private static string GetReproducibleExportId(string originalIndexId)
+    {
+        if (originalIndexId.IsNullOrEmpty())
+        {
+            return originalIndexId;
+        }
+
+        var hash = HashCode.Combine(SessionSalt.Value, originalIndexId) & 0x7FFFFFFF;
+        var bytes = BitConverter.GetBytes(hash);
+        return Convert.ToBase64String(bytes).Replace("=", "");
+    }
+
+    private static void RemoveEmptyJson(JsonNode? node)
+    {
+        // ReSharper disable once ConvertIfStatementToSwitchStatement
+        if (node is JsonObject jsonObject)
+        {
+            var propertiesToRemove = new List<string>();
+
+            foreach (var property in jsonObject)
+            {
+                RemoveEmptyJson(property.Value);
+
+                if (IsEmpty(property.Value))
+                {
+                    propertiesToRemove.Add(property.Key);
+                }
+            }
+
+            foreach (var key in propertiesToRemove)
+            {
+                jsonObject.Remove(key);
+            }
+        }
+        else if (node is JsonArray jsonArray)
+        {
+            for (var i = jsonArray.Count - 1; i >= 0; i--)
+            {
+                RemoveEmptyJson(jsonArray[i]);
+
+                if (IsEmpty(jsonArray[i]))
+                {
+                    jsonArray.RemoveAt(i);
+                }
+            }
+        }
+    }
+
+    private static bool IsEmpty(JsonNode? node)
+    {
+        return node switch
+        {
+            null => true,
+            JsonValue value when value.TryGetValue<string>(out var str) => string.IsNullOrEmpty(str),
+            JsonObject obj => obj.Count == 0,
+            JsonArray arr => arr.Count == 0,
+            _ => false
+        };
+    }
+}

v2rayN/ServiceLib/Handler/Fmt/NaiveFmt.cs

@@ -0,0 +1,91 @@
+namespace ServiceLib.Handler.Fmt;
+
+public class NaiveFmt : BaseFmt
+{
+    public static ProfileItem? Resolve(string str, out string msg)
+    {
+        msg = ResUI.ConfigurationFormatIncorrect;
+
+        var parsedUrl = Utils.TryUri(str);
+        if (parsedUrl == null)
+        {
+            return null;
+        }
+
+        ProfileItem item = new()
+        {
+            ConfigType = EConfigType.Naive,
+            Remarks = parsedUrl.GetComponents(UriComponents.Fragment, UriFormat.Unescaped),
+            Address = parsedUrl.IdnHost,
+            Port = parsedUrl.Port,
+        };
+        var protocolExtra = item.GetProtocolExtra();
+        if (parsedUrl.Scheme.Contains("quic"))
+        {
+            protocolExtra = protocolExtra with
+            {
+                NaiveQuic = true,
+            };
+        }
+        var rawUserInfo = Utils.UrlDecode(parsedUrl.UserInfo);
+        if (rawUserInfo.Contains(':'))
+        {
+            var split = rawUserInfo.Split(':', 2);
+            item.Username = split[0];
+            item.Password = split[1];
+        }
+        else
+        {
+            item.Password = rawUserInfo;
+        }
+
+        var query = Utils.ParseQueryString(parsedUrl.Query);
+        ResolveUriQuery(query, ref item);
+        var insecureConcurrency = int.TryParse(GetQueryValue(query, "insecure-concurrency"), out var ic) ? ic : 0;
+        if (insecureConcurrency > 0)
+        {
+            protocolExtra = protocolExtra with
+            {
+                InsecureConcurrency = insecureConcurrency,
+            };
+        }
+
+        item.SetProtocolExtra(protocolExtra);
+        return item;
+    }
+
+    public static string? ToUri(ProfileItem? item)
+    {
+        if (item == null)
+        {
+            return null;
+        }
+        var remark = string.Empty;
+        if (item.Remarks.IsNotEmpty())
+        {
+            remark = "#" + Utils.UrlEncode(item.Remarks);
+        }
+        var userInfo = item.Username.IsNotEmpty() ? $"{Utils.UrlEncode(item.Username)}:{Utils.UrlEncode(item.Password)}" : Utils.UrlEncode(item.Password);
+        var dicQuery = new Dictionary<string, string>();
+        ToUriQuery(item, Global.None, ref dicQuery);
+        var protocolExtra = item.GetProtocolExtra();
+        if (protocolExtra.InsecureConcurrency > 0)
+        {
+            dicQuery.Add("insecure-concurrency", protocolExtra?.InsecureConcurrency.ToString());
+        }
+
+        var query = dicQuery.Count > 0
+            ? ("?" + string.Join("&", dicQuery.Select(x => x.Key + "=" + x.Value).ToArray()))
+            : string.Empty;
+        var url = $"{userInfo}@{GetIpv6(item.Address)}:{item.Port}";
+
+        if (protocolExtra.NaiveQuic == true)
+        {
+            return $"{Global.NaiveQuicProtocolShare}{url}{query}{remark}";
+        }
+        else
+        {
+            return $"{Global.NaiveHttpsProtocolShare}{url}{query}{remark}";
+        }
+    }
+}

v2rayN/ServiceLib/Handler/Fmt/ShadowsocksFmt.cs

@@ -42,31 +42,28 @@ public class ShadowsocksFmt : BaseFmt
         //url = Utile.Base64Encode(url);
         //new Sip002
         var pw = Utils.Base64Encode($"{item.GetProtocolExtra().SsMethod}:{item.Password}", true);
+        var transport = item.GetTransportExtra();
 
         // plugin
         var plugin = string.Empty;
         var pluginArgs = string.Empty;
 
-        if (item.Network == nameof(ETransport.tcp) && item.HeaderType == Global.TcpHeaderHttp)
+        if (item.Network == nameof(ETransport.raw) && transport.RawHeaderType == Global.RawHeaderHttp)
         {
             plugin = "obfs-local";
-            pluginArgs = $"obfs=http;obfs-host={item.RequestHost};";
+            pluginArgs = $"obfs=http;obfs-host={transport.Host};";
         }
         else
         {
             if (item.Network == nameof(ETransport.ws))
             {
                 pluginArgs += "mode=websocket;";
-                pluginArgs += $"host={item.RequestHost};";
+                pluginArgs += $"host={transport.Host};";
                 // https://github.com/shadowsocks/v2ray-plugin/blob/e9af1cdd2549d528deb20a4ab8d61c5fbe51f306/args.go#L172
                 // Equal signs and commas [and backslashes] must be escaped with a backslash.
-                var path = item.Path.Replace("\\", "\\\\").Replace("=", "\\=").Replace(",", "\\,");
+                var path = (transport.Path ?? string.Empty).Replace("\\", "\\\\").Replace("=", "\\=").Replace(",", "\\,");
                 pluginArgs += $"path={path};";
             }
-            else if (item.Network == nameof(ETransport.quic))
-            {
-                pluginArgs += "mode=quic;";
-            }
             if (item.StreamSecurity == Global.StreamSecurity)
             {
                 pluginArgs += "tls;";
@@ -213,8 +210,11 @@ public class ShadowsocksFmt : BaseFmt
                 {
                     obfsHost = obfsHost.Replace("obfs-host=", "");
                     item.Network = Global.DefaultNetwork;
-                    item.HeaderType = Global.TcpHeaderHttp;
-                    item.RequestHost = obfsHost;
+                    item.SetTransportExtra(item.GetTransportExtra() with
+                    {
+                        RawHeaderType = Global.RawHeaderHttp,
+                        Host = obfsHost,
+                    });
                 }
             }
             // Parse v2ray-plugin
@@ -231,21 +231,20 @@ public class ShadowsocksFmt : BaseFmt
                 if (modeValue == "websocket")
                 {
                     item.Network = nameof(ETransport.ws);
+                    var t = item.GetTransportExtra();
                     if (!host.IsNullOrEmpty())
                     {
-                        item.RequestHost = host.Replace("host=", "");
-                        item.Sni = item.RequestHost;
+                        var wsHost = host.Replace("host=", "");
+                        t = t with { Host = wsHost };
+                        item.Sni = wsHost;
                     }
                     if (!path.IsNullOrEmpty())
                     {
                         var pathValue = path.Replace("path=", "");
                         pathValue = pathValue.Replace("\\=", "=").Replace("\\,", ",").Replace("\\\\", "\\");
-                        item.Path = pathValue;
+                        t = t with { Path = pathValue };
                     }
-                }
-                else if (modeValue == "quic")
-                {
-                    item.Network = nameof(ETransport.quic);
+                    item.SetTransportExtra(t);
                 }
 
                 if (hasTls)

v2rayN/ServiceLib/Handler/Fmt/SocksFmt.cs

@@ -71,7 +71,7 @@ public class SocksFmt : BaseFmt
             return null;
         }
         var arr21 = arr1.First().Split(':');
-        var indexPort = arr1.Last().LastIndexOf(":");
+        var indexPort = arr1.Last().LastIndexOf(':');
         if (arr21.Length != 2 || indexPort < 0)
         {
             return null;
@@ -99,12 +99,17 @@ public class SocksFmt : BaseFmt
         };
         // parse base64 UserInfo
         var rawUserInfo = Utils.UrlDecode(parsedUrl.UserInfo);
-        var userInfo = Utils.Base64Decode(rawUserInfo);
-        var userInfoParts = userInfo.Split([':'], 2);
-        if (userInfoParts.Length == 2)
+        if (rawUserInfo.IsNotEmpty())
         {
-            item.Username = userInfoParts.First();
-            item.Password = userInfoParts[1];
+            var userInfoParts = rawUserInfo.Contains(':')
+                ? rawUserInfo.Split(":", 2)
+                : Utils.Base64Decode(rawUserInfo).Split(":", 2);
+
+            if (userInfoParts.Length == 2)
+            {
+                item.Username = userInfoParts.First();
+                item.Password = userInfoParts.Last();
+            }
         }
 
         return item;

v2rayN/ServiceLib/Handler/Fmt/TuicFmt.cs

@@ -30,7 +30,10 @@ public class TuicFmt : BaseFmt
 
         var query = Utils.ParseQueryString(url.Query);
         ResolveUriQuery(query, ref item);
-        item.HeaderType = GetQueryValue(query, "congestion_control");
+        item.SetProtocolExtra(item.GetProtocolExtra() with
+        {
+            CongestionControl = GetQueryValue(query, "congestion_control")
+        });
 
         return item;
     }
@@ -51,7 +54,10 @@ public class TuicFmt : BaseFmt
         var dicQuery = new Dictionary<string, string>();
         ToUriQueryLite(item, ref dicQuery);
 
