diff --git a/eslint.config.mjs b/eslint.config.mjs
index 4d2ab02..2113e97 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -2,8 +2,26 @@ import { defineConfig, globalIgnores } from "eslint/config";
 import nextVitals from "eslint-config-next/core-web-vitals";
 import nextTypescript from "eslint-config-next/typescript";
 
+const accessibilityRules = {
+  "jsx-a11y/click-events-have-key-events": "error",
+  "jsx-a11y/label-has-associated-control": "error",
+  "jsx-a11y/no-static-element-interactions": "error",
+};
+
+const nextVitalsWithAccessibility = nextVitals.map((config) =>
+  config.name === "next"
+    ? {
+        ...config,
+        rules: {
+          ...config.rules,
+          ...accessibilityRules,
+        },
+      }
+    : config
+);
+
 export default defineConfig([
-  ...nextVitals,
+  ...nextVitalsWithAccessibility,
   ...nextTypescript,
   {
     linterOptions: {
diff --git a/local/Dockerfile b/local/Dockerfile
index c361758..9a859ff 100644
--- a/local/Dockerfile
+++ b/local/Dockerfile
@@ -2,14 +2,27 @@ FROM node:22-alpine AS deps
 WORKDIR /package
 RUN apk add --no-cache openssl
 
+COPY package.json package-lock.json ./
 COPY packages/core packages/core
 COPY packages/server-core packages/server-core
 COPY packages/ui packages/ui
 COPY packages/config packages/config
-COPY local/package*.json local/
+COPY local/package.json local/package.json
 
-WORKDIR /package/local
-RUN npm install
+RUN --mount=type=cache,target=/root/.npm,sharing=locked \
+    set -eu; \
+    attempt=1; \
+    max_attempts=3; \
+    until npm ci; do \
+      if [ "$attempt" -ge "$max_attempts" ]; then \
+        echo "npm ci failed after ${max_attempts} attempts" >&2; \
+        exit 1; \
+      fi; \
+      delay=$((attempt * 10)); \
+      echo "npm ci attempt ${attempt} failed; retrying in ${delay}s" >&2; \
+      sleep "$delay"; \
+      attempt=$((attempt + 1)); \
+    done
 
 FROM node:22-alpine AS builder
 WORKDIR /package
@@ -24,8 +37,7 @@ ENV APP_BUILD_SHA=${APP_BUILD_SHA}
 ENV APP_VERSION=${APP_VERSION}
 ENV APP_VERSION_TOKEN=${APP_VERSION_TOKEN}
 
-COPY --from=deps /package/local/node_modules local/node_modules
-RUN ln -s local/node_modules node_modules
+COPY --from=deps /package/node_modules node_modules
 COPY packages/core packages/core
 COPY packages/server-core packages/server-core
 COPY packages/ui packages/ui
@@ -35,6 +47,9 @@ COPY local local
 WORKDIR /package/local
 RUN npm run build
 
+FROM deps AS production-deps
+RUN npm prune --omit=dev
+
 FROM node:22-alpine AS runner
 WORKDIR /app
 ENV NODE_ENV=production
@@ -48,14 +63,14 @@ ENV APP_VERSION=${APP_VERSION}
 ENV APP_VERSION_TOKEN=${APP_VERSION_TOKEN}
 RUN apk add --no-cache openssl
 
-COPY --from=builder /package/local/.next/standalone ./
-COPY --from=deps /package/local/node_modules local/node_modules
-COPY --from=builder /package/local/.next/static local/.next/static
-COPY --from=builder /package/local/public local/public
-COPY --from=builder /package/local/prisma.config.ts local/prisma.config.ts
-COPY --from=builder /package/local/prisma local/prisma
-RUN if [ ! -e node_modules ] && [ -d local/node_modules ]; then ln -s local/node_modules node_modules; fi
+COPY --chown=node:node --from=builder /package/local/.next/standalone ./
+COPY --chown=node:node --from=production-deps /package/node_modules ./node_modules
+COPY --chown=node:node --from=builder /package/local/.next/static local/.next/static
+COPY --chown=node:node --from=builder /package/local/public local/public
+COPY --chown=node:node --from=builder /package/local/prisma.config.ts local/prisma.config.ts
+COPY --chown=node:node --from=builder /package/local/prisma local/prisma
 
 WORKDIR /app/local
+USER node
 EXPOSE 3000
-CMD ["sh", "-c", "./node_modules/.bin/prisma migrate deploy --schema prisma/schema.prisma && node server.js"]
+CMD ["sh", "-c", "../node_modules/.bin/prisma migrate deploy --schema prisma/schema.prisma && node server.js"]
diff --git a/local/app/api/auth/local-auth-routes.test.ts b/local/app/api/auth/local-auth-routes.test.ts
index b419970..908b4c0 100644
--- a/local/app/api/auth/local-auth-routes.test.ts
+++ b/local/app/api/auth/local-auth-routes.test.ts
@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
+import { clearLocalRateLimitsForTests } from "@local/lib/rate-limit";
 
 const mocks = vi.hoisted(() => ({
   bcryptCompare: vi.fn(),
@@ -49,6 +50,7 @@ async function readJson(response: Response) {
 describe("local auth and health routes", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    clearLocalRateLimitsForTests();
   });
 
   it("logs in a valid local admin and sets the session cookie", async () => {
@@ -101,6 +103,15 @@ describe("local auth and health routes", () => {
       status: 401,
       body: { error: "Invalid username or password.", code: "UNAUTHORIZED" },
     });
+
+    await expect(readJson(await POST(new Request("https://local.test/api/auth/login", {
+      method: "POST",
+      headers: { "content-length": String(64 * 1024 + 1) },
+      body: "{}",
+    })))).resolves.toEqual({
+      status: 413,
+      body: { error: "Request body is too large.", code: "PAYLOAD_TOO_LARGE" },
+    });
   });
 
   it("logs out by clearing the session cookie", async () => {
diff --git a/local/app/api/auth/login/route.ts b/local/app/api/auth/login/route.ts
index 949a36b..795c604 100644
--- a/local/app/api/auth/login/route.ts
+++ b/local/app/api/auth/login/route.ts
@@ -1,15 +1,44 @@
 import bcrypt from "bcryptjs";
 import { NextResponse } from "next/server";
-import { apiError, getStringField, readJsonBody } from "@local/lib/http";
+import { apiError, getStringField, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import { prisma } from "@local/lib/prisma";
 import { sessionCookieOptions, signSession, SESSION_COOKIE } from "@local/lib/session";
+import {
+  consumeLocalRateLimit,
+  getTrustedClientRateLimitKey,
+  hashLocalRateLimitKey,
+  localRateLimitResponse,
+  resetLocalRateLimit,
+} from "@local/lib/rate-limit";
+
+const LOGIN_WINDOW_MS = 15 * 60 * 1000;
 
 export async function POST(request: Request) {
-  const body = await readJsonBody(request);
-  if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+  const clientKey = getTrustedClientRateLimitKey(request);
+  if (clientKey) {
+    const clientLimit = consumeLocalRateLimit("auth-login-client", clientKey, {
+      limit: 30,
+      windowMs: LOGIN_WINDOW_MS,
+    });
+    if (!clientLimit.allowed) {
+      return localRateLimitResponse("Too many login attempts. Try again later.", clientLimit.retryAfterSeconds);
+    }
+  }
+
+  const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.small);
+  if (!parsedBody.ok) return jsonBodyError(parsedBody);
+  const body = parsedBody.value;
 
   const username = getStringField(body, "username");
   const password = getStringField(body, "password");
+  const usernameLimitKey = hashLocalRateLimitKey(username.toLowerCase() || "missing");
+  const usernameLimit = consumeLocalRateLimit("auth-login-username", usernameLimitKey, {
+    limit: 8,
+    windowMs: LOGIN_WINDOW_MS,
+  });
+  if (!usernameLimit.allowed) {
+    return localRateLimitResponse("Too many login attempts. Try again later.", usernameLimit.retryAfterSeconds);
+  }
   const admin = username
     ? await prisma.localAdmin.findUnique({ where: { username }, select: { id: true, username: true, passwordHash: true } })
     : null;
@@ -18,6 +47,8 @@ export async function POST(request: Request) {
     return apiError("Invalid username or password.", "UNAUTHORIZED", 401);
   }
 
+  resetLocalRateLimit("auth-login-username", usernameLimitKey);
+
   await prisma.localAdmin.update({ where: { id: admin.id }, data: { lastLoginAt: new Date() } });
   const response = NextResponse.json({ success: true, user: { id: admin.id, username: admin.username } });
   response.cookies.set(SESSION_COOKIE, await signSession({ adminId: admin.id, username: admin.username }), sessionCookieOptions());
diff --git a/local/app/api/cron/update-subscriptions/route.ts b/local/app/api/cron/update-subscriptions/route.ts
index 44cc195..f36242d 100644
--- a/local/app/api/cron/update-subscriptions/route.ts
+++ b/local/app/api/cron/update-subscriptions/route.ts
@@ -2,15 +2,44 @@ import { NextRequest } from "next/server";
 import { json } from "@local/lib/http";
 import { requireLocalCronAuth } from "@local/lib/cron-auth";
 import { runLocalSubscriptionAutoUpdateCron } from "@local/lib/auto-update-service";
+import {
+  acquireLocalJobLease,
+  JobLeaseLostError,
+  releaseLocalJobLease,
+  startLocalJobLeaseHeartbeat,
+  type LocalJobLease,
+} from "@local/lib/job-lease";
+
+const LEASE_NAME = "local-subscription-auto-update";
+const LEASE_MS = 5 * 60 * 1000;
+const HEARTBEAT_MS = 60 * 1000;
 
 export async function POST(request: NextRequest) {
   const authError = requireLocalCronAuth(request);
   if (authError) return authError;
 
-  const summary = await runLocalSubscriptionAutoUpdateCron();
-  return json({
-    success: true,
-    ...summary,
-    timestamp: new Date().toISOString(),
-  });
+  let lease: LocalJobLease | null = null;
+  let heartbeat: ReturnType<typeof startLocalJobLeaseHeartbeat> | null = null;
+  try {
+    lease = await acquireLocalJobLease({ name: LEASE_NAME, leaseMs: LEASE_MS });
+    if (!lease) return json({ success: true, skipped: true, reason: "already_running" });
+
+    heartbeat = startLocalJobLeaseHeartbeat({ lease, leaseMs: LEASE_MS, intervalMs: HEARTBEAT_MS });
+    const summary = await runLocalSubscriptionAutoUpdateCron(new Date(), {
+      assertLease: heartbeat.assertOwned,
+    });
+    return json({
+      success: true,
+      ...summary,
+      timestamp: new Date().toISOString(),
+    });
+  } catch (error) {
+    if (error instanceof JobLeaseLostError) {
+      return json({ error: "Local subscription update lease lost.", code: "JOB_LEASE_LOST" }, 503);
+    }
+    throw error;
+  } finally {
+    await heartbeat?.stop();
+    if (lease) await releaseLocalJobLease(lease).catch(() => undefined);
+  }
 }
diff --git a/local/app/api/settings/source-import/route.test.ts b/local/app/api/settings/source-import/route.test.ts
new file mode 100644
index 0000000..9e42244
--- /dev/null
+++ b/local/app/api/settings/source-import/route.test.ts
@@ -0,0 +1,117 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  getCurrentAdmin: vi.fn(),
+  prisma: {
+    localAdmin: {
+      findUnique: vi.fn(),
+      update: vi.fn(),
+    },
+  },
+}));
+
+vi.mock("@local/lib/auth", () => ({
+  getCurrentAdmin: mocks.getCurrentAdmin,
+}));
+
+vi.mock("@local/lib/prisma", () => ({
+  prisma: mocks.prisma,
+}));
+
+import { GET, PATCH } from "./route";
+
+async function readJson(response: Response) {
+  return { status: response.status, body: await response.json() };
+}
+
+function patchRequest(body: string) {
+  return new Request("https://local.test/api/settings/source-import", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body,
+  });
+}
+
+describe("local source import settings route", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.getCurrentAdmin.mockResolvedValue({ id: "admin-1", username: "admin" });
+  });
+
+  it("requires the local administrator for reads and writes", async () => {
+    mocks.getCurrentAdmin.mockResolvedValue(null);
+
+    await expect(readJson(await GET())).resolves.toEqual({
+      status: 401,
+      body: { error: "Authentication required.", code: "UNAUTHORIZED" },
+    });
+    await expect(readJson(await PATCH(patchRequest("{}")))).resolves.toEqual({
+      status: 401,
+      body: { error: "Authentication required.", code: "UNAUTHORIZED" },
+    });
+    expect(mocks.prisma.localAdmin.findUnique).not.toHaveBeenCalled();
+    expect(mocks.prisma.localAdmin.update).not.toHaveBeenCalled();
+  });
+
+  it("returns the persisted setting", async () => {
+    mocks.prisma.localAdmin.findUnique.mockResolvedValueOnce({
+      allowUnsafeSubscriptionSources: true,
+    });
+
+    await expect(readJson(await GET())).resolves.toEqual({
+      status: 200,
+      body: { allowUnsafeSubscriptionSources: true },
+    });
+    expect(mocks.prisma.localAdmin.findUnique).toHaveBeenCalledWith({
+      where: { id: "admin-1" },
+      select: { allowUnsafeSubscriptionSources: true },
+    });
+  });
+
+  it("updates the setting with a boolean value", async () => {
+    mocks.prisma.localAdmin.update.mockResolvedValueOnce({
+      allowUnsafeSubscriptionSources: true,
+    });
+
+    await expect(
+      readJson(await PATCH(patchRequest(JSON.stringify({ allowUnsafeSubscriptionSources: true }))))
+    ).resolves.toEqual({
+      status: 200,
+      body: { allowUnsafeSubscriptionSources: true },
+    });
+    expect(mocks.prisma.localAdmin.update).toHaveBeenCalledWith({
+      where: { id: "admin-1" },
+      data: { allowUnsafeSubscriptionSources: true },
+      select: { allowUnsafeSubscriptionSources: true },
+    });
+  });
+
+  it("rejects malformed JSON and non-boolean values", async () => {
+    await expect(readJson(await PATCH(patchRequest("{")))).resolves.toEqual({
+      status: 400,
+      body: { error: "Invalid JSON body.", code: "BAD_REQUEST" },
+    });
+    await expect(
+      readJson(await PATCH(patchRequest(JSON.stringify({ allowUnsafeSubscriptionSources: "yes" }))))
+    ).resolves.toEqual({
+      status: 400,
+      body: {
+        error: "allowUnsafeSubscriptionSources must be a boolean.",
+        code: "VALIDATION_ERROR",
+      },
+    });
+    expect(mocks.prisma.localAdmin.update).not.toHaveBeenCalled();
+  });
+
+  it("rejects settings bodies above 64 KiB", async () => {
+    const response = await PATCH(new Request("https://local.test/api/settings/source-import", {
+      method: "PATCH",
+      headers: { "content-length": String(64 * 1024 + 1) },
+      body: "{}",
+    }));
+    expect(await readJson(response)).toEqual({
+      status: 413,
+      body: { error: "Request body is too large.", code: "PAYLOAD_TOO_LARGE" },
+    });
+  });
+});
diff --git a/local/app/api/settings/source-import/route.ts b/local/app/api/settings/source-import/route.ts
new file mode 100644
index 0000000..abcc298
--- /dev/null
+++ b/local/app/api/settings/source-import/route.ts
@@ -0,0 +1,39 @@
+import { withCurrentAdmin } from "@local/lib/api-auth";
+import { apiError, json, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
+import { prisma } from "@local/lib/prisma";
+
+export async function GET() {
+  return withCurrentAdmin(async (admin) => {
+    const settings = await prisma.localAdmin.findUnique({
+      where: { id: admin.id },
+      select: { allowUnsafeSubscriptionSources: true },
+    });
+
+    if (!settings) return apiError("Local admin not found.", "NOT_FOUND", 404);
+    return json(settings);
+  });
+}
+
+export async function PATCH(request: Request) {
+  return withCurrentAdmin(async (admin) => {
+    const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.small);
+    if (!parsedBody.ok) return jsonBodyError(parsedBody);
+    const body = parsedBody.value;
+
+    const allowUnsafeSubscriptionSources =
+      typeof body === "object" && !Array.isArray(body)
+        ? (body as Record<string, unknown>).allowUnsafeSubscriptionSources
+        : undefined;
+    if (typeof allowUnsafeSubscriptionSources !== "boolean") {
+      return apiError("allowUnsafeSubscriptionSources must be a boolean.", "VALIDATION_ERROR", 400);
+    }
+
+    const settings = await prisma.localAdmin.update({
+      where: { id: admin.id },
+      data: { allowUnsafeSubscriptionSources },
+      select: { allowUnsafeSubscriptionSources: true },
+    });
+
+    return json(settings);
+  });
+}
diff --git a/local/app/api/setup/admin/route.test.ts b/local/app/api/setup/admin/route.test.ts
index 0c52218..a9a4198 100644
--- a/local/app/api/setup/admin/route.test.ts
+++ b/local/app/api/setup/admin/route.test.ts
@@ -3,10 +3,16 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 const mocks = vi.hoisted(() => ({
   hash: vi.fn(),
   readJsonBody: vi.fn(),
+  jsonBodyError: vi.fn((result: { reason: string }, message: string) => new Response(JSON.stringify({
+    error: result.reason === "too_large" ? "Request body is too large." : message,
+    code: result.reason === "too_large" ? "PAYLOAD_TOO_LARGE" : "BAD_REQUEST",
+  }), { status: result.reason === "too_large" ? 413 : 400 })),
   apiError: vi.fn((message: string, code: string, status: number) => new Response(JSON.stringify({ error: message, code }), { status })),
   getStringField: vi.fn((body: Record<string, unknown>, key: string) => (typeof body[key] === "string" ? String(body[key]).trim() : "")),
   count: vi.fn(),
   create: vi.fn(),
+  queryRaw: vi.fn(),
+  transaction: vi.fn(),
   signSession: vi.fn(),
   sessionCookieOptions: vi.fn(),
 }));
@@ -15,10 +21,13 @@ vi.mock("bcryptjs", () => ({ default: { hash: mocks.hash } }));
 vi.mock("@local/lib/http", () => ({
   apiError: mocks.apiError,
   getStringField: mocks.getStringField,
+  jsonBodyError: mocks.jsonBodyError,
+  LOCAL_JSON_BODY_LIMITS: { small: 64 * 1024 },
   readJsonBody: mocks.readJsonBody,
 }));
 vi.mock("@local/lib/prisma", () => ({
   prisma: {
+    $transaction: mocks.transaction,
     localAdmin: {
       count: mocks.count,
       create: mocks.create,
@@ -32,62 +41,75 @@ vi.mock("@local/lib/session", () => ({
 }));
 
 import { POST } from "./route";
+import { clearLocalRateLimitsForTests } from "@local/lib/rate-limit";
 
 async function readJson(response: Response) {
   return { status: response.status, body: await response.json(), headers: response.headers };
 }
 
+function setupRequest(token = "setup-secret") {
+  return new Request("https://local.test/api/setup/admin", {
+    headers: token ? { "X-SubBoost-Setup-Token": token } : {},
+  });
+}
+
 describe("local setup admin route", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    clearLocalRateLimitsForTests();
+    process.env.LOCAL_SETUP_TOKEN = "setup-secret";
     mocks.count.mockResolvedValue(0);
     mocks.hash.mockResolvedValue("hash");
     mocks.create.mockResolvedValue({ id: "admin-1", username: "ry" });
+    mocks.transaction.mockImplementation(async (callback) => callback({
+      $queryRaw: mocks.queryRaw,
+      localAdmin: { count: mocks.count, create: mocks.create },
+    }));
     mocks.signSession.mockResolvedValue("signed-session");
     mocks.sessionCookieOptions.mockReturnValue({ httpOnly: true, path: "/" });
   });
 
   it("rejects invalid JSON, existing admins, and invalid credentials", async () => {
-    mocks.readJsonBody.mockResolvedValueOnce(null);
-    expect(await readJson(await POST(new Request("https://local.test/api/setup/admin")))).toMatchObject({
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: false, reason: "invalid_json" });
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
       status: 400,
       body: { error: "请求格式有误，请刷新页面后重试", code: "BAD_REQUEST" },
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ username: "ry", password: "long-password", passwordConfirm: "long-password" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { username: "ry", password: "long-password", passwordConfirm: "long-password" } });
     mocks.count.mockResolvedValueOnce(1);
-    expect(await readJson(await POST(new Request("https://local.test/api/setup/admin")))).toMatchObject({
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
       status: 409,
       body: { error: "已有管理员账号，请直接登录", code: "CONFLICT" },
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ username: "ry", password: "short", passwordConfirm: "short" });
-    expect(await readJson(await POST(new Request("https://local.test/api/setup/admin")))).toMatchObject({
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { username: "ry", password: "short", passwordConfirm: "short" } });
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
       status: 400,
       body: { error: "密码至少需要 10 个字符", code: "BAD_REQUEST" },
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ username: "", password: "long-password", passwordConfirm: "long-password" });
-    expect(await readJson(await POST(new Request("https://local.test/api/setup/admin")))).toMatchObject({
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { username: "", password: "long-password", passwordConfirm: "long-password" } });
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
       status: 400,
       body: { error: "请输入管理员账号", code: "BAD_REQUEST" },
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ username: "ry", password: "long-password", passwordConfirm: "different-password" });
-    expect(await readJson(await POST(new Request("https://local.test/api/setup/admin")))).toMatchObject({
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { username: "ry", password: "long-password", passwordConfirm: "different-password" } });
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
       status: 400,
       body: { error: "两次输入的密码不一致，请重新确认", code: "BAD_REQUEST" },
     });
   });
 
   it("creates the first local admin and sets the session cookie", async () => {
-    mocks.readJsonBody.mockResolvedValue({
+    mocks.readJsonBody.mockResolvedValue({ ok: true, value: {
       username: " ry ",
       password: "long-password",
       passwordConfirm: "long-password",
-    });
+    } });
 
-    const result = await readJson(await POST(new Request("https://local.test/api/setup/admin")));
+    const result = await readJson(await POST(setupRequest()));
 
     expect(result.status).toBe(200);
     expect(result.body).toEqual({ success: true, user: { id: "admin-1", username: "ry" } });
@@ -99,4 +121,39 @@ describe("local setup admin route", () => {
     expect(mocks.signSession).toHaveBeenCalledWith({ adminId: "admin-1", username: "ry" });
     expect(result.headers.get("set-cookie")).toContain("subboost_local_session=signed-session");
   });
+
+  it("rechecks setup state under a database lock", async () => {
+    mocks.readJsonBody.mockResolvedValue({ ok: true, value: {
+      username: "ry",
+      password: "long-password",
+      passwordConfirm: "long-password",
+    } });
+    mocks.count.mockResolvedValueOnce(0).mockResolvedValueOnce(1);
+
+    const result = await readJson(await POST(setupRequest()));
+
+    expect(result).toMatchObject({
+      status: 409,
+      body: { error: "已有管理员账号，请直接登录", code: "CONFLICT" },
+    });
+    expect(mocks.queryRaw).toHaveBeenCalledWith(
+      expect.arrayContaining(["SELECT pg_advisory_xact_lock(", ') IS NULL AS "locked"']),
+      1_397_704_283
+    );
+    expect(mocks.create).not.toHaveBeenCalled();
+  });
+
+  it("fails closed when the setup token is missing or misconfigured", async () => {
+    expect(await readJson(await POST(setupRequest("wrong")))).toMatchObject({
+      status: 403,
+      body: { code: "FORBIDDEN" },
+    });
+
+    delete process.env.LOCAL_SETUP_TOKEN;
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
+      status: 503,
+      body: { code: "CONFIGURATION_ERROR" },
+    });
+    expect(mocks.readJsonBody).not.toHaveBeenCalled();
+  });
 });
diff --git a/local/app/api/setup/admin/route.ts b/local/app/api/setup/admin/route.ts
index 3b57f55..cb0a87c 100644
--- a/local/app/api/setup/admin/route.ts
+++ b/local/app/api/setup/admin/route.ts
@@ -1,13 +1,35 @@
 import bcrypt from "bcryptjs";
 import { NextResponse } from "next/server";
 import { getLocalAdminSetupCredentialError, LOCAL_ADMIN_CREDENTIAL_MESSAGES } from "@local/lib/admin-credentials";
-import { apiError, getStringField, readJsonBody } from "@local/lib/http";
+import { apiError, getStringField, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import { prisma } from "@local/lib/prisma";
 import { sessionCookieOptions, signSession, SESSION_COOKIE } from "@local/lib/session";
+import { consumeLocalRateLimit, getTrustedClientRateLimitKey, localRateLimitResponse } from "@local/lib/rate-limit";
+import { validateLocalSetupToken } from "@local/lib/setup-token";
 
 export async function POST(request: Request) {
-  const body = await readJsonBody(request);
-  if (!body) return apiError(LOCAL_ADMIN_CREDENTIAL_MESSAGES.invalidJson, "BAD_REQUEST", 400);
+  const clientKey = getTrustedClientRateLimitKey(request);
+  if (clientKey) {
+    const setupLimit = consumeLocalRateLimit("admin-setup-client", clientKey, {
+      limit: 5,
+      windowMs: 15 * 60 * 1000,
+    });
+    if (!setupLimit.allowed) {
+      return localRateLimitResponse("Too many setup attempts. Try again later.", setupLimit.retryAfterSeconds);
+    }
+  }
+
+  const setupToken = validateLocalSetupToken(request);
+  if (setupToken === "missing_config") {
+    return apiError("LOCAL_SETUP_TOKEN is not configured.", "CONFIGURATION_ERROR", 503);
+  }
+  if (setupToken === "invalid") {
+    return apiError("Invalid setup token.", "FORBIDDEN", 403);
+  }
+
+  const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.small);
+  if (!parsedBody.ok) return jsonBodyError(parsedBody, LOCAL_ADMIN_CREDENTIAL_MESSAGES.invalidJson);
+  const body = parsedBody.value;
 
   const existingCount = await prisma.localAdmin.count();
   if (existingCount > 0) {
@@ -23,10 +45,17 @@ export async function POST(request: Request) {
   }
 
   const passwordHash = await bcrypt.hash(password, 12);
-  const admin = await prisma.localAdmin.create({
-    data: { username, passwordHash, lastLoginAt: new Date() },
-    select: { id: true, username: true },
+  const admin = await prisma.$transaction(async (transaction) => {
+    await transaction.$queryRaw`SELECT pg_advisory_xact_lock(${1_397_704_283}) IS NULL AS "locked"`;
+    if (await transaction.localAdmin.count()) return null;
+    return transaction.localAdmin.create({
+      data: { username, passwordHash, lastLoginAt: new Date() },
+      select: { id: true, username: true },
+    });
   });
+  if (!admin) {
+    return apiError(LOCAL_ADMIN_CREDENTIAL_MESSAGES.adminExists, "CONFLICT", 409);
+  }
 
   const response = NextResponse.json({
     success: true,
diff --git a/local/app/api/source-import/route.ts b/local/app/api/source-import/route.ts
index 0b62232..38bca35 100644
--- a/local/app/api/source-import/route.ts
+++ b/local/app/api/source-import/route.ts
@@ -1,5 +1,5 @@
 import { withCurrentAdmin } from "@local/lib/api-auth";
-import { apiError, json, readJsonBody } from "@local/lib/http";
+import { apiError, json, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import { importSourceUrlDirect } from "@local/lib/source-import";
 import { buildSourceImportParseResult } from "@subboost/server-core/subscription";
 