-        dicQuery.Add("congestion_control", item.HeaderType);
+        if (!item.GetProtocolExtra().CongestionControl.IsNullOrEmpty())
+        {
+            dicQuery.Add("congestion_control", item.GetProtocolExtra().CongestionControl);
+        }
 
         return ToUri(EConfigType.TUIC, item.Address, item.Port, $"{item.Username ?? ""}:{item.Password}", dicQuery, remark);
     }

v2rayN/ServiceLib/Handler/Fmt/VmessFmt.cs

@@ -26,6 +26,7 @@ public class VmessFmt : BaseFmt
 
         var vmessQRCode = new VmessQRCode
         {
+            // vmess link keeps shared transport keys; map from new transport model on export.
             v = 2,
             ps = item.Remarks.TrimEx(),
             add = item.Address,
@@ -33,15 +34,41 @@ public class VmessFmt : BaseFmt
             id = item.Password,
             aid = int.TryParse(item.GetProtocolExtra()?.AlterId, out var result) ? result : 0,
             scy = item.GetProtocolExtra().VmessSecurity ?? "",
-            net = item.Network,
-            type = item.HeaderType,
-            host = item.RequestHost,
-            path = item.Path,
+            net = item.GetNetwork() == nameof(ETransport.raw) ? Global.RawNetworkAlias : item.Network,
+            type = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => item.GetTransportExtra().RawHeaderType,
+                nameof(ETransport.kcp) => item.GetTransportExtra().KcpHeaderType,
+                nameof(ETransport.xhttp) => item.GetTransportExtra().XhttpMode,
+                nameof(ETransport.grpc) => item.GetTransportExtra().GrpcMode,
+                _ => Global.None,
+            },
+            host = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => item.GetTransportExtra().Host,
+                nameof(ETransport.ws) => item.GetTransportExtra().Host,
+                nameof(ETransport.httpupgrade) => item.GetTransportExtra().Host,
+                nameof(ETransport.xhttp) => item.GetTransportExtra().Host,
+                nameof(ETransport.grpc) => item.GetTransportExtra().GrpcAuthority,
+                _ => null,
+            },
+            path = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => item.GetTransportExtra().Path,
+                nameof(ETransport.kcp) => item.GetTransportExtra().KcpSeed,
+                nameof(ETransport.ws) => item.GetTransportExtra().Path,
+                nameof(ETransport.httpupgrade) => item.GetTransportExtra().Path,
+                nameof(ETransport.xhttp) => item.GetTransportExtra().Path,
+                nameof(ETransport.grpc) => item.GetTransportExtra().GrpcServiceName,
+                _ => null,
+            },
             tls = item.StreamSecurity,
             sni = item.Sni,
             alpn = item.Alpn,
             fp = item.Fingerprint,
-            insecure = item.AllowInsecure.Equals(Global.AllowInsecure.First()) ? "1" : "0"
+            insecure = item.GetAllowInsecure() ? "1" : "0",
+            vcn = item.VerifyPeerCertByName,
+            pcs = item.CertSha
         };
 
         var url = JsonUtils.Serialize(vmessQRCode);
@@ -70,7 +97,10 @@ public class VmessFmt : BaseFmt
         }
 
         item.Network = Global.DefaultNetwork;
-        item.HeaderType = Global.None;
+        var transport = new TransportExtraItem
+        {
+            RawHeaderType = Global.None,
+        };
 
         //item.ConfigVersion = vmessQRCode.v;
         item.Remarks = Utils.ToString(vmessQRCode.ps);
@@ -84,20 +114,37 @@ public class VmessFmt : BaseFmt
         });
         if (vmessQRCode.net.IsNotEmpty())
         {
-            item.Network = vmessQRCode.net;
+            item.Network = vmessQRCode.net == Global.RawNetworkAlias ? nameof(ETransport.raw) : vmessQRCode.net;
         }
         if (vmessQRCode.type.IsNotEmpty())
         {
-            item.HeaderType = vmessQRCode.type;
+            transport = item.GetNetwork() switch
+            {
+                nameof(ETransport.raw) => transport with { RawHeaderType = vmessQRCode.type },
+                nameof(ETransport.kcp) => transport with { KcpHeaderType = vmessQRCode.type },
+                nameof(ETransport.xhttp) => transport with { XhttpMode = vmessQRCode.type },
+                nameof(ETransport.grpc) => transport with { GrpcMode = vmessQRCode.type },
+                _ => transport,
+            };
         }
-
-        item.RequestHost = Utils.ToString(vmessQRCode.host);
-        item.Path = Utils.ToString(vmessQRCode.path);
+        transport = item.GetNetwork() switch
+        {
+            nameof(ETransport.raw) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.kcp) => transport with { KcpSeed = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.ws) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.httpupgrade) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.xhttp) => transport with { Host = Utils.ToString(vmessQRCode.host), Path = Utils.ToString(vmessQRCode.path) },
+            nameof(ETransport.grpc) => transport with { GrpcAuthority = Utils.ToString(vmessQRCode.host), GrpcServiceName = Utils.ToString(vmessQRCode.path) },
+            _ => transport,
+        };
+        item.SetTransportExtra(transport);
         item.StreamSecurity = Utils.ToString(vmessQRCode.tls);
         item.Sni = Utils.ToString(vmessQRCode.sni);
         item.Alpn = Utils.ToString(vmessQRCode.alpn);
         item.Fingerprint = Utils.ToString(vmessQRCode.fp);
-        item.AllowInsecure = vmessQRCode.insecure == "1" ? Global.AllowInsecure.First() : string.Empty;
+        item.AllowInsecure = vmessQRCode.insecure == "1" ? Global.StringTrue : string.Empty;
+        item.VerifyPeerCertByName = Utils.ToString(vmessQRCode.vcn);
+        item.CertSha = Utils.ToString(vmessQRCode.pcs);
 
         return item;
     }
@@ -122,7 +169,7 @@ public class VmessFmt : BaseFmt
 
         item.SetProtocolExtra(new ProtocolExtraItem
         {
-            VmessSecurity = "auto",
+            VmessSecurity = Global.DefaultSecurity,
         });
 
         var query = Utils.ParseQueryString(url.Query);

v2rayN/ServiceLib/Handler/Fmt/WireguardFmt.cs

@@ -27,9 +27,10 @@ public class WireguardFmt : BaseFmt
         item.SetProtocolExtra(item.GetProtocolExtra() with
         {
             WgPublicKey = GetQueryDecoded(query, "publickey"),
+            WgPresharedKey = GetQueryDecoded(query, "presharedkey"),
             WgReserved = GetQueryDecoded(query, "reserved"),
             WgInterfaceAddress = GetQueryDecoded(query, "address"),
-            WgMtu = int.TryParse(GetQueryDecoded(query, "mtu"), out var mtuVal) ? mtuVal : 1280,
+            WgMtu = int.TryParse(GetQueryDecoded(query, "mtu"), out var mtuVal) ? mtuVal : null,
         });
 
         return item;
@@ -48,20 +49,183 @@ public class WireguardFmt : BaseFmt
             remark = "#" + Utils.UrlEncode(item.Remarks);
         }
 
+        var protoExtra = item.GetProtocolExtra();
         var dicQuery = new Dictionary<string, string>();
-        if (!item.GetProtocolExtra().WgPublicKey.IsNullOrEmpty())
+        if (!protoExtra.WgPublicKey.IsNullOrEmpty())
         {
-            dicQuery.Add("publickey", Utils.UrlEncode(item.GetProtocolExtra().WgPublicKey));
+            dicQuery.Add("publickey", Utils.UrlEncode(protoExtra.WgPublicKey));
         }
-        if (!item.GetProtocolExtra().WgReserved.IsNullOrEmpty())
+        if (!protoExtra.WgPresharedKey.IsNullOrEmpty())
         {
-            dicQuery.Add("reserved", Utils.UrlEncode(item.GetProtocolExtra().WgReserved));
+            dicQuery.Add("presharedkey", Utils.UrlEncode(protoExtra.WgPresharedKey));
         }
-        if (!item.GetProtocolExtra().WgInterfaceAddress.IsNullOrEmpty())
+        if (!protoExtra.WgReserved.IsNullOrEmpty())
         {
-            dicQuery.Add("address", Utils.UrlEncode(item.GetProtocolExtra().WgInterfaceAddress));
+            dicQuery.Add("reserved", Utils.UrlEncode(protoExtra.WgReserved));
+        }
+        if (!protoExtra.WgInterfaceAddress.IsNullOrEmpty())
+        {
+            dicQuery.Add("address", Utils.UrlEncode(protoExtra.WgInterfaceAddress));
+        }
+        if (protoExtra.WgMtu > 0)
+        {
+            dicQuery.Add("mtu", protoExtra.WgMtu.ToString());
         }
-        dicQuery.Add("mtu", Utils.UrlEncode(item.GetProtocolExtra().WgMtu > 0 ? item.GetProtocolExtra().WgMtu.ToString() : "1280"));
         return ToUri(EConfigType.WireGuard, item.Address, item.Port, item.Password, dicQuery, remark);
     }
+
+    public static List<ProfileItem>? ResolveConfig(string strData)
+    {
+        var interfaceDic = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+        var peerDicList = new List<Dictionary<string, string>>();
+        var currentDicRef = interfaceDic;
+        using (var reader = new StringReader(strData))
+        {
+            while (reader.ReadLine() is { } line)
+            {
+                if (line.IsNullOrEmpty())
+                {
+                    continue;
+                }
+
+                var trimmedLine = line.Trim();
+
+                if (trimmedLine.Equals("[Interface]", StringComparison.OrdinalIgnoreCase))
+                {
+                    currentDicRef = interfaceDic;
+                    continue;
+                }
+                if (trimmedLine.Equals("[Peer]", StringComparison.OrdinalIgnoreCase))
+                {
+                    var peerDic = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+                    peerDicList.Add(peerDic);
+                    currentDicRef = peerDic;
+                    continue;
+                }
+
+                if (trimmedLine.StartsWith('[') || trimmedLine.StartsWith('#') || trimmedLine.StartsWith(';'))
+                {
+                    continue;
+                }
+
+                var idx = line.IndexOf('=');
+                if (idx <= 0)
+                {
+                    continue;
+                }
+
+                var key = line[..idx].Trim();
+                var value = line[(idx + 1)..].Trim();
+                var commentPos = value.IndexOfAny(['#', ';']);
+                if (commentPos >= 0)
+                {
+                    value = value[..commentPos].TrimEnd();
+                }
+
+                currentDicRef[key] = value;
+            }
+        }
+
+        if (!interfaceDic.TryGetValue("PrivateKey", out var privateKey) || privateKey.IsNullOrEmpty())
+        {
+            return null;
+        }
+
+        var wgMtu = interfaceDic.TryGetValue("MTU", out var mtuStr) && int.TryParse(mtuStr, out var mtuVal) ? mtuVal : 0;
+        var wgInterfaceAddress = interfaceDic.TryGetValue("Address", out var interfaceAddress) ? interfaceAddress : string.Empty;
+
+        var index = 0;
+        var resultList = new List<ProfileItem>();
+
+        foreach (var peerDic in peerDicList)
+        {
+            if (!peerDic.TryGetValue("Endpoint", out var endpoint) || endpoint.IsNullOrEmpty())
+            {
+                continue;
+            }
+
+            if (!TryParseEndpoint(endpoint, out var peerAddress, out var peerPort))
+            {
+                continue;
+            }
+
+            var protoExtra = new ProtocolExtraItem
+            {
+                WgPublicKey = (peerDic.TryGetValue("PublicKey", out var publicKey) ? publicKey : string.Empty).NullIfEmpty(),
+                WgPresharedKey = (peerDic.TryGetValue("PresharedKey", out var presharedKey) ? presharedKey : string.Empty).NullIfEmpty(),
+                WgInterfaceAddress = wgInterfaceAddress,
+                WgReserved = (peerDic.TryGetValue("Reserved", out var reserved) ? reserved : string.Empty).NullIfEmpty(),
+                WgMtu = wgMtu > 0 ? wgMtu : null,
+            };
+
+            var item = new ProfileItem
+            {
+                Remarks = $"{nameof(EConfigType.WireGuard)} Peer {index + 1}",
+                ConfigType = EConfigType.WireGuard,
+                Address = peerAddress,
+                Port = peerPort,
+                Password = privateKey,
+            };
+            item.SetProtocolExtra(protoExtra);
+            resultList.Add(item);
+
+            index += 1;
+        }
+
+        return resultList;
+    }
+
+    private static bool TryParseEndpoint(string endpoint, out string address, out int port)
+    {
+        address = string.Empty;
+        port = 2408;
+
+        var trimmedEndpoint = endpoint.Trim();
+        if (trimmedEndpoint.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        if (trimmedEndpoint[0] == '[')
+        {
+            var closeIndex = trimmedEndpoint.IndexOf(']');
+            if (closeIndex <= 1)
+            {
+                return false;
+            }
+
+            address = trimmedEndpoint[1..closeIndex].Trim();
+            var portIndex = closeIndex + 1;
+            if (portIndex < trimmedEndpoint.Length && trimmedEndpoint[portIndex] == ':' &&
+                int.TryParse(trimmedEndpoint[(portIndex + 1)..].Trim(), out var bracketedPort) && bracketedPort is > 0 and <= 65535)
+            {
+                port = bracketedPort;
+            }
+
+            return address.IsNotEmpty();
+        }
+
+        var lastColonIndex = trimmedEndpoint.LastIndexOf(':');
+        if (lastColonIndex <= 0)
+        {
+            address = trimmedEndpoint;
+            return true;
+        }
+
+        address = trimmedEndpoint[..lastColonIndex].Trim();
+        var portText = trimmedEndpoint[(lastColonIndex + 1)..].Trim();
+        if (address.IsNullOrEmpty())
+        {
+            return false;
+        }
+
+        if (int.TryParse(portText, out var parsedPortValue) && parsedPortValue is > 0 and <= 65535)
+        {
+            port = parsedPortValue;
+            return true;
+        }
+
+        address = trimmedEndpoint;
+        return true;
+    }
 }