@@ -11,8 +11,12 @@ function getStringField(body: unknown, key: string): string {
 
 export async function POST(request: Request) {
   return withCurrentAdmin(async () => {
-    const body = await readJsonBody(request);
-    if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.small);
+    if (!parsedBody.ok) return jsonBodyError(parsedBody);
+    const body = parsedBody.value;
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    }
 
     const result = await importSourceUrlDirect({
       url: getStringField(body, "url"),
diff --git a/local/app/api/subscriptions/[id]/config.yaml/route.test.ts b/local/app/api/subscriptions/[id]/config.yaml/route.test.ts
new file mode 100644
index 0000000..7506310
--- /dev/null
+++ b/local/app/api/subscriptions/[id]/config.yaml/route.test.ts
@@ -0,0 +1,92 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  consumeLocalRateLimit: vi.fn(),
+  generateSubscriptionYaml: vi.fn(),
+  getTrustedClientRateLimitKey: vi.fn(),
+  hashLocalRateLimitKey: vi.fn(() => "token-hash"),
+  localRateLimitResponse: vi.fn(
+    () => new Response(JSON.stringify({ error: "limited", code: "RATE_LIMITED" }), { status: 429 })
+  ),
+}));
+
+vi.mock("@local/lib/rate-limit", () => ({
+  consumeLocalRateLimit: mocks.consumeLocalRateLimit,
+  getTrustedClientRateLimitKey: mocks.getTrustedClientRateLimitKey,
+  hashLocalRateLimitKey: mocks.hashLocalRateLimitKey,
+  localRateLimitResponse: mocks.localRateLimitResponse,
+}));
+vi.mock("@local/lib/subscription-service", () => ({
+  generateSubscriptionYaml: mocks.generateSubscriptionYaml,
+}));
+
+import { GET } from "./route";
+
+describe("local subscription YAML route", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.consumeLocalRateLimit.mockReturnValue({ allowed: true, retryAfterSeconds: 0 });
+    mocks.getTrustedClientRateLimitKey.mockReturnValue("client-hash");
+    mocks.generateSubscriptionYaml.mockResolvedValue({
+      yaml: "mixed-port: 7890\n",
+      name: "Test",
+      subscriptionInfo: {},
+      cacheExpirySeconds: 3600,
+      autoUpdateIntervalSeconds: null,
+      isAdmin: true,
+    });
+  });
+
+  it("applies available client and per-token limits before generating YAML", async () => {
+    const response = await GET(new Request("https://local.test/config.yaml"), {
+      params: Promise.resolve({ id: "secret-token" }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(mocks.hashLocalRateLimitKey).toHaveBeenCalledWith("secret-token");
+    expect(mocks.consumeLocalRateLimit).toHaveBeenNthCalledWith(
+      1,
+      "subscription-yaml-client",
+      "client-hash",
+      { limit: 600, windowMs: 60_000 }
+    );
+    expect(mocks.consumeLocalRateLimit).toHaveBeenNthCalledWith(
+      2,
+      "subscription-yaml-token",
+      "token-hash",
+      { limit: 120, windowMs: 60_000 }
+    );
+    expect(mocks.generateSubscriptionYaml).toHaveBeenCalledWith("secret-token");
+  });
+
+  it("returns 429 before touching subscription data", async () => {
+    mocks.consumeLocalRateLimit.mockReturnValueOnce({ allowed: false, retryAfterSeconds: 17 });
+
+    const response = await GET(new Request("https://local.test/config.yaml"), {
+      params: Promise.resolve({ id: "secret-token" }),
+    });
+
+    expect(response.status).toBe(429);
+    expect(mocks.localRateLimitResponse).toHaveBeenCalledWith(
+      "Too many subscription requests. Try again later.",
+      17
+    );
+    expect(mocks.generateSubscriptionYaml).not.toHaveBeenCalled();
+  });
+
+  it("skips the client bucket when no trustworthy client key is available", async () => {
+    mocks.getTrustedClientRateLimitKey.mockReturnValueOnce(null);
+
+    const response = await GET(new Request("https://local.test/config.yaml"), {
+      params: Promise.resolve({ id: "secret-token" }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(mocks.consumeLocalRateLimit).toHaveBeenCalledTimes(1);
+    expect(mocks.consumeLocalRateLimit).toHaveBeenCalledWith(
+      "subscription-yaml-token",
+      "token-hash",
+      { limit: 120, windowMs: 60_000 }
+    );
+  });
+});
diff --git a/local/app/api/subscriptions/[id]/config.yaml/route.ts b/local/app/api/subscriptions/[id]/config.yaml/route.ts
index 38b8257..a5cf32e 100644
--- a/local/app/api/subscriptions/[id]/config.yaml/route.ts
+++ b/local/app/api/subscriptions/[id]/config.yaml/route.ts
@@ -1,13 +1,36 @@
 import { apiError } from "@local/lib/http";
 import { generateSubscriptionYaml } from "@local/lib/subscription-service";
 import { buildSubscriptionResponseHeaders } from "@subboost/server-core/subscription";
+import {
+  consumeLocalRateLimit,
+  getTrustedClientRateLimitKey,
+  hashLocalRateLimitKey,
+  localRateLimitResponse,
+} from "@local/lib/rate-limit";
 
 type RouteContext = {
   params: Promise<{ id: string }>;
 };
 
-export async function GET(_request: Request, { params }: RouteContext) {
+export async function GET(request: Request, { params }: RouteContext) {
   const { id: token } = await params;
+  const clientKey = getTrustedClientRateLimitKey(request);
+  if (clientKey) {
+    const clientLimit = consumeLocalRateLimit("subscription-yaml-client", clientKey, {
+      limit: 600,
+      windowMs: 60_000,
+    });
+    if (!clientLimit.allowed) {
+      return localRateLimitResponse("Too many subscription requests. Try again later.", clientLimit.retryAfterSeconds);
+    }
+  }
+  const tokenLimit = consumeLocalRateLimit("subscription-yaml-token", hashLocalRateLimitKey(token), {
+    limit: 120,
+    windowMs: 60_000,
+  });
+  if (!tokenLimit.allowed) {
+    return localRateLimitResponse("Too many subscription requests. Try again later.", tokenLimit.retryAfterSeconds);
+  }
   const result = await generateSubscriptionYaml(token);
   if (!result) return apiError("Subscription YAML not found.", "NOT_FOUND", 404);
   return new Response(result.yaml, {
diff --git a/local/app/api/templates/route.ts b/local/app/api/templates/route.ts
index 8df3943..a755a53 100644
--- a/local/app/api/templates/route.ts
+++ b/local/app/api/templates/route.ts
@@ -1,5 +1,5 @@
 import { getOptionalCurrentAdmin, localAdminRequiredResponse, withCurrentAdmin } from "@local/lib/api-auth";
-import { apiError, json, readJsonBody } from "@local/lib/http";
+import { apiError, json, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import {
   createTemplate,
   deleteTemplate,
@@ -51,11 +51,14 @@ export async function GET(request: Request) {
 
 export async function POST(request: Request) {
   return withCurrentAdmin(async (admin) => {
-    const body = await readJsonBody(request);
-    if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.template);
+    if (!parsedBody.ok) return jsonBodyError(parsedBody);
+    if (!parsedBody.value || typeof parsedBody.value !== "object" || Array.isArray(parsedBody.value)) {
+      return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    }
 
     try {
-      const template = await createTemplate(admin.id, body);
+      const template = await createTemplate(admin.id, parsedBody.value);
       return json({ template }, 201);
     } catch (error) {
       return apiError(error instanceof Error ? error.message : "Unable to create template.", "BAD_REQUEST", 400);
diff --git a/local/app/dashboard/settings/page.tsx b/local/app/dashboard/settings/page.tsx
index fde0882..439e987 100644
--- a/local/app/dashboard/settings/page.tsx
+++ b/local/app/dashboard/settings/page.tsx
@@ -1,30 +1,93 @@
 "use client";
 
 import * as React from "react";
-import { LogOut, ServerCog, ShieldCheck } from "lucide-react";
+import { LogOut, Network, ServerCog, ShieldCheck } from "lucide-react";
 
 import { Button } from "@subboost/ui/components/ui/button";
 import { Card, CardContent, CardHeader, CardTitle } from "@subboost/ui/components/ui/card";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { useUserStore } from "@subboost/ui/store/user-store";
 
 export default function SettingsPage() {
   const { user, fetchUser, logout } = useUserStore();
+  const [allowUnsafeSubscriptionSources, setAllowUnsafeSubscriptionSources] = React.useState(false);
+  const [sourceImportLoading, setSourceImportLoading] = React.useState(true);
+  const [sourceImportSaving, setSourceImportSaving] = React.useState(false);
+  const [sourceImportError, setSourceImportError] = React.useState<string | null>(null);
 
   React.useEffect(() => {
     void fetchUser();
   }, [fetchUser]);
 
+  React.useEffect(() => {
+    let cancelled = false;
+    if (!user) {
+      setSourceImportLoading(false);
+      return () => {
+        cancelled = true;
+      };
+    }
+
+    setSourceImportLoading(true);
+    setSourceImportError(null);
+    void fetch("/api/settings/source-import", { cache: "no-store" })
+      .then(async (response) => {
+        if (!response.ok) throw new Error("Unable to load source import settings.");
+        const body = (await response.json()) as { allowUnsafeSubscriptionSources?: unknown };
+        if (typeof body.allowUnsafeSubscriptionSources !== "boolean") {
+          throw new Error("Invalid source import settings response.");
+        }
+        if (!cancelled) setAllowUnsafeSubscriptionSources(body.allowUnsafeSubscriptionSources);
+      })
+      .catch(() => {
+        if (!cancelled) setSourceImportError("加载失败，请刷新重试");
+      })
+      .finally(() => {
+        if (!cancelled) setSourceImportLoading(false);
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, [user]);
+
   const handleLogout = async () => {
     await logout();
     window.location.href = "/login";
   };
 
+  const handleUnsafeSourceToggle = async (checked: boolean) => {
+    const previousValue = allowUnsafeSubscriptionSources;
+    setAllowUnsafeSubscriptionSources(checked);
+    setSourceImportSaving(true);
+    setSourceImportError(null);
+
+    try {
+      const response = await fetch("/api/settings/source-import", {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ allowUnsafeSubscriptionSources: checked }),
+      });
+      if (!response.ok) throw new Error("Unable to save source import settings.");
+      const body = (await response.json()) as { allowUnsafeSubscriptionSources?: unknown };
+      if (typeof body.allowUnsafeSubscriptionSources !== "boolean") {
+        throw new Error("Invalid source import settings response.");
+      }
+      setAllowUnsafeSubscriptionSources(body.allowUnsafeSubscriptionSources);
+    } catch {
+      setAllowUnsafeSubscriptionSources(previousValue);
+      setSourceImportError("保存失败，请重试");
+    } finally {
+      setSourceImportSaving(false);
+    }
+  };
+
   return (
     <div className="container mx-auto px-4 py-8">
       <div className="mb-8 flex flex-col gap-4 sm:flex-row sm:items-end sm:justify-between">
         <div>
           <h1 className="text-2xl font-bold mb-1">账户设置</h1>
-          <p className="text-white/50">本地管理员、订阅容量和运行端点</p>
+          <p className="text-white/50">本地管理员、订阅源安全和运行端点</p>
         </div>
       </div>
 
@@ -52,6 +115,25 @@ export default function SettingsPage() {
           </CardContent>
         </Card>
 
+        <Card>
+          <CardHeader className="flex flex-row items-center gap-3 space-y-0">
+            <div className="rounded-lg bg-emerald-500/20 p-2 text-emerald-300">
+              <Network className="h-5 w-5" />
+            </div>
+            <CardTitle className="text-base">订阅源安全</CardTitle>
+          </CardHeader>
+          <CardContent className="space-y-2">
+            <SwitchField
+              label="允许本机和局域网订阅"
+              description="开启后，本机、局域网及其他保留地址都可作为订阅源。仅在信任来源时开启。"
+              checked={allowUnsafeSubscriptionSources}
+              disabled={!user || sourceImportLoading || sourceImportSaving}
+              onCheckedChange={(checked) => void handleUnsafeSourceToggle(checked)}
+            />
+            {sourceImportError && <p className="text-xs text-red-300">{sourceImportError}</p>}
+          </CardContent>
+        </Card>
+
         <Card>
           <CardHeader className="flex flex-row items-center gap-3 space-y-0">
             <div className="rounded-lg bg-sky-500/20 p-2 text-sky-300">
diff --git a/local/app/local-pages.test.ts b/local/app/local-pages.test.ts
index 2201aea..fb686f0 100644
--- a/local/app/local-pages.test.ts
+++ b/local/app/local-pages.test.ts
@@ -8,6 +8,7 @@ const mocks = vi.hoisted(() => ({
   homeAdapter: null as any,
   readJsonResponse: vi.fn(),
   readSourceImportResponse: vi.fn(),
+  switches: [] as any[],
   templateAdapter: null as any,
   userState: {
     fetchUser: vi.fn(),
@@ -18,6 +19,7 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock("lucide-react", () => ({
   LogOut: () => React.createElement("span", null, "LogOut"),
+  Network: () => React.createElement("span", null, "Network"),
   ServerCog: () => React.createElement("span", null, "ServerCog"),
   ShieldCheck: () => React.createElement("span", null, "ShieldCheck"),
 }));
@@ -36,6 +38,13 @@ vi.mock("@subboost/ui/components/ui/card", () => ({
   CardTitle: (props: any) => React.createElement("h2", props, props.children),
 }));
 
+vi.mock("@subboost/ui/components/ui/switch", () => ({
+  Switch: (props: any) => {
+    mocks.switches.push(props);
+    return React.createElement("button", { disabled: props.disabled, role: "switch" });
+  },
+}));
+
 vi.mock("@subboost/ui/dashboard/subscription-dashboard-surface", () => ({
   SubscriptionDashboardSurface: (props: any) => {
     mocks.dashboardAdapter = props.adapter;
@@ -85,6 +94,7 @@ describe("local app pages and adapters", () => {
     mocks.homeAdapter = null;
     mocks.templateAdapter = null;
     mocks.buttons = [];
+    mocks.switches = [];
     mocks.userState = {
       fetchUser: vi.fn(),
       logout: vi.fn(),
@@ -217,13 +227,17 @@ describe("local app pages and adapters", () => {
   it("renders local settings for anonymous and authenticated states", async () => {
     let html = renderToStaticMarkup(React.createElement(SettingsPage));
     expect(html).toContain("未登录");
+    expect(html).toContain("允许本机和局域网订阅");
+    expect(html).toContain("本机、局域网及其他保留地址都可作为订阅源");
     expect(html).toContain("/api/health/live");
     expect(mocks.buttons.find((button: any) => button.variant === "destructive")).toMatchObject({
       disabled: true,
     });
+    expect(mocks.switches[0]).toMatchObject({ checked: false, disabled: true });
 
     vi.stubGlobal("window", { location: { href: "" } });
     mocks.buttons = [];
+    mocks.switches = [];
     mocks.userState = {
       fetchUser: vi.fn(),
       logout: vi.fn(),
@@ -234,6 +248,7 @@ describe("local app pages and adapters", () => {
     expect(html).toContain("2 / 9999");
     const logoutButton = mocks.buttons.find((button: any) => button.variant === "destructive");
     expect(logoutButton).toMatchObject({ disabled: false });
+    expect(mocks.switches[0]).toMatchObject({ checked: false, disabled: true });
     logoutButton.onClick();
     await Promise.resolve();
     await Promise.resolve();
diff --git a/local/docker-compose.image.yml b/local/docker-compose.image.yml
index d46684a..f582ac5 100644
--- a/local/docker-compose.image.yml
+++ b/local/docker-compose.image.yml
@@ -27,6 +27,8 @@ services:
       ENCRYPTION_KEY: ${ENCRYPTION_KEY:?set ENCRYPTION_KEY}
       JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET}
       CRON_SECRET: ${CRON_SECRET:?set CRON_SECRET}
+      LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:?set LOCAL_SETUP_TOKEN}
+      TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
       APP_URL: ${APP_URL:-http://localhost:3000}
 
   cron:
@@ -41,7 +43,7 @@ services:
       [
         "sh",
         "-c",
-        "i=0; while true; do if [ $$i -le 0 ]; then echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-rule-index\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-rule-index || true; i=10; fi; echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-subscriptions\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-subscriptions || true; i=$$((i - 1)); sleep 360; done"
+        "i=0; while true; do failed=0; if [ $$i -le 0 ]; then echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-rule-index\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-rule-index || failed=1; i=10; fi; echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-subscriptions\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-subscriptions || failed=1; i=$$((i - 1)); if [ $$failed -ne 0 ]; then echo \"[local-cron] one or more endpoints failed; restarting after delay\" >&2; sleep 30; exit 1; fi; sleep 360; done"
       ]
 
 volumes:
diff --git a/local/docker-compose.yml b/local/docker-compose.yml
index 656e220..01584a0 100644
--- a/local/docker-compose.yml
+++ b/local/docker-compose.yml
@@ -34,6 +34,8 @@ services:
       ENCRYPTION_KEY: ${ENCRYPTION_KEY:?set ENCRYPTION_KEY}
       JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET}
       CRON_SECRET: ${CRON_SECRET:?set CRON_SECRET}
+      LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:?set LOCAL_SETUP_TOKEN}
+      TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
       APP_URL: ${APP_URL:-http://localhost:3000}
       APP_RELEASE_VERSION: ${APP_RELEASE_VERSION:-}
       APP_BUILD_SHA: ${APP_BUILD_SHA:-}
@@ -52,7 +54,7 @@ services:
       [
         "sh",
         "-c",
-        "i=0; while true; do if [ $$i -le 0 ]; then echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-rule-index\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-rule-index || true; i=10; fi; echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-subscriptions\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-subscriptions || true; i=$$((i - 1)); sleep 360; done"
+        "i=0; while true; do failed=0; if [ $$i -le 0 ]; then echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-rule-index\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-rule-index || failed=1; i=10; fi; echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-subscriptions\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-subscriptions || failed=1; i=$$((i - 1)); if [ $$failed -ne 0 ]; then echo \"[local-cron] one or more endpoints failed; restarting after delay\" >&2; sleep 30; exit 1; fi; sleep 360; done"
       ]
 
 volumes:
diff --git a/local/local.env.example b/local/local.env.example
index ac3b24f..77ef2f9 100644
--- a/local/local.env.example
+++ b/local/local.env.example
@@ -5,5 +5,10 @@ DATABASE_URL=<postgres-connection-string>
 ENCRYPTION_KEY=<generate-a-random-key>
 JWT_SECRET=<generate-a-random-key>
 CRON_SECRET=<generate-a-random-key>
+LOCAL_SETUP_TOKEN=<generate-a-32-byte-random-token>
+# 仅开发/测试可显式开启；生产环境即使设置也不会绕过 CRON_SECRET。
+ALLOW_UNAUTHENTICATED_CRON=false
+# 只有反向代理会清洗并重写 X-Forwarded-For / X-Real-IP 时才设为 true。
+TRUST_PROXY_HEADERS=false
 APP_URL=http://localhost:3000
 SUBBOOST_PORT=3000
diff --git a/local/package.json b/local/package.json
index d294337..5b6ba74 100644
--- a/local/package.json
+++ b/local/package.json
@@ -22,9 +22,8 @@
     "check": "npm run lint && npm run typecheck && npm run build"
   },
   "dependencies": {
-    "@prisma/adapter-pg": "^7.8.0",
-    "@prisma/client": "^7.8.0",
-    "@radix-ui/react-accordion": "^1.2.0",
+    "@prisma/adapter-pg": "^7.9.0",
+    "@prisma/client": "^7.9.0",
     "@radix-ui/react-avatar": "^1.1.0",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -32,7 +31,6 @@
     "@radix-ui/react-popover": "^1.1.0",
     "@radix-ui/react-scroll-area": "^1.2.0",
     "@radix-ui/react-select": "^2.1.0",
-    "@radix-ui/react-separator": "^1.1.0",
     "@radix-ui/react-slot": "^1.1.0",
     "@radix-ui/react-switch": "^1.1.0",
     "@radix-ui/react-tabs": "^1.1.0",
@@ -46,10 +44,11 @@
     "clsx": "^2.1.0",
     "dotenv": "^17.4.2",
     "jose": "^6.2.3",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.3.0",
     "lucide-react": "^1.17.0",
-    "next": "^16.2.7",
+    "next": "^16.2.12",
     "peggy": "^5.1.0",
+    "prisma": "^7.9.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "react-remove-scroll-bar": "^2.3.8",
@@ -63,15 +62,9 @@
     "@types/react": "^19.2.16",
     "@types/react-dom": "^19.2.3",
     "eslint": "^9.39.4",
-    "eslint-config-next": "^16.2.7",
-    "postcss": "8.5.15",
-    "prisma": "^7.8.0",
+    "eslint-config-next": "^16.2.12",
+    "postcss": "8.5.23",
     "tailwindcss": "^4.3.0",
     "typescript": "^6.0.3"
-  },
-  "overrides": {
-    "@hono/node-server": "1.19.13",
-    "hono": "4.12.25",
-    "postcss": "8.5.15"
   }
 }
diff --git a/local/prisma/migrations/20260714000000_allow_unsafe_subscription_sources/migration.sql b/local/prisma/migrations/20260714000000_allow_unsafe_subscription_sources/migration.sql
new file mode 100644
index 0000000..e3e487a
--- /dev/null
+++ b/local/prisma/migrations/20260714000000_allow_unsafe_subscription_sources/migration.sql
@@ -0,0 +1,2 @@
+ALTER TABLE "LocalAdmin"
+ADD COLUMN "allowUnsafeSubscriptionSources" BOOLEAN NOT NULL DEFAULT false;
diff --git a/local/prisma/migrations/20260716091000_job_lease_lock/migration.sql b/local/prisma/migrations/20260716091000_job_lease_lock/migration.sql
new file mode 100644
index 0000000..f40f6c8
--- /dev/null
+++ b/local/prisma/migrations/20260716091000_job_lease_lock/migration.sql
@@ -0,0 +1,10 @@
+CREATE TABLE "JobLeaseLock" (
+    "name" TEXT NOT NULL,
+    "ownerToken" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "JobLeaseLock_pkey" PRIMARY KEY ("name")
+);
+
+CREATE INDEX "JobLeaseLock_expiresAt_idx" ON "JobLeaseLock"("expiresAt");
diff --git a/local/prisma/schema.prisma b/local/prisma/schema.prisma
index fadee48..d21427c 100644
--- a/local/prisma/schema.prisma
+++ b/local/prisma/schema.prisma
@@ -14,6 +14,7 @@ model LocalAdmin {
   createdAt    DateTime  @default(now())
   updatedAt    DateTime  @updatedAt
   lastLoginAt  DateTime?
+  allowUnsafeSubscriptionSources Boolean @default(false)
 
   subscriptions Subscription[]
   templates      LocalTemplate[]
@@ -38,7 +39,7 @@ model Subscription {
   id                            String    @id @default(cuid())
   ownerId                       String
   name                          String
-  token                         String    @unique @default(cuid())
+  token                         String    @unique
   isPrimary                     Boolean   @default(false)
   encryptedUrls                 String    @db.Text
   encryptedNodes                String    @db.Text
@@ -72,3 +73,12 @@ model SubscriptionAutoUpdateState {
 
   subscription Subscription @relation(fields: [subscriptionId], references: [id], onDelete: Cascade)
 }
+
+model JobLeaseLock {
+  name       String   @id
+  ownerToken String
+  expiresAt  DateTime
+  updatedAt  DateTime @updatedAt
+
+  @@index([expiresAt])
+}
diff --git a/local/scripts/install.sh b/local/scripts/install.sh
index c4c58a6..53f640a 100644
--- a/local/scripts/install.sh
+++ b/local/scripts/install.sh
@@ -57,6 +57,13 @@ run_root() {
   sudo_do "$@"
 }
 
+prepare_private_directory() {
+  local directory="$1"
+  run_root mkdir -p "$directory"
+  run_root chmod 700 "$directory"
+  if ! is_root; then run_root chown "$(id -u):$(id -g)" "$directory"; fi
+}
+
 install_secret_file() {
   local source="$1"
   local destination="$2"
@@ -120,15 +127,6 @@ download_to_temp() {
   esac
 }
 
-install_file_from_url() {
-  local url="$1"
-  local destination="$2"
-  local mode="$3"
-  local tmp="$TMP_DIR/download"
-  download_to_temp "$url" "$tmp"
-  run_root install -m "$mode" "$tmp" "$destination"
-}
-
 json_get() {
   local key="$1"
   local file="$2"
@@ -416,7 +414,11 @@ docker_runner() {
 
 docker_cmd() {
   if [ "$DOCKER_RUNNER" = "sudo docker" ]; then
-    sudo docker "$@"
+    if [ -n "${DOCKER_CONFIG:-}" ]; then
+      sudo env "DOCKER_CONFIG=$DOCKER_CONFIG" docker "$@"
+    else
+      sudo docker "$@"
+    fi
   else
     docker "$@"
   fi
@@ -445,7 +447,7 @@ docker_login_if_needed() {
 }
 
 compose() {
-  (cd "$SUBBOOST_HOME" && docker_cmd compose --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@")
+  (cd "$SUBBOOST_HOME" && docker_cmd compose --project-directory "$SUBBOOST_HOME" --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@")
 }
 
 subboost_app_container_id() {
@@ -507,20 +509,6 @@ prompt_for_port() {
   done
 }
 
-select_existing_or_random_port() {
-  local current_port selected_port
-  current_port="$(port_number "${1:-}")"
-  if port_can_be_used "$current_port"; then
-    printf '%s\n' "$current_port"
-    return 0
-  fi
-  selected_port="$(random_free_port)"
-  if [ -n "$current_port" ]; then
-    warn "已有配置端口 $current_port 被其它服务占用，已自动改用随机空闲端口 $selected_port。"
-  fi
-  printf '%s\n' "$selected_port"
-}
-
 wait_for_health() {
   local port="$1"
   local base="http://127.0.0.1:$(port_number "$port")"
@@ -541,9 +529,42 @@ wait_for_health() {
   return 1
 }
 
+cleanup_failed_install() {
+  local volumes_before="$1"
+  local project_name
+  project_name="$(basename "$SUBBOOST_HOME")"
+  compose down --remove-orphans >/dev/null 2>&1 || true
+  while IFS= read -r volume; do
+    [ -n "$volume" ] || continue
+    if ! grep -Fxq "$volume" "$volumes_before"; then
+      docker_cmd volume rm "$volume" >/dev/null 2>&1 || true
+    fi
+  done < <(docker_cmd volume ls -q --filter "label=com.docker.compose.project=$project_name" 2>/dev/null || true)
+}
+
+commit_candidate_install() {
+  local candidate_env="$1" candidate_compose="$2" candidate_manager="$3"
+  local live_env="$4" live_compose="$5"
+  local staged_env="${live_env}.candidate.$$"
+  local staged_compose="${live_compose}.candidate.$$"
+  local staged_manager="${SUBBOOST_BIN}.candidate.$$"
+  run_root install -m 600 "$candidate_env" "$staged_env" || return 1
+  if ! is_root; then run_root chown "$(id -u):$(id -g)" "$staged_env" || return 1; fi
+  run_root install -m 644 "$candidate_compose" "$staged_compose" || return 1
+  run_root install -m 755 "$candidate_manager" "$staged_manager" || return 1
+  run_root mv -f "$staged_env" "$live_env" || return 1
+  run_root mv -f "$staged_compose" "$live_compose" || return 1
+  run_root mv -f "$staged_manager" "$SUBBOOST_BIN" || return 1
+}
+
 main() {
   require_linux
   require_curl
+  local live_env="$ENV_FILE"
+  local live_compose="$COMPOSE_FILE"
+  if [ -e "$live_env" ] || [ -e "$live_compose" ]; then
+    die "Existing installation metadata was found. Use 'subboost update' or inspect the incomplete installation before retrying."
+  fi
   fetch_release_manifest
 
   local manifest_image manifest_compose manifest_manager manifest_version
@@ -556,6 +577,7 @@ main() {
   image="${SUBBOOST_IMAGE:-${manifest_image:-$DEFAULT_IMAGE}}"
   compose_url="${SUBBOOST_COMPOSE_URL:-$(resolve_url "$SUBBOOST_RELEASE_URL" "${manifest_compose:-$DEFAULT_COMPOSE_URL}")}"
   manager_url="${SUBBOOST_MANAGER_URL:-$(resolve_url "$SUBBOOST_RELEASE_URL" "${manifest_manager:-$DEFAULT_MANAGER_URL}")}"
+  [ -n "$image" ] && [ -n "$compose_url" ] && [ -n "$manager_url" ] || die "Release metadata is missing image, composeUrl, or managerUrl."
 
   say "Installing SubBoost."
   say "Install directory: $SUBBOOST_HOME"
@@ -571,12 +593,19 @@ main() {
 
   ensure_docker
   docker_login_if_needed
-  run_root mkdir -p "$SUBBOOST_HOME" "$SUBBOOST_HOME/backups" "$(dirname "$SUBBOOST_BIN")"
-  install_file_from_url "$compose_url" "$COMPOSE_FILE" 644
-  install_file_from_url "$manager_url" "$SUBBOOST_BIN" 755
-
-  local existing_env="0"
-  if [ -f "$ENV_FILE" ]; then existing_env="1"; fi
+  prepare_private_directory "$SUBBOOST_HOME"
+  prepare_private_directory "$SUBBOOST_HOME/backups"
+  run_root mkdir -p "$(dirname "$SUBBOOST_BIN")"
+  ENV_FILE="$TMP_DIR/candidate.env"
+  COMPOSE_FILE="$TMP_DIR/candidate-compose.yml"
+  local candidate_manager="$TMP_DIR/candidate-manager"
+  local volumes_before="$TMP_DIR/volumes.before"
+  umask 077
+  : > "$ENV_FILE"
+  download_to_temp "$compose_url" "$COMPOSE_FILE"
+  download_to_temp "$manager_url" "$candidate_manager"
+  [ -s "$COMPOSE_FILE" ] || die "Candidate Compose file is empty."
+  [ -s "$candidate_manager" ] && bash -n "$candidate_manager" || die "Candidate manager is invalid."
 