v2rayN/ServiceLib/Handler/SubscriptionHandler.cs

@@ -133,12 +133,12 @@ public static class SubscriptionHandler
 
             if (!url.Contains("target="))
             {
-                url += string.Format("&target={0}", item.ConvertTarget);
+                url += $"&target={item.ConvertTarget}";
             }
 
             if (!url.Contains("config="))
             {
-                url += string.Format("&config={0}", Global.SubConvertConfig.FirstOrDefault());
+                url += $"&config={Global.SubConvertConfig.FirstOrDefault()}";
             }
         }
 

v2rayN/ServiceLib/Handler/SysProxy/ProxySettingLinux.cs

@@ -1,5 +1,6 @@
 namespace ServiceLib.Handler.SysProxy;
 
+[SupportedOSPlatform("linux")]
 public static class ProxySettingLinux
 {
     private static readonly string _proxySetFileName = $"{Global.ProxySetLinuxShellFileName.Replace(Global.NamespaceSample, "")}.sh";

v2rayN/ServiceLib/Handler/SysProxy/ProxySettingOSX.cs

@@ -1,5 +1,6 @@
 namespace ServiceLib.Handler.SysProxy;
 
+[SupportedOSPlatform("macos")]
 public static class ProxySettingOSX
 {
     private static readonly string _proxySetFileName = $"{Global.ProxySetOSXShellFileName.Replace(Global.NamespaceSample, "")}.sh";

v2rayN/ServiceLib/Handler/SysProxy/ProxySettingWindows.cs

@@ -2,6 +2,7 @@ using static ServiceLib.Handler.SysProxy.ProxySettingWindows.InternetConnectionO
 
 namespace ServiceLib.Handler.SysProxy;
 
+[SupportedOSPlatform("windows")]
 public static class ProxySettingWindows
 {
     private const string _regPath = @"Software\Microsoft\Windows\CurrentVersion\Internet Settings";

v2rayN/ServiceLib/Handler/SysProxy/SysProxyHandler.cs

@@ -88,6 +88,7 @@ public static class SysProxyHandler
         }
     }
 
+    [SupportedOSPlatform("windows")]
     private static async Task SetWindowsProxyPac(int port)
     {
         var portPac = AppManager.Instance.GetLocalPort(EInboundProtocol.pac);

v2rayN/ServiceLib/Manager/AppManager.cs

@@ -48,6 +48,13 @@ public sealed class AppManager
         }
     }
 
+    public Dictionary<ECoreType, string> LastCheckUpdateResults { get; set; } = new();
+
+    public void SetLastCheckUpdateResult(ECoreType coreType, string result)
+    {
+        LastCheckUpdateResults[coreType] = result;
+    }
+
     #endregion Property
 
     #region App
@@ -261,7 +268,7 @@ public sealed class AppManager
             .ToListAsync();
         var itemMap = items.ToDictionary(it => it.IndexId);
 
-        return idList.Select(id => itemMap.GetValueOrDefault(id))
+        return idList.Select(itemMap.GetValueOrDefault)
             .Where(item => item != null)
             .ToList();
     }
@@ -305,12 +312,19 @@ public sealed class AppManager
         return await SQLiteHelper.Instance.TableAsync<FullConfigTemplateItem>().FirstOrDefaultAsync(it => it.CoreType == eCoreType);
     }
 
-    public async Task MigrateProfileExtra()
-    {
-        await MigrateProfileExtraGroup();
-
 #pragma warning disable CS0618
 
+    public async Task MigrateProfileExtra()
+    {
+        await MigrateProfileExtraGroupV2ToV3();
+
+        await MigrateProfileExtraV2ToV3();
+
+        await MigrateProfileTransportV3ToV4();
+    }
+
+    private async Task MigrateProfileExtraV2ToV3()
+    {
         const int pageSize = 100;
         var offset = 0;
 
@@ -326,7 +340,7 @@ public sealed class AppManager
                 break;
             }
 
-            var batchSuccessCount = await MigrateProfileExtraSub(batch);
+            var batchSuccessCount = await MigrateProfileExtraV2ToV3Sub(batch);
 
             // Only increment offset by the number of failed items that remain in the result set
             // Successfully updated items are automatically excluded from future queries due to ConfigVersion = 3
@@ -334,10 +348,122 @@ public sealed class AppManager
         }
 
         //await ProfileGroupItemManager.Instance.ClearAll();
-#pragma warning restore CS0618
     }
 
-    private async Task<int> MigrateProfileExtraSub(List<ProfileItem> batch)
+    private async Task MigrateProfileTransportV3ToV4()
+    {
+        const int pageSize = 100;
+        var offset = 0;
+
+        while (true)
+        {
+            var sql = $"SELECT * FROM ProfileItem WHERE ConfigVersion = 3 LIMIT {pageSize} OFFSET {offset}";
+            var batch = await SQLiteHelper.Instance.QueryAsync<ProfileItem>(sql);
+            if (batch is null || batch.Count == 0)
+            {
+                break;
+            }
+
+            var updateProfileItems = new List<ProfileItem>();
+            foreach (var item in batch)
+            {
+                try
+                {
+                    if (item.Network == Global.RawNetworkAlias)
+                    {
+                        item.Network = nameof(ETransport.raw);
+                    }
+                    var transport = item.GetTransportExtra();
+                    var network = item.GetNetwork();
+
+                    switch (network)
+                    {
+                        case nameof(ETransport.raw):
+                            transport = transport with
+                            {
+                                RawHeaderType = item.HeaderType.NullIfEmpty(),
+                                Host = item.RequestHost.NullIfEmpty(),
+                                Path = item.Path.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.ws):
+                        case nameof(ETransport.httpupgrade):
+                            transport = transport with
+                            {
+                                Host = item.RequestHost.NullIfEmpty(),
+                                Path = item.Path.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.xhttp):
+                            transport = transport with
+                            {
+                                Host = item.RequestHost.NullIfEmpty(),
+                                Path = item.Path.NullIfEmpty(),
+                                XhttpMode = item.HeaderType.NullIfEmpty(),
+                                XhttpExtra = item.Extra.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.grpc):
+                            transport = transport with
+                            {
+                                GrpcAuthority = item.RequestHost.NullIfEmpty(),
+                                GrpcServiceName = item.Path.NullIfEmpty(),
+                                GrpcMode = item.HeaderType.NullIfEmpty(),
+                            };
+                            break;
+
+                        case nameof(ETransport.kcp):
+                            transport = transport with
+                            {
+                                KcpHeaderType = item.HeaderType.NullIfEmpty(),
+                                KcpSeed = item.Path.NullIfEmpty(),
+                            };
+                            break;
+
+                        default:
+                            item.Network = Global.DefaultNetwork;
+                            transport = transport with
+                            {
+                                RawHeaderType = item.HeaderType.NullIfEmpty(),
+                                Host = item.RequestHost.NullIfEmpty(),
+                            };
+                            break;
+                    }
+
+                    item.SetTransportExtra(transport);
+                    item.ConfigVersion = 4;
+                    updateProfileItems.Add(item);
+                }
+                catch (Exception ex)
+                {
+                    Logging.SaveLog($"MigrateProfileTransportV3ToV4 Error: {ex}");
+                }
+            }
+
+            if (updateProfileItems.Count > 0)
+            {
+                try
+                {
+                    var count = await SQLiteHelper.Instance.UpdateAllAsync(updateProfileItems);
+                    offset += batch.Count - count;
+                }
+                catch (Exception ex)
+                {
+                    Logging.SaveLog($"MigrateProfileTransportV3ToV4 update error: {ex}");
+                    offset += batch.Count;
+                }
+            }
+            else
+            {
+                offset += batch.Count;
+            }
+        }
+    }
+
+    private async Task<int> MigrateProfileExtraV2ToV3Sub(List<ProfileItem> batch)
     {
         var updateProfileItems = new List<ProfileItem>();
 