   set_env_value SUBBOOST_IMAGE "$image"
   set_env_value SUBBOOST_RELEASE_URL "$SUBBOOST_UPDATE_RELEASE_URL"
@@ -588,6 +617,7 @@ main() {
   ensure_env_value ENCRYPTION_KEY "$(random_hex 32)"
   ensure_env_value JWT_SECRET "$(random_hex 32)"
   ensure_env_value CRON_SECRET "$(random_hex 32)"
+  ensure_env_value LOCAL_SETUP_TOKEN "$(random_hex 32)"
 
   local db_name db_user db_pass database_url current_url current_port default_host default_url input_url selected_port final_url recommended_port
   db_name="$(env_value POSTGRES_DB)"
@@ -599,37 +629,46 @@ main() {
   current_port="${SUBBOOST_PORT:-$(env_value SUBBOOST_PORT || true)}"
   current_url="${APP_URL:-$(env_value APP_URL || true)}"
 
-  if [ "$existing_env" = "0" ] || [ -z "$current_url" ]; then
-    default_host="$(detect_public_host)"
-    if [ -n "$current_url" ]; then
-      default_url="$(url_without_port "$current_url")"
-    else
-      default_url="http://$default_host"
-    fi
-    recommended_port="$(recommended_port_from "$current_port")"
-    input_url="$(prompt "请输入 SubBoost 访问地址，直接回车会自动填入服务器 ip [$default_url]: " "$default_url")"
-    selected_port="$(prompt_for_port "$recommended_port")"
-    final_url="$(normalize_app_url "$(url_without_port "$input_url")" "$selected_port")"
-    set_env_value SUBBOOST_PORT "$selected_port"
-    set_env_value APP_URL "$final_url"
+  default_host="$(detect_public_host)"
+  if [ -n "$current_url" ]; then
+    default_url="$(url_without_port "$current_url")"
   else
-    selected_port="$(select_existing_or_random_port "$current_port")"
-    final_url="$(normalize_app_url "$(url_without_port "$current_url")" "$selected_port")"
-    set_env_value SUBBOOST_PORT "$selected_port"
-    set_env_value APP_URL "$final_url"
-  fi
-
-  say "Pulling SubBoost image..."
+    default_url="http://$default_host"
+  fi
+  recommended_port="$(recommended_port_from "$current_port")"
+  input_url="$(prompt "请输入 SubBoost 访问地址，直接回车会自动填入服务器 ip [$default_url]: " "$default_url")"
+  selected_port="$(prompt_for_port "$recommended_port")"
+  final_url="$(normalize_app_url "$(url_without_port "$input_url")" "$selected_port")"
+  set_env_value SUBBOOST_PORT "$selected_port"
+  set_env_value APP_URL "$final_url"
+
+  compose config >/dev/null
+  local services
+  services="$(compose config --services)"
+  for service in app db cron; do
+    printf '%s\n' "$services" | grep -Fxq "$service" || die "Candidate Compose is missing service: $service"
+  done
+  docker_cmd volume ls -q > "$volumes_before"
+  say "Pulling SubBoost image before creating containers..."
   compose pull
   say "Starting SubBoost..."
-  compose up -d --remove-orphans
-  compose up -d --no-deps --force-recreate app
-  wait_for_health "$(env_value SUBBOOST_PORT)"
+  if ! compose up -d db app || ! wait_for_health "$(env_value SUBBOOST_PORT)" || ! compose up -d cron; then
+    cleanup_failed_install "$volumes_before"
+    die "New installation failed; only resources created by this run were cleaned up."
+  fi
+  if ! commit_candidate_install "$ENV_FILE" "$COMPOSE_FILE" "$candidate_manager" "$live_env" "$live_compose"; then
+    cleanup_failed_install "$volumes_before"
+    run_root rm -f "$live_env" "$live_compose" "${live_env}.candidate.$$" "${live_compose}.candidate.$$" "${SUBBOOST_BIN}.candidate.$$"
+    die "Failed to atomically install candidate metadata."
+  fi
+  ENV_FILE="$live_env"
+  COMPOSE_FILE="$live_compose"
 
   say ""
   say "SubBoost 已启动。"
   say "访问地址: $(env_value APP_URL)"
-  say "第一次打开网页时，请创建管理员账号。"
+  say "首次初始化链接: $(env_value APP_URL)/login#setup-token=$(env_value LOCAL_SETUP_TOKEN)"
+  say "请通过上面的链接创建第一个管理员；初始化成功后页面会清除令牌片段。"
   say "管理命令: subboost"
   say "重要提醒: 请把 $ENV_FILE 和数据库备份一起保存好。"
 }
diff --git a/local/scripts/selfhost-lifecycle-shell.test.ts b/local/scripts/selfhost-lifecycle-shell.test.ts
new file mode 100644
index 0000000..b6bb1c8
--- /dev/null
+++ b/local/scripts/selfhost-lifecycle-shell.test.ts
@@ -0,0 +1,151 @@
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+const publicRoot = path.resolve(__dirname, "../..");
+
+function runRollbackScenario(restoreFails: boolean) {
+  const script = `
+    set -Eeuo pipefail
+    home="$(mktemp -d)"
+    trap 'rm -rf "$home"' EXIT
+    mkdir -p "$home/release" "$home/bin"
+    cat > "$home/release/release.json" <<'JSON'
+{"image":"new-image","composeUrl":"compose.yml","managerUrl":"manager"}
+JSON
+    printf 'services:\n  app: {}\n  db: {}\n  cron: {}\n' > "$home/release/compose.yml"
+    printf '#!/usr/bin/env bash\nexit 0\n' > "$home/release/manager"
+    cat > "$home/.env" <<ENV
+SUBBOOST_RELEASE_URL=file://$home/release/release.json
+SUBBOOST_IMAGE=old-image
+POSTGRES_DB=subboost
+POSTGRES_USER=subboost
+POSTGRES_PASSWORD=password
+DATABASE_URL=postgresql://subboost:password@db:5432/subboost?schema=public
+ENCRYPTION_KEY=key
+JWT_SECRET=jwt
+CRON_SECRET=cron
+APP_URL=http://127.0.0.1:31000
+SUBBOOST_PORT=31000
+ENV
+    : > "$home/docker-compose.yml"
+    export SUBBOOST_SCRIPT_SOURCE_ONLY=1
+    export SUBBOOST_HOME="$home"
+    export SUBBOOST_BIN="$home/bin/subboost"
+    export SUBBOOST_DOCTOR_HEALTH_ATTEMPTS=1
+    export SUBBOOST_DOCTOR_HEALTH_INTERVAL_SECONDS=0
+    source local/scripts/subboost.sh
+    sudo_do() { "$@"; }
+    read_env_file() { cat "$ENV_FILE"; }
+    log="$home/docker.log"
+    state="$home/state"
+    : > "$log"
+    printf 'old\n' > "$state"
+    docker() {
+      printf '%s\n' "$*" >> "$log"
+      if [ "$1" = "compose" ]; then
+        case "$*" in
+          *" config --services") printf 'app\ndb\ncron\n'; return 0 ;;
+          *" config") return 0 ;;
+          *" ps -q app") printf 'app-id\n'; return 0 ;;
+          *"pg_dump -Fc"*) printf 'custom-dump'; return 0 ;;
+          *"pg_restore --list"*) cat >/dev/null; return 0 ;;
+          *"pg_restore --clean"*) cat >/dev/null; [ "${restoreFails ? "1" : "0"}" = "0" ]; return $? ;;
+          *"candidate-compose.yml"*" up -d --no-deps app") printf 'candidate\n' > "$state"; return 0 ;;
+          *"old-compose.yml"*" up -d app") printf 'old\n' > "$state"; return 0 ;;
+        esac
+        return 0
+      fi
+      if [ "$1" = "inspect" ]; then printf 'sha256:old-image\n'; return 0; fi
+      return 0
+    }
+    curl() { [ "$(cat "$state")" = "old" ]; }
+    set +e
+    output="$(update_cmd 2>&1)"
+    status=$?
+    set -e
+    printf 'status=%s\n%s\n' "$status" "$output"
+    cat "$log"
+    [ "$status" -ne 0 ]
+  `;
+  return spawnSync("bash", ["-lc", "exec \"$BASH\" -s"], {
+    cwd: publicRoot,
+    encoding: "utf8",
+    input: script,
+    timeout: 30_000,
+    env: { ...process.env, LC_ALL: "C.UTF-8" },
+  });
+}
+
+describe("self-host update rollback lifecycle", () => {
+  it("restores the verified dump and old image after candidate health failure", () => {
+    const result = runRollbackScenario(false);
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain("Candidate update failed: candidate health check failed");
+    expect(result.stdout).toContain("pg_restore --clean --if-exists --exit-on-error");
+    expect(result.stdout).toContain("tag subboost-rollback:update-");
+    expect(result.stdout).toContain("old-image");
+    expect(result.stdout).toContain("Previous version restored successfully.");
+  });
+
+  it("keeps writers stopped and preserves the dump when database restore fails", () => {
+    const result = runRollbackScenario(true);
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain("Automatic rollback stopped: database restore failed");
+    expect(result.stdout).toContain("Keep app and cron stopped");
+    expect(result.stdout).toMatch(/old-compose\.yml.* stop cron app/);
+    expect(result.stdout).not.toMatch(/old-compose\.yml.* up -d app/);
+  });
+
+  it("never deletes a volume that existed before a failed installation", () => {
+    const result = spawnSync("bash", ["-lc", "exec \"$BASH\" -s"], {
+      cwd: publicRoot,
+      encoding: "utf8",
+      input: `
+        set -Eeuo pipefail
+        home="$(mktemp -d)"
+        trap 'rm -rf "$home"' EXIT
+        : > "$home/env"
+        : > "$home/compose.yml"
+        printf 'existing-volume\n' > "$home/volumes.before"
+        export SUBBOOST_SCRIPT_SOURCE_ONLY=1 SUBBOOST_HOME="$home"
+        source local/scripts/install.sh
+        ENV_FILE="$home/env" COMPOSE_FILE="$home/compose.yml" DOCKER_RUNNER=docker
+        docker() {
+          case "$*" in
+            "volume ls -q"*) printf 'existing-volume\nnew-volume\n' ;;
+            "volume rm"*) printf 'removed=%s\n' "$3" >> "$home/removed" ;;
+          esac
+        }
+        cleanup_failed_install "$home/volumes.before"
+        cat "$home/removed"
+      `,
+      timeout: 30_000,
+      env: { ...process.env, LC_ALL: "C.UTF-8" },
+    });
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain("removed=new-volume");
+    expect(result.stdout).not.toContain("removed=existing-volume");
+  });
+
+  it("persists a setup token and prints only the fragment bootstrap link", () => {
+    const installer = readFileSync(path.join(publicRoot, "local/scripts/install.sh"), "utf8");
+    expect(installer).toContain('ensure_env_value LOCAL_SETUP_TOKEN "$(random_hex 32)"');
+    expect(installer).toContain('prepare_private_directory "$SUBBOOST_HOME"');
+    expect(installer).toContain('prepare_private_directory "$SUBBOOST_HOME/backups"');
+    expect(installer).toContain("/login#setup-token=$(env_value LOCAL_SETUP_TOKEN)");
+    expect(installer).not.toContain("?setup-token=");
+  });
+
+  it("propagates cron endpoint failures to the container restart policy", () => {
+    for (const file of ["local/docker-compose.yml", "local/docker-compose.image.yml"]) {
+      const compose = readFileSync(path.join(publicRoot, file), "utf8");
+      expect(compose).toContain("LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:?set LOCAL_SETUP_TOKEN}");
+      expect(compose).toContain("curl -fsS");
+      expect(compose).toContain("failed=1");
+      expect(compose).toContain("exit 1");
+      expect(compose).not.toContain("|| true");
+    }
+  });
+});
diff --git a/local/scripts/selfhost-shell.test.ts b/local/scripts/selfhost-shell.test.ts
index 3895239..2596f2e 100644
--- a/local/scripts/selfhost-shell.test.ts
+++ b/local/scripts/selfhost-shell.test.ts
@@ -3,8 +3,12 @@ import { spawnSync } from "node:child_process";
 import { describe, expect, it } from "vitest";
 
 const publicRoot = path.resolve(__dirname, "../..");
-const BASH_NON_INTERACTIVE_COMMAND =
-  "if command -v setsid >/dev/null 2>&1; then exec setsid \"$BASH\" -s; fi; exec \"$BASH\" -s";
+const BASH_NON_INTERACTIVE_COMMAND = "exec \"$BASH\" -s";
+const POSIX_BACKUP_MODE_ASSERTIONS = process.platform === "win32"
+  ? ": # NTFS permissions are verified by Windows ACL checks, not POSIX mode bits"
+  : `
+      [ "$unsafe_files" = "0" ]
+      [ "$unsafe_dirs" = "0" ]`;
 
 function runBash(script: string) {
   return spawnSync("bash", ["-lc", BASH_NON_INTERACTIVE_COMMAND], {
@@ -12,6 +16,7 @@ function runBash(script: string) {
     encoding: "utf8",
     input: script,
     timeout: 30_000,
+    detached: true,
     env: {
       ...process.env,
       LC_ALL: "C.UTF-8",
@@ -20,6 +25,23 @@ function runBash(script: string) {
 }
 
 describe("self-host shell scripts", () => {
+  it("preserves an explicit Docker config when Docker requires sudo", () => {
+    const result = runBash(`
+      set -Eeuo pipefail
+      export SUBBOOST_SCRIPT_SOURCE_ONLY=1
+      source local/scripts/install.sh
+      export DOCKER_CONFIG=/tmp/subboost-isolated-docker-config
+      DOCKER_RUNNER="sudo docker"
+      sudo() { printf 'sudo-call=%s\\n' "$*"; }
+      docker_cmd info
+    `);
+
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain(
+      "sudo-call=env DOCKER_CONFIG=/tmp/subboost-isolated-docker-config docker info",
+    );
+  });
+
   it("uses prompt defaults without /dev/tty errors in non-interactive mode", () => {
     const result = runBash(`
       set -Eeuo pipefail
@@ -238,13 +260,17 @@ ENV
       export SUBBOOST_DOCTOR_HEALTH_ATTEMPTS=3
       export SUBBOOST_DOCTOR_HEALTH_INTERVAL_SECONDS=0
       source local/scripts/subboost.sh
+      sudo_do() { "$@"; }
       docker() {
         if [ "$1" = "info" ]; then return 0; fi
         if [ "$1" = "compose" ]; then
           case "$*" in
             "compose version"*) return 0 ;;
+            *" config --services") printf 'app\\ndb\\ncron\\n'; return 0 ;;
             *" config") return 0 ;;
             *" pull") return 0 ;;
+            *"pg_dump -Fc"*) printf 'custom-dump'; return 0 ;;
+            *"pg_restore --list"*) cat >/dev/null; return 0 ;;
             *" up -d --remove-orphans") return 0 ;;
             *" up -d --no-deps --force-recreate app") return 0 ;;
             *" ps -q app") printf 'app-id\\n'; return 0 ;;
@@ -254,6 +280,7 @@ ENV
         fi
         if [ "$1" = "inspect" ]; then
           case "$*" in
+            *"{{.Image}}"*) printf 'sha256:old-image\\n'; return 0 ;;
             *".State.Status"*) printf 'running\\n'; return 0 ;;
             *".State.Health"*) printf 'healthy\\n'; return 0 ;;
           esac
@@ -324,15 +351,19 @@ ENV
       docker_log="$home/docker-log"
       : > "$docker_log"
       docker() {
+        printf 'command=%s\n' "$*" >> "$docker_log"
         if [ "$1" = "info" ]; then return 0; fi
         if [ "$1" = "compose" ]; then
           case "$*" in
             "compose version"*) return 0 ;;
+            *" config --services") printf 'app\\ndb\\ncron\\n'; return 0 ;;
             *" config") return 0 ;;
             *" pull")
               printf 'pull_image=%s\\n' "\${SUBBOOST_IMAGE:-}" >> "$docker_log"
               return 0
               ;;
+            *"pg_dump -Fc"*) printf 'custom-dump'; return 0 ;;
+            *"pg_restore --list"*) cat >/dev/null; return 0 ;;
             *" up -d --remove-orphans") return 0 ;;
             *" up -d --no-deps --force-recreate app") return 0 ;;
             *" ps -q app") printf 'app-id\\n'; return 0 ;;
@@ -342,6 +373,7 @@ ENV
         fi
         if [ "$1" = "inspect" ]; then
           case "$*" in
+            *"{{.Image}}"*) printf 'sha256:old-image\\n'; return 0 ;;
             *".State.Status"*) printf 'running\\n'; return 0 ;;
             *".State.Health"*) printf 'healthy\\n'; return 0 ;;
           esac
@@ -361,6 +393,14 @@ ENV
     expect(result.stdout).toContain("SUBBOOST_IMAGE=new-image");
     expect(result.stdout).toContain("SUBBOOST_COMPOSE_URL=file://");
     expect(result.stdout).toContain("SUBBOOST_MANAGER_URL=file://");
+    const pullIndex = result.stdout.search(/^command=compose.* pull$/m);
+    const pauseIndex = result.stdout.indexOf(" stop cron app");
+    const dumpIndex = result.stdout.indexOf("pg_dump -Fc");
+    const candidateStartIndex = result.stdout.indexOf("candidate-compose.yml", dumpIndex);
+    expect(pullIndex).toBeGreaterThanOrEqual(0);
+    expect(pauseIndex).toBeGreaterThan(pullIndex);
+    expect(dumpIndex).toBeGreaterThan(pauseIndex);
+    expect(candidateStartIndex).toBeGreaterThan(dumpIndex);
   }, 10_000);
 
   it("migrates old fixed official update sources to stable latest", () => {
@@ -414,11 +454,14 @@ JSON
         if [ "$1" = "compose" ]; then
           case "$*" in
             "compose version"*) return 0 ;;
+            *" config --services") printf 'app\\ndb\\ncron\\n'; return 0 ;;
             *" config") return 0 ;;
             *" pull")
               printf 'pull_image=%s\\n' "\${SUBBOOST_IMAGE:-}" >> "$docker_log"
               return 0
               ;;
+            *"pg_dump -Fc"*) printf 'custom-dump'; return 0 ;;
+            *"pg_restore --list"*) cat >/dev/null; return 0 ;;
             *" up -d --remove-orphans") return 0 ;;
             *" up -d --no-deps --force-recreate app") return 0 ;;
             *" ps -q app") printf 'app-id\\n'; return 0 ;;
@@ -428,6 +471,7 @@ JSON
         fi
         if [ "$1" = "inspect" ]; then
           case "$*" in
+            *"{{.Image}}"*) printf 'sha256:old-image\\n'; return 0 ;;
             *".State.Status"*) printf 'running\\n'; return 0 ;;
             *".State.Health"*) printf 'healthy\\n'; return 0 ;;
           esac
@@ -495,22 +539,30 @@ ENV
       source local/scripts/subboost.sh
       sudo_do() { "$@"; }
       load_env() { :; }
-      compose() { printf 'dump'; }
+      compose() {
+        case "$*" in
+          *"pg_dump -Fc"*) printf 'custom-dump' ;;
+          *"pg_restore --list"*) cat >/dev/null ;;
+        esac
+      }
       cat > "$ENV_FILE" <<'ENV'
 POSTGRES_DB=subboost
 POSTGRES_USER=subboost
 ENV
       for i in $(seq -w 1 12); do
-        : > "$BACKUP_DIR/subboost-20240101T0000\${i}Z.sql.gz"
+        : > "$BACKUP_DIR/subboost-20240101T0000\${i}Z.dump"
         : > "$BACKUP_DIR/subboost-20240101T0000\${i}Z.env"
       done
       backup_cmd >/dev/null
-      sql_count="$(find "$BACKUP_DIR" -maxdepth 1 -type f -name 'subboost-*.sql.gz' | wc -l | tr -d '[:space:]')"
+      sql_count="$(find "$BACKUP_DIR" -maxdepth 1 -type f -name 'subboost-*.dump' | wc -l | tr -d '[:space:]')"
       env_count="$(find "$BACKUP_DIR" -maxdepth 1 -type f -name 'subboost-*.env' | wc -l | tr -d '[:space:]')"
-      printf 'sql=%s env=%s\\n' "$sql_count" "$env_count"
+      unsafe_files="$(find "$BACKUP_DIR" -maxdepth 1 -type f ! -perm 600 | wc -l | tr -d '[:space:]')"
+      unsafe_dirs="$(find "$BACKUP_DIR" -maxdepth 0 -type d ! -perm 700 | wc -l | tr -d '[:space:]')"
+      printf 'sql=%s env=%s unsafe_files=%s unsafe_dirs=%s\\n' "$sql_count" "$env_count" "$unsafe_files" "$unsafe_dirs"
       [ "$sql_count" = "10" ]
       [ "$env_count" = "10" ]
-      [ ! -e "$BACKUP_DIR/subboost-20240101T000001Z.sql.gz" ]
+      ${POSIX_BACKUP_MODE_ASSERTIONS}
+      [ ! -e "$BACKUP_DIR/subboost-20240101T000001Z.dump" ]
       [ ! -e "$BACKUP_DIR/subboost-20240101T000001Z.env" ]
     `;
 
@@ -518,5 +570,8 @@ ENV
 
     expect(result.status).toBe(0);
     expect(result.stdout).toContain("sql=10 env=10");
+    if (process.platform !== "win32") {
+      expect(result.stdout).toContain("unsafe_files=0 unsafe_dirs=0");
+    }
   });
 });
diff --git a/local/scripts/subboost.sh b/local/scripts/subboost.sh
index c564fd7..b4189c3 100644
--- a/local/scripts/subboost.sh
+++ b/local/scripts/subboost.sh
@@ -27,6 +27,13 @@ sudo_do() {
   if is_root; then "$@"; else sudo "$@"; fi
 }
 
+prepare_private_directory() {
+  local directory="$1"
+  sudo_do mkdir -p "$directory"
+  sudo_do chmod 700 "$directory"
+  if ! is_root; then sudo_do chown "$(id -u):$(id -g)" "$directory"; fi
+}
+
 install_secret_file() {
   local source="$1"
   local destination="$2"
@@ -60,9 +67,16 @@ docker_cmd() {
 }
 
 compose() {
-  [ -f "$COMPOSE_FILE" ] || die "Missing $COMPOSE_FILE"
-  [ -f "$ENV_FILE" ] || die "Missing $ENV_FILE"
-  (cd "$SUBBOOST_HOME" && docker_cmd compose --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@")
+  compose_files "$ENV_FILE" "$COMPOSE_FILE" "$@"
+}
+
+compose_files() {
+  local env_file="$1"
+  local compose_file="$2"
+  shift 2
+  [ -f "$compose_file" ] || die "Missing $compose_file"
+  [ -f "$env_file" ] || die "Missing $env_file"
+  (cd "$SUBBOOST_HOME" && docker_cmd compose --project-directory "$SUBBOOST_HOME" --env-file "$env_file" -f "$compose_file" "$@")
 }
 
 load_env() {
@@ -120,7 +134,7 @@ resolve_url() {
 }
 
 read_env_file() {
-  if is_root; then cat "$ENV_FILE"; else sudo cat "$ENV_FILE"; fi
+  sudo_do cat "$ENV_FILE"
 }
 
 write_env_value() {
@@ -147,11 +161,47 @@ is_official_fixed_release_url() {
   esac
 }
 
-migrate_update_release_url() {
-  local release_url="$1"
-  is_official_fixed_release_url "$release_url" || return 1
-  say "Detected old fixed release update source; switching updates to stable latest."
-  write_runtime_env_value SUBBOOST_RELEASE_URL "$DEFAULT_STABLE_RELEASE_URL"
+random_hex() {
+  local bytes="$1"
+  if command -v openssl >/dev/null 2>&1; then
+    openssl rand -hex "$bytes"
+  else
+    dd if=/dev/urandom bs="$bytes" count=1 2>/dev/null | od -An -tx1 | tr -d ' \n'
+  fi
+}
+
+set_file_env_value() {
+  local file="$1"
+  local key="$2"
+  local value="$3"
+  local tmp="$TMP_DIR/env.$key"
+  awk -F= -v key="$key" '$1 != key { print }' "$file" > "$tmp"
+  printf '%s=%s\n' "$key" "$value" >> "$tmp"
+  mv "$tmp" "$file"
+}
+
+atomic_install_file() {
+  local source="$1"
+  local destination="$2"
+  local mode="$3"
+  stage_install_file "$source" "$destination" "$mode"
+  activate_staged_file "$destination"
+}
+
+stage_install_file() {
+  local source="$1"
+  local destination="$2"
+  local mode="$3"
+  local staged="${destination}.candidate.$$"
+  sudo_do install -m "$mode" "$source" "$staged" || return 1
+  if [ "$mode" = "600" ] && ! is_root; then
+    sudo_do chown "$(id -u):$(id -g)" "$staged" || return 1
+  fi
+}
+
+activate_staged_file() {
+  local destination="$1"
+  sudo_do mv -f "${destination}.candidate.$$" "$destination"
 }
 
 install_file_from_url() {
@@ -164,6 +214,33 @@ install_file_from_url() {
   sudo_do install -m "$mode" "$tmp" "$destination"
 }
 