@@ -380,6 +506,7 @@ public sealed class AppManager
                         break;
 
                     case EConfigType.TUIC:
+                        extra = extra with { CongestionControl = item.HeaderType.NullIfEmpty(), };
                         item.Username = item.Id;
                         item.Id = item.Security;
                         item.Password = item.Security;
@@ -434,9 +561,8 @@ public sealed class AppManager
         }
     }
 
-    private async Task<bool> MigrateProfileExtraGroup()
+    private async Task<bool> MigrateProfileExtraGroupV2ToV3()
     {
-#pragma warning disable CS0618
         var list = await SQLiteHelper.Instance.TableAsync<ProfileGroupItem>().ToListAsync();
         var groupItems = new ConcurrentDictionary<string, ProfileGroupItem>(list.Where(t => !string.IsNullOrEmpty(t.IndexId)).ToDictionary(t => t.IndexId!));
 
@@ -501,9 +627,10 @@ public sealed class AppManager
         return true;
 
         //await ProfileGroupItemManager.Instance.ClearAll();
-#pragma warning restore CS0618
     }
 
+#pragma warning restore CS0618
+
     #endregion SqliteHelper
 
     #region Core Type

v2rayN/ServiceLib/Manager/CertPemManager.cs

@@ -4,16 +4,15 @@ using System.Security.Cryptography.X509Certificates;
 namespace ServiceLib.Manager;
 
 /// <summary>
-/// Manager for certificate operations with CA pinning to prevent MITM attacks
+///     Manager for certificate operations with CA pinning to prevent MITM attacks
 /// </summary>
 public class CertPemManager
 {
     private static readonly string _tag = "CertPemManager";
     private static readonly Lazy<CertPemManager> _instance = new(() => new());
-    public static CertPemManager Instance => _instance.Value;
 
     /// <summary>
-    /// Trusted CA certificate thumbprints (SHA256) to prevent MITM attacks
+    ///     Trusted CA certificate thumbprints (SHA256) to prevent MITM attacks
     /// </summary>
     private static readonly HashSet<string> TrustedCaThumbprints = new(StringComparer.OrdinalIgnoreCase)
     {
@@ -24,21 +23,17 @@ public class CertPemManager
         "D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4", // Comodo AAA Services root
         "85A0DD7DD720ADB7FF05F83D542B209DC7FF4528F7D677B18389FEA5E5C49E86", // QuoVadis Root CA 2
         "18F1FC7F205DF8ADDDEB7FE007DD57E3AF375A9C4D8D73546BF4F1FED1E18D35", // QuoVadis Root CA 3
-        "CECDDC905099D8DADFC5B1D209B737CBE2C18CFB2C10C0FF0BCF0D3286FC1AA2", // XRamp Global CA Root
         "C3846BF24B9E93CA64274C0EC67C1ECC5E024FFCACD2D74019350E81FE546AE4", // Go Daddy Class 2 CA
         "1465FA205397B876FAA6F0A9958E5590E40FCC7FAA4FB7C2C8677521FB5FB658", // Starfield Class 2 CA
         "3E9099B5015E8F486C00BCEA9D111EE721FABA355A89BCF1DF69561E3DC6325C", // DigiCert Assured ID Root CA
         "4348A0E9444C78CB265E058D5E8944B4D84F9662BD26DB257F8934A443C70161", // DigiCert Global Root CA
         "7431E5F4C3C1CE4690774F0B61E05440883BA9A01ED00BA6ABD7806ED3B118CF", // DigiCert High Assurance EV Root CA
         "62DD0BE9B9F50A163EA0F8E75C053B1ECA57EA55C8688F647C6881F2C8357B95", // SwissSign Gold CA - G2
-        "F1C1B50AE5A20DD8030EC9F6BC24823DD367B5255759B4E71B61FCE9F7375D73", // SecureTrust CA
-        "4200F5043AC8590EBB527D209ED1503029FBCBD41CA1B506EC27F15ADE7DAC69", // Secure Global CA
         "0C2CD63DF7806FA399EDE809116B575BF87989F06518F9808C860503178BAF66", // COMODO Certification Authority
         "1793927A0614549789ADCE2F8F34F7F0B66D0F3AE3A3B84D21EC15DBBA4FADC7", // COMODO ECC Certification Authority
         "41C923866AB4CAD6B7AD578081582E020797A6CBDF4FFF78CE8396B38937D7F5", // OISTE WISeKey Global Root GA CA
         "E3B6A2DB2ED7CE48842F7AC53241C7B71D54144BFB40C11F3F1D0B42F5EEA12D", // Certigna
         "C0A6F4DC63A24BFDCF54EF2A6A082A0A72DE35803E2FF5FF527AE5D87206DFD5", // ePKI Root Certification Authority
-        "EAA962C4FA4A6BAFEBE415196D351CCD888D4F53F3FA8AE6D7C466A94E6042BB", // certSIGN ROOT CA
         "6C61DAC3A2DEF031506BE036D2A6FE401994FBD13DF9C8D466599274C446EC98", // NetLock Arany (Class Gold) Főtanúsítvány
         "3C5F81FEA5FAB82C64BFA2EAECAFCDE8E077FC8620A7CAE537163DF36EDBF378", // Microsec e-Szigno Root CA 2009
         "CBB522D7B7F127AD6A0113865BDF1CD4102E7D0759AF635A7CF4720DC963C53B", // GlobalSign Root CA - R3
@@ -46,10 +41,6 @@ public class CertPemManager
         "45140B3247EB9CC8C5B4F0D7B53091F73292089E6E5A63E2749DD3ACA9198EDA", // Go Daddy Root Certificate Authority - G2
         "2CE1CB0BF9D2F9E102993FBE215152C3B2DD0CABDE1C68E5319B839154DBB7F5", // Starfield Root Certificate Authority - G2
         "568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5", // Starfield Services Root Certificate Authority - G2
-        "0376AB1D54C5F9803CE4B2E201A0EE7EEF7B57B636E8A93C9B8D4860C96F5FA7", // AffirmTrust Commercial
-        "0A81EC5A929777F145904AF38D5D509F66B5E2C58FCDB531058B0E17F3F0B41B", // AffirmTrust Networking
-        "70A73F7F376B60074248904534B11482D5BF0E698ECC498DF52577EBF2E93B9A", // AffirmTrust Premium
-        "BD71FDF6DA97E4CF62D1647ADD2581B07D79ADF8397EB4ECBA9C5E8488821423", // AffirmTrust Premium ECC
         "5C58468D55F58E497E743982D2B50010B6D165374ACF83A7D4A32DB768C4408E", // Certum Trusted Network CA
         "BFD88FE1101C41AE3E801BF8BE56350EE9BAD1A6B9BD515EDC5C6D5B8711AC44", // TWCA Root Certification Authority
         "513B2CECB810D4CDE5DD85391ADFC6C2DD60D87BB736D2B521484AA47A0EBEF6", // Security Communication RootCA2
@@ -62,7 +53,6 @@ public class CertPemManager
         "E23D4A036D7B70E9F595B1422079D2B91EDFBB1FB651A0633EAA8A9DC5F80703", // CA Disig Root R2
         "9A6EC012E1A7DA9DBE34194D478AD7C0DB1822FB071DF12981496ED104384113", // ACCVRAIZ1
         "59769007F7685D0FCD50872F9F95D5755A5B2B457D81F3692B610A98672F0E1B", // TWCA Global Root CA
-        "DD6936FE21F8F077C123A1A521C12224F72255B73E03A7260693E8A24B0FA389", // TeliaSonera Root CA v1
         "91E2F5788D5810EBA7BA58737DE1548A8ECACD014598BC0B143E041B17052552", // T-TeleSec GlobalRoot Class 2
         "F356BEA244B7A91EB35D53CA9AD7864ACE018E2D35D5F8F96DDF68A6F41AA474", // Atos TrustedRoot 2011
         "8A866FD1B276B57E578E921C65828A2BED58E9F2F288054134B7F1F4BFC9CC74", // QuoVadis Root CA 1 G3
@@ -116,16 +106,12 @@ public class CertPemManager
         "C741F70F4B2A8D88BF2E71C14122EF53EF10EBA0CFA5E64CFA20F418853073E0", // Microsoft RSA Root Certificate Authority 2017
         "BEB00B30839B9BC32C32E4447905950641F26421B15ED089198B518AE2EA1B99", // e-Szigno Root CA 2017
         "657CFE2FA73FAA38462571F332A2363A46FCE7020951710702CDFBB6EEDA3305", // certSIGN Root CA G2
-        "97552015F5DDFC3C8788C006944555408894450084F100867086BC1A2BB58DC8", // Trustwave Global Certification Authority
-        "945BBC825EA554F489D1FD51A73DDF2EA624AC7019A05205225C22A78CCFA8B4", // Trustwave Global ECC P256 Certification Authority
-        "55903859C8C0C3EBB8759ECE4E2557225FF5758BBD38EBD48276601E1BD58097", // Trustwave Global ECC P384 Certification Authority
         "88F438DCF8FFD1FA8F429115FFE5F82AE1E06E0C70C375FAAD717B34A49E7265", // NAVER Global Root Certification Authority
         "554153B13D2CF9DDB753BFBE1A4E0AE08D0AA4187058FE60A2B862B2E4B87BCB", // AC RAIZ FNMT-RCM SERVIDORES SEGUROS
         "319AF0A7729E6F89269C131EA6A3A16FCD86389FDCAB3C47A4A675C161A3F974", // GlobalSign Secure Mail Root R45
         "5CBF6FB81FD417EA4128CD6F8172A3C9402094F74AB2ED3A06B4405D04F30B19", // GlobalSign Secure Mail Root E45
         "4FA3126D8D3A11D1C4855A4F807CBAD6CF919D3A5A88B03BEA2C6372D93C40C9", // GlobalSign Root R46
         "CBB9C44D84B8043E1050EA31A69F514955D7BFD2E2C6B49301019AD61D9F5058", // GlobalSign Root E46
-        "9A296A5182D1D451A2E37F439B74DAAFA267523329F90F9A0D2007C334E23C9A", // GLOBALTRUST 2020
         "FB8FEC759169B9106B1E511644C618C51304373F6C0643088D8BEFFD1B997599", // ANF Secure Server Root CA
         "6B328085625318AA50D173C98D8BDA09D57E27413D114CF787A0F5D06C030CF6", // Certum EC-384 CA
         "FE7696573855773E37A95E7AD4D9CC96C30157C15D31765BA9B15704E1AE78FD", // Certum Trusted Root CA
@@ -179,7 +165,6 @@ public class CertPemManager
         "578AF4DED0853F4E5998DB4AEAF9CBEA8D945F60B620A38D1A3C13B2BC7BA8E1", // Telekom Security TLS ECC Root 2020
         "78A656344F947E9CC0F734D9053D32F6742086B6B9CD2CAE4FAE1A2E4EFDE048", // Telekom Security SMIME RSA Root 2023
         "EFC65CADBB59ADB6EFE84DA22311B35624B71B3B1EA0DA8B6655174EC8978646", // Telekom Security TLS RSA Root 2023
-        "BEF256DAF26E9C69BDEC1602359798F3CAF71821A03E018257C53C65617F3D4A", // FIRMAPROFESIONAL CA ROOT-A WEB
         "3F63BB2814BE174EC8B6439CF08D6D56F0B7C405883A5648A334424D6B3EC558", // TWCA CYBER Root CA
         "3A0072D49FFC04E996C59AEB75991D3C340F3615D6FD4DCE90AC0B3D88EAD4F4", // TWCA Global Root CA G2
         "3F034BB5704D44B2D08545A02057DE93EBF3905FCE721ACBC730C06DDAEE904E", // SecureSign Root CA12
@@ -200,10 +185,13 @@ public class CertPemManager
         "B49141502D00663D740F2E7EC340C52800962666121A36D09CF7DD2B90384FB4", // e-Szigno TLS Root CA 2023
     };
 