+create_verified_dump() {
+  local output="$1"
+  local partial="${output}.partial"
+  local -a dump_status verify_status
+  prepare_private_directory "$(dirname "$output")"
+  sudo_do install -m 600 /dev/null "$partial"
+  set +e
+  compose exec -T db pg_dump -Fc -U "${POSTGRES_USER:-subboost}" -d "${POSTGRES_DB:-subboost}" | sudo_do tee "$partial" >/dev/null
+  dump_status=("${PIPESTATUS[@]}")
+  set -e
+  if (( dump_status[0] != 0 || dump_status[1] != 0 )) || [ ! -s "$partial" ]; then
+    sudo_do rm -f -- "$partial"
+    say "Backup failed: pg_dump=${dump_status[0]} write=${dump_status[1]}"
+    return 1
+  fi
+  set +e
+  sudo_do cat "$partial" | compose exec -T db pg_restore --list >/dev/null
+  verify_status=("${PIPESTATUS[@]}")
+  set -e
+  if (( verify_status[0] != 0 || verify_status[1] != 0 )); then
+    sudo_do rm -f -- "$partial"
+    say "Backup verification failed: read=${verify_status[0]} pg_restore=${verify_status[1]}"
+    return 1
+  fi
+  sudo_do mv "$partial" "$output"
+}
+
 port_number() {
   local value="$1"
   case "$value" in
@@ -304,36 +381,156 @@ update_cmd() {
   load_env
   local release_url="${SUBBOOST_RELEASE_URL:-}"
   local release_file="$TMP_DIR/release.json"
-  local image compose_url manager_url
+  local candidate_env="$TMP_DIR/candidate.env"
+  local candidate_compose="$TMP_DIR/candidate-compose.yml"
+  local candidate_manager="$TMP_DIR/candidate-manager"
+  local old_env="$TMP_DIR/old.env"
+  local old_compose="$TMP_DIR/old-compose.yml"
+  local old_manager="$TMP_DIR/old-manager"
+  local rollback_dump="$BACKUP_DIR/update-rollback-$(date -u +%Y%m%dT%H%M%SZ).dump"
+  local image="${SUBBOOST_IMAGE:-}" compose_url="" manager_url="" services=""
+  local app_id old_image_id rollback_tag old_image_ref update_error restore_error db_ready
+  local manager_present=0 old_manager_present=0
+  local -a restore_status
   mkdir -p "$TMP_DIR"
-  if migrate_update_release_url "$release_url"; then
+  if is_official_fixed_release_url "$release_url"; then
+    say "Detected old fixed release update source; switching updates to stable latest."
     release_url="$DEFAULT_STABLE_RELEASE_URL"
   fi
   if [ -n "$release_url" ] && download_to_temp "$release_url" "$release_file" 2>/dev/null; then
     image="$(json_get image "$release_file" || true)"
     compose_url="$(resolve_url "$release_url" "$(json_get composeUrl "$release_file" || true)")"
     manager_url="$(resolve_url "$release_url" "$(json_get managerUrl "$release_file" || true)")"
-    if [ -n "$image" ]; then write_runtime_env_value SUBBOOST_IMAGE "$image"; fi
-    if [ -n "$compose_url" ]; then
-      install_file_from_url "$compose_url" "$COMPOSE_FILE" 644
-      write_runtime_env_value SUBBOOST_COMPOSE_URL "$compose_url"
-    fi
-    if [ -n "$manager_url" ]; then
-      install_file_from_url "$manager_url" "${SUBBOOST_BIN:-/usr/local/bin/subboost}" 755
-      write_runtime_env_value SUBBOOST_MANAGER_URL "$manager_url"
-    fi
+    [ -n "$image" ] && [ -n "$compose_url" ] && [ -n "$manager_url" ] || die "Release manifest is missing image, composeUrl, or managerUrl."
+    download_to_temp "$compose_url" "$candidate_compose"
+    download_to_temp "$manager_url" "$candidate_manager"
+    [ -s "$candidate_manager" ] && bash -n "$candidate_manager" || die "Candidate manager is invalid."
   else
     say "Release manifest unavailable; updating current image and compose only."
+    cp "$COMPOSE_FILE" "$candidate_compose"
+    if [ -f "${SUBBOOST_BIN:-/usr/local/bin/subboost}" ]; then
+      sudo_do cp "${SUBBOOST_BIN:-/usr/local/bin/subboost}" "$candidate_manager"
+      manager_present=1
+    fi
   fi
-  compose pull
-  compose up -d --remove-orphans
-  compose up -d --no-deps --force-recreate app
-  if ! wait_for_health; then
-    local health_status
-    health_status="$(health_status_code)"
-    status_cmd
-    die "$(doctor_health_failure_message "$health_status")"
+  [ -n "$manager_url" ] && manager_present=1
+  [ -n "$image" ] || die "SUBBOOST_IMAGE is missing."
+  read_env_file > "$candidate_env"
+  cp "$candidate_env" "$old_env"
+  cp "$COMPOSE_FILE" "$old_compose"
+  if [ -f "${SUBBOOST_BIN:-/usr/local/bin/subboost}" ]; then
+    sudo_do cp "${SUBBOOST_BIN:-/usr/local/bin/subboost}" "$old_manager"
+    old_manager_present=1
+  fi
+  set_file_env_value "$candidate_env" SUBBOOST_IMAGE "$image"
+  set_file_env_value "$candidate_env" SUBBOOST_RELEASE_URL "$release_url"
+  [ -n "$compose_url" ] && set_file_env_value "$candidate_env" SUBBOOST_COMPOSE_URL "$compose_url"
+  [ -n "$manager_url" ] && set_file_env_value "$candidate_env" SUBBOOST_MANAGER_URL "$manager_url"
+  if ! grep -q '^LOCAL_SETUP_TOKEN=.' "$candidate_env"; then
+    set_file_env_value "$candidate_env" LOCAL_SETUP_TOKEN "$(random_hex 32)"
+  fi
+  compose_files "$candidate_env" "$candidate_compose" config >/dev/null
+  services="$(compose_files "$candidate_env" "$candidate_compose" config --services)"
+  for service in app db cron; do
+    printf '%s\n' "$services" | grep -Fxq "$service" || die "Candidate Compose is missing service: $service"
+  done
+  say "Pulling candidate image before the maintenance window..."
+  SUBBOOST_IMAGE="$image" compose_files "$candidate_env" "$candidate_compose" pull
+
+  app_id="$(service_container_id app)"
+  [ -n "$app_id" ] || die "Cannot identify the current app container for rollback."
+  old_image_id="$(docker_cmd inspect -f '{{.Image}}' "$app_id" 2>/dev/null || true)"
+  [ -n "$old_image_id" ] || die "Cannot identify the current app image for rollback."
+  old_image_ref="${SUBBOOST_IMAGE:-}"
+  rollback_tag="subboost-rollback:update-$$"
+  if ! stage_install_file "$candidate_env" "$ENV_FILE" 600 \
+    || ! stage_install_file "$candidate_compose" "$COMPOSE_FILE" 644 \
+    || { [ "$manager_present" = "1" ] && ! stage_install_file "$candidate_manager" "${SUBBOOST_BIN:-/usr/local/bin/subboost}" 755; }; then
+    sudo_do rm -f "${ENV_FILE}.candidate.$$" "${COMPOSE_FILE}.candidate.$$" "${SUBBOOST_BIN:-/usr/local/bin/subboost}.candidate.$$"
+    die "Candidate metadata could not be staged safely."
+  fi
+  if ! docker_cmd tag "$old_image_id" "$rollback_tag"; then
+    sudo_do rm -f "${ENV_FILE}.candidate.$$" "${COMPOSE_FILE}.candidate.$$" "${SUBBOOST_BIN:-/usr/local/bin/subboost}.candidate.$$"
+    die "Could not create the rollback image tag."
+  fi
+
+  say "Pausing app and cron for a stable database snapshot..."
+  if ! compose stop cron app; then
+    sudo_do rm -f "${ENV_FILE}.candidate.$$" "${COMPOSE_FILE}.candidate.$$" "${SUBBOOST_BIN:-/usr/local/bin/subboost}.candidate.$$"
+    docker_cmd image rm "$rollback_tag" >/dev/null 2>&1 || true
+    die "Update aborted because app and cron could not be paused safely."
+  fi
+  if ! create_verified_dump "$rollback_dump"; then
+    compose up -d app cron || true
+    wait_for_health || true
+    sudo_do rm -f "${ENV_FILE}.candidate.$$" "${COMPOSE_FILE}.candidate.$$" "${SUBBOOST_BIN:-/usr/local/bin/subboost}.candidate.$$"
+    docker_cmd image rm "$rollback_tag" >/dev/null 2>&1 || true
+    die "Update aborted because a verified rollback dump could not be created."
+  fi
+
+  update_error=""
+  compose_files "$candidate_env" "$candidate_compose" up -d db || update_error="candidate database startup failed"
+  if [ -z "$update_error" ]; then
+    compose_files "$candidate_env" "$candidate_compose" up -d --no-deps app || update_error="candidate app startup or migration failed"
+  fi
+  if [ -z "$update_error" ] && ! wait_for_health; then
+    update_error="candidate health check failed"
   fi
+  if [ -z "$update_error" ]; then
+    activate_staged_file "$ENV_FILE" || update_error="candidate environment activation failed"
+  fi
+  if [ -z "$update_error" ]; then
+    activate_staged_file "$COMPOSE_FILE" || update_error="candidate Compose activation failed"
+  fi
+  if [ -z "$update_error" ] && [ "$manager_present" = "1" ]; then
+    activate_staged_file "${SUBBOOST_BIN:-/usr/local/bin/subboost}" || update_error="candidate manager activation failed"
+  fi
+  if [ -z "$update_error" ]; then
+    compose_files "$candidate_env" "$candidate_compose" up -d cron || update_error="candidate cron startup failed"
+  fi
+
+  if [ -n "$update_error" ]; then
+    say "Candidate update failed: $update_error"
+    compose_files "$candidate_env" "$candidate_compose" stop cron app >/dev/null 2>&1 || true
+    docker_cmd tag "$rollback_tag" "$old_image_ref" || true
+    sudo_do rm -f "${ENV_FILE}.candidate.$$" "${COMPOSE_FILE}.candidate.$$" "${SUBBOOST_BIN:-/usr/local/bin/subboost}.candidate.$$"
+    restore_error=""
+    atomic_install_file "$old_env" "$ENV_FILE" 600 || restore_error="old environment metadata restore failed"
+    atomic_install_file "$old_compose" "$COMPOSE_FILE" 644 || restore_error="old Compose metadata restore failed"
+    if [ "$old_manager_present" = "1" ]; then
+      atomic_install_file "$old_manager" "${SUBBOOST_BIN:-/usr/local/bin/subboost}" 755 || restore_error="old manager metadata restore failed"
+    fi
+    db_ready=1
+    compose_files "$old_env" "$old_compose" up -d db || { restore_error="old database container did not start"; db_ready=0; }
+    if [ "$db_ready" = "1" ]; then
+      set +e
+      sudo_do cat "$rollback_dump" | compose_files "$old_env" "$old_compose" exec -T db pg_restore --clean --if-exists --exit-on-error --no-owner --no-privileges -U "${POSTGRES_USER:-subboost}" -d "${POSTGRES_DB:-subboost}"
+      restore_status=("${PIPESTATUS[@]}")
+      set -e
+      if (( restore_status[0] != 0 || restore_status[1] != 0 )); then restore_error="database restore failed"; fi
+    fi
+    if [ -n "$restore_error" ]; then
+      compose_files "$old_env" "$old_compose" stop cron app >/dev/null 2>&1 || true
+      say "Automatic rollback stopped: $restore_error"
+      say "Rollback dump preserved at: $rollback_dump"
+      say "Keep app and cron stopped. Restore manually with pg_restore before restarting them."
+      return 1
+    fi
+    compose_files "$old_env" "$old_compose" up -d app
+    if ! wait_for_health; then
+      compose_files "$old_env" "$old_compose" stop cron app >/dev/null 2>&1 || true
+      say "Database and old image were restored, but the old app did not become healthy."
+      say "Rollback dump preserved at: $rollback_dump"
+      return 1
+    fi
+    compose_files "$old_env" "$old_compose" up -d cron
+    docker_cmd image rm "$rollback_tag" >/dev/null 2>&1 || true
+    say "Previous version restored successfully."
+    return 1
+  fi
+
+  docker_cmd image rm "$rollback_tag" >/dev/null 2>&1 || true
+  load_env
   status_cmd
 }
 
@@ -343,36 +540,28 @@ logs_cmd() {
 
 backup_cmd() {
   load_env
-  sudo_do mkdir -p "$BACKUP_DIR"
-  local stamp db_tmp db_out env_out
+  prepare_private_directory "$BACKUP_DIR"
+  local stamp db_out env_out
   local -a sql_backups env_backups
-  local -a backup_status
   local i backup_retention_count
   backup_retention_count="${SUBBOOST_BACKUP_RETENTION_COUNT:-$DEFAULT_BACKUP_RETENTION_COUNT}"
   if ! [[ "$backup_retention_count" =~ ^[0-9]+$ ]] || (( backup_retention_count < 1 )); then
     die "SUBBOOST_BACKUP_RETENTION_COUNT must be a positive integer"
   fi
   stamp="$(date -u +%Y%m%dT%H%M%SZ)"
-  db_tmp="$BACKUP_DIR/subboost-$stamp.sql.gz.partial"
-  db_out="$BACKUP_DIR/subboost-$stamp.sql.gz"
+  db_out="$BACKUP_DIR/subboost-$stamp.dump"
   env_out="$BACKUP_DIR/subboost-$stamp.env"
-  set +e
-  compose exec -T db pg_dump -U "${POSTGRES_USER:-subboost}" -d "${POSTGRES_DB:-subboost}" | gzip -c | sudo_do tee "$db_tmp" >/dev/null
-  backup_status=("${PIPESTATUS[@]}")
-  set -e
-  if (( backup_status[0] != 0 || backup_status[1] != 0 || backup_status[2] != 0 )); then
-    sudo_do rm -f -- "$db_tmp"
-    say "Backup failed: pg_dump=${backup_status[0]} gzip=${backup_status[1]} write=${backup_status[2]}"
-    return 1
-  fi
-  sudo_do mv "$db_tmp" "$db_out"
+  create_verified_dump "$db_out"
   sudo_do install -m 600 "$ENV_FILE" "$env_out"
 
   shopt -s nullglob
-  sql_backups=("$BACKUP_DIR"/subboost-*.sql.gz)
+  sql_backups=("$BACKUP_DIR"/subboost-*.dump)
   env_backups=("$BACKUP_DIR"/subboost-*.env)
   shopt -u nullglob
 
+  if ((${#sql_backups[@]} > 0)); then sudo_do chmod 600 "${sql_backups[@]}"; fi
+  if ((${#env_backups[@]} > 0)); then sudo_do chmod 600 "${env_backups[@]}"; fi
+
   for ((i = 0; i < ${#sql_backups[@]} - backup_retention_count; i++)); do
     sudo_do rm -f -- "${sql_backups[$i]}"
   done
diff --git a/local/src/components/local-login.test.ts b/local/src/components/local-login.test.ts
index e422829..b5a895a 100644
--- a/local/src/components/local-login.test.ts
+++ b/local/src/components/local-login.test.ts
@@ -93,12 +93,19 @@ function response(body: unknown, ok = true) {
   } as unknown as Response;
 }
 
-function installWindow() {
+function installWindow(hash = "") {
+  const replaceState = vi.fn();
   Object.defineProperty(globalThis, "window", {
-    value: { location: { href: "" } },
+    value: {
+      location: { href: "", hash, pathname: "/login", search: "" },
+      history: { replaceState },
+    },
     configurable: true,
   });
-  return (globalThis as any).window as { location: { href: string } };
+  return (globalThis as any).window as {
+    location: { href: string; hash: string; pathname: string; search: string };
+    history: { replaceState: ReturnType<typeof vi.fn> };
+  };
 }
 
 function renderLogin(overrides: Record<number, unknown> = {}, runEffects = false) {
@@ -174,7 +181,7 @@ describe("local login component", () => {
 
     await mocks.forms[0].onSubmit({ preventDefault: vi.fn() });
 
-    expect(setters[6]).toHaveBeenCalledWith("密码至少需要 10 个字符");
+    expect(setters[5]).toHaveBeenCalledWith("密码至少需要 10 个字符");
     expect(globalThis.fetch).not.toHaveBeenCalled();
   });
 
@@ -190,7 +197,7 @@ describe("local login component", () => {
 
     await mocks.forms[0].onSubmit({ preventDefault: vi.fn() });
 
-    expect(setters[6]).toHaveBeenCalledWith("两次输入的密码不一致，请重新确认");
+    expect(setters[5]).toHaveBeenCalledWith("两次输入的密码不一致，请重新确认");
     expect(globalThis.fetch).not.toHaveBeenCalled();
   });
 
@@ -201,7 +208,6 @@ describe("local login component", () => {
       0: { setupRequired: false, authenticated: false },
       1: "admin",
       2: "secret",
-      4: false,
     });
 
     mocks.inputs.find((input) => input.placeholder === "管理员账号").onChange({ target: { value: "root" } });
@@ -211,8 +217,8 @@ describe("local login component", () => {
 
     expect(setters[1]).toHaveBeenCalledWith("root");
     expect(setters[2]).toHaveBeenCalledWith("next");
+    expect((setters[7] as any).lastValue).toBe(true);
     expect(setters[4]).toHaveBeenCalledWith(true);
-    expect(setters[5]).toHaveBeenCalledWith(true);
     expect(globalThis.fetch).toHaveBeenCalledWith(
       "/api/auth/login",
       expect.objectContaining({
@@ -221,7 +227,7 @@ describe("local login component", () => {
       }),
     );
     expect(win.location.href).toBe("/dashboard");
-    expect(setters[5]).toHaveBeenLastCalledWith(false);
+    expect(setters[4]).toHaveBeenLastCalledWith(false);
   });
 
   it("submits setup requests and reports server or load errors", async () => {
@@ -232,7 +238,9 @@ describe("local login component", () => {
       1: "admin",
       2: "long-secret",
       3: "long-secret",
-      4: true,
+      6: "setup-secret",
+      7: true,
+      8: true,
     });
 
     expect(mocks.inputs.find((input) => input.placeholder === "密码").type).toBe("text");
@@ -244,17 +252,51 @@ describe("local login component", () => {
       "/api/setup/admin",
       expect.objectContaining({
         method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-SubBoost-Setup-Token": "setup-secret",
+        },
         body: JSON.stringify({ username: "admin", password: "long-secret", passwordConfirm: "long-secret" }),
       }),
     );
-    expect(setters[6]).toHaveBeenCalledWith("用户名已存在");
-    expect(setters[5]).toHaveBeenLastCalledWith(false);
+    expect(setters[5]).toHaveBeenCalledWith("用户名已存在");
+    expect(setters[4]).toHaveBeenLastCalledWith(false);
 
     (globalThis as any).fetch = vi.fn(async () => {
       throw new Error("加载失败");
     });
     const load = renderLogin({}, true);
     await flushPromises();
-    expect(load.setters[6]).toHaveBeenCalledWith("加载失败");
+    expect(load.setters[5]).toHaveBeenCalledWith("加载失败");
+  });
+
+  it("requires the installer fragment and clears it after successful setup", async () => {
+    const missingWindow = installWindow();
+    (globalThis as any).fetch = vi.fn();
+    const missing = renderLogin({
+      0: { setupRequired: true, authenticated: false },
+      1: "admin",
+      2: "long-secret",
+      3: "long-secret",
+    });
+    expect(missing.html).toContain("安装器输出的初始化链接");
+    await mocks.forms[0].onSubmit({ preventDefault: vi.fn() });
+    expect(missing.setters[5]).toHaveBeenCalledWith("缺少初始化令牌，请使用安装器输出的初始化链接");
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+
+    const win = installWindow("#setup-token=setup-secret");
+    (globalThis as any).fetch = vi.fn(async () => response({ success: true }));
+    const setup = renderLogin({
+      0: { setupRequired: true, authenticated: false },
+      1: "admin",
+      2: "long-secret",
+      3: "long-secret",
+      6: "setup-secret",
+    });
+    await mocks.forms[0].onSubmit({ preventDefault: vi.fn() });
+
+    expect(win.history.replaceState).toHaveBeenCalledWith(null, "", "/login");
+    expect(win.location.href).toBe("/dashboard");
+    expect(missingWindow.history.replaceState).not.toHaveBeenCalled();
   });
 });
diff --git a/local/src/components/local-login.tsx b/local/src/components/local-login.tsx
index b800f95..16a0b93 100644
--- a/local/src/components/local-login.tsx
+++ b/local/src/components/local-login.tsx
@@ -3,8 +3,12 @@
 import * as React from "react";
 import Image from "next/image";
 import Link from "next/link";
-import { Eye, EyeOff, Loader2 } from "lucide-react";
+import { Loader2 } from "lucide-react";
 import { getLocalAdminSetupCredentialError, LOCAL_ADMIN_PASSWORD_MIN_LENGTH } from "@local/lib/admin-credentials";
+import { Button } from "@subboost/ui/components/ui/button";
+import { FormField } from "@subboost/ui/components/ui/form-field";
+import { Input } from "@subboost/ui/components/ui/input";
+import { PasswordField } from "@subboost/ui/components/ui/password-field";
 import { hasAuthConfigHandoff } from "@subboost/ui/store/config-store/auth-handoff";
 
 type AuthState = {
@@ -26,12 +30,14 @@ export function LocalLogin() {
   const [username, setUsername] = React.useState("");
   const [password, setPassword] = React.useState("");
   const [passwordConfirm, setPasswordConfirm] = React.useState("");
-  const [showPassword, setShowPassword] = React.useState(false);
   const [loading, setLoading] = React.useState(false);
   const [error, setError] = React.useState("");
+  const [setupToken, setSetupToken] = React.useState("");
 
   React.useEffect(() => {
     let cancelled = false;
+    const fragment = new URLSearchParams(window.location.hash.replace(/^#/, ""));
+    setSetupToken(fragment.get("setup-token")?.trim() || "");
     void fetch("/api/auth/me", { cache: "no-store" })
       .then((response) => readJson<AuthState>(response))
       .then((nextAuth) => {
@@ -60,16 +66,26 @@ export function LocalLogin() {
       setError(credentialError);
       return;
     }
+    if (setupRequired && !setupToken) {
+      setError("缺少初始化令牌，请使用安装器输出的初始化链接");
+      return;
+    }
 
     setLoading(true);
     try {
       const response = await fetch(setupRequired ? "/api/setup/admin" : "/api/auth/login", {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          "Content-Type": "application/json",
+          ...(setupRequired ? { "X-SubBoost-Setup-Token": setupToken } : {}),
+        },
         body: JSON.stringify({ username, password, passwordConfirm }),
       });
       const data = await readJson<{ error?: string }>(response);
       if (!response.ok) throw new Error(data.error || "登录失败");
+      if (setupRequired) {
+        window.history.replaceState(null, "", `${window.location.pathname}${window.location.search}`);
+      }
       window.location.href = getPostLoginHref();
     } catch (submitError) {
       setError(submitError instanceof Error ? submitError.message : "登录失败，请重试");
@@ -92,45 +108,37 @@ export function LocalLogin() {
         <div className="bg-white/5 backdrop-blur-sm border border-white/10 rounded-2xl p-6 space-y-4">
           {auth ? (
             <form onSubmit={handleSubmit} className="space-y-3">
-              <input
-                type="text"
+              <FormField label="管理员账号">
+                <Input
                 autoComplete="username"
                 placeholder="管理员账号"
                 value={username}
                 onChange={(e) => setUsername(e.target.value)}
-                className="w-full px-4 py-3 bg-white/5 border border-white/10 rounded-xl text-white placeholder-white/30 focus:outline-none focus:border-indigo-500/50 transition-colors"
-              />
-              <div className="relative">
-                <input
-                  type={showPassword ? "text" : "password"}
-                  autoComplete={setupRequired ? "new-password" : "current-password"}
-                  aria-describedby={setupRequired ? "local-admin-password-help" : undefined}
-                  placeholder="密码"
-                  value={password}
-                  onChange={(e) => setPassword(e.target.value)}
-                  className="w-full px-4 py-3 bg-white/5 border border-white/10 rounded-xl text-white placeholder-white/30 focus:outline-none focus:border-indigo-500/50 transition-colors pr-12"
+                className="h-12"
                 />
-                <button
-                  type="button"
-                  onClick={() => setShowPassword(!showPassword)}
-                  className="absolute right-3 top-1/2 -translate-y-1/2 text-white/40 hover:text-white/60"
-                >
-                  {showPassword ? <EyeOff className="w-5 h-5" /> : <Eye className="w-5 h-5" />}
-                </button>
-              </div>
-              {setupRequired ? (
-                <p id="local-admin-password-help" className="-mt-1 text-xs text-white/45">
-                  至少 {LOCAL_ADMIN_PASSWORD_MIN_LENGTH} 个字符
+              </FormField>
+              <PasswordField
+                label="密码"
+                autoComplete={setupRequired ? "new-password" : "current-password"}
+                description={setupRequired ? `至少 ${LOCAL_ADMIN_PASSWORD_MIN_LENGTH} 个字符` : undefined}
+                placeholder="密码"
+                value={password}
+                onChange={(e) => setPassword(e.target.value)}
+                className="h-12"
+              />
+              {setupRequired && !setupToken ? (
+                <p className="text-amber-300/80 text-xs">
+                  请从安装器输出的初始化链接进入本页面。
                 </p>
               ) : null}
               {setupRequired ? (
-                <input
-                  type={showPassword ? "text" : "password"}
+                <PasswordField
+                  label="确认密码"
                   autoComplete="new-password"
                   placeholder="确认密码"
                   value={passwordConfirm}
                   onChange={(e) => setPasswordConfirm(e.target.value)}
-                  className="w-full px-4 py-3 bg-white/5 border border-white/10 rounded-xl text-white placeholder-white/30 focus:outline-none focus:border-indigo-500/50 transition-colors"
+                  className="h-12"
                 />
               ) : null}
 
@@ -140,14 +148,14 @@ export function LocalLogin() {
                 </p>
               ) : null}
 
-              <button
+              <Button
                 type="submit"
                 disabled={loading || !username || !password || (setupRequired && !passwordConfirm)}
-                className="w-full flex items-center justify-center gap-2 px-4 py-3 btn-primary"
+                className="h-12 w-full"
               >
                 {loading && <Loader2 className="w-4 h-4 animate-spin" />}
                 {setupRequired ? "创建管理员" : "登录"}
-              </button>
+              </Button>
             </form>
           ) : (
             <div className="h-36 animate-pulse rounded-xl bg-white/5" />
diff --git a/local/src/lib/auto-update-service.test.ts b/local/src/lib/auto-update-service.test.ts
index bd55ec6..27fba41 100644
--- a/local/src/lib/auto-update-service.test.ts
+++ b/local/src/lib/auto-update-service.test.ts
@@ -14,7 +14,7 @@ const mocks = vi.hoisted(() => ({
     $transaction: vi.fn(),
     subscription: {
       findMany: vi.fn(),
-      update: vi.fn(),
+      updateMany: vi.fn(),
     },
     subscriptionAutoUpdateState: {
       upsert: vi.fn(),
@@ -63,6 +63,7 @@ const subscription = {
   createdAt: new Date("2026-06-05T00:00:00.000Z"),
   lastUpdatedAt: null,
   autoUpdateState: null,
+  updatedAt: new Date("2026-06-05T00:00:00.000Z"),
 };
 
 function accumulator(total: number) {
@@ -85,9 +86,12 @@ describe("local subscription auto update service", () => {
     });
     mocks.finalizeCronUpdateSummary.mockImplementation((acc, options) => ({ ...acc, options }));
     mocks.prisma.subscription.findMany.mockResolvedValue([subscription]);
-    mocks.prisma.subscription.update.mockReturnValue({ update: true });
-    mocks.prisma.subscriptionAutoUpdateState.upsert.mockReturnValue({ upsert: true });
-    mocks.prisma.$transaction.mockResolvedValue([]);
+    mocks.prisma.subscription.updateMany.mockResolvedValue({ count: 1 });
+    mocks.prisma.subscriptionAutoUpdateState.upsert.mockResolvedValue({ upsert: true });
+    mocks.prisma.$transaction.mockImplementation(async (callback) => callback({
+      subscription: { updateMany: mocks.prisma.subscription.updateMany },
+      subscriptionAutoUpdateState: { upsert: mocks.prisma.subscriptionAutoUpdateState.upsert },
+    }));
     mocks.resolveSubscriptionAutoUpdateState.mockReturnValue({ lastAttemptedAt: null, externalFailureCount: 0 });
     mocks.resolveAutoUpdateScheduleState.mockReturnValue({ due: true });
     mocks.readSubscriptionSecrets.mockReturnValue({ config: { rules: [] }, urls: ["https://airport.example/sub"], nodes: [] });
@@ -150,9 +154,9 @@ describe("local subscription auto update service", () => {
         storedNodes: [],
       })
     );
-    expect(mocks.prisma.subscription.update).toHaveBeenCalledWith(
+    expect(mocks.prisma.subscription.updateMany).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { id: "sub-1" },
+        where: { id: "sub-1", updatedAt: subscription.updatedAt },
         data: expect.objectContaining({
           encryptedNodes: { encrypted: [{ name: "A" }] },
           encryptedConfig: { encrypted: { rules: [], sources: [{ url: "https://airport.example/sub" }] } },
@@ -180,7 +184,7 @@ describe("local subscription auto update service", () => {
       expect.objectContaining({ outcomes: [{ kind: "disabled", subscriptionId: "sub-1" }] })
     );
 
-    expect(mocks.prisma.subscription.update).toHaveBeenCalledWith(
+    expect(mocks.prisma.subscription.updateMany).toHaveBeenCalledWith(
       expect.objectContaining({
         data: expect.objectContaining({ autoUpdateInterval: null }),
       })
@@ -235,4 +239,18 @@ describe("local subscription auto update service", () => {
       expect.objectContaining({ subscriptionId: "sub-1", message: "unexpected" })
     );
   });
+
+  it("treats a CAS miss as a stale skip without publishing success", async () => {
+    mocks.prisma.subscription.updateMany.mockResolvedValueOnce({ count: 0 });
+
+    await runLocalSubscriptionAutoUpdateCron(now);
+
+    expect(mocks.prisma.subscriptionAutoUpdateState.upsert).not.toHaveBeenCalled();
+    expect(mocks.applyCronUpdateOutcome).toHaveBeenCalledWith(expect.anything(), {
+      status: "skipped",
+      requestedHosts: ["airport.example"],
+      recordHosts: false,
+    });
+    expect(console.info).not.toHaveBeenCalled();
+  });
 });
diff --git a/local/src/lib/auto-update-service.ts b/local/src/lib/auto-update-service.ts
index e3ed3ff..db45c7a 100644
--- a/local/src/lib/auto-update-service.ts
+++ b/local/src/lib/auto-update-service.ts
@@ -28,6 +28,7 @@ import {
   type SubscriptionRow,
 } from "./subscription-service";
 import { LOCAL_AUTO_UPDATE_MIN_SECONDS } from "./auto-update-policy";
+import { JobLeaseLostError } from "./job-lease";
 
 type AutoUpdateSubscriptionRow = SubscriptionRow & {
   owner: {
@@ -56,20 +57,29 @@ function toCompletionTarget(subscription: AutoUpdateSubscriptionRow): AutomaticR
 
 async function writeAutoUpdateState(
   subscriptionId: string,
+  expectedUpdatedAt: Date,
   state: SubscriptionAutoUpdateStateFields,
-  extraSubscriptionData: Record<string, unknown> = {}
-) {
-  await prisma.$transaction([
-    prisma.subscription.update({
-      where: { id: subscriptionId },
-      data: extraSubscriptionData,
-    }),
-    prisma.subscriptionAutoUpdateState.upsert({
+  extraSubscriptionData: Record<string, unknown> = {},
+  assertLease?: () => Promise<void>
+): Promise<boolean> {
+  await assertLease?.();
+  return prisma.$transaction(async (tx) => {
+    const updated = await tx.subscription.updateMany({
+      where: { id: subscriptionId, updatedAt: expectedUpdatedAt },
+      data: { ...extraSubscriptionData, updatedAt: new Date() },
+    });
+    if (updated.count !== 1) return false;
+    await tx.subscriptionAutoUpdateState.upsert({
       where: { subscriptionId },
       create: { subscriptionId, ...state },
       update: state,
-    }),
-  ]);
+    });
+    return true;
+  });
+}
+
+function staleOutcome(requestedHosts: string[]): CronUpdateOutcome {
+  return { status: "skipped", requestedHosts, recordHosts: false };
 }
 
 async function prepareLocalRefresh(
@@ -110,10 +120,16 @@ async function completeAllSourcesFailed(params: {
   subscription: AutoUpdateSubscriptionRow;
   prepared: PreparedLocalRefresh;
   decision: Extract<ReturnType<typeof resolveAutomaticRefreshCompletionDecision>, { kind: "all_sources_failed" }>;
+  assertLease?: () => Promise<void>;
 }): Promise<CronUpdateOutcome> {
-  await writeAutoUpdateState(params.subscription.id, params.decision.nextAutoUpdateState.state, {
-    ...(params.decision.nextAutoUpdateState.shouldDisableAutoUpdate ? { autoUpdateInterval: null } : {}),
-  });
+  const persisted = await writeAutoUpdateState(
+    params.subscription.id,
+    params.subscription.updatedAt,
+    params.decision.nextAutoUpdateState.state,
+    { ...(params.decision.nextAutoUpdateState.shouldDisableAutoUpdate ? { autoUpdateInterval: null } : {}) },
+    params.assertLease
+  );
+  if (!persisted) return staleOutcome(params.prepared.requestedHosts);
 
   if (params.decision.nextAutoUpdateState.shouldDisableAutoUpdate) {
     console.warn("[local-subscription-cron] auto update disabled", {
@@ -130,6 +146,7 @@ async function completeSuccess(params: {
   prepared: PreparedLocalRefresh;
   attemptedAt: Date;
   intervalSeconds: number;
+  assertLease?: () => Promise<void>;
 }): Promise<CronUpdateOutcome> {
   const refreshResult = params.prepared.refreshResult;
   if (!refreshResult.ok) throw new Error(`Unexpected refresh failure reason: ${refreshResult.reason}`);
@@ -146,14 +163,21 @@ async function completeSuccess(params: {
   if (decision.kind !== "success") throw new Error(`Unexpected refresh completion decision: ${decision.kind}`);
   const config = { ...params.prepared.config, sources: params.prepared.snapshot.savedSources };
 