+    public static CertPemManager Instance => _instance.Value;
+
     /// <summary>
-    /// Get certificate in PEM format from a server with CA pinning validation
+    ///     Get certificate in PEM format from a server with CA pinning validation
     /// </summary>
-    public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName, int timeout = 4)
+    public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName,
+        List<string>? verifyPeerCertByName = null, int timeout = 4)
     {
         try
         {
@@ -215,12 +203,14 @@ public class CertPemManager
             using var client = new TcpClient();
             await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);
 
-            await using var ssl = new SslStream(client.GetStream(), false, ValidateServerCertificate);
+            var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) =>
+                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? []));
+            await using var ssl = new SslStream(client.GetStream(), false, callback);
 
             var sslOptions = new SslClientAuthenticationOptions
             {
                 TargetHost = serverName,
-                RemoteCertificateValidationCallback = ValidateServerCertificate
+                RemoteCertificateValidationCallback = callback,
             };
 
             await ssl.AuthenticateAsClientAsync(sslOptions, cts.Token);
@@ -247,9 +237,10 @@ public class CertPemManager
     }
 
     /// <summary>
-    /// Get certificate chain in PEM format from a server with CA pinning validation
+    ///     Get certificate chain in PEM format from a server with CA pinning validation
     /// </summary>
-    public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName, int timeout = 4)
+    public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName,
+        List<string>? verifyPeerCertByName = null, int timeout = 4)
     {
         var pemList = new List<string>();
         try
@@ -262,12 +253,14 @@ public class CertPemManager
             using var client = new TcpClient();
             await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);
 
-            await using var ssl = new SslStream(client.GetStream(), false, ValidateServerCertificate);
+            var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) =>
+                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? []));
+            await using var ssl = new SslStream(client.GetStream(), false, callback);
 
             var sslOptions = new SslClientAuthenticationOptions
             {
                 TargetHost = serverName,
-                RemoteCertificateValidationCallback = ValidateServerCertificate
+                RemoteCertificateValidationCallback = callback,
             };
 
             await ssl.AuthenticateAsClientAsync(sslOptions, cts.Token);
@@ -297,35 +290,35 @@ public class CertPemManager
     }
 
     /// <summary>
-    /// Validate server certificate with CA pinning
+    ///     Validate server certificate with CA pinning
     /// </summary>
-    private bool ValidateServerCertificate(
-        object sender,
+    private static bool ValidateServerCertificate(
+        object _,
         X509Certificate? certificate,
         X509Chain? chain,
-        SslPolicyErrors sslPolicyErrors)
+        SslPolicyErrors sslPolicyErrors,
+        List<string> verifyPeerCertByName)
     {
         if (certificate == null)
         {
             return false;
         }
 
-        // Check certificate name mismatch
-        if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateNameMismatch))
-        {
-            return false;
-        }
-
         // Build certificate chain
         var cert2 = certificate as X509Certificate2 ?? new X509Certificate2(certificate);
         var certChain = chain ?? new X509Chain();
 
-        certChain.ChainPolicy.RevocationMode = X509RevocationMode.Online;
-        certChain.ChainPolicy.RevocationFlag = X509RevocationFlag.ExcludeRoot;
-        certChain.ChainPolicy.VerificationFlags = X509VerificationFlags.NoFlag;
-        certChain.ChainPolicy.VerificationTime = DateTime.Now;
+        if (chain == null)
+        {
+            certChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+            certChain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllowUnknownCertificateAuthority;
+            certChain.ChainPolicy.VerificationTime = DateTime.UtcNow;
 
-        certChain.Build(cert2);
+            if (!certChain.Build(cert2))
+            {
+                return false;
+            }
+        }
 
         // Find root CA
         if (certChain.ChainElements.Count == 0)
@@ -333,10 +326,37 @@ public class CertPemManager
             return false;
         }
 
-        var rootCert = certChain.ChainElements[certChain.ChainElements.Count - 1].Certificate;
+        var rootCert = certChain.ChainElements[^1].Certificate;
         var rootThumbprint = rootCert.GetCertHashString(HashAlgorithmName.SHA256);
 
-        return TrustedCaThumbprints.Contains(rootThumbprint);
+        if (!TrustedCaThumbprints.Contains(rootThumbprint))
+        {
+            return false;
+        }
+
+        if (!sslPolicyErrors.HasFlag(
+                SslPolicyErrors.RemoteCertificateNameMismatch))
+        {
+            return true;
+        }
+
+        if (verifyPeerCertByName.Count == 0)
+        {
+            return false;
+        }
+
+        foreach (var ext in cert2.Extensions)
+        {
+            if (ext is not X509SubjectAlternativeNameExtension san)
+            {
+                continue;
+            }
+
+            return san.EnumerateDnsNames().Any(dnsName =>
+                verifyPeerCertByName.Contains(dnsName, StringComparer.OrdinalIgnoreCase));
+        }
+
+        return false;
     }
 
     public static string ExportCertToPem(X509Certificate2 cert)
@@ -347,8 +367,8 @@ public class CertPemManager
     }
 
     /// <summary>
-    /// Parse concatenated PEM certificates string into a list of individual certificates
-    /// Normalizes format: removes line breaks from base64 content for better compatibility
+    ///     Parse concatenated PEM certificates string into a list of individual certificates
+    ///     Normalizes format: removes line breaks from base64 content for better compatibility
     /// </summary>
     /// <param name="pemChain">Concatenated PEM certificates string (supports both \r\n and \n line endings)</param>
     /// <returns>List of individual PEM certificate strings with normalized format</returns>
@@ -400,18 +420,13 @@ public class CertPemManager
     }
 
     /// <summary>
-    /// Concatenate a list of PEM certificates into a single string
+    ///     Concatenate a list of PEM certificates into a single string
     /// </summary>
     /// <param name="pemList">List of individual PEM certificate strings</param>
     /// <returns>Concatenated PEM certificates string</returns>
-    public static string ConcatenatePemChain(IEnumerable<string> pemList)
+    public static string ConcatenatePemChain(IEnumerable<string>? pemList)
     {
-        if (pemList == null)
-        {
-            return string.Empty;
-        }
-
-        return string.Concat(pemList);
+        return pemList == null ? string.Empty : string.Concat(pemList);
     }
 
     public static string GetCertSha256Thumbprint(string pemCert, bool includeColon = false)
@@ -420,11 +435,7 @@ public class CertPemManager
         {
             var cert = X509Certificate2.CreateFromPem(pemCert);
             var thumbprint = cert.GetCertHashString(HashAlgorithmName.SHA256);
-            if (includeColon)
-            {
-                return string.Join(":", thumbprint.Chunk(2).Select(c => new string(c)));
-            }
-            return thumbprint;
+            return includeColon ? string.Join(":", thumbprint.Chunk(2).Select(c => new string(c))) : thumbprint;
         }
         catch
         {

v2rayN/ServiceLib/Manager/ClashApiManager.cs

@@ -1,4 +1,4 @@
-using static ServiceLib.Models.ClashProxies;
+using static ServiceLib.Models.Dto.ClashProxies;
 
 namespace ServiceLib.Manager;
 
@@ -45,19 +45,14 @@ public sealed class ClashApiManager
                 {
                     await GetClashProxiesAsync();
                 }
-                lstProxy = new List<ClashProxyModel>();
-                foreach (var kv in _proxies ?? [])
-                {
-                    if (Global.notAllowTestType.Contains(kv.Value.type?.ToLower()))
-                    {
-                        continue;
-                    }
-                    lstProxy.Add(new ClashProxyModel()
-                    {
-                        Name = kv.Value.name,
-                        Type = kv.Value.type?.ToLower(),
-                    });
-                }
+                lstProxy = [];
+                lstProxy.AddRange(from kv in _proxies ?? []
+                                  where !Global.notAllowTestType.Contains(kv.Value.type?.ToLower())
+                                  select new ClashProxyModel()
+                                  {
+                                      Name = kv.Value.name,
+                                      Type = kv.Value.type?.ToLower(),
+                                  });
             }
 
             if (lstProxy is not { Count: > 0 })

v2rayN/ServiceLib/Manager/CoreInfoManager.cs

@@ -50,6 +50,50 @@ public sealed class CoreInfoManager
         return fileName;
     }
 