-  await writeAutoUpdateState(params.subscription.id, decision.nextAutoUpdateState.state, {
-    encryptedNodes: encryptJson(refreshResult.cacheEntry.nodes),
-    encryptedConfig: encryptJson(config),
-    encryptedSubscriptionInfo: encryptJson(refreshResult.cacheEntry.subscriptionInfo),
-    lastUpdatedAt: cachedAt,
-    cacheExpiresAt: buildSubscriptionCacheExpiry(cachedAt),
-    ...(decision.nextAutoUpdateState.shouldDisableAutoUpdate ? { autoUpdateInterval: null } : {}),
-  });
+  const persisted = await writeAutoUpdateState(
+    params.subscription.id,
+    params.subscription.updatedAt,
+    decision.nextAutoUpdateState.state,
+    {
+      encryptedNodes: encryptJson(refreshResult.cacheEntry.nodes),
+      encryptedConfig: encryptJson(config),
+      encryptedSubscriptionInfo: encryptJson(refreshResult.cacheEntry.subscriptionInfo),
+      lastUpdatedAt: cachedAt,
+      cacheExpiresAt: buildSubscriptionCacheExpiry(cachedAt),
+      ...(decision.nextAutoUpdateState.shouldDisableAutoUpdate ? { autoUpdateInterval: null } : {}),
+    },
+    params.assertLease
+  );
+  if (!persisted) return staleOutcome(params.prepared.requestedHosts);
 
   console.info("[local-subscription-cron] updated", {
     subscriptionId: params.subscription.id,
@@ -172,6 +196,7 @@ async function completeLocalRefresh(params: {
   prepared: PreparedLocalRefresh;
   attemptedAt: Date;
   intervalSeconds: number;
+  assertLease?: () => Promise<void>;
 }): Promise<CronUpdateOutcome> {
   const refreshResult = params.prepared.refreshResult;
 
@@ -189,7 +214,14 @@ async function completeLocalRefresh(params: {
     }
     if (decision.kind === "success") throw new Error("Unexpected successful completion decision");
 
-    await writeAutoUpdateState(params.subscription.id, decision.attemptedState);
+    const persisted = await writeAutoUpdateState(
+      params.subscription.id,
+      params.subscription.updatedAt,
+      decision.attemptedState,
+      {},
+      params.assertLease
+    );
+    if (!persisted) return staleOutcome(params.prepared.requestedHosts);
     return decision.outcome;
   }
 
@@ -201,6 +233,7 @@ async function recordUnexpectedFailure(params: {
   requestedHosts: string[];
   error: unknown;
   attemptStartedAt: Date | null;
+  assertLease?: () => Promise<void>;
 }): Promise<CronUpdateOutcome> {
   const completion = resolveAutomaticRefreshUnexpectedFailureCompletion({
     target: toCompletionTarget(params.subscription),
@@ -209,7 +242,17 @@ async function recordUnexpectedFailure(params: {
     attemptStartedAt: params.attemptStartedAt,
   });
   if (completion.attemptedState) {
-    await writeAutoUpdateState(params.subscription.id, completion.attemptedState).catch(() => undefined);
+    const persisted = await writeAutoUpdateState(
+      params.subscription.id,
+      params.subscription.updatedAt,
+      completion.attemptedState,
+      {},
+      params.assertLease
+    ).catch((error) => {
+      if (error instanceof JobLeaseLostError) throw error;
+      return null;
+    });
+    if (persisted === false) return staleOutcome(params.requestedHosts);
   }
 
   console.error("[local-subscription-cron] failed", {
@@ -220,7 +263,11 @@ async function recordUnexpectedFailure(params: {
   return completion.outcome;
 }
 
-export async function runLocalSubscriptionAutoUpdateCron(now = new Date()): Promise<FinalCronUpdateSummary> {
+export async function runLocalSubscriptionAutoUpdateCron(
+  now = new Date(),
+  options: { assertLease?: () => Promise<void> } = {}
+): Promise<FinalCronUpdateSummary> {
+  await options.assertLease?.();
   const subscriptions = (await prisma.subscription.findMany({
     where: { autoUpdateInterval: { not: null } },
     include: { owner: { select: { username: true } }, autoUpdateState: true },
@@ -228,6 +275,7 @@ export async function runLocalSubscriptionAutoUpdateCron(now = new Date()): Prom
 
   const accumulator = createCronUpdateAccumulator(subscriptions.length);
   for (const subscription of subscriptions) {
+    await options.assertLease?.();
     let requestedHosts: string[] = [];
     let attemptStartedAt: Date | null = null;
     try {
@@ -258,15 +306,24 @@ export async function runLocalSubscriptionAutoUpdateCron(now = new Date()): Prom
         prepared,
         attemptedAt: attemptStartedAt,
         intervalSeconds,
+        assertLease: options.assertLease,
       });
       applyCronUpdateOutcome(accumulator, outcome);
     } catch (error) {
+      if (error instanceof JobLeaseLostError) throw error;
       applyCronUpdateOutcome(
         accumulator,
-        await recordUnexpectedFailure({ subscription, requestedHosts, error, attemptStartedAt })
+        await recordUnexpectedFailure({
+          subscription,
+          requestedHosts,
+          error,
+          attemptStartedAt,
+          assertLease: options.assertLease,
+        })
       );
     }
   }
 
+  await options.assertLease?.();
   return finalizeCronUpdateSummary(accumulator, { maxTopHosts: 50, maxTopUsers: 50 });
 }
diff --git a/local/src/lib/cron-auth.ts b/local/src/lib/cron-auth.ts
index c4e86ae..f8912e7 100644
--- a/local/src/lib/cron-auth.ts
+++ b/local/src/lib/cron-auth.ts
@@ -20,7 +20,7 @@ export function requireLocalCronAuth(request: Request): ReturnType<typeof apiErr
 
   if (auth.reason === "missing-secret") {
     if (isDevelopmentBypassAllowed()) return null;
-    return apiError("CRON_SECRET not configured.", "CONFIGURATION_ERROR", 500);
+    return apiError("CRON_SECRET not configured.", "CONFIGURATION_ERROR", 503);
   }
 
   return apiError("Invalid cron secret.", "UNAUTHORIZED", 401);
diff --git a/local/src/lib/http.ts b/local/src/lib/http.ts
index 99768fe..36af9dd 100644
--- a/local/src/lib/http.ts
+++ b/local/src/lib/http.ts
@@ -1,34 +1,82 @@
 import { NextResponse } from "next/server";
 import { buildApiErrorBody } from "@subboost/server-core/http";
 
-export type ApiErrorCode =
+export type LocalApiErrorCode =
   | "BAD_REQUEST"
   | "VALIDATION_ERROR"
   | "UNAUTHORIZED"
   | "FORBIDDEN"
   | "NOT_FOUND"
   | "CONFLICT"
+  | "RATE_LIMITED"
+  | "PAYLOAD_TOO_LARGE"
   | "CONFIGURATION_ERROR"
   | "INTERNAL_ERROR";
 
+export const LOCAL_JSON_BODY_LIMITS = {
+  small: 64 * 1024,
+  subscription: 16 * 1024 * 1024,
+  template: 4 * 1024 * 1024,
+} as const;
+
+export type ReadJsonBodyResult =
+  | { ok: true; value: unknown }
+  | { ok: false; reason: "invalid_json" | "too_large" };
+
 export function json(data: unknown, status = 200): NextResponse {
   return NextResponse.json(data, { status });
 }
 
-export function apiError(error: string, code: ApiErrorCode, status: number): NextResponse {
+export function apiError(error: string, code: LocalApiErrorCode, status: number): NextResponse {
   return NextResponse.json(buildApiErrorBody(error, code), { status });
 }
 
-export async function readJsonBody(request: Request): Promise<unknown> {
-  const text = await request.text();
-  if (!text.trim()) return {};
+export async function readJsonBody(request: Request, maxBytes: number): Promise<ReadJsonBodyResult> {
+  const limit = Math.max(1, Math.floor(maxBytes));
+  const declaredLength = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > limit) {
+    return { ok: false, reason: "too_large" };
+  }
+
+  if (!request.body) return { ok: true, value: {} };
+  const reader = request.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let totalBytes = 0;
   try {
-    return JSON.parse(text);
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      totalBytes += value.byteLength;
+      if (totalBytes > limit) {
+        await reader.cancel("payload too large").catch(() => undefined);
+        return { ok: false, reason: "too_large" };
+      }
+      chunks.push(value);
+    }
+
+    const bytes = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    if (!text.trim()) return { ok: true, value: {} };
+    return { ok: true, value: JSON.parse(text) };
   } catch {
-    return null;
+    return { ok: false, reason: "invalid_json" };
   }
 }
 
+export function jsonBodyError(
+  result: Extract<ReadJsonBodyResult, { ok: false }>,
+  invalidJsonMessage = "Invalid JSON body."
+): NextResponse {
+  return result.reason === "too_large"
+    ? apiError("Request body is too large.", "PAYLOAD_TOO_LARGE", 413)
+    : apiError(invalidJsonMessage, "BAD_REQUEST", 400);
+}
+
 export function getStringField(body: unknown, key: string): string {
   if (!body || typeof body !== "object" || Array.isArray(body)) return "";
   const value = (body as Record<string, unknown>)[key];
diff --git a/local/src/lib/job-lease.test.ts b/local/src/lib/job-lease.test.ts
new file mode 100644
index 0000000..a3a1513
--- /dev/null
+++ b/local/src/lib/job-lease.test.ts
@@ -0,0 +1,56 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  prisma: {
+    $queryRaw: vi.fn(),
+    $executeRaw: vi.fn(),
+  },
+}));
+
+vi.mock("./prisma", () => ({ prisma: mocks.prisma }));
+
+import {
+  acquireLocalJobLease,
+  releaseLocalJobLease,
+  renewLocalJobLease,
+  startLocalJobLeaseHeartbeat,
+} from "./job-lease";
+
+describe("local job lease", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-07-16T00:00:00.000Z"));
+  });
+
+  afterEach(() => vi.useRealTimers());
+
+  it("acquires only when the conditional database upsert returns a row", async () => {
+    mocks.prisma.$queryRaw
+      .mockResolvedValueOnce([{ name: "local-cron", ownerToken: "owner", expiresAt: new Date() }])
+      .mockResolvedValueOnce([]);
+
+    await expect(acquireLocalJobLease({ name: "local-cron", leaseMs: 300_000 })).resolves.toMatchObject({
+      name: "local-cron",
+    });
+    await expect(acquireLocalJobLease({ name: "local-cron", leaseMs: 300_000 })).resolves.toBeNull();
+  });
+
+  it("renews and releases only the current owner", async () => {
+    const lease = { name: "local-cron", ownerToken: "owner", expiresAt: new Date() };
+    mocks.prisma.$executeRaw.mockResolvedValueOnce(1).mockResolvedValueOnce(1);
+
+    await expect(renewLocalJobLease(lease, 300_000)).resolves.toBe(true);
+    await expect(releaseLocalJobLease(lease)).resolves.toBeUndefined();
+    expect(mocks.prisma.$executeRaw).toHaveBeenCalledTimes(2);
+  });
+
+  it("fails closed when heartbeat renewal loses ownership", async () => {
+    const lease = { name: "local-cron", ownerToken: "owner", expiresAt: new Date() };
+    mocks.prisma.$executeRaw.mockResolvedValueOnce(0);
+    const heartbeat = startLocalJobLeaseHeartbeat({ lease, leaseMs: 300_000, intervalMs: 60_000 });
+
+    await expect(heartbeat.assertOwned()).rejects.toThrow("Local job lease lost");
+    await heartbeat.stop();
+  });
+});
diff --git a/local/src/lib/job-lease.ts b/local/src/lib/job-lease.ts
new file mode 100644
index 0000000..859d209
--- /dev/null
+++ b/local/src/lib/job-lease.ts
@@ -0,0 +1,99 @@
+import { randomUUID } from "node:crypto";
+import { prisma } from "./prisma";
+
+export type LocalJobLease = {
+  name: string;
+  ownerToken: string;
+  expiresAt: Date;
+};
+
+export class JobLeaseLostError extends Error {
+  constructor(name: string) {
+    super(`Local job lease lost: ${name}`);
+    this.name = "JobLeaseLostError";
+  }
+}
+
+export async function acquireLocalJobLease(params: {
+  name: string;
+  leaseMs: number;
+  now?: Date;
+}): Promise<LocalJobLease | null> {
+  const now = params.now ?? new Date();
+  const ownerToken = randomUUID();
+  const expiresAt = new Date(now.getTime() + params.leaseMs);
+  const rows = await prisma.$queryRaw<LocalJobLease[]>`
+    INSERT INTO "JobLeaseLock" ("name", "ownerToken", "expiresAt", "updatedAt")
+    VALUES (${params.name}, ${ownerToken}, ${expiresAt}, ${now})
+    ON CONFLICT ("name") DO UPDATE
+    SET "ownerToken" = EXCLUDED."ownerToken",
+        "expiresAt" = EXCLUDED."expiresAt",
+        "updatedAt" = EXCLUDED."updatedAt"
+    WHERE "JobLeaseLock"."expiresAt" <= ${now}
+    RETURNING "name", "ownerToken", "expiresAt"
+  `;
+  return rows[0] ?? null;
+}
+
+export async function renewLocalJobLease(
+  lease: LocalJobLease,
+  leaseMs: number,
+  now = new Date()
+): Promise<boolean> {
+  const expiresAt = new Date(now.getTime() + leaseMs);
+  const count = await prisma.$executeRaw`
+    UPDATE "JobLeaseLock"
+    SET "expiresAt" = ${expiresAt}, "updatedAt" = ${now}
+    WHERE "name" = ${lease.name}
+      AND "ownerToken" = ${lease.ownerToken}
+      AND "expiresAt" > ${now}
+  `;
+  if (count === 1) lease.expiresAt = expiresAt;
+  return count === 1;
+}
+
+export async function releaseLocalJobLease(lease: LocalJobLease): Promise<void> {
+  await prisma.$executeRaw`
+    DELETE FROM "JobLeaseLock"
+    WHERE "name" = ${lease.name} AND "ownerToken" = ${lease.ownerToken}
+  `;
+}
+
+export function startLocalJobLeaseHeartbeat(params: {
+  lease: LocalJobLease;
+  leaseMs: number;
+  intervalMs: number;
+}): { assertOwned: () => Promise<void>; stop: () => Promise<void> } {
+  let stopped = false;
+  let lost = false;
+  let pending: Promise<void> = Promise.resolve();
+
+  const renew = async () => {
+    if (stopped) return;
+    if (lost || !(await renewLocalJobLease(params.lease, params.leaseMs))) {
+      lost = true;
+      throw new JobLeaseLostError(params.lease.name);
+    }
+  };
+  const enqueue = () => {
+    const next = pending.then(renew);
+    pending = next.catch(() => undefined);
+    return next;
+  };
+  const timer = setInterval(() => {
+    void enqueue().catch(() => undefined);
+  }, params.intervalMs);
+  timer.unref?.();
+
+  return {
+    assertOwned: async () => {
+      if (stopped || lost) throw new JobLeaseLostError(params.lease.name);
+      await enqueue();
+    },
+    stop: async () => {
+      stopped = true;
+      clearInterval(timer);
+      await pending;
+    },
+  };
+}
diff --git a/local/src/lib/local-helpers.test.ts b/local/src/lib/local-helpers.test.ts
index 085a0c4..42080ce 100644
--- a/local/src/lib/local-helpers.test.ts
+++ b/local/src/lib/local-helpers.test.ts
@@ -164,9 +164,20 @@ describe("local lib helpers", () => {
       status: 400,
       body: { error: "bad", code: "BAD_REQUEST" },
     });
-    await expect(readJsonBody(new Request("https://local.test", { method: "POST", body: "" }))).resolves.toEqual({});
-    await expect(readJsonBody(new Request("https://local.test", { method: "POST", body: "{bad" }))).resolves.toBeNull();
-    await expect(readJsonBody(new Request("https://local.test", { method: "POST", body: '{"name":" Ry "}' }))).resolves.toEqual({ name: " Ry " });
+    await expect(readJsonBody(new Request("https://local.test", { method: "POST", body: "" }), 1024)).resolves.toEqual({
+      ok: true,
+      value: {},
+    });
+    await expect(readJsonBody(new Request("https://local.test", { method: "POST", body: "{bad" }), 1024)).resolves.toEqual({
+      ok: false,
+      reason: "invalid_json",
+    });
+    await expect(
+      readJsonBody(new Request("https://local.test", { method: "POST", body: '{"name":" Ry "}' }), 1024)
+    ).resolves.toEqual({ ok: true, value: { name: " Ry " } });
+    await expect(
+      readJsonBody(new Request("https://local.test", { method: "POST", body: '{"too":"large"}' }), 4)
+    ).resolves.toEqual({ ok: false, reason: "too_large" });
     expect(getStringField({ name: " Ry " }, "name")).toBe("Ry");
     expect(getStringField({ name: 1 }, "name")).toBe("");
     expect(getStringField(null, "name")).toBe("");
diff --git a/local/src/lib/pinned-http.test.ts b/local/src/lib/pinned-http.test.ts
new file mode 100644
index 0000000..15174ba
--- /dev/null
+++ b/local/src/lib/pinned-http.test.ts
@@ -0,0 +1,55 @@
+import { createServer, type Server } from "node:http";
+import { gzipSync } from "node:zlib";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { requestPinnedText, ResponseTooLargeError } from "./pinned-http";
+
+describe("pinned local HTTP transport", () => {
+  let server: Server;
+  let port = 0;
+  let observedHost = "";
+
+  beforeAll(async () => {
+    server = createServer((request, response) => {
+      observedHost = request.headers.host || "";
+      const body = request.url === "/large" ? "x".repeat(2048) : "ss://node";
+      response.writeHead(200, {
+        "Content-Type": "text/plain",
+        "Content-Encoding": "gzip",
+      });
+      response.end(gzipSync(body));
+    });
+    await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    if (!address || typeof address === "string") throw new Error("Expected TCP test server address");
+    port = address.port;
+  });
+
+  afterAll(async () => {
+    await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+  });
+
+  it("connects only to the validated address while preserving the original Host header", async () => {
+    const response = await requestPinnedText({
+      url: `http://example.test:${port}/ok`,
+      addresses: ["127.0.0.1"],
+      method: "GET",
+      userAgent: "SubBoost Test",
+      maxBytes: 1024,
+      signal: new AbortController().signal,
+    });
+
+    expect(response).toMatchObject({ status: 200, content: "ss://node" });
+    expect(observedHost).toBe(`example.test:${port}`);
+  });
+
+  it("enforces the limit after response decompression", async () => {
+    await expect(requestPinnedText({
+      url: `http://example.test:${port}/large`,
+      addresses: ["127.0.0.1"],
+      method: "GET",
+      userAgent: "SubBoost Test",
+      maxBytes: 128,
+      signal: new AbortController().signal,
+    })).rejects.toBeInstanceOf(ResponseTooLargeError);
+  });
+});
diff --git a/local/src/lib/pinned-http.ts b/local/src/lib/pinned-http.ts
new file mode 100644
index 0000000..59d03fd
--- /dev/null
+++ b/local/src/lib/pinned-http.ts
@@ -0,0 +1,123 @@
+import { isIP } from "node:net";
+import { request as httpRequest, type IncomingHttpHeaders, type IncomingMessage } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { createBrotliDecompress, createGunzip, createInflate } from "node:zlib";
+
+export class ResponseTooLargeError extends Error {
+  constructor() {
+    super("Subscription response exceeds the configured byte limit");
+    this.name = "ResponseTooLargeError";
+  }
+}
+
+export type DirectHttpResponse = {
+  status: number;
+  headers: Record<string, string>;
+  content: string;
+};
+
+function normalizeHeaders(headers: IncomingHttpHeaders): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (value === undefined) continue;
+    out[key.toLowerCase()] = Array.isArray(value) ? value.join(", ") : String(value);
+  }
+  return out;
+}
+
+async function readLimitedBody(response: IncomingMessage, maxBytes: number): Promise<string> {
+  const encoding = String(response.headers["content-encoding"] || "").trim().toLowerCase();
+  const decoded = encoding === "gzip" || encoding === "x-gzip"
+    ? response.pipe(createGunzip())
+    : encoding === "deflate"
+      ? response.pipe(createInflate())
+      : encoding === "br"
+        ? response.pipe(createBrotliDecompress())
+        : response;
+
+  const chunks: Buffer[] = [];
+  let total = 0;
+  try {
+    for await (const raw of decoded) {
+      const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+      total += chunk.byteLength;
+      if (total > maxBytes) throw new ResponseTooLargeError();
+      chunks.push(chunk);
+    }
+  } catch (error) {
+    response.destroy();
+    if (decoded !== response) decoded.destroy();
+    throw error;
+  }
+  return Buffer.concat(chunks, total).toString("utf8");
+}
+
+function openPinnedRequest(params: {
+  parsed: URL;
+  address: string;
+  method: "GET" | "HEAD";
+  userAgent: string;
+  signal: AbortSignal;
+}): Promise<IncomingMessage> {
+  const requestImpl = params.parsed.protocol === "https:" ? httpsRequest : httpRequest;
+  return new Promise((resolve, reject) => {
+    const request = requestImpl({
+      protocol: params.parsed.protocol,
+      hostname: params.address,
+      family: isIP(params.address) || undefined,
+      port: params.parsed.port || undefined,
+      path: `${params.parsed.pathname}${params.parsed.search}`,
+      method: params.method,
+      headers: {
+        Host: params.parsed.host,
+        "User-Agent": params.userAgent,
+        Accept: "text/plain, application/yaml, application/x-yaml, */*;q=0.8",
+        "Accept-Encoding": "gzip, deflate, br",
+        "Cache-Control": "no-cache",
+      },
+      signal: params.signal,
+      ...(params.parsed.protocol === "https:" && !isIP(params.parsed.hostname)
+        ? { servername: params.parsed.hostname }
+        : {}),
+    }, resolve);
+    request.once("error", reject);
+    request.end();
+  });
+}
+
+export async function requestPinnedText(params: {
+  url: string;
+  addresses: readonly string[];
+  method: "GET" | "HEAD";
+  userAgent: string;
+  maxBytes: number;
+  signal: AbortSignal;
+}): Promise<DirectHttpResponse> {
+  const parsed = new URL(params.url);
+  let lastError: unknown = new Error("No validated address is available");
+  let response: IncomingMessage | null = null;
+  for (const address of params.addresses) {
+    try {
+      response = await openPinnedRequest({ ...params, parsed, address });
+      break;
+    } catch (error) {
+      lastError = error;
+      if (params.signal.aborted) throw error;
+    }
+  }
+  if (!response) throw lastError;
+
+  const headers = normalizeHeaders(response.headers);
+  if ((response.statusCode || 0) >= 300 && (response.statusCode || 0) < 400) {
+    response.destroy();
+    return { status: response.statusCode || 0, headers, content: "" };
+  }
+  const contentLength = Number(headers["content-length"] || "0");
+  if (Number.isFinite(contentLength) && contentLength > params.maxBytes) {
+    response.destroy();
+    throw new ResponseTooLargeError();
+  }
+  const content = params.method === "HEAD" ? "" : await readLimitedBody(response, params.maxBytes);
+  if (params.method === "HEAD") response.resume();
+  return { status: response.statusCode || 0, headers, content };
+}
diff --git a/local/src/lib/rate-limit.test.ts b/local/src/lib/rate-limit.test.ts
new file mode 100644
index 0000000..52a32d4
--- /dev/null
+++ b/local/src/lib/rate-limit.test.ts
@@ -0,0 +1,63 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  clearLocalRateLimitsForTests,
+  consumeLocalRateLimit,
+  getTrustedClientRateLimitKey,
+  hashLocalRateLimitKey,
+  localRateLimitResponse,
+  resetLocalRateLimit,
+} from "./rate-limit";
+
+describe("local rate limits", () => {
+  beforeEach(() => clearLocalRateLimitsForTests());
+
+  it("blocks requests above a fixed-window limit and resets after expiry", () => {
+    expect(consumeLocalRateLimit("login", "all", { limit: 2, windowMs: 10_000, now: 1_000 }).allowed).toBe(true);
+    expect(consumeLocalRateLimit("login", "all", { limit: 2, windowMs: 10_000, now: 2_000 }).allowed).toBe(true);
+    expect(consumeLocalRateLimit("login", "all", { limit: 2, windowMs: 10_000, now: 3_000 })).toEqual({
+      allowed: false,
+      retryAfterSeconds: 8,
+    });
+    expect(consumeLocalRateLimit("login", "all", { limit: 2, windowMs: 10_000, now: 11_000 }).allowed).toBe(true);
+  });
+
+  it("hashes sensitive keys and supports clearing successful identity buckets", () => {
+    const key = hashLocalRateLimitKey("secret-token");
+    expect(key).toMatch(/^[a-f0-9]{64}$/);
+    expect(key).not.toContain("secret-token");
+    consumeLocalRateLimit("token", key, { limit: 1, windowMs: 10_000, now: 1_000 });
+    expect(consumeLocalRateLimit("token", key, { limit: 1, windowMs: 10_000, now: 2_000 }).allowed).toBe(false);
+    resetLocalRateLimit("token", key);
+    expect(consumeLocalRateLimit("token", key, { limit: 1, windowMs: 10_000, now: 2_000 }).allowed).toBe(true);
+  });
+
+  it("returns a structured 429 response with Retry-After", async () => {
+    const response = localRateLimitResponse("slow down", 7);
+    expect(response.status).toBe(429);
+    expect(response.headers.get("Retry-After")).toBe("7");
+    await expect(response.json()).resolves.toEqual({ error: "slow down", code: "RATE_LIMITED" });
+  });
+
+  it("uses only runtime or explicitly trusted proxy client addresses", () => {
+    const direct = new Request("https://local.test");
+    expect(getTrustedClientRateLimitKey(direct)).toBeNull();
+
+    const runtime = Object.assign(new Request("https://local.test"), { ip: "203.0.113.10" });
+    expect(getTrustedClientRateLimitKey(runtime)).toBe(hashLocalRateLimitKey("203.0.113.10"));
+
+    process.env.TRUST_PROXY_HEADERS = "true";
+    const proxied = new Request("https://local.test", { headers: { "x-forwarded-for": "198.51.100.2, 10.0.0.1" } });
+    expect(getTrustedClientRateLimitKey(proxied)).toBe(hashLocalRateLimitKey("198.51.100.2"));
+    delete process.env.TRUST_PROXY_HEADERS;
+  });
+
+  it("caps in-memory buckets at 10,000 by evicting the earliest expiry", () => {
+    for (let index = 0; index < 10_000; index += 1) {
+      consumeLocalRateLimit("bounded", String(index), { limit: 1, windowMs: 60_000, now: 1_000 });
+    }
+    consumeLocalRateLimit("bounded", "overflow", { limit: 1, windowMs: 60_000, now: 1_000 });
+
+    expect(consumeLocalRateLimit("bounded", "0", { limit: 1, windowMs: 60_000, now: 1_001 }).allowed).toBe(true);
+    expect(consumeLocalRateLimit("bounded", "9999", { limit: 1, windowMs: 60_000, now: 1_001 }).allowed).toBe(false);
+  });
+});
diff --git a/local/src/lib/rate-limit.ts b/local/src/lib/rate-limit.ts
new file mode 100644
index 0000000..4edbc2e
--- /dev/null
+++ b/local/src/lib/rate-limit.ts
@@ -0,0 +1,104 @@
+import { createHash } from "node:crypto";
+import { apiError } from "./http";
+
+type RateLimitBucket = {
+  count: number;
+  resetAt: number;
+};
+
+export type LocalRateLimitResult = {
+  allowed: boolean;
+  retryAfterSeconds: number;
+};
+
+const buckets = new Map<string, RateLimitBucket>();
+const MAX_BUCKETS = 10_000;
+let nextCleanupAt = 0;
+
+function cleanupExpiredBuckets(now: number, force = false): void {
+  if (!force && (buckets.size < 1024 || now < nextCleanupAt)) return;
+  for (const [key, bucket] of buckets) {
+    if (bucket.resetAt <= now) buckets.delete(key);
+  }
+  nextCleanupAt = now + 60_000;
+}
+
+function makeRoomForBucket(): void {
+  while (buckets.size >= MAX_BUCKETS) {
+    let earliestKey: string | null = null;
+    let earliestResetAt = Number.POSITIVE_INFINITY;
+    for (const [key, bucket] of buckets) {
+      if (bucket.resetAt < earliestResetAt) {
+        earliestKey = key;
+        earliestResetAt = bucket.resetAt;
+      }
+    }
+    if (!earliestKey) return;
+    buckets.delete(earliestKey);
+  }
+}
+
+export function hashLocalRateLimitKey(value: string): string {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+export function consumeLocalRateLimit(
+  scope: string,
+  key: string,
+  options: { limit: number; windowMs: number; now?: number }
+): LocalRateLimitResult {
+  const now = options.now ?? Date.now();
+  const limit = Math.max(1, Math.floor(options.limit));
+  const windowMs = Math.max(1000, Math.floor(options.windowMs));
+  cleanupExpiredBuckets(now);
+
+  const bucketKey = `${scope}:${key}`;
+  const current = buckets.get(bucketKey);
+  if (!current || current.resetAt <= now) {
+    if (!current && buckets.size >= MAX_BUCKETS) {
+      cleanupExpiredBuckets(now, true);
+      makeRoomForBucket();
+    }
+    buckets.set(bucketKey, { count: 1, resetAt: now + windowMs });
+    return { allowed: true, retryAfterSeconds: 0 };
+  }
+
+  current.count += 1;
+  if (current.count <= limit) return { allowed: true, retryAfterSeconds: 0 };
+  return {
+    allowed: false,
+    retryAfterSeconds: Math.max(1, Math.ceil((current.resetAt - now) / 1000)),
+  };
+}
+
+export function getTrustedClientRateLimitKey(request: Request): string | null {
+  const runtimeIp = (request as Request & { ip?: unknown }).ip;
+  if (typeof runtimeIp === "string" && runtimeIp.trim()) {
+    return hashLocalRateLimitKey(runtimeIp.trim());
+  }
+  if (process.env.TRUST_PROXY_HEADERS !== "true") return null;
+
+  const forwarded = request.headers.get("cf-connecting-ip")
+    || request.headers.get("x-real-ip")
+    || request.headers.get("x-forwarded-for")?.split(",")[0]
+    || "";
+  const normalized = forwarded.trim();
+  return normalized ? hashLocalRateLimitKey(normalized) : null;
+}
+
+export function resetLocalRateLimit(scope: string, key: string): void {
+  buckets.delete(`${scope}:${key}`);
+}
+
+export function localRateLimitResponse(message: string, retryAfterSeconds: number): Response {
+  const response = apiError(message, "RATE_LIMITED", 429);
+  response.headers.set("Retry-After", String(Math.max(1, retryAfterSeconds)));
+  return response;
+}
+
+export function clearLocalRateLimitsForTests(): void {
+  if (process.env.NODE_ENV === "test") {
+    buckets.clear();
+    nextCleanupAt = 0;
+  }
+}
diff --git a/local/src/lib/setup-token.test.ts b/local/src/lib/setup-token.test.ts
new file mode 100644
index 0000000..fda81b5
--- /dev/null
+++ b/local/src/lib/setup-token.test.ts
@@ -0,0 +1,27 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { LOCAL_SETUP_TOKEN_HEADER, validateLocalSetupToken } from "./setup-token";
+
+describe("local setup token", () => {
+  const original = process.env.LOCAL_SETUP_TOKEN;
+
+  afterEach(() => {
+    if (original === undefined) delete process.env.LOCAL_SETUP_TOKEN;
+    else process.env.LOCAL_SETUP_TOKEN = original;
+  });
+
+  it("fails closed when the operator token is missing", () => {
+    delete process.env.LOCAL_SETUP_TOKEN;
+    expect(validateLocalSetupToken(new Request("https://local.test"))).toBe("missing_config");
+  });
+
+  it("accepts only an exact setup token supplied through the dedicated header", () => {
+    process.env.LOCAL_SETUP_TOKEN = "expected-secret";
+    expect(validateLocalSetupToken(new Request("https://local.test"))).toBe("invalid");
+    expect(validateLocalSetupToken(new Request("https://local.test", {
+      headers: { [LOCAL_SETUP_TOKEN_HEADER]: "wrong-secret" },
+    }))).toBe("invalid");
+    expect(validateLocalSetupToken(new Request("https://local.test", {
+      headers: { [LOCAL_SETUP_TOKEN_HEADER]: "expected-secret" },
+    }))).toBe("valid");
+  });
+});
diff --git a/local/src/lib/setup-token.ts b/local/src/lib/setup-token.ts
new file mode 100644
index 0000000..5e65661
--- /dev/null
+++ b/local/src/lib/setup-token.ts
@@ -0,0 +1,15 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+
+export const LOCAL_SETUP_TOKEN_HEADER = "x-subboost-setup-token";
+
+export function validateLocalSetupToken(request: Request): "valid" | "invalid" | "missing_config" {
+  const expected = process.env.LOCAL_SETUP_TOKEN;
+  if (!expected) return "missing_config";
+
+  const supplied = request.headers.get(LOCAL_SETUP_TOKEN_HEADER);
+  if (!supplied) return "invalid";
+
+  const expectedDigest = createHash("sha256").update(expected).digest();
+  const suppliedDigest = createHash("sha256").update(supplied).digest();
+  return timingSafeEqual(expectedDigest, suppliedDigest) ? "valid" : "invalid";
+}
diff --git a/local/src/lib/source-import-settings.test.ts b/local/src/lib/source-import-settings.test.ts
new file mode 100644
index 0000000..a5031ad
--- /dev/null
+++ b/local/src/lib/source-import-settings.test.ts
@@ -0,0 +1,34 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  findFirst: vi.fn(),
+}));
+
+vi.mock("./prisma", () => ({
+  prisma: {
+    localAdmin: { findFirst: mocks.findFirst },
+  },
+}));
+
+import { getAllowUnsafeSubscriptionSources } from "./source-import-settings";
+
+describe("local source import settings", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("defaults to disabled when no local administrator exists", async () => {
+    mocks.findFirst.mockResolvedValueOnce(null);
+
+    await expect(getAllowUnsafeSubscriptionSources()).resolves.toBe(false);
+  });
+
+  it("reads the persisted local administrator setting", async () => {
+    mocks.findFirst.mockResolvedValueOnce({ allowUnsafeSubscriptionSources: true });
+
+    await expect(getAllowUnsafeSubscriptionSources()).resolves.toBe(true);
+    expect(mocks.findFirst).toHaveBeenCalledWith({
+      select: { allowUnsafeSubscriptionSources: true },
+    });
+  });
+});
diff --git a/local/src/lib/source-import-settings.ts b/local/src/lib/source-import-settings.ts
new file mode 100644
index 0000000..3f083c1
--- /dev/null
+++ b/local/src/lib/source-import-settings.ts
@@ -0,0 +1,9 @@
+import { prisma } from "./prisma";
+
+export async function getAllowUnsafeSubscriptionSources(): Promise<boolean> {
+  const admin = await prisma.localAdmin.findFirst({
+    select: { allowUnsafeSubscriptionSources: true },
+  });
+
+  return admin?.allowUnsafeSubscriptionSources ?? false;
+}
diff --git a/local/src/lib/source-import.test.ts b/local/src/lib/source-import.test.ts
index e8db443..783a889 100644
--- a/local/src/lib/source-import.test.ts
+++ b/local/src/lib/source-import.test.ts
@@ -2,14 +2,25 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import { fetchSourceUserInfoHeadersDirect, importSourceUrlDirect } from "./source-import";
 
 const mocks = vi.hoisted(() => ({
+  getAllowUnsafeSubscriptionSources: vi.fn(),
   lookup: vi.fn(),
   importSubscriptionFromUrl: vi.fn(),
+  requestPinnedText: vi.fn(),
 }));
 
 vi.mock("node:dns/promises", () => ({
   lookup: mocks.lookup,
 }));
 
+vi.mock("@local/lib/source-import-settings", () => ({
+  getAllowUnsafeSubscriptionSources: mocks.getAllowUnsafeSubscriptionSources,
+}));
+
+vi.mock("./pinned-http", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./pinned-http")>();
+  return { ...actual, requestPinnedText: mocks.requestPinnedText };
+});
+
 vi.mock("@subboost/server-core/subscription", async (importOriginal) => {
   const actual = await importOriginal<typeof import("@subboost/server-core/subscription")>();
   return {
@@ -59,7 +70,9 @@ async function runTransport(url: string, overrides: Record<string, unknown> = {}
 describe("local source import transport", () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    mocks.lookup.mockResolvedValue([{ address: "93.184.216.34" }]);
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(false);
+    mocks.lookup.mockRejectedValue(new Error("dns unavailable"));
+    mocks.requestPinnedText.mockResolvedValue({ status: 200, headers: {}, content: "ss://node" });
     globalThis.fetch = vi.fn();
   });
 
@@ -108,12 +121,43 @@ describe("local source import transport", () => {
     expect(globalThis.fetch).not.toHaveBeenCalled();
   });
 
+  it("allows all local and reserved address sources when the high-risk setting is enabled", async () => {
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(true);
+    const allowedUrls = [
+      "http://localhost:8080/sub",
+      "http://127.0.0.1/sub",
+      "http://[::1]/sub",
+      "http://router.local/sub",
+      "http://10.1.2.3/sub",
+      "http://169.254.169.254/latest/meta-data",
+      "http://100.64.0.1/sub",
+      "http://192.0.2.1/sub",
+      "http://198.18.0.1/sub",
+      "http://224.0.0.1/sub",
+      "http://[fc00::1]/sub",
+      "http://[fe80::1]/sub",
+      "http://[::ffff:192.168.0.1]/sub",
+    ];
+
+    for (const url of allowedUrls) {
+      vi.mocked(globalThis.fetch).mockResolvedValueOnce(response("ss://node", { status: 200 }));
+      await expect(runTransport(url)).resolves.toMatchObject({ ok: true, content: "ss://node" });
+    }
+    expect(mocks.lookup).not.toHaveBeenCalled();
+  });
+
+  it("keeps URL scheme and embedded-credential checks enabled for high-risk sources", async () => {
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(true);
+    await expect(runTransport("ftp://127.0.0.1/sub")).resolves.toMatchObject({ ok: false });
+    await expect(runTransport("http://user:pass@127.0.0.1/sub")).resolves.toMatchObject({ ok: false });
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
   it("rechecks fake-ip DNS answers with DoH before fetching the subscription", async () => {
     mocks.lookup.mockResolvedValueOnce([{ address: "198.18.3.6" }]);
     vi.mocked(globalThis.fetch)
       .mockResolvedValueOnce(dnsResponse(["93.184.216.34"]))
-      .mockResolvedValueOnce(dnsResponse([]))
-      .mockResolvedValueOnce(response("ss://node", { status: 200 }));
+      .mockResolvedValueOnce(dnsResponse([]));
 
     await expect(runTransport("https://api.dler.io/sub")).resolves.toMatchObject({
       ok: true,
@@ -131,11 +175,54 @@ describe("local source import transport", () => {
         body: expect.any(ArrayBuffer),
       })
     );
-    expect(globalThis.fetch).toHaveBeenNthCalledWith(
-      3,
-      "https://api.dler.io/sub",
-      expect.objectContaining({ method: "GET", redirect: "manual" })
-    );
+    expect(mocks.requestPinnedText).toHaveBeenCalledWith(expect.objectContaining({
+      url: "https://api.dler.io/sub",
+      addresses: ["93.184.216.34"],
+      method: "GET",
+    }));
+  });
+
+  it("pins ordinary successful DNS validation results into the connection", async () => {
+    mocks.lookup.mockResolvedValueOnce([{ address: "93.184.216.34" }]);
+
+    await expect(runTransport("https://example.com/sub")).resolves.toMatchObject({
+      ok: true,
+      content: "ss://node",
+    });
+
+    expect(mocks.requestPinnedText).toHaveBeenCalledWith(expect.objectContaining({
+      url: "https://example.com/sub",
+      addresses: ["93.184.216.34"],
+      maxBytes: 1024,
+    }));
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("revalidates and pins every redirect target independently", async () => {
+    mocks.lookup
+      .mockResolvedValueOnce([{ address: "93.184.216.34" }])
+      .mockResolvedValueOnce([{ address: "1.1.1.1" }]);
+    mocks.requestPinnedText
+      .mockResolvedValueOnce({
+        status: 302,
+        headers: { location: "https://cdn.example.net/sub" },
+        content: "",
+      })
+      .mockResolvedValueOnce({ status: 200, headers: {}, content: "ss://node" });
+
+    await expect(runTransport("https://example.com/sub")).resolves.toMatchObject({
+      ok: true,
+      content: "ss://node",
+    });
+
+    expect(mocks.requestPinnedText).toHaveBeenNthCalledWith(1, expect.objectContaining({
+      url: "https://example.com/sub",
+      addresses: ["93.184.216.34"],
+    }));
+    expect(mocks.requestPinnedText).toHaveBeenNthCalledWith(2, expect.objectContaining({
+      url: "https://cdn.example.net/sub",
+      addresses: ["1.1.1.1"],
+    }));
   });
 
   it("keeps blocking fake-ip DNS answers when DoH confirms an unsafe target", async () => {
@@ -151,6 +238,21 @@ describe("local source import transport", () => {
     expect(globalThis.fetch).toHaveBeenCalledTimes(2);
   });
 
+  it("lets the explicit high-risk setting bypass fake-ip DNS blocking", async () => {
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(true);
+    vi.mocked(globalThis.fetch).mockResolvedValueOnce(response("ss://node", { status: 200 }));
+
+    await expect(runTransport("https://fake-ip-private.example/sub")).resolves.toMatchObject({
+      ok: true,
+      content: "ss://node",
+    });
+    expect(mocks.lookup).not.toHaveBeenCalled();
+    expect(globalThis.fetch).toHaveBeenCalledWith(
+      "https://fake-ip-private.example/sub",
+      expect.objectContaining({ method: "GET", redirect: "manual" })
+    );
+  });
+
   it("rejects additional private IPv4 and IPv6 address ranges", async () => {
     const blockedUrls = [
       "http://0.0.0.0/sub",
@@ -274,7 +376,9 @@ describe("local source import transport", () => {
   });
 
   it("handles redirect loops, missing locations, and thrown fetch errors", async () => {
-    vi.mocked(globalThis.fetch).mockResolvedValue(response("", { status: 302, headers: { location: "/next" } }));
+    vi.mocked(globalThis.fetch).mockImplementation(async () => (
+      response("", { status: 302, headers: { location: "/next" } })
+    ));
     await expect(runTransport("https://example.com/loop")).resolves.toMatchObject({
       ok: false,
       publicReason: "HTTP 310",
@@ -303,6 +407,19 @@ describe("local source import transport", () => {
     });
   });
 
+  it("applies the enabled high-risk setting to redirect targets", async () => {
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(true);
+    vi.mocked(globalThis.fetch)
+      .mockResolvedValueOnce(response("", { status: 302, headers: { location: "http://127.0.0.1/sub" } }))
+      .mockResolvedValueOnce(response("ss://node", { status: 200 }));
+
+    await expect(runTransport("https://example.com/private-redirect")).resolves.toMatchObject({
+      ok: true,
+      content: "ss://node",
+    });
+    expect(mocks.getAllowUnsafeSubscriptionSources).toHaveBeenCalledTimes(1);
+  });
+
   it("returns userinfo headers with HEAD and skips when no userinfo URL is configured", async () => {
     await expect(fetchSourceUserInfoHeadersDirect({})).resolves.toBeUndefined();
 
@@ -338,5 +455,13 @@ describe("local source import transport", () => {
         headers: expect.objectContaining({ "User-Agent": expect.any(String) }),
       })
     );
+
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(true);
+    vi.mocked(globalThis.fetch).mockResolvedValueOnce(
+      response("", { status: 200, headers: { "Subscription-Userinfo": "upload=2; total=4096" } })
+    );
+    await expect(fetchSourceUserInfoHeadersDirect({ userinfoUrl: "http://127.0.0.1/userinfo" })).resolves.toMatchObject({
+      "subscription-userinfo": "upload=2; total=4096",
+    });
   });
 });
diff --git a/local/src/lib/source-import.ts b/local/src/lib/source-import.ts
index 81a6667..f4e7abb 100644
--- a/local/src/lib/source-import.ts
+++ b/local/src/lib/source-import.ts
@@ -1,4 +1,5 @@
 import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
 import {
   createSubscriptionImportErrorInfo,
   inferSubscriptionImportErrorCategory,
@@ -19,6 +20,8 @@ import {
   selectDnsAddressesAfterFakeIpRecheck,
   shouldRecheckFakeIpDnsAnswers,
 } from "@subboost/server-core/subscription/ssrf-ip";
+import { getAllowUnsafeSubscriptionSources } from "./source-import-settings";
+import { requestPinnedText, ResponseTooLargeError, type DirectHttpResponse } from "./pinned-http";
 
 const DEFAULT_TIMEOUT_MS = 15000;
 const DEFAULT_MAX_BYTES = 10 * 1024 * 1024;
@@ -68,32 +71,47 @@ function normalizeHostname(hostname: string): string {
   return hostname.replace(/^\[|\]$/g, "").toLowerCase();
 }
 
-async function validatePublicFetchTarget(url: string): Promise<SourceImportTransportResult | null> {
+async function validatePublicFetchTarget(
+  url: string,
+  allowUnsafeSubscriptionSources: boolean
+): Promise<
+  | { ok: true; addresses: string[] | null }
+  | { ok: false; failure: SourceImportTransportResult }
+> {
   let parsed: URL;
   try {
     parsed = new URL(url);
   } catch {
-    return toSecurityFailure("无效的订阅 URL");
+    return { ok: false, failure: toSecurityFailure("无效的订阅 URL") };
   }
 
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    return toSecurityFailure("只支持 HTTP 或 HTTPS 订阅 URL");
+    return { ok: false, failure: toSecurityFailure("只支持 HTTP 或 HTTPS 订阅 URL") };
   }
 
   if (parsed.username || parsed.password) {
-    return toSecurityFailure("订阅 URL 不允许包含用户名或密码");
+    return { ok: false, failure: toSecurityFailure("订阅 URL 不允许包含用户名或密码") };
   }
 
+  if (allowUnsafeSubscriptionSources) return { ok: true, addresses: null };
+
   const hostname = normalizeHostname(parsed.hostname);
   if (!hostname || hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local")) {
-    return toSecurityFailure("禁止访问本机或内网地址");
+    return { ok: false, failure: toSecurityFailure("禁止访问本机或内网地址") };
   }
 
   if (isPrivateOrReservedIp(hostname)) {
-    return toSecurityFailure("禁止访问本机或内网地址");
+    return { ok: false, failure: toSecurityFailure("禁止访问本机或内网地址") };
   }
 
-  const records = await lookup(hostname, { all: true, verbatim: true }).catch(() => []);
+  if (isIP(hostname)) return { ok: true, addresses: [hostname] };
+
+  const records = await lookup(hostname, { all: true, verbatim: true }).catch(() => null);
+  if (!records || records.length === 0) {
+    // Compatibility fallback documented for local: if DNS validation cannot
+    // obtain any address, let the runtime resolver make the connection.
+    return { ok: true, addresses: null };
+  }
   const addresses = normalizeResolvedIpAddresses(records.map((record) => record.address));
   const finalAddresses = shouldRecheckFakeIpDnsAnswers(addresses)
     ? selectDnsAddressesAfterFakeIpRecheck(
@@ -103,53 +121,109 @@ async function validatePublicFetchTarget(url: string): Promise<SourceImportTrans
     : addresses;
   const addressesToCheck = finalAddresses.length > 0 ? finalAddresses : addresses;
   if (addressesToCheck.some((address) => isPrivateOrReservedIp(address))) {
-    return toSecurityFailure("禁止访问本机或内网地址");
+    return { ok: false, failure: toSecurityFailure("禁止访问本机或内网地址") };
+  }
+
+  return { ok: true, addresses: addressesToCheck.length > 0 ? addressesToCheck : null };
+}
+
+async function readFetchBodyLimited(response: Response, maxBytes: number): Promise<string> {
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel("response too large").catch(() => undefined);
+      throw new ResponseTooLargeError();
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
   }
+  return new TextDecoder().decode(bytes);
+}
 
-  return null;
+async function requestUnpinnedText(params: {
+  url: string;
+  method: "GET" | "HEAD";
+  userAgent: string;
+  maxBytes: number;
+  signal: AbortSignal;
+}): Promise<DirectHttpResponse> {
+  const response = await fetch(params.url, {
+    method: params.method,
+    headers: {
+      "User-Agent": params.userAgent,
+      Accept: "text/plain, application/yaml, application/x-yaml, */*;q=0.8",
+      "Cache-Control": "no-cache",
+    },
+    redirect: "manual",
+    signal: params.signal,
+  });
+  const headers = headersToRecord(response.headers);
+  if (response.status >= 300 && response.status < 400) {
+    await response.body?.cancel("redirect response is not consumed").catch(() => undefined);
+    return { status: response.status, headers, content: "" };
+  }
+  const contentLength = Number(headers["content-length"] || "0");
+  if (Number.isFinite(contentLength) && contentLength > params.maxBytes) {
+    await response.body?.cancel().catch(() => undefined);
+    throw new ResponseTooLargeError();
+  }
+  const content = params.method === "HEAD" ? "" : await readFetchBodyLimited(response, params.maxBytes);
+  return { status: response.status, headers, content };
 }
 
-async function fetchTextDirect(request: SourceImportTransportRequest): Promise<SourceImportTransportResult> {
+async function fetchTextDirect(
+  request: SourceImportTransportRequest,
+  allowUnsafeSubscriptionSources: boolean
+): Promise<SourceImportTransportResult> {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), request.timeoutMs);
 
   try {
     let currentUrl = request.url;
-    let response: Response | null = null;
+    let response: DirectHttpResponse | null = null;
     for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount += 1) {
-      const guardFailure = await validatePublicFetchTarget(currentUrl);
-      if (guardFailure) return guardFailure;
-
-      response = await fetch(currentUrl, {
-        method: request.purpose === "userinfo" ? "HEAD" : "GET",
-        headers: {
-          "User-Agent": request.userAgent,
-          Accept: "text/plain, application/yaml, application/x-yaml, */*;q=0.8",
-          "Cache-Control": "no-cache",
-        },
-        redirect: "manual",
-        signal: controller.signal,
-      });
+      const validation = await validatePublicFetchTarget(currentUrl, allowUnsafeSubscriptionSources);
+      if (!validation.ok) return validation.failure;
+
+      const method = request.purpose === "userinfo" ? "HEAD" : "GET";
+      response = validation.addresses
+        ? await requestPinnedText({
+            url: currentUrl,
+            addresses: validation.addresses,
+            method,
+            userAgent: request.userAgent,
+            maxBytes: request.maxBytes,
+            signal: controller.signal,
+          })
+        : await requestUnpinnedText({
+            url: currentUrl,
+            method,
+            userAgent: request.userAgent,
+            maxBytes: request.maxBytes,
+            signal: controller.signal,
+          });
 
       if (response.status < 300 || response.status >= 400) break;
-      const location = response.headers.get("location");
+      const location = response.headers.location;
       if (!location) break;
       currentUrl = new URL(location, currentUrl).toString();
       response = null;
     }
 
     if (!response) return toFailure("订阅重定向次数过多", 310);
-    const headers = headersToRecord(response.headers);
-    const contentLength = Number(headers["content-length"] || "0");
-    if (Number.isFinite(contentLength) && contentLength > request.maxBytes) {
-      return toFailure("订阅响应过大", 413);
-    }
-
-    const content = request.purpose === "userinfo" ? "" : await response.text();
-    if (new TextEncoder().encode(content).length > request.maxBytes) {
-      return toFailure("订阅响应过大", 413);
-    }
-    if (!response.ok) {
+    const { headers, content } = response;
+    if (response.status < 200 || response.status >= 300) {
       return toFailure(`HTTP ${response.status}`, response.status);
     }
 
@@ -160,6 +234,7 @@ async function fetchTextDirect(request: SourceImportTransportRequest): Promise<S
       responseStatus: response.status,
     };
   } catch (error) {
+    if (error instanceof ResponseTooLargeError) return toFailure("订阅响应过大", 413);
     const message = error instanceof Error ? error.message : String(error);
     return toFailure(message);
   } finally {
@@ -168,10 +243,11 @@ async function fetchTextDirect(request: SourceImportTransportRequest): Promise<S
 }
 
 export async function importSourceUrlDirect(request: SourceImportRequest): Promise<SourceImportResult> {
+  const allowUnsafeSubscriptionSources = await getAllowUnsafeSubscriptionSources();
   return importSubscriptionFromUrl(request, {
     timeoutMs: DEFAULT_TIMEOUT_MS,
     maxBytes: DEFAULT_MAX_BYTES,
-    fetchText: fetchTextDirect,
+    fetchText: (transportRequest) => fetchTextDirect(transportRequest, allowUnsafeSubscriptionSources),
   });
 }
 