+    public List<ECoreType> GetCheckUpdateCoreTypes()
+    {
+        var lst = new List<ECoreType>();
+
+        if (RuntimeInformation.ProcessArchitecture != Architecture.X86)
+        {
+            if (IsCheckUpdateSupported(ECoreType.v2rayN))
+            {
+                lst.Add(ECoreType.v2rayN);
+            }
+
+            if (!(Utils.IsWindows() && Environment.OSVersion.Version.Major < 10))
+            {
+                lst.Add(ECoreType.Xray);
+                lst.Add(ECoreType.mihomo);
+                lst.Add(ECoreType.sing_box);
+            }
+        }
+
+        return lst;
+    }
+
+    public bool IsCheckUpdateSupported(ECoreType type)
+    {
+        return type switch
+        {
+            ECoreType.v2rayN => !Utils.IsPackagedInstall(),
+            ECoreType.Xray => true,
+            ECoreType.mihomo => true,
+            ECoreType.sing_box => true,
+            _ => false,
+        };
+    }
+
+    public bool GetCheckPreRelease(ECoreType type, bool preRelease)
+    {
+        return type switch
+        {
+            ECoreType.v2rayN => preRelease,
+            ECoreType.Xray => preRelease,
+            _ => false,
+        };
+    }
+
     private void InitCoreInfo()
     {
         var urlN = GetCoreUrl(ECoreType.v2rayN);
@@ -68,6 +112,8 @@ public sealed class CoreInfoManager
                     DownloadUrlWinArm64 = urlN + "/download/{0}/v2rayN-windows-arm64.zip",
                     DownloadUrlLinux64 = urlN + "/download/{0}/v2rayN-linux-64.zip",
                     DownloadUrlLinuxArm64 = urlN + "/download/{0}/v2rayN-linux-arm64.zip",
+                    DownloadUrlLinuxRiscV64 = urlN + "/download/{0}/v2rayN-linux-riscv64.zip",
+                    DownloadUrlLinuxLoong64 = urlN + "/download/{0}/v2rayN-linux-loong64.zip",
                     DownloadUrlOSX64 = urlN + "/download/{0}/v2rayN-macos-64.zip",
                     DownloadUrlOSXArm64 = urlN + "/download/{0}/v2rayN-macos-arm64.zip",
                 },
@@ -111,6 +157,8 @@ public sealed class CoreInfoManager
                     DownloadUrlWinArm64 = urlXray + "/download/{0}/Xray-windows-arm64-v8a.zip",
                     DownloadUrlLinux64 = urlXray + "/download/{0}/Xray-linux-64.zip",
                     DownloadUrlLinuxArm64 = urlXray + "/download/{0}/Xray-linux-arm64-v8a.zip",
+                    DownloadUrlLinuxRiscV64 = urlXray + "/download/{0}/Xray-linux-riscv64.zip",
+                    DownloadUrlLinuxLoong64 = urlXray + "/download/{0}/Xray-linux-loong64.zip",
                     DownloadUrlOSX64 = urlXray + "/download/{0}/Xray-macos-64.zip",
                     DownloadUrlOSXArm64 = urlXray + "/download/{0}/Xray-macos-arm64-v8a.zip",
                     Match = "Xray",
@@ -133,6 +181,8 @@ public sealed class CoreInfoManager
                     DownloadUrlWinArm64 = urlMihomo + "/download/{0}/mihomo-windows-arm64-{0}.zip",
                     DownloadUrlLinux64 = urlMihomo + "/download/{0}/mihomo-linux-amd64-v1-{0}.gz",
                     DownloadUrlLinuxArm64 = urlMihomo + "/download/{0}/mihomo-linux-arm64-{0}.gz",
+                    DownloadUrlLinuxRiscV64 = urlMihomo + "/download/{0}/mihomo-linux-riscv64-{0}.gz",
+                    DownloadUrlLinuxLoong64 = urlMihomo + "/download/{0}/mihomo-linux-loong64-abi2-{0}.gz",
                     DownloadUrlOSX64 = urlMihomo + "/download/{0}/mihomo-darwin-amd64-v1-{0}.gz",
                     DownloadUrlOSXArm64 = urlMihomo + "/download/{0}/mihomo-darwin-arm64-{0}.gz",
                     Match = "Mihomo",
@@ -175,6 +225,8 @@ public sealed class CoreInfoManager
                     DownloadUrlWinArm64 = urlSingbox + "/download/{0}/sing-box-{1}-windows-arm64.zip",
                     DownloadUrlLinux64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-amd64.tar.gz",
                     DownloadUrlLinuxArm64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-arm64.tar.gz",
+                    DownloadUrlLinuxRiscV64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-riscv64.tar.gz",
+                    DownloadUrlLinuxLoong64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-loong64.tar.gz",
                     DownloadUrlOSX64 = urlSingbox + "/download/{0}/sing-box-{1}-darwin-amd64.tar.gz",
                     DownloadUrlOSXArm64 = urlSingbox + "/download/{0}/sing-box-{1}-darwin-arm64.tar.gz",
                     Match = "sing-box",
@@ -265,6 +317,8 @@ public sealed class CoreInfoManager
             names.Add("mihomo-linux-amd64-v1");
             names.Add("mihomo-linux-amd64");
             names.Add("mihomo-linux-arm64");
+            names.Add("mihomo-linux-riscv64");
+            names.Add("mihomo-linux-loong64-abi2");
         }
         else if (Utils.IsMacOS())
         {

v2rayN/ServiceLib/Manager/CoreManager.cs

@@ -8,6 +8,7 @@ public class CoreManager
     private static readonly Lazy<CoreManager> _instance = new(() => new());
     public static CoreManager Instance => _instance.Value;
     private Config _config;
+    [SupportedOSPlatform("windows")]
     private WindowsJobService? _processJob;
     private ProcessService? _processService;
     private ProcessService? _processPreService;
@@ -90,6 +91,9 @@ public class CoreManager
 
         await CoreStart(mainContext);
         await CoreStartPreService(preContext);
+
+        AppManager.Instance.RunningCoreType = preContext?.RunCoreType ?? mainContext.RunCoreType;
+
         if (_processService != null)
         {
             await UpdateFunc(true, $"{node.GetSummary()}");
@@ -172,7 +176,7 @@ public class CoreManager
     private async Task CoreStart(CoreConfigContext context)
     {
         var node = context.Node;
-        var coreType = AppManager.Instance.RunningCoreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
+        var coreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
         var coreInfo = CoreInfoManager.Instance.GetCoreInfo(coreType);
 
         var displayLog = node.ConfigType != EConfigType.Custom || node.DisplayLog;

v2rayN/ServiceLib/Manager/GroupProfileManager.cs

@@ -9,7 +9,7 @@ public class GroupProfileManager
 
     public static async Task<bool> HasCycle(string? indexId, ProtocolExtraItem? extraInfo)
     {
-        return await HasCycle(indexId, extraInfo, new HashSet<string>(), new HashSet<string>());
+        return await HasCycle(indexId, extraInfo, [], []);
     }
 
     private static async Task<bool> HasCycle(string? indexId, ProtocolExtraItem? extraInfo, HashSet<string> visited, HashSet<string> stack)
@@ -55,7 +55,7 @@ public class GroupProfileManager
             var childItems = await AppManager.Instance.GetProfileItemsByIndexIds(childIds);
             foreach (var childItem in childItems)
             {
-                if (await HasCycle(childItem.IndexId, childItem?.GetProtocolExtra(), visited, stack))
+                if (await HasCycle(childItem.IndexId, childItem.GetProtocolExtra(), visited, stack))
                 {
                     return true;
                 }
@@ -71,7 +71,7 @@ public class GroupProfileManager
 
     public static async Task<(List<ProfileItem> Items, ProtocolExtraItem? Extra)> GetChildProfileItems(ProfileItem profileItem)
     {
-        var protocolExtra = profileItem?.GetProtocolExtra();
+        var protocolExtra = profileItem.GetProtocolExtra();
         return (await GetChildProfileItemsByProtocolExtra(protocolExtra), protocolExtra);
     }
 

v2rayN/ServiceLib/Manager/NetBridgeManager.cs

@@ -0,0 +1,239 @@
+using NetBridgeLib.Services;
+
+namespace ServiceLib.Manager;
+
+public sealed class NetBridgeManager
+{
+    private static readonly Lazy<NetBridgeManager> _instance = new(() => new());
+    public static NetBridgeManager Instance => _instance.Value;
+    private readonly Config _config = AppManager.Instance.Config;
+    private NetBridgeService? _netBridgeService;
+    private bool _isProxyRunning;
+    private bool _isInitialized;
+    private List<NetBridgeRuleConfig> _ruleConfigs = [];
+    private Func<bool, string, Task>? _updateFunc;
+    private uint _proxyConfigId;
+
+    public async Task Init(Func<bool, string, Task>? updateFunc = null)
+    {
+        if (_isInitialized)
+        {
+            return;
+        }
+
+        _updateFunc = updateFunc;
+
+        try
+        {
+            _netBridgeService = new NetBridgeService();
+            _netBridgeService.LogReceived += msg =>
+            {
+                var message = $"NetBridge Log: {msg}";
+                _ = _updateFunc?.Invoke(false, message);
+            };
+
+            _netBridgeService.ConnectionReceived += (processName, pid, destIp, destPort, proxyInfo) =>
+            {
+                var message = $"NetBridge Connection: {processName} (PID: {pid}) -> {destIp}:{destPort} -> {proxyInfo}";
+                _ = _updateFunc?.Invoke(false, message);
+            };
+
+            _ruleConfigs = BuildRuleConfigs(_config.NetBridgeItem?.RuleProcess);
+            _isInitialized = true;
+        }
+        catch (Exception ex)
+        {
+            var error = $"Failed to initialize NetBridgeService: {ex.Message}";
+            await _updateFunc?.Invoke(true, error);
+        }
+    }
+
+    public async Task<bool> Start()
+    {
+        if (_isProxyRunning)
+        {
+            return true;
+        }
+
+        try
+        {
+            if (_netBridgeService == null)
+            {
+                return false;
+            }
+
+            var started = _netBridgeService.Start();
+            if (!started)
+            {
+                return false;
+            }
+
+            _isProxyRunning = true;
+        }
+        catch (Exception ex)
+        {
+            var error = $"Failed to start NetBridgeService: {ex.Message}";
+            await _updateFunc?.Invoke(true, error);
+            return false;
+        }
+
+        return true;
+    }
+
+    public async Task<bool> Stop()
+    {
+        if (!_isProxyRunning)
+        {
+            return true;
+        }
+
+        try
+        {
+            if (_netBridgeService == null)
+            {
+                return false;
+            }
+
+            var stopped = _netBridgeService.Stop();
+            if (!stopped)
+            {
+                return false;
+            }
+
+            _isProxyRunning = false;
+        }
+        catch (Exception ex)
+        {
+            var error = $"Failed to stop NetBridgeService: {ex.Message}";
+            await _updateFunc?.Invoke(true, error);
+            return false;
+        }
+
+        return true;
+    }
+
+    public async Task<bool> UpdateRoutes(string? ruleProcess)
+    {
+        var newRuleConfigs = BuildRuleConfigs(ruleProcess);
+
+        _ruleConfigs = newRuleConfigs;
+
+        if (!_isProxyRunning)
+        {
+            return true;
+        }
+
+        return await ApplyRoutesInternal();
+    }
+
+    public async Task<bool> UpdateProxyConfig(string proxyHost, int proxyPort)
+    {
+        try
+        {
+            if (_netBridgeService == null)
+            {
+                return false;
+            }
+
+            var proxyType = "SOCKS5";
+            var username = "";
+            var password = "";
+
+            if (_proxyConfigId > 0)
+            {
+                var edited = _netBridgeService.EditProxyConfig(_proxyConfigId, proxyType, proxyHost, (ushort)proxyPort, username, password);
+                if (!edited)
+                {
+                    return false;
+                }
+            }
+            else
+            {
+                _proxyConfigId = _netBridgeService.AddProxyConfig(proxyType, proxyHost, (ushort)proxyPort, username, password);
+                if (_proxyConfigId == 0)
+                {
+                    return false;
+                }
+            }
+
+            return await Task.FromResult(true);
+        }
+        catch (Exception ex)
+        {
+            var error = $"Failed to update proxy config: {ex.Message}";
+            await _updateFunc?.Invoke(true, error);
+            return false;
+        }
+    }
+
+    public async Task<bool> SetDnsViaProxy(bool enable)
+    {
+        if (_netBridgeService == null)
+        {
+            return false;
+        }
+
+        _netBridgeService.SetDnsViaProxy(enable);
+
+        return await Task.FromResult(true);
+    }
+
+    private async Task<bool> ApplyRoutesInternal()
+    {
+        if (_netBridgeService == null)
+        {
+            return false;
+        }
+
+        List<NetBridgeRuleConfig> rules;
+
+        rules = _ruleConfigs.Select(JsonUtils.DeepCopy).ToList();
+
+        foreach (var rule in rules.Where(x => x.RuleId > 0))
+        {
+            try
+            {
+                _ = _netBridgeService.DeleteRule(rule.RuleId);
+            }
+            catch
+            {
+                // ignored
+            }
+        }
+
+        for (var i = 0; i < rules.Count; i++)
+        {
+            var rule = rules[i];
+            var newRuleId = _netBridgeService.AddRule(rule.ProcessName, rule.TargetHosts, rule.TargetPorts, rule.Protocol, rule.Action, rule.ProxyConfigId);
+            if (newRuleId == 0)
+            {
+                return false;
+            }
+
+            rules[i].RuleId = newRuleId;
+        }
+
+        _ruleConfigs = rules;
+
+        return await Task.FromResult(true);
+    }
+
+    private static List<NetBridgeRuleConfig> BuildRuleConfigs(string? ruleProcess)
+    {
+        if (ruleProcess.IsNullOrEmpty())
+        {
+            return new();
+        }
+
+        var processNames = Utils.String2List(Utils.Convert2Comma(ruleProcess));
+        return processNames.Select(processName => new NetBridgeRuleConfig
+        {
+            ProcessName = processName,
+            TargetHosts = "*",
+            TargetPorts = "*",
+            Protocol = "BOTH",
+            Action = "PROXY",
+            ProxyConfigId = 0
+        }).ToList();
+    }
+}

v2rayN/ServiceLib/Manager/ProfileExManager.cs

@@ -111,7 +111,7 @@ public class ProfileExManager
     public async Task ClearAll()
     {
         await SQLiteHelper.Instance.ExecuteAsync($"delete from ProfileExItem ");
-        _lstProfileEx = new();
+        _lstProfileEx = [];
     }
 
     public async Task SaveTo()
@@ -150,6 +150,14 @@ public class ProfileExManager
         IndexIdEnqueue(indexId);
     }
 
+    public void SetTestIpInfo(string indexId, string ipInfo)
+    {
+        var profileEx = GetProfileExItem(indexId);
+
+        profileEx.IpInfo = ipInfo;
+        IndexIdEnqueue(indexId);
+    }
+
     public void SetSort(string indexId, int sort)
     {
         var profileEx = GetProfileExItem(indexId);
@@ -174,6 +182,6 @@ public class ProfileExManager
         {
             return 0;
         }
-        return _lstProfileEx.Max(t => t == null ? 0 : t.Sort);
+        return _lstProfileEx.Max(t => t?.Sort ?? 0);
     }
 }

v2rayN/ServiceLib/Manager/StatisticsManager.cs

@@ -45,7 +45,7 @@ public class StatisticsManager
     {
         await SQLiteHelper.Instance.ExecuteAsync($"delete from ServerStatItem ");
         _serverStatItem = null;
-        _lstServerStat = new();
+        _lstServerStat = [];
     }
 
     public async Task SaveTo()

v2rayN/ServiceLib/Manager/TaskManager.cs

@@ -56,7 +56,7 @@ public class TaskManager
             {
                 //Logging.SaveLog("Execute delete expired files");
 
-                FileUtils.DeleteExpiredFiles(Utils.GetBinConfigPath(), DateTime.Now.AddHours(-1));
+                FileUtils.DeleteExpiredFiles(Utils.GetBinConfigPath(), DateTime.Now.AddHours(-1), "Test");
                 FileUtils.DeleteExpiredFiles(Utils.GetLogPath(), DateTime.Now.AddMonths(-1));
                 FileUtils.DeleteExpiredFiles(Utils.GetTempPath(), DateTime.Now.AddMonths(-1));
 
@@ -70,6 +70,18 @@ public class TaskManager
                 }
             }
 
+            //Execute once 24 hour
+            if (numOfExecuted % 1440 == 1)
+            {
+                try
+                {
+                    await UpdateTaskRunCheckUpdate();
+                }
+                catch (Exception ex)
+                {
+                    Logging.SaveLog("ScheduledTasks - UpdateTaskRunCheckUpdate", ex);
+                }
+            }
             numOfExecuted++;
         }
     }
@@ -117,4 +129,23 @@ public class TaskManager
             }).UpdateGeoFileAll();
         }
     }
+
+    private async Task UpdateTaskRunCheckUpdate()
+    {
+        Logging.SaveLog("Execute check update");
+
+        var updateService = new UpdateService(_config, async (success, msg) => await Task.CompletedTask);
+
+        var msgs = await updateService.CheckHasUpdateOnlyAll(_config.CheckUpdateItem.CheckPreReleaseUpdate);
+        foreach (var msg in msgs)
+        {
+            await _updateFunc?.Invoke(false, msg);
+        }
+        NoticeManager.Instance.Enqueue(string.Join("\n", msgs));
+
+        if (msgs.Count > 0)
+        {
+            AppEvents.HasUpdateNotified.Publish(true);
+        }
+    }
 }

v2rayN/ServiceLib/Models/Configs/Config.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.Configs;
 
 [Serializable]
 public class Config
@@ -29,6 +29,7 @@ public class Config
     public SystemProxyItem SystemProxyItem { get; set; }
     public WebDavItem WebDavItem { get; set; }
     public CheckUpdateItem CheckUpdateItem { get; set; }
+    public NetBridgeItem NetBridgeItem { get; set; }
     public Fragment4RayItem? Fragment4RayItem { get; set; }
     public List<InItem> Inbound { get; set; }
     public List<KeyEventItem> GlobalHotkeys { get; set; }

v2rayN/ServiceLib/Models/Configs/ConfigItems.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.Configs;
 
 [Serializable]
 public class CoreBasicItem
@@ -7,16 +7,18 @@ public class CoreBasicItem
 
     public string Loglevel { get; set; }
 
-    public bool MuxEnabled { get; set; }
-
-    public bool DefAllowInsecure { get; set; }
-
     public string DefFingerprint { get; set; }
 
     public string DefUserAgent { get; set; }
 
+    public string? SendThrough { get; set; }
+
+    public string? BindInterface { get; set; }
+
     public bool EnableFragment { get; set; }
 
+    public bool EnableFinalFragment { get; set; }
+
     public bool EnableCacheFile4Sbox { get; set; } = true;
 }
 
@@ -47,11 +49,9 @@ public class KcpItem
 
     public int DownlinkCapacity { get; set; }
 
-    public bool Congestion { get; set; }
+    public int CwndMultiplier { get; set; }
 
-    public int ReadBufferSize { get; set; }
-
-    public int WriteBufferSize { get; set; }
+    public int MaxSendingWindow { get; set; }
 }
 
 [Serializable]
@@ -144,6 +144,9 @@ public class TunModeItem
     public string Stack { get; set; }
     public int Mtu { get; set; }
     public bool EnableIPv6Address { get; set; }
+    public string IcmpRouting { get; set; }
+    public bool EnableLegacyProtect { get; set; }
+    public List<string>? RouteExcludeAddress { get; set; }
 }
 
 [Serializable]
@@ -154,6 +157,9 @@ public class SpeedTestItem
     public string SpeedPingTestUrl { get; set; }
     public int MixedConcurrencyCount { get; set; }
     public string IPAPIUrl { get; set; }
+    public string UdpTestTarget { get; set; }
+    public int? SpeedTestPageSize { get; set; }
+    public int? SpeedTestDelayInterval { get; set; }
 }
 
 [Serializable]
@@ -193,7 +199,7 @@ public class HysteriaItem
 {
     public int UpMbps { get; set; }
     public int DownMbps { get; set; }
-    public int HopInterval { get; set; } = 30;
+    public int HopInterval { get; set; } = Global.Hysteria2DefaultHopInt;
 }
 
 [Serializable]
@@ -271,3 +277,10 @@ public class SimpleDNSItem
     public string? Hosts { get; set; }
     public string? DirectExpectedIPs { get; set; }
 }
+
+[Serializable]
+public class NetBridgeItem
+{
+    public string? RuleProcess { get; set; }
+    public bool EnableDnsViaProxy { get; set; }
+}

v2rayN/ServiceLib/Models/CoreConfigs/CoreConfigContext.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.CoreConfigs;
 
 public record CoreConfigContext
 {
@@ -16,10 +16,8 @@ public record CoreConfigContext
 
     // TUN Compatibility
     public bool IsTunEnabled { get; init; } = false;
-    public HashSet<string> ProtectDomainList { get; init; } = new();
-    // -> tun inbound --(if routing proxy)--> relay outbound
-    // -> proxy core (relay inbound --> proxy outbound --(dialerProxy)--> protect outbound)
-    // -> protect inbound -> direct proxy outbound data -> internet
-    public int TunProtectSsPort { get; init; } = 0;
-    public int ProxyRelaySsPort { get; init; } = 0;
+    public HashSet<string> ProtectDomainList { get; init; } = [];
+
+    public bool IsWindows { get; init; }
+    public bool IsMacOS { get; init; }
 }

v2rayN/ServiceLib/Models/CoreConfigs/CoreInfo.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.CoreConfigs;
 
 [Serializable]
 public class CoreInfo
@@ -12,6 +12,8 @@ public class CoreInfo
     public string? DownloadUrlWinArm64 { get; set; }
     public string? DownloadUrlLinux64 { get; set; }
     public string? DownloadUrlLinuxArm64 { get; set; }
+    public string? DownloadUrlLinuxRiscV64 { get; set; }
+    public string? DownloadUrlLinuxLoong64 { get; set; }
     public string? DownloadUrlOSX64 { get; set; }
     public string? DownloadUrlOSXArm64 { get; set; }
     public string? Match { get; set; }

v2rayN/ServiceLib/Models/CoreConfigs/SingboxConfig.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.CoreConfigs;
 
 public class SingboxConfig
 {
@@ -93,6 +93,7 @@ public class Rule4Sbox
     public List<string>? wifi_bssid { get; set; }
     public bool? rule_set_ip_cidr_match_source { get; set; }
     public bool? rule_set_ip_cidr_accept_empty { get; set; }
+    public bool? tls_record_fragment { get; set; }
 }
 