@@ -180,12 +256,16 @@ export async function fetchSourceUserInfoHeadersDirect(source: {
   userinfoUserAgent?: string;
 }): Promise<Record<string, string> | undefined> {
   if (!source.userinfoUrl) return undefined;
-  const response = await fetchTextDirect({
-    url: source.userinfoUrl,
-    userAgent: source.userinfoUserAgent?.trim() || SUBSCRIPTION_IMPORT_USER_AGENTS[0],
-    purpose: "userinfo",
-    timeoutMs: USERINFO_TIMEOUT_MS,
-    maxBytes: USERINFO_MAX_BYTES,
-  });
+  const allowUnsafeSubscriptionSources = await getAllowUnsafeSubscriptionSources();
+  const response = await fetchTextDirect(
+    {
+      url: source.userinfoUrl,
+      userAgent: source.userinfoUserAgent?.trim() || SUBSCRIPTION_IMPORT_USER_AGENTS[0],
+      purpose: "userinfo",
+      timeoutMs: USERINFO_TIMEOUT_MS,
+      maxBytes: USERINFO_MAX_BYTES,
+    },
+    allowUnsafeSubscriptionSources
+  );
   return response.ok ? response.headers : undefined;
 }
diff --git a/local/src/lib/subscription-route-handlers.test.ts b/local/src/lib/subscription-route-handlers.test.ts
index a5d0663..bfe88c7 100644
--- a/local/src/lib/subscription-route-handlers.test.ts
+++ b/local/src/lib/subscription-route-handlers.test.ts
@@ -15,6 +15,7 @@ const mocks = vi.hoisted(() => ({
   deleteSubscription: vi.fn(),
   getSubscription: vi.fn(),
   json: vi.fn(),
+  jsonBodyError: vi.fn(),
   listSubscriptions: vi.fn(),
   readJsonBody: vi.fn(),
   refreshSubscription: vi.fn(),
@@ -26,6 +27,8 @@ vi.mock("@local/lib/api-auth", () => ({ withCurrentAdmin: mocks.withCurrentAdmin
 vi.mock("@local/lib/http", () => ({
   apiError: mocks.apiError,
   json: mocks.json,
+  jsonBodyError: mocks.jsonBodyError,
+  LOCAL_JSON_BODY_LIMITS: { subscription: 16 * 1024 * 1024 },
   readJsonBody: mocks.readJsonBody,
 }));
 vi.mock("@local/lib/subscription-service", () => ({
@@ -47,6 +50,7 @@ describe("local subscription route handlers", () => {
     );
     mocks.json.mockImplementation((body: unknown, status = 200) => ({ body, status }));
     mocks.apiError.mockImplementation((message: string, code: string, status: number) => ({ message, code, status }));
+    mocks.jsonBodyError.mockImplementation(() => ({ message: "Invalid JSON body.", code: "BAD_REQUEST", status: 400 }));
   });
 
   it("extracts subscription ids from query strings", () => {
@@ -71,14 +75,14 @@ describe("local subscription route handlers", () => {
   });
 
   it("creates subscriptions and reports bad input", async () => {
-    mocks.readJsonBody.mockResolvedValueOnce(null);
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: false, reason: "invalid_json" });
     await expect(createSubscriptionResponse(request)).resolves.toEqual({
       message: "Invalid JSON body.",
       code: "BAD_REQUEST",
       status: 400,
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "A" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "A" } });
     mocks.createSubscription.mockResolvedValueOnce({ id: "sub-1" });
     await expect(createSubscriptionResponse(request)).resolves.toEqual({
       body: { subscription: { id: "sub-1" } },
@@ -86,7 +90,7 @@ describe("local subscription route handlers", () => {
     });
     expect(mocks.createSubscription).toHaveBeenCalledWith("admin-1", { name: "A" });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "" } });
     mocks.createSubscription.mockRejectedValueOnce(new Error("Name required"));
     await expect(createSubscriptionResponse(request)).resolves.toEqual({
       message: "Name required",
@@ -94,7 +98,7 @@ describe("local subscription route handlers", () => {
       status: 400,
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "" } });
     mocks.createSubscription.mockRejectedValueOnce("bad");
     await expect(createSubscriptionResponse(request)).resolves.toEqual({
       message: "Unable to create subscription.",
@@ -104,21 +108,21 @@ describe("local subscription route handlers", () => {
   });
 
   it("updates subscriptions and validates JSON body shape", async () => {
-    mocks.readJsonBody.mockResolvedValueOnce([]);
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: [] });
     await expect(updateSubscriptionResponse(request, "sub-1")).resolves.toEqual({
       message: "Invalid JSON body.",
       code: "BAD_REQUEST",
       status: 400,
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "B" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "B" } });
     mocks.updateSubscription.mockResolvedValueOnce({ id: "sub-1", name: "B" });
     await expect(updateSubscriptionResponse(request, "sub-1")).resolves.toEqual({
       body: { subscription: { id: "sub-1", name: "B" } },
       status: 200,
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "B" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "B" } });
     mocks.updateSubscription.mockResolvedValueOnce(null);
     await expect(updateSubscriptionResponse(request, "missing")).resolves.toEqual({
       message: "Subscription not found.",
@@ -126,7 +130,7 @@ describe("local subscription route handlers", () => {
       status: 404,
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "" } });
     mocks.updateSubscription.mockRejectedValueOnce("bad");
     await expect(updateSubscriptionResponse(request, "sub-1")).resolves.toEqual({
       message: "Unable to update subscription.",
diff --git a/local/src/lib/subscription-route-handlers.ts b/local/src/lib/subscription-route-handlers.ts
index 5957b95..fa5d076 100644
--- a/local/src/lib/subscription-route-handlers.ts
+++ b/local/src/lib/subscription-route-handlers.ts
@@ -1,5 +1,5 @@
 import { withCurrentAdmin } from "@local/lib/api-auth";
-import { apiError, json, readJsonBody } from "@local/lib/http";
+import { apiError, json, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import {
   createSubscription,
   deleteSubscription,
@@ -19,11 +19,11 @@ export async function listSubscriptionsResponse() {
 
 export async function createSubscriptionResponse(request: Request) {
   return withCurrentAdmin(async (admin) => {
-    const body = await readJsonBody(request);
-    if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.subscription);
+    if (!parsedBody.ok) return jsonBodyError(parsedBody);
 
     try {
-      const subscription = await createSubscription(admin.id, body);
+      const subscription = await createSubscription(admin.id, parsedBody.value);
       return json({ subscription }, 201);
     } catch (error) {
       return apiError(error instanceof Error ? error.message : "Unable to create subscription.", "BAD_REQUEST", 400);
@@ -41,7 +41,9 @@ export async function getSubscriptionResponse(id: string) {
 
 export async function updateSubscriptionResponse(request: Request, id: string) {
   return withCurrentAdmin(async (admin) => {
-    const body = await readJsonBody(request);
+    const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.subscription);
+    if (!parsedBody.ok) return jsonBodyError(parsedBody);
+    const body = parsedBody.value;
     if (!body || typeof body !== "object" || Array.isArray(body)) {
       return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
     }
diff --git a/local/src/lib/subscription-service.test.ts b/local/src/lib/subscription-service.test.ts
index 472b42a..4a37a0b 100644
--- a/local/src/lib/subscription-service.test.ts
+++ b/local/src/lib/subscription-service.test.ts
@@ -33,8 +33,10 @@ const mocks = vi.hoisted(() => ({
       findFirst: vi.fn(),
       findUnique: vi.fn(),
       update: vi.fn(),
+      updateMany: vi.fn(),
       delete: vi.fn(),
     },
+    subscriptionAutoUpdateState: { upsert: vi.fn() },
     $transaction: vi.fn(),
   },
 }));
@@ -164,13 +166,16 @@ describe("local subscription service", () => {
     mocks.prisma.subscription.findFirst.mockResolvedValue(row());
     mocks.prisma.subscription.findUnique.mockResolvedValue(row());
     mocks.prisma.subscription.update.mockResolvedValue(row({ name: "Updated" }));
+    mocks.prisma.subscription.updateMany.mockResolvedValue({ count: 1 });
+    mocks.prisma.subscriptionAutoUpdateState.upsert.mockResolvedValue({});
     mocks.prisma.subscription.delete.mockResolvedValue(row());
-    mocks.prisma.$transaction.mockImplementation(async (callback) =>
-      callback({
-        subscription: { update: vi.fn() },
-        subscriptionAutoUpdateState: { upsert: vi.fn() },
-      })
-    );
+    mocks.prisma.$transaction.mockImplementation(async (callback) => callback({
+      subscription: {
+        update: mocks.prisma.subscription.update,
+        updateMany: mocks.prisma.subscription.updateMany,
+      },
+      subscriptionAutoUpdateState: { upsert: mocks.prisma.subscriptionAutoUpdateState.upsert },
+    }));
     mocks.importSourceUrlDirect.mockResolvedValue({
       ok: true,
       parsedNodes: [node("Imported")],
@@ -287,6 +292,7 @@ describe("local subscription service", () => {
       data: expect.objectContaining({
         ownerId: "owner-1",
         name: "Created",
+        token: expect.stringMatching(/^[A-Za-z0-9_-]{43}$/),
         encryptedUrls: JSON.stringify(["https://example.com/sub"]),
         encryptedNodes: expect.stringContaining('"name":"Node"'),
         encryptedConfig: expect.stringContaining('"smartNodeMatchingEnabled":false'),
@@ -335,6 +341,58 @@ describe("local subscription service", () => {
         autoUpdateInterval: 359,
       })
     ).rejects.toThrow("自动更新最小间隔为 0.1 小时");
+
+    await expect(createSubscription("owner-1", { name: "Bad", nodes: [null] })).rejects.toThrow(
+      "节点 #1 必须是对象"
+    );
+    await expect(
+      createSubscription("owner-1", { name: "Too many", nodes: Array.from({ length: 10_001 }, () => null) })
+    ).rejects.toThrow("Node count cannot exceed 10000");
+  });
+
+  it("validates node filters and permits provider-only output on create", async () => {
+    await expect(
+      createSubscription("owner-1", {
+        name: "Invalid filter",
+        nodes: [node("套餐到期提醒")],
+        config: {
+          nodeNameFilter: { enabled: true, excludeRegexes: ["("] },
+        },
+      })
+    ).rejects.toThrow("节点名称过滤配置无效");
+
+    mocks.buildGenerateOptionsFromConfig.mockReturnValueOnce({ nodes: [] });
+    await expect(
+      createSubscription("owner-1", {
+        name: "Empty filter result",
+        nodes: [node("套餐到期提醒")],
+        config: {
+          nodeNameFilter: { enabled: true, excludeRegexes: ["套餐到期"] },
+        },
+      })
+    ).rejects.toThrow("过滤后没有可用节点");
+
+    mocks.buildGenerateOptionsFromConfig.mockReturnValueOnce({
+      nodes: [],
+      proxyProviders: { provider: { type: "http" } },
+    });
+    await expect(
+      createSubscription("owner-1", {
+        name: "Provider output",
+        nodes: [node("套餐到期提醒")],
+        config: {
+          sources: [
+            {
+              id: "provider",
+              type: "url",
+              content: "https://provider.example/sub",
+              useProxyProviders: true,
+            },
+          ],
+          nodeNameFilter: { enabled: true, excludeRegexes: ["套餐到期"] },
+        },
+      })
+    ).resolves.toMatchObject({ name: "Created" });
   });
 
   it("updates subscriptions and preserves existing values when fields are omitted", async () => {
@@ -387,6 +445,60 @@ describe("local subscription service", () => {
       }),
       include: { autoUpdateState: true },
     });
+
+    mocks.prisma.subscription.findFirst.mockResolvedValueOnce(row({ autoUpdateInterval: null }));
+    await updateSubscription("owner-1", "sub-1", { autoUpdateInterval: 7200 });
+    expect(mocks.prisma.subscriptionAutoUpdateState.upsert).toHaveBeenCalledWith({
+      where: { subscriptionId: "sub-1" },
+      create: { subscriptionId: "sub-1" },
+      update: {
+        externalFailureCount: 0,
+        failureSourceState: null,
+        lastFailedAt: null,
+        lastAttemptedAt: null,
+        disabledAt: null,
+        disabledReason: null,
+        disabledPreviousInterval: null,
+      },
+    });
+  });
+
+  it("rejects updates whose filter removes every ordinary node", async () => {
+    mocks.buildGenerateOptionsFromConfig.mockReturnValueOnce({ nodes: [] });
+
+    await expect(
+      updateSubscription("owner-1", "sub-1", {
+        nodes: [node("套餐到期提醒")],
+        config: {
+          nodeNameFilter: { enabled: true, excludeRegexes: ["套餐到期"] },
+        },
+      })
+    ).rejects.toThrow("过滤后没有可用节点");
+    expect(mocks.prisma.subscription.update).not.toHaveBeenCalled();
+  });
+
+  it("replaces submitted config instead of retaining omitted stale fields", async () => {
+    mocks.prisma.subscription.findFirst.mockResolvedValueOnce(
+      row({
+        encryptedConfig: JSON.stringify({
+          staleSetting: true,
+          sources: [{ id: "old", type: "url", content: "https://old.example/sub" }],
+        }),
+      })
+    );
+
+    await updateSubscription("owner-1", "sub-1", {
+      config: {
+        freshSetting: true,
+        sources: [{ id: "new", type: "url", content: "https://new.example/sub" }],
+      },
+    });
+
+    const update = mocks.prisma.subscription.update.mock.calls.at(-1)?.[0];
+    const encryptedConfig = update?.data?.encryptedConfig;
+    expect(typeof encryptedConfig).toBe("string");
+    expect(JSON.parse(encryptedConfig)).toMatchObject({ freshSetting: true });
+    expect(JSON.parse(encryptedConfig)).not.toHaveProperty("staleSetting");
   });
 
   it("builds fetch callbacks for refresh source imports", async () => {
@@ -453,6 +565,18 @@ describe("local subscription service", () => {
     });
     expect(mocks.prisma.$transaction).toHaveBeenCalled();
 
+    mocks.prisma.subscription.updateMany.mockResolvedValueOnce({ count: 0 });
+    await expect(refreshSubscription("owner-1", "sub-1")).resolves.toEqual({
+      ok: false,
+      response: {
+        body: {
+          error: "Subscription changed while refresh was in progress.",
+          code: "SUBSCRIPTION_CHANGED",
+        },
+        status: 409,
+      },
+    });
+
     mocks.prepareRefreshCacheResult.mockReturnValueOnce({ ok: false, reason: "too_many_nodes" });
     await expect(refreshSubscription("owner-1", "sub-1")).resolves.toEqual({
       ok: false,
diff --git a/local/src/lib/subscription-service.ts b/local/src/lib/subscription-service.ts
index 3850876..401e0d4 100644
--- a/local/src/lib/subscription-service.ts
+++ b/local/src/lib/subscription-service.ts
@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
 import { generateClashYaml } from "@subboost/core/generator";
 import { buildGenerateOptionsFromConfig, getEffectiveTestOptions } from "@subboost/core/subscription/config-utils";
 import { buildProxyProvidersFromConfig } from "@subboost/core/subscription/proxy-providers";
@@ -10,12 +10,12 @@ import {
   normalizeSubscriptionConfigForPersistence,
   normalizeSubscriptionInfoForPersistence,
   normalizeSubscriptionName,
-  normalizeSubscriptionNodeList,
   normalizeSubscriptionUrlList,
   prepareRefreshCacheResult,
   refreshNodeSnapshot,
   serializeSubscriptionDetailData,
   serializeSubscriptionSummaryData,
+  validateSubscriptionNodeList,
   type SavedSource,
   type RefreshNodeSnapshotResult,
 } from "@subboost/server-core/subscription";
@@ -101,6 +101,14 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
+function validateLocalSubscriptionNodes(value: unknown): ParsedNode[] {
+  if (value === undefined || value === null) return [];
+  if (Array.isArray(value) && value.length > MAX_NODES_PER_SUBSCRIPTION) {
+    throw new Error(`Node count cannot exceed ${MAX_NODES_PER_SUBSCRIPTION}.`);
+  }
+  return validateSubscriptionNodeList(value);
+}
+
 function buildLocalSubscriptionUrl(token: string): string {
   return `${getAppUrl()}/api/subscriptions/${token}/config.yaml`;
 }
@@ -118,11 +126,30 @@ function buildLocalSubscriptionConfig(
       existingConfig,
       idFactory: randomUUID,
       splitUrlLines: true,
+      mergeExistingConfig: false,
       defaultSmartNodeMatchingEnabled: true,
     }
   );
 }
 
+function assertNodeNameFilterKeepsOutput(
+  nodes: ParsedNode[],
+  config: Record<string, unknown>
+): void {
+  if (nodes.length === 0) return;
+  const options = buildGenerateOptionsFromConfig(config, { nodes });
+  const hasProxyProviders = Boolean(
+    options.proxyProviders && Object.keys(options.proxyProviders).length > 0
+  );
+  if (options.nodes.length === 0 && !hasProxyProviders) {
+    throw new Error("过滤后没有可用节点");
+  }
+}
+
+export function generateLocalSubscriptionToken(): string {
+  return randomBytes(32).toString("base64url");
+}
+
 export function readSubscriptionSecrets(row: SubscriptionRow) {
   return {
     urls: decryptJson<string[]>(row.encryptedUrls, []),
@@ -176,10 +203,11 @@ export async function createSubscription(ownerId: string, body: unknown): Promis
   if (!name) throw new Error("Subscription name is required.");
 
   const urls = normalizeSubscriptionUrlList(body.urls);
-  const nodes = normalizeSubscriptionNodeList(body.nodes);
+  const nodes = validateLocalSubscriptionNodes(body.nodes);
   if (urls.length === 0 && nodes.length === 0) throw new Error("At least one URL or node is required.");
 
   const config = buildLocalSubscriptionConfig(body);
+  assertNodeNameFilterKeepsOutput(nodes, config);
   const autoUpdateInterval = normalizeLocalAutoUpdateIntervalSeconds(body.autoUpdateInterval);
   const subscriptionInfo = normalizeSubscriptionInfoForPersistence(body.subscriptionInfo) ?? {};
 
@@ -187,6 +215,7 @@ export async function createSubscription(ownerId: string, body: unknown): Promis
     data: {
       ownerId,
       name,
+      token: generateLocalSubscriptionToken(),
       encryptedUrls: encryptJson(urls),
       encryptedNodes: encryptJson(nodes),
       encryptedConfig: encryptJson(config),
@@ -209,16 +238,18 @@ export async function updateSubscription(ownerId: string, id: string, body: unkn
   const hasUrls = "urls" in body;
   const hasNodes = "nodes" in body;
   const hasConfig = "config" in body || "smartNodeMatchingEnabled" in body;
+  const nextNodes = hasNodes ? validateLocalSubscriptionNodes(body.nodes) : currentSecrets.nodes;
+  let nextConfig = currentSecrets.config;
 
   if (hasUrls) {
     data.encryptedUrls = encryptJson(normalizeSubscriptionUrlList(body.urls));
   }
   if (hasNodes) {
-    data.encryptedNodes = encryptJson(normalizeSubscriptionNodeList(body.nodes));
+    data.encryptedNodes = encryptJson(nextNodes);
   }
   if (hasConfig) {
-    const config = buildLocalSubscriptionConfig(body, currentSecrets.config);
-    data.encryptedConfig = encryptJson(config);
+    nextConfig = buildLocalSubscriptionConfig(body, currentSecrets.config);
+    data.encryptedConfig = encryptJson(nextConfig);
   }
   if ("subscriptionInfo" in body) {
     data.encryptedSubscriptionInfo = encryptJson(normalizeSubscriptionInfoForPersistence(body.subscriptionInfo) ?? {});
@@ -226,20 +257,40 @@ export async function updateSubscription(ownerId: string, id: string, body: unkn
 
   if (hasUrls || hasNodes || hasConfig) {
     const nextUrls = hasUrls ? normalizeSubscriptionUrlList(body.urls) : currentSecrets.urls;
-    const nextNodes = hasNodes ? normalizeSubscriptionNodeList(body.nodes) : currentSecrets.nodes;
     if (nextUrls.length === 0 && nextNodes.length === 0) {
       throw new Error("At least one URL or node is required.");
     }
+    assertNodeNameFilterKeepsOutput(nextNodes, nextConfig);
   }
 
+  let resetAutoUpdateState = false;
   if ("autoUpdateInterval" in body) {
-    data.autoUpdateInterval = normalizeLocalAutoUpdateIntervalSeconds(body.autoUpdateInterval);
+    const nextAutoUpdateInterval = normalizeLocalAutoUpdateIntervalSeconds(body.autoUpdateInterval);
+    data.autoUpdateInterval = nextAutoUpdateInterval;
+    resetAutoUpdateState = current.autoUpdateInterval === null && nextAutoUpdateInterval !== null;
   }
 
-  const row = await prisma.subscription.update({
-    where: { id: current.id },
-    data,
-    include: { autoUpdateState: true },
+  const row = await prisma.$transaction(async (tx) => {
+    if (resetAutoUpdateState) {
+      await tx.subscriptionAutoUpdateState.upsert({
+        where: { subscriptionId: current.id },
+        create: { subscriptionId: current.id },
+        update: {
+          externalFailureCount: 0,
+          failureSourceState: null,
+          lastFailedAt: null,
+          lastAttemptedAt: null,
+          disabledAt: null,
+          disabledReason: null,
+          disabledPreviousInterval: null,
+        },
+      });
+    }
+    return tx.subscription.update({
+      where: { id: current.id },
+      data,
+      include: { autoUpdateState: true },
+    });
   });
   return formatSubscription(row);
 }
@@ -296,21 +347,24 @@ export function buildSubscriptionCacheExpiry(from: Date): Date {
 
 async function persistRefreshSuccess(params: {
   subscriptionId: string;
+  expectedUpdatedAt: Date;
   snapshot: RefreshNodeSnapshotResult;
   config: Record<string, unknown>;
   cachedAt: Date;
-}) {
-  await prisma.$transaction(async (tx) => {
-    await tx.subscription.update({
-      where: { id: params.subscriptionId },
+}): Promise<boolean> {
+  return prisma.$transaction(async (tx) => {
+    const updated = await tx.subscription.updateMany({
+      where: { id: params.subscriptionId, updatedAt: params.expectedUpdatedAt },
       data: {
         encryptedNodes: encryptJson(params.snapshot.nodes),
         encryptedConfig: encryptJson({ ...params.config, sources: params.snapshot.savedSources }),
         encryptedSubscriptionInfo: encryptJson(params.snapshot.subscriptionInfo),
         lastUpdatedAt: params.cachedAt,
         cacheExpiresAt: buildSubscriptionCacheExpiry(params.cachedAt),
+        updatedAt: params.cachedAt,
       },
     });
+    if (updated.count !== 1) return false;
     await tx.subscriptionAutoUpdateState.upsert({
       where: { subscriptionId: params.subscriptionId },
       create: { subscriptionId: params.subscriptionId },
@@ -324,6 +378,7 @@ async function persistRefreshSuccess(params: {
         disabledPreviousInterval: null,
       },
     });
+    return true;
   });
 }
 
@@ -355,7 +410,22 @@ export async function refreshSubscription(ownerId: string, id: string) {
   }
 
   const cachedAt = new Date();
-  await persistRefreshSuccess({ subscriptionId: row.id, snapshot, config: secrets.config, cachedAt });
+  const persisted = await persistRefreshSuccess({
+    subscriptionId: row.id,
+    expectedUpdatedAt: row.updatedAt,
+    snapshot,
+    config: secrets.config,
+    cachedAt,
+  });
+  if (!persisted) {
+    return {
+      ok: false as const,
+      response: {
+        body: { error: "Subscription changed while refresh was in progress.", code: "SUBSCRIPTION_CHANGED" },
+        status: 409,
+      },
+    };
+  }
   return {
     ok: true as const,
     body: buildManualRefreshSuccessResponseBody({
diff --git a/local/test/auto-update-service.test.ts b/local/test/auto-update-service.test.ts
index 00cca57..6a7d3fe 100644
--- a/local/test/auto-update-service.test.ts
+++ b/local/test/auto-update-service.test.ts
@@ -3,6 +3,13 @@ import { refreshNodeSnapshot } from "@subboost/server-core/subscription";
 import { prisma } from "@local/lib/prisma";
 import { runLocalSubscriptionAutoUpdateCron } from "@local/lib/auto-update-service";
 
+const dbMocks = vi.hoisted(() => ({
+  findMany: vi.fn(),
+  updateMany: vi.fn(async () => ({ count: 1 })),
+  upsert: vi.fn(async (args) => args),
+  transaction: vi.fn(),
+}));
+
 vi.mock("@local/lib/crypto", () => ({
   decryptJson: vi.fn((ciphertext: string | null | undefined, fallback: unknown) =>
     ciphertext ? JSON.parse(ciphertext.replace(/^json:/, "")) : fallback
@@ -16,13 +23,13 @@ vi.mock("@local/lib/crypto", () => ({
 vi.mock("@local/lib/prisma", () => ({
   prisma: {
     subscription: {
-      findMany: vi.fn(),
-      update: vi.fn(async (args) => args),
+      findMany: dbMocks.findMany,
+      updateMany: dbMocks.updateMany,
     },
     subscriptionAutoUpdateState: {
-      upsert: vi.fn(async (args) => args),
+      upsert: dbMocks.upsert,
     },
-    $transaction: vi.fn(async (operations: Array<Promise<unknown>>) => Promise.all(operations)),
+    $transaction: dbMocks.transaction,
   },
 }));
 
@@ -67,9 +74,14 @@ function subscription(overrides: Record<string, unknown> = {}) {
 
 beforeEach(() => {
   vi.mocked(prisma.subscription.findMany).mockReset();
-  vi.mocked(prisma.subscription.update).mockClear();
+  vi.mocked(prisma.subscription.updateMany).mockClear();
   vi.mocked(prisma.subscriptionAutoUpdateState.upsert).mockClear();
   vi.mocked(prisma.$transaction).mockClear();
+  dbMocks.updateMany.mockResolvedValue({ count: 1 });
+  dbMocks.transaction.mockImplementation(async (callback) => callback({
+    subscription: { updateMany: dbMocks.updateMany },
+    subscriptionAutoUpdateState: { upsert: dbMocks.upsert },
+  }));
   vi.mocked(refreshNodeSnapshot).mockReset();
 });
 
@@ -82,7 +94,7 @@ describe("local subscription auto-update service", () => {
     const summary = await runLocalSubscriptionAutoUpdateCron(new Date("2026-06-02T00:30:00.000Z"));
     expect(summary.results).toMatchObject({ total: 1, updated: 0, skipped: 1, failed: 0 });
     expect(refreshNodeSnapshot).not.toHaveBeenCalled();
-    expect(prisma.subscription.update).not.toHaveBeenCalled();
+    expect(prisma.subscription.updateMany).not.toHaveBeenCalled();
   });
 
   it("refreshes due subscriptions and persists the refreshed cache", async () => {
@@ -110,9 +122,9 @@ describe("local subscription auto-update service", () => {
         storedNodes: [],
       })
     );
-    expect(prisma.subscription.update).toHaveBeenCalledWith(
+    expect(prisma.subscription.updateMany).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { id: "sub-1" },
+        where: { id: "sub-1", updatedAt: new Date("2026-06-01T00:00:00.000Z") },
         data: expect.objectContaining({
           encryptedNodes: expect.stringContaining("node-a"),
           encryptedConfig: expect.stringContaining("src-1"),
@@ -132,4 +144,3 @@ describe("local subscription auto-update service", () => {
     );
   });
 });
-
diff --git a/local/test/cron-route-contract.test.ts b/local/test/cron-route-contract.test.ts
index 34a9c76..9fc89f7 100644
--- a/local/test/cron-route-contract.test.ts
+++ b/local/test/cron-route-contract.test.ts
@@ -5,6 +5,14 @@ import { refreshRuleIndex } from "@local/lib/rule-catalog";
 import * as updateSubscriptionsRoute from "../app/api/cron/update-subscriptions/route";
 import * as updateRuleIndexRoute from "../app/api/cron/update-rule-index/route";
 
+const leaseMocks = vi.hoisted(() => ({
+  acquire: vi.fn(),
+  assertOwned: vi.fn(),
+  release: vi.fn(),
+  stop: vi.fn(),
+  JobLeaseLostError: class JobLeaseLostError extends Error {},
+}));
+
 vi.mock("@local/lib/auto-update-service", () => ({
   runLocalSubscriptionAutoUpdateCron: vi.fn(),
 }));
@@ -13,6 +21,16 @@ vi.mock("@local/lib/rule-catalog", () => ({
   refreshRuleIndex: vi.fn(),
 }));
 
+vi.mock("@local/lib/job-lease", () => ({
+  acquireLocalJobLease: leaseMocks.acquire,
+  releaseLocalJobLease: leaseMocks.release,
+  startLocalJobLeaseHeartbeat: vi.fn(() => ({
+    assertOwned: leaseMocks.assertOwned,
+    stop: leaseMocks.stop,
+  })),
+  JobLeaseLostError: leaseMocks.JobLeaseLostError,
+}));
+
 function cronRequest(secret?: string): Request {
   return new Request("http://local.test/api/cron/update-subscriptions", {
     method: "POST",
@@ -35,6 +53,14 @@ beforeEach(() => {
   vi.clearAllMocks();
   vi.stubEnv("NODE_ENV", "production");
   vi.stubEnv("CRON_SECRET", "secret-1");
+  leaseMocks.acquire.mockResolvedValue({
+    name: "local-subscription-auto-update",
+    ownerToken: "owner",
+    expiresAt: new Date("2026-07-16T00:05:00.000Z"),
+  });
+  leaseMocks.assertOwned.mockResolvedValue(undefined);
+  leaseMocks.release.mockResolvedValue(undefined);
+  leaseMocks.stop.mockResolvedValue(undefined);
   vi.mocked(runLocalSubscriptionAutoUpdateCron).mockResolvedValue({
     results: { total: 0, updated: 0, skipped: 0, failed: 0, errors: [] },
     updatedSubscriptions: [],
@@ -62,7 +88,7 @@ describe("local cron routes", () => {
   it("rejects cron calls when CRON_SECRET is missing in production", async () => {
     vi.stubEnv("CRON_SECRET", "");
     const response = await updateSubscriptionsRoute.POST(cronRequest());
-    expect(response.status).toBe(500);
+    expect(response.status).toBe(503);
     expect(await readJson(response)).toEqual({
       error: "CRON_SECRET not configured.",
       code: "CONFIGURATION_ERROR",
@@ -108,6 +134,23 @@ describe("local cron routes", () => {
     expect((await readJson(response)).success).toBe(true);
   });
 
+  it("skips an overlapping run and fails closed after lease loss", async () => {
+    leaseMocks.acquire.mockResolvedValueOnce(null);
+    let response = await updateSubscriptionsRoute.POST(cronRequest("secret-1"));
+    expect(response.status).toBe(200);
+    expect(await readJson(response)).toMatchObject({ skipped: true, reason: "already_running" });
+    expect(runLocalSubscriptionAutoUpdateCron).not.toHaveBeenCalled();
+
+    vi.mocked(runLocalSubscriptionAutoUpdateCron).mockRejectedValueOnce(new leaseMocks.JobLeaseLostError());
+    response = await updateSubscriptionsRoute.POST(cronRequest("secret-1"));
+    expect(response.status).toBe(503);
+    expect(await readJson(response)).toEqual({
+      error: "Local subscription update lease lost.",
+      code: "JOB_LEASE_LOST",
+    });
+    expect(leaseMocks.release).toHaveBeenCalled();
+  });
+
   it("runs the rule index refresh cron when authorized", async () => {
     const response = await updateRuleIndexRoute.POST(
       new Request("http://local.test/api/cron/update-rule-index", {
@@ -120,4 +163,3 @@ describe("local cron routes", () => {
     expect((await readJson(response)).success).toBe(true);
   });
 });
-
diff --git a/local/test/source-import-guard.test.ts b/local/test/source-import-guard.test.ts
index 70860c7..dbdec80 100644
--- a/local/test/source-import-guard.test.ts
+++ b/local/test/source-import-guard.test.ts
@@ -1,4 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@local/lib/source-import-settings", () => ({
+  getAllowUnsafeSubscriptionSources: vi.fn(async () => false),
+}));
+
 import { importSourceUrlDirect } from "@local/lib/source-import";
 
 beforeEach(() => {
@@ -19,4 +24,3 @@ describe("local source import network guard", () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 });
-
diff --git a/local/test/source-import-route-contract.test.ts b/local/test/source-import-route-contract.test.ts
index 9045d18..5044298 100644
--- a/local/test/source-import-route-contract.test.ts
+++ b/local/test/source-import-route-contract.test.ts
@@ -80,6 +80,19 @@ describe("local source import route", () => {
     expect(importSourceUrlDirect).not.toHaveBeenCalled();
   });
 
+  it("rejects source import bodies above 64 KiB", async () => {
+    const response = await route.POST(new Request("http://local.test/api/source-import", {
+      method: "POST",
+      headers: { "content-length": String(64 * 1024 + 1) },
+      body: "{}",
+    }));
+    expect(response.status).toBe(413);
+    await expect(response.json()).resolves.toEqual({
+      error: "Request body is too large.",
+      code: "PAYLOAD_TOO_LARGE",
+    });
+  });
+
   it("normalizes optional userinfo fields and forwards import errors", async () => {
     let response = await route.POST(jsonRequest({
       url: " https://example.com/sub.yaml ",
diff --git a/local/test/subscription-route-contract.test.ts b/local/test/subscription-route-contract.test.ts
index 0ef551e..cd9edb3 100644
--- a/local/test/subscription-route-contract.test.ts
+++ b/local/test/subscription-route-contract.test.ts
@@ -125,6 +125,20 @@ describe("local subscription routes", () => {
     expect(createSubscription).toHaveBeenCalledWith("admin-1", fullConfigPayload);
   });
 
+  it("rejects subscription bodies above 16 MiB", async () => {
+    const response = await pluralCollectionRoute.POST(new Request("http://local.test/api/subscriptions", {
+      method: "POST",
+      headers: { "content-length": String(16 * 1024 * 1024 + 1) },
+      body: "{}",
+    }));
+    expect(response.status).toBe(413);
+    await expect(response.json()).resolves.toEqual({
+      error: "Request body is too large.",
+      code: "PAYLOAD_TOO_LARGE",
+    });
+    expect(createSubscription).not.toHaveBeenCalled();
+  });
+
   it("uses plural item and refresh routes with path ids", async () => {
     const params = { params: Promise.resolve({ id: "sub-1" }) };
 
diff --git a/local/test/template-route-contract.test.ts b/local/test/template-route-contract.test.ts
index 38d5477..815c7c8 100644
--- a/local/test/template-route-contract.test.ts
+++ b/local/test/template-route-contract.test.ts
@@ -94,6 +94,19 @@ describe("local template routes", () => {
     expect(deleteTemplate).toHaveBeenCalledWith("admin-1", "tpl-1");
   });
 
+  it("rejects template bodies above 4 MiB", async () => {
+    const response = await collectionRoute.POST(new Request("http://local.test/api/templates", {
+      method: "POST",
+      headers: { "content-length": String(4 * 1024 * 1024 + 1) },
+      body: "{}",
+    }));
+    expect(response.status).toBe(413);
+    await expect(response.json()).resolves.toEqual({
+      error: "Request body is too large.",
+      code: "PAYLOAD_TOO_LARGE",
+    });
+  });
+
   it("reports local template collection errors", async () => {
     vi.mocked(listTemplates).mockRejectedValueOnce(new Error("Bad filters"));
     let response = await collectionRoute.GET(new Request("http://local.test/api/templates?type=default"));
diff --git a/package-lock.json b/package-lock.json
index b2793aa..645671f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,9 +13,8 @@
         "local"
       ],
       "dependencies": {
-        "@prisma/adapter-pg": "^7.8.0",
-        "@prisma/client": "^7.8.0",
-        "@radix-ui/react-accordion": "^1.2.0",
+        "@prisma/adapter-pg": "^7.9.0",
+        "@prisma/client": "^7.9.0",
         "@radix-ui/react-avatar": "^1.1.0",
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -23,7 +22,6 @@
         "@radix-ui/react-popover": "^1.1.0",
         "@radix-ui/react-scroll-area": "^1.2.0",
         "@radix-ui/react-select": "^2.1.0",
-        "@radix-ui/react-separator": "^1.1.0",
         "@radix-ui/react-slot": "^1.1.0",
         "@radix-ui/react-switch": "^1.1.0",
         "@radix-ui/react-tabs": "^1.1.0",
@@ -37,9 +35,9 @@
         "clsx": "^2.1.0",
         "dotenv": "^17.4.2",
         "jose": "^6.2.3",
-        "js-yaml": "^4.2.0",
+        "js-yaml": "^4.3.0",
         "lucide-react": "^1.17.0",
-        "next": "^16.2.7",
+        "next": "^16.2.12",
         "peggy": "^5.1.0",
         "react": "^19.2.7",
         "react-dom": "^19.2.7",
@@ -54,9 +52,9 @@
         "@types/react": "^19.2.16",
         "@types/react-dom": "^19.2.3",
         "eslint": "^9.39.4",
-        "eslint-config-next": "^16.2.7",
-        "postcss": "8.5.15",
-        "prisma": "^7.8.0",
+        "eslint-config-next": "^16.2.12",
+        "postcss": "8.5.23",
+        "prisma": "^7.9.0",
         "tailwindcss": "^4.3.0",
         "typescript": "^6.0.3",
         "vitest": "^4.1.7"
@@ -70,9 +68,8 @@
       "version": "2.6.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "@prisma/adapter-pg": "^7.8.0",
-        "@prisma/client": "^7.8.0",
-        "@radix-ui/react-accordion": "^1.2.0",
+        "@prisma/adapter-pg": "^7.9.0",
+        "@prisma/client": "^7.9.0",
         "@radix-ui/react-avatar": "^1.1.0",
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -80,7 +77,6 @@
         "@radix-ui/react-popover": "^1.1.0",
         "@radix-ui/react-scroll-area": "^1.2.0",
         "@radix-ui/react-select": "^2.1.0",
-        "@radix-ui/react-separator": "^1.1.0",
         "@radix-ui/react-slot": "^1.1.0",
         "@radix-ui/react-switch": "^1.1.0",
         "@radix-ui/react-tabs": "^1.1.0",
@@ -94,10 +90,11 @@
         "clsx": "^2.1.0",
         "dotenv": "^17.4.2",
         "jose": "^6.2.3",
-        "js-yaml": "^4.2.0",
+        "js-yaml": "^4.3.0",
         "lucide-react": "^1.17.0",
-        "next": "^16.2.7",
+        "next": "^16.2.12",
         "peggy": "^5.1.0",
+        "prisma": "^7.9.0",
         "react": "^19.2.7",
         "react-dom": "^19.2.7",
         "react-remove-scroll-bar": "^2.3.8",
@@ -111,9 +108,8 @@
         "@types/react": "^19.2.16",
         "@types/react-dom": "^19.2.3",
         "eslint": "^9.39.4",
-        "eslint-config-next": "^16.2.7",
-        "postcss": "8.5.15",
-        "prisma": "^7.8.0",
+        "eslint-config-next": "^16.2.12",
+        "postcss": "8.5.23",
         "tailwindcss": "^4.3.0",
         "typescript": "^6.0.3"
       },
@@ -375,33 +371,30 @@
       }
     },
     "node_modules/@electric-sql/pglite": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite/-/pglite-0.4.1.tgz",
-      "integrity": "sha512-mZ9NzzUSYPOCnxHH1oAHPRzoMFJHY472raDKwXl/+6oPbpdJ7g8LsCN4FSaIIfkiCKHhb3iF/Zqo3NYxaIhU7Q==",
-      "devOptional": true,
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@electric-sql/pglite/-/pglite-0.4.3.tgz",
+      "integrity": "sha512-ichuWTgtd4mOM1G4SpyGJa5trT03lWbMypDV0fUXUCXg5hiHqVAz/bZyV68NqmkLB7WcYmj1RMJVSp8HV/v/ZQ==",
       "license": "Apache-2.0"
     },
     "node_modules/@electric-sql/pglite-socket": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-socket/-/pglite-socket-0.1.1.tgz",
-      "integrity": "sha512-p2hoXw3Z3LQHwTeikdZNsFBOvXGqKY2hk51BBw+8NKND8eoH+8LFOtW9Z8CQKmTJ2qqGYu82ipqiyFZOTTXNfw==",
-      "devOptional": true,
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-socket/-/pglite-socket-0.1.3.tgz",
+      "integrity": "sha512-LAciWM0M1dCL8hlsxu2venbVZcdxema0BtDfpWYVqr+Y468UADw0pFWidhKw1M8sfJ8rdLT71tjMmnirf/IZRQ==",
       "license": "Apache-2.0",
       "bin": {
         "pglite-server": "dist/scripts/server.js"
       },
       "peerDependencies": {
-        "@electric-sql/pglite": "0.4.1"
+        "@electric-sql/pglite": "0.4.3"
       }
     },
     "node_modules/@electric-sql/pglite-tools": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-tools/-/pglite-tools-0.3.1.tgz",
-      "integrity": "sha512-C+T3oivmy9bpQvSxVqXA1UDY8cB9Eb9vZHL9zxWwEUfDixbXv4G3r2LjoTdR33LD8aomR3O9ZXEO3XEwr/cUCA==",
-      "devOptional": true,
+      "version": "0.3.3",
+      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-tools/-/pglite-tools-0.3.3.tgz",
+      "integrity": "sha512-AlzLJTRJ8+UFgK8CmxIpyIpJ0+YaFw02IiOSdYrqxwPXdSyeIShz8aa9Tq+tYFXdPwcaMp/Fc80mQZ1dkOQ/wg==",
       "license": "Apache-2.0",
       "peerDependencies": {
-        "@electric-sql/pglite": "0.4.1"
+        "@electric-sql/pglite": "0.4.3"
       }
     },
     "node_modules/@emnapi/core": {
@@ -420,6 +413,7 @@
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
       "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -619,19 +613,6 @@
       "integrity": "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==",
       "license": "MIT"
     },
-    "node_modules/@hono/node-server": {
-      "version": "1.19.13",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.13.tgz",
-      "integrity": "sha512-TsQLe4i2gvoTtrHje625ngThGBySOgSK3Xo2XRYOdqGN1teR8+I7vchQC46uLJi8OF62YTYA3AhSpumtkhsaKQ==",
-      "devOptional": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.14.1"
-      },
-      "peerDependencies": {
-        "hono": "^4"
-      }
-    },
     "node_modules/@humanfs/core": {
       "version": "0.19.2",
       "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
@@ -709,9 +690,9 @@
       }
     },
     "node_modules/@img/sharp-darwin-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.5.tgz",
-      "integrity": "sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.3.tgz",
+      "integrity": "sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg==",
       "cpu": [
         "arm64"
       ],
@@ -721,19 +702,19 @@
         "darwin"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-arm64": "1.2.4"
+        "@img/sharp-libvips-darwin-arm64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-darwin-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.5.tgz",
-      "integrity": "sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.3.tgz",
+      "integrity": "sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w==",
       "cpu": [
         "x64"
       ],
@@ -743,19 +724,38 @@
         "darwin"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-x64": "1.2.4"
+        "@img/sharp-libvips-darwin-x64": "1.3.2"
+      }
+    },
+    "node_modules/@img/sharp-freebsd-wasm32": {
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.3.tgz",
+      "integrity": "sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "dependencies": {
+        "@img/sharp-wasm32": "0.35.3"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-libvips-darwin-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.4.tgz",
-      "integrity": "sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.2.tgz",
+      "integrity": "sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg==",
       "cpu": [
         "arm64"
       ],
@@ -769,9 +769,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-darwin-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.4.tgz",
-      "integrity": "sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.2.tgz",
+      "integrity": "sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw==",
       "cpu": [
         "x64"
       ],
@@ -785,9 +785,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.4.tgz",
-      "integrity": "sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.2.tgz",
+      "integrity": "sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ==",
       "cpu": [
         "arm"
       ],
@@ -801,9 +801,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.4.tgz",
-      "integrity": "sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.2.tgz",
+      "integrity": "sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA==",
       "cpu": [
         "arm64"
       ],
@@ -817,9 +817,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-ppc64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.2.4.tgz",
-      "integrity": "sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.2.tgz",
+      "integrity": "sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw==",
       "cpu": [
         "ppc64"
       ],
@@ -833,9 +833,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-riscv64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.2.4.tgz",
-      "integrity": "sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.2.tgz",
+      "integrity": "sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w==",
       "cpu": [
         "riscv64"
       ],
@@ -849,9 +849,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-s390x": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.2.4.tgz",
-      "integrity": "sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.2.tgz",
+      "integrity": "sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ==",
       "cpu": [
         "s390x"
       ],
@@ -865,9 +865,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.2.4.tgz",
-      "integrity": "sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.2.tgz",
+      "integrity": "sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w==",
       "cpu": [
         "x64"
       ],
@@ -881,9 +881,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.2.4.tgz",
-      "integrity": "sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.2.tgz",
+      "integrity": "sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw==",
       "cpu": [
         "arm64"
       ],
@@ -897,9 +897,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.4.tgz",
-      "integrity": "sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.2.tgz",
+      "integrity": "sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ==",
       "cpu": [
         "x64"
       ],
@@ -913,9 +913,9 @@
       }
     },
     "node_modules/@img/sharp-linux-arm": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.5.tgz",
-      "integrity": "sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.3.tgz",
+      "integrity": "sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA==",
       "cpu": [
         "arm"
       ],
@@ -925,19 +925,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm": "1.2.4"
+        "@img/sharp-libvips-linux-arm": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.5.tgz",
-      "integrity": "sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.3.tgz",
+      "integrity": "sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ==",
       "cpu": [
         "arm64"
       ],
@@ -947,19 +947,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm64": "1.2.4"
+        "@img/sharp-libvips-linux-arm64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-ppc64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.34.5.tgz",
-      "integrity": "sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.3.tgz",
+      "integrity": "sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA==",
       "cpu": [
         "ppc64"
       ],
@@ -969,19 +969,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-ppc64": "1.2.4"
+        "@img/sharp-libvips-linux-ppc64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-riscv64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.34.5.tgz",
-      "integrity": "sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.3.tgz",
+      "integrity": "sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ==",
       "cpu": [
         "riscv64"
       ],
@@ -991,19 +991,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-riscv64": "1.2.4"
+        "@img/sharp-libvips-linux-riscv64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-s390x": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.5.tgz",
-      "integrity": "sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.3.tgz",
+      "integrity": "sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw==",
       "cpu": [
         "s390x"
       ],
@@ -1013,19 +1013,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-s390x": "1.2.4"
+        "@img/sharp-libvips-linux-s390x": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.5.tgz",
-      "integrity": "sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.3.tgz",
+      "integrity": "sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA==",
       "cpu": [
         "x64"
       ],
@@ -1035,19 +1035,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-x64": "1.2.4"
+        "@img/sharp-libvips-linux-x64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linuxmusl-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.5.tgz",
-      "integrity": "sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.3.tgz",
+      "integrity": "sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w==",
       "cpu": [
         "arm64"
       ],
@@ -1057,19 +1057,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4"
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linuxmusl-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.5.tgz",
-      "integrity": "sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.3.tgz",
+      "integrity": "sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg==",
       "cpu": [
         "x64"
       ],
@@ -1079,38 +1079,64 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-x64": "1.2.4"
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-wasm32": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.34.5.tgz",
-      "integrity": "sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.3.tgz",
+      "integrity": "sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w==",
+      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/runtime": "^1.11.1"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-wasm32/node_modules/@emnapi/runtime": {
+      "version": "1.11.3",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.3.tgz",
+      "integrity": "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@img/sharp-webcontainers-wasm32": {
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.3.tgz",
+      "integrity": "sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q==",
       "cpu": [
         "wasm32"
       ],
-      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@emnapi/runtime": "^1.7.0"
+        "@img/sharp-wasm32": "0.35.3"
       },
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-win32-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.5.tgz",
-      "integrity": "sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.3.tgz",
+      "integrity": "sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w==",
       "cpu": [
         "arm64"
       ],
@@ -1120,16 +1146,16 @@
         "win32"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-win32-ia32": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.5.tgz",
-      "integrity": "sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.3.tgz",
+      "integrity": "sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw==",
       "cpu": [
         "ia32"
       ],
@@ -1139,16 +1165,16 @@
         "win32"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": "^20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-win32-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.5.tgz",
-      "integrity": "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.3.tgz",
+      "integrity": "sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA==",
       "cpu": [
         "x64"
       ],
@@ -1158,7 +1184,7 @@
         "win32"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
@@ -1214,13 +1240,6 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
-    "node_modules/@kurkle/color": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@kurkle/color/-/color-0.3.4.tgz",
-      "integrity": "sha512-M5UknZPHRu3DEDWoipU6sE8PdkZ6Z/S+v4dD+Ke8IaNlpdSQah50lz1KtcFBa2vsdOnwbbnxJwVM4wty6udA5w==",
-      "devOptional": true,
-      "license": "MIT"
-    },
     "node_modules/@napi-rs/wasm-runtime": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
@@ -1241,15 +1260,15 @@
       }
     },
     "node_modules/@next/env": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.7.tgz",
-      "integrity": "sha512-tMJizPlj6ZYpBMMdK8S0LJufrP4QTdR6pcv9KQ/bVETPAmg0j1mlHE9G2c38UyGHxoBapgwuj7XjbGJ2RcDFOg==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.12.tgz",
+      "integrity": "sha512-d0Z5Bc13Fa4nR8pFAKx2jay2yhJM16vlfHbTzYnUQAxlNb6B6lmn4hjt69lYNt4kRtyYP6gEM49lPRHNbIyneg==",
       "license": "MIT"
     },
     "node_modules/@next/eslint-plugin-next": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.2.7.tgz",
-      "integrity": "sha512-VbS+QgMHqvIDMTIqD2xMBKK1otIpdAUKA8VLHFwR9h6OfU/mOm7w/69nQcvdmI8hCk99Wr2AsGLn/PJ/tMHw1w==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.2.12.tgz",
+      "integrity": "sha512-uF2z/qAK2q7B5/6CpnFcBRX6jOq5iCO+Uqh1UkJhXljX1JwLarLYhhoJadO6dPb6moTprOKewMXheBcbIoSbug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1257,9 +1276,9 @@
       }
     },
     "node_modules/@next/swc-darwin-arm64": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.7.tgz",
-      "integrity": "sha512-vm1EDI/pVaBNNiychmxk3fft+OhQPVD9cIM/tReLZIQ3TfQ4kqI9DwKk00dzuS1ulC7icbrzCFrmRRlk9PfNdw==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.12.tgz",
+      "integrity": "sha512-0W1R0teHWJrqKX0FH20IzzIWAOuGtBxPGuObrxy1lE8hQvCFj49KE8a3WUg0D7sq6rn6zkM4c7YGUnhudBS6oA==",
       "cpu": [
         "arm64"
       ],
@@ -1273,9 +1292,9 @@
       }
     },
     "node_modules/@next/swc-darwin-x64": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.7.tgz",
-      "integrity": "sha512-O3IRSv1ZBL1zs0WrIgefTEcTKFVn+ryxBNe54erJ6KsD+2f/Mmt7g2jOYh8PSBdUwPtKQJuCsTMlZ7tIu2AcsQ==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.12.tgz",
+      "integrity": "sha512-Hy5Ls099+aFUmOLmIgPfLqNi6iCwhL3uQCssz5rWk+5Nkc6TUKCE83DY5BbNylfm3+mfwcSFnLRfrZDJhVxdtw==",
       "cpu": [
         "x64"
       ],
@@ -1289,9 +1308,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.7.tgz",
-      "integrity": "sha512-Re6PZtjBDd0aMU+VcZcC/PrIvj4WhrjDYtMhhCVQamWN4L90EVP0pcEOBQD25prSlw7OzNw5QpHLWMilRLsRNw==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.12.tgz",
+      "integrity": "sha512-+YqU2h1cQkHsGfvjAsrSmst8UIFBibBGm5x3Xgel8NLMiDQtNOM4sM2GOEMvG5YiOBNeN/Ykk8cQC2S0Xrqljg==",
       "cpu": [
         "arm64"
       ],
@@ -1305,9 +1324,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.7.tgz",
-      "integrity": "sha512-qyogG9QtBzWxgJfeGBvOEHI3851gTfCF3wLZ5RDLTBJGAmE9p1qDwKCOdrBrvBzRvYDT+gUDp72pzlSEfAXgNA==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.12.tgz",
+      "integrity": "sha512-0qjhiYBaKAqF63LA1ZWAAnKTzFUguAaZiRa5etMLGGPj/B6uEVjtIZldIzFEp3wHlB0koK6aTzqPtSdplTCjoA==",
       "cpu": [
         "arm64"
       ],
@@ -1321,9 +1340,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.7.tgz",
-      "integrity": "sha512-Vhe4ZDuBpmMogrGi5D4R2Kq4JAQlj6+wvgaFYy31zfES0zPmt6TLA+cuYpM/OLrPZjo2MYQTHVqNUSCR6+fDZQ==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.12.tgz",
+      "integrity": "sha512-7A3q26W+h7gnA15uqBToNuDqBEFZZcqh0mW2mn4AJh/G5pdg2RVE3n4slzLEliASZFG3NmsbEzng/x2Sh09mBg==",
       "cpu": [
         "x64"
       ],
@@ -1337,9 +1356,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-musl": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.7.tgz",
-      "integrity": "sha512-srvian89JahFLw1YLBEuhvPJ0DO5lpUeJQMXy4xYo7g628ZlNgXdNkqoxSAv9OYrBfByh6vxISMwW/mRbzCY+g==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.12.tgz",
+      "integrity": "sha512-qSjL/uppm+cbh21s72Ss8gkiOhQ4dExWHNGOWy6eZV7STj5WsKehgxT61beSsOj+YYQuTplL376lOCdMQU5T8w==",
       "cpu": [
         "x64"
       ],
@@ -1353,9 +1372,9 @@
       }
     },
     "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.7.tgz",
-      "integrity": "sha512-GX3wvLpULFuRFJzwHaKfm7QZJ18F4ZSuxlPJ96BoBglCzBmdSjyeBKF+ZhWhvL/ckxNfLnNa7bsObO2ipYpszw==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.12.tgz",
+      "integrity": "sha512-X6hzsOUJac/e7AWSbn9gQ9nzHld1xWP5iyjHpYWvud8pufB679O1xg4JDyKr8Xd69Jvd+kM2Der6uftiZCmjYA==",
       "cpu": [
         "arm64"
       ],
@@ -1369,9 +1388,9 @@
       }
     },
     "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.7.tgz",
-      "integrity": "sha512-J4WlM72NMk076Qsg0jTdK3SNXatlSdnjW7L7oNGLst1tAGjHrJh/FYi+pw9wyIjEtGRKDNzD0zuiY16oWYWVaw==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.12.tgz",
+      "integrity": "sha512-F6fakeHuFTLOPt0bslQJdf+xtT+WIP9DVn/m4y1w1mRnVPyh3D/cNvzlRkxM444xfm+IvvYNSOrKiA2CDJ0Uxw==",
       "cpu": [
         "x64"
       ],
@@ -1467,24 +1486,24 @@
       }
     },
     "node_modules/@prisma/adapter-pg": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/adapter-pg/-/adapter-pg-7.8.0.tgz",
-      "integrity": "sha512-ygb3UkerK3v8MDpXVgCISdRNDozpxh6+JVJgiIGbSr5KBgz10LLf5ejUskPGoXlsIjxsOu6nuy1JVQr2EKGSlg==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/adapter-pg/-/adapter-pg-7.9.0.tgz",
+      "integrity": "sha512-kPYuFvNTlqnaFf2UpXBBG3ycTT3PL76uSZtLFBEwDytjMMUW8ZHrsb9cSNIarzdPW5EXWmBOeOq9/MVjMtbWkA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/driver-adapter-utils": "7.8.0",
+        "@prisma/driver-adapter-utils": "7.9.0",
         "@types/pg": "^8.16.0",
         "pg": "^8.16.3",
         "postgres-array": "3.0.4"
       }
     },
     "node_modules/@prisma/client": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/client/-/client-7.8.0.tgz",
-      "integrity": "sha512-HFp3Dawv/3sU3JtlPha90IB+48lS7zHiH4LKZPjmcE8YH5P9DOXGPvo8dqOtO7MqLDd1p2hOWMcFlRT1DMblHw==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/client/-/client-7.9.0.tgz",
+      "integrity": "sha512-BTG/mB+WL/1sD2gWwdNc2uuVJjNNBgCDlPFdjco6jJArgbg4IAChtzVeW4debFa/NKBbsGedCjET316sjllWTQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/client-runtime-utils": "7.8.0"
+        "@prisma/client-runtime-utils": "7.9.0"
       },
       "engines": {
         "node": "^20.19 || ^22.12 || >=24.0"
@@ -1503,16 +1522,15 @@
       }
     },
     "node_modules/@prisma/client-runtime-utils": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/client-runtime-utils/-/client-runtime-utils-7.8.0.tgz",
-      "integrity": "sha512-5NQZztQ0oY/ADFkmd9gPuweH5A1/CCY8YQPorLLO0Mu6a87mY5gsnDkzmFmIHs9NFaLnZojzgddFVN4RpKYrdw==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/client-runtime-utils/-/client-runtime-utils-7.9.0.tgz",
+      "integrity": "sha512-kMVmS4ZEy3xlkca+TfxOEm/ToVVlOS2x1Tc6/wIRf/HfczBqENtSPcKszy4ZpFNzjJ8SRKvlU5V0rrpoFw2KOg==",
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/config": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/config/-/config-7.8.0.tgz",
-      "integrity": "sha512-HFESzd9rx2ZQxlK+TL7tu1HPvCqrHiL6LCxYykI2c34mvaUuIVVl3lYuicJD/MNnzgPnyeBEMlK4WTomJCV5jw==",
-      "devOptional": true,
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/config/-/config-7.9.0.tgz",
+      "integrity": "sha512-CsoK2mhl0u+N4/8V+XroQMOUNIic4isqD+E2HBG8l1yGEKo62CFDu3FHo0FdwItjl6XkW+omA1STSzeN1DAXlg==",
       "license": "Apache-2.0",
       "dependencies": {
         "c12": "3.3.4",
@@ -1522,29 +1540,26 @@
       }
     },
     "node_modules/@prisma/debug": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.8.0.tgz",
-      "integrity": "sha512-p+QZReysDUqXC+mk17q9a+Y/qzh4c2KYliDK30buYUyfrGeTGSyfmc0AIrJRhZJrLHhRiJa9Au/J72h3C+szvA==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.9.0.tgz",
+      "integrity": "sha512-i0KdVQuKUE6N9NloHs+sUNAk2c9svR3myBndQbA3BoeoArsSpwtNgTdHZL+wBtCLCcdS2OOC/PKhgTe36jkF5A==",
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/dev": {
-      "version": "0.24.3",
-      "resolved": "https://registry.npmjs.org/@prisma/dev/-/dev-0.24.3.tgz",
-      "integrity": "sha512-ffHlQuKXZiaDt9Go0OnCTdJZrHxK0k7omJKNV86/VjpsXu5EIHZLK0T7JSWgvNlJwh56kW9JFu9v0qJciFzepg==",
-      "devOptional": true,
+      "version": "0.24.14",
+      "resolved": "https://registry.npmjs.org/@prisma/dev/-/dev-0.24.14.tgz",
+      "integrity": "sha512-NhFO49O2JPTdzYiLHvceQn/HiwmcKF/iGV39ko3CpYsoGqS3rz3ko6gzuxFSIeHNwNJeuNcDexyyGeTO3DW80A==",
       "license": "ISC",
       "dependencies": {
-        "@electric-sql/pglite": "0.4.1",
-        "@electric-sql/pglite-socket": "0.1.1",
-        "@electric-sql/pglite-tools": "0.3.1",
-        "@hono/node-server": "1.19.11",
+        "@electric-sql/pglite": "0.4.3",
+        "@electric-sql/pglite-socket": "0.1.3",
+        "@electric-sql/pglite-tools": "0.3.3",
         "@prisma/get-platform": "7.2.0",
         "@prisma/query-plan-executor": "7.2.0",
-        "@prisma/streams-local": "0.1.2",
+        "@prisma/streams-local": "0.1.11",
+        "find-my-way": "9.6.0",
         "foreground-child": "3.3.1",
         "get-port-please": "3.2.0",
-        "hono": "^4.12.8",
-        "http-status-codes": "2.3.0",
         "pathe": "2.0.3",
         "proper-lockfile": "4.1.2",
         "remeda": "2.33.4",
@@ -1554,72 +1569,66 @@
       }
     },
     "node_modules/@prisma/driver-adapter-utils": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/driver-adapter-utils/-/driver-adapter-utils-7.8.0.tgz",
-      "integrity": "sha512-/Q13o0ZT0rjc1Xk0Q9KhZYwuq2EW/vSbWUBKfgEKkaCuB/Sg6bqnjmTZqC5cD4d6y1vfFAEwBRzfzoSMIVJ55A==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/driver-adapter-utils/-/driver-adapter-utils-7.9.0.tgz",
+      "integrity": "sha512-fFXujitfMyjk3kOd1Tbs5FXBm6i2OWwEhaP5lHgkUM99jHpPEQwCWj+z/WKPFq6EDMThE1zGzSlVegtR0Pmu2w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "7.8.0"
+        "@prisma/debug": "7.9.0"
       }
     },
     "node_modules/@prisma/engines": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-7.8.0.tgz",
-      "integrity": "sha512-jx3rCnNNrt5uzbkKlegtQ2GZHxSlihMCzutgT/BP6UIDF1r9tDI39hV/0T/cHZgzJ3ELbuQPXlVZy+Y