 [Serializable]
@@ -110,6 +111,7 @@ public class Inbound4Sbox
     public bool? endpoint_independent_nat { get; set; }
     public string? stack { get; set; }
     public List<User4Sbox> users { get; set; }
+    public List<string>? route_exclude_address { get; set; }
 }
 
 public class User4Sbox
@@ -134,10 +136,14 @@ public class Outbound4Sbox : BaseServer4Sbox
     public int? recv_window_conn { get; set; }
     public int? recv_window { get; set; }
     public bool? disable_mtu_discovery { get; set; }
+    public int? insecure_concurrency { get; set; }
+    public bool? udp_over_tcp { get; set; }
     public string? method { get; set; }
     public string? username { get; set; }
     public string? password { get; set; }
     public string? congestion_control { get; set; }
+    public bool? quic { get; set; }
+    public string? quic_congestion_control { get; set; }
     public string? version { get; set; }
     public string? network { get; set; }
     public string? packet_encoding { get; set; }
@@ -169,7 +175,7 @@ public class Peer4Sbox
     public string? pre_shared_key { get; set; }
     public List<string> allowed_ips { get; set; }
     public int? persistent_keepalive_interval { get; set; }
-    public List<int> reserved { get; set; }
+    public List<int>? reserved { get; set; }
 }
 
 public class Tls4Sbox
@@ -233,6 +239,9 @@ public class Transport4Sbox
 public class Headers4Sbox
 {
     public string? Host { get; set; }
+
+    [JsonPropertyName("User-Agent")]
+    public string UserAgent { get; set; }
 }
 
 public class HyObfs4Sbox
@@ -255,14 +264,6 @@ public class Server4Sbox : BaseServer4Sbox
 
     // public List<string>? path { get; set; } // hosts
     public Dictionary<string, List<string>>? predefined { get; set; }
-
-    // Deprecated in sing-box 1.12.0 , kept for backward compatibility
-    public string? address { get; set; }
-
-    public string? address_resolver { get; set; }
-    public string? address_strategy { get; set; }
-    public string? strategy { get; set; }
-    // Deprecated End
 }
 
 public class Experimental4Sbox

v2rayN/ServiceLib/Models/CoreConfigs/V2rayConfig.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.CoreConfigs;
 
 public class V2rayConfig
 {
@@ -20,7 +20,7 @@ public class Stats4Ray
 
 public class Metrics4Ray
 {
-    public string tag { get; set; }
+    public string listen { get; set; }
 }
 
 public class Policy4Ray
@@ -47,9 +47,9 @@ public class Inbounds4Ray
 {
     public string tag { get; set; }
 
-    public int port { get; set; }
+    public int? port { get; set; }
 
-    public string listen { get; set; }
+    public string? listen { get; set; }
 
     public string protocol { get; set; }
 
@@ -75,6 +75,18 @@ public class Inboundsettings4Ray
     public bool? allowTransparent { get; set; }
 
     public List<AccountsItem4Ray>? accounts { get; set; }
+
+    public string? name { get; set; }
+
+    public int? MTU { get; set; }
+
+    public List<string>? gateway { get; set; }
+
+    public List<string>? autoSystemRoutingTable { get; set; }
+
+    public string? autoOutboundsInterface { get; set; }
+
+    public List<string>? dns { get; set; }
 }
 
 public class UsersItem4Ray
@@ -105,6 +117,8 @@ public class Outbounds4Ray
 
     public string protocol { get; set; }
 
+    public string? sendThrough { get; set; }
+
     public string? targetStrategy { get; set; }
 
     public Outboundsettings4Ray settings { get; set; }
@@ -122,15 +136,14 @@ public class Outboundsettings4Ray
 
     public Response4Ray? response { get; set; }
 
-    public string domainStrategy { get; set; }
+    public string? domainStrategy { get; set; }
 
     public int? userLevel { get; set; }
 
-    public FragmentItem4Ray? fragment { get; set; }
-
     public string? secretKey { get; set; }
 
-    public Object? address { get; set; }
+    public object? address { get; set; }
+
     public int? port { get; set; }
 
     public List<WireguardPeer4Ray>? peers { get; set; }
@@ -150,6 +163,7 @@ public class WireguardPeer4Ray
 {
     public string endpoint { get; set; }
     public string publicKey { get; set; }
+    public string? preSharedKey { get; set; }
 }
 
 public class VnextItem4Ray
@@ -179,6 +193,8 @@ public class ServersItem4Ray
 
     public string flow { get; set; }
 
+    public bool? uot { get; set; }
+
     public List<SocksUsersItem4Ray> users { get; set; }
 }
 
@@ -260,6 +276,7 @@ public class BalancersItem4Ray
     public List<string>? selector { get; set; }
     public BalancersStrategy4Ray? strategy { get; set; }
     public string? tag { get; set; }
+    public string? fallbackTag { get; set; }
 }
 
 public class BalancersStrategy4Ray
@@ -315,7 +332,7 @@ public class StreamSettings4Ray
 
     public TlsSettings4Ray? tlsSettings { get; set; }
 
-    public TcpSettings4Ray? tcpSettings { get; set; }
+    public RawSettings4Ray? rawSettings { get; set; }
 
     public KcpSettings4Ray? kcpSettings { get; set; }
 
@@ -335,7 +352,7 @@ public class StreamSettings4Ray
 
     public HysteriaSettings4Ray? hysteriaSettings { get; set; }
 
-    public Finalmask4Ray? finalmask { get; set; }
+    public object? finalmask { get; set; }
 
     public Sockopt4Ray? sockopt { get; set; }
 }
@@ -356,6 +373,7 @@ public class TlsSettings4Ray
     public string? spiderX { get; set; }
     public string? mldsa65Verify { get; set; }
     public List<CertificateSettings4Ray>? certificates { get; set; }
+    public string? verifyPeerCertByName { get; set; }
     public string? pinnedPeerCertSha256 { get; set; }
     public bool? disableSystemRoot { get; set; }
     public string? echConfigList { get; set; }
@@ -369,7 +387,7 @@ public class CertificateSettings4Ray
     public string? usage { get; set; }
 }
 
-public class TcpSettings4Ray
+public class RawSettings4Ray
 {
     public Header4Ray header { get; set; }
 }
@@ -393,11 +411,9 @@ public class KcpSettings4Ray
 
     public int downlinkCapacity { get; set; }
 
-    public bool congestion { get; set; }
+    public int cwndMultiplier { get; set; }
 
-    public int readBufferSize { get; set; }
-
-    public int writeBufferSize { get; set; }
+    public int maxSendingWindow { get; set; }
 }
 
 public class WsSettings4Ray
@@ -419,6 +435,8 @@ public class HttpupgradeSettings4Ray
     public string? path { get; set; }
 
     public string? host { get; set; }
+
+    public Headers4Ray headers { get; set; }
 }
 
 public class XhttpSettings4Ray
@@ -454,20 +472,18 @@ public class GrpcSettings4Ray
     public int? health_check_timeout { get; set; }
     public bool? permit_without_stream { get; set; }
     public int? initial_windows_size { get; set; }
+    public string? user_agent { get; set; }
 }
 
 public class HysteriaSettings4Ray
 {
     public int version { get; set; }
     public string? auth { get; set; }
-    public string? up { get; set; }
-    public string? down { get; set; }
-    public HysteriaUdpHop4Ray? udphop { get; set; }
 }
 
-public class HysteriaUdpHop4Ray
+public class UdpHop4Ray
 {
-    public string? port { get; set; }
+    public string? ports { get; set; }
     public string? interval { get; set; }
 }
 
@@ -475,18 +491,46 @@ public class Finalmask4Ray
 {
     public List<Mask4Ray>? tcp { get; set; }
     public List<Mask4Ray>? udp { get; set; }
+    public QuicParams4Ray? quicParams { get; set; }
 }
 
 public class Mask4Ray
 {
     public string type { get; set; }
-    public object? settings { get; set; }
+    public MaskSettings4Ray? settings { get; set; }
 }
 
 public class MaskSettings4Ray
 {
+    public string? header { get; set; }
+    public string? value { get; set; }
+
     public string? password { get; set; }
-    public string? domain { get; set; }
+
+    // fragment
+    public string? packets { get; set; }
+
+    public string? length { get; set; }
+    public string? delay { get; set; }
+
+    // noise
+    public int? reset { get; set; }
+
+    public List<NoiseMask4Ray>? noise { get; set; }
+}
+
+public class NoiseMask4Ray
+{
+    public string? rand { get; set; }
+    public string? delay { get; set; }
+}
+
+public class QuicParams4Ray
+{
+    public string? congestion { get; set; }
+    public string? brutalUp { get; set; }
+    public string? brutalDown { get; set; }
+    public UdpHop4Ray? udpHop { get; set; }
 }
 
 public class AccountsItem4Ray
@@ -499,6 +543,9 @@ public class AccountsItem4Ray
 public class Sockopt4Ray
 {
     public string? dialerProxy { get; set; }
+
+    [JsonPropertyName("interface")]
+    public string? Interface { get; set; }
 }
 
 public class FragmentItem4Ray

v2rayN/ServiceLib/Models/CoreConfigs/V2rayMetricsVars.cs

@@ -1,6 +1,6 @@
 using System.Collections;
 
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.CoreConfigs;
 
 internal class V2rayMetricsVars
 {

v2rayN/ServiceLib/Models/CoreConfigs/V2rayTcpRequest.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.CoreConfigs;
 
 public class V2rayTcpRequest
 {

v2rayN/ServiceLib/Models/Dto/CheckUpdateModel.cs

@@ -1,10 +1,12 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.Dto;
 
 public class CheckUpdateModel : ReactiveObject
 {
     public bool? IsSelected { get; set; }
-    public string? CoreType { get; set; }
+    public ECoreType? CoreType { get; set; }
     [Reactive] public string? Remarks { get; set; }
     public string? FileName { get; set; }
     public bool? IsFinished { get; set; }
+    public bool IsGeoFile { get; set; }
+    public string CoreTypeForStorage => IsGeoFile ? "GeoFiles" : (CoreType?.ToString() ?? "");
 }

v2rayN/ServiceLib/Models/Dto/ClashConnectionModel.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.Dto;
 
 public class ClashConnectionModel
 {

v2rayN/ServiceLib/Models/Dto/ClashConnections.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.Dto;
 
 public class ClashConnections
 {

v2rayN/ServiceLib/Models/Dto/ClashProviders.cs

@@ -1,6 +1,6 @@
-using static ServiceLib.Models.ClashProxies;
+using static ServiceLib.Models.Dto.ClashProxies;
 
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.Dto;
 
 public class ClashProviders
 {

v2rayN/ServiceLib/Models/Dto/ClashProxies.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.Dto;
 
 public class ClashProxies
 {

v2rayN/ServiceLib/Models/Dto/ClashProxyModel.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.Dto;
 
 [Serializable]
 public class ClashProxyModel : ReactiveObject

v2rayN/ServiceLib/Models/Dto/CmdItem.cs

@@ -1,4 +1,4 @@
-namespace ServiceLib.Models;
+namespace ServiceLib.Models.Dto;
 
 public class CmdItem
 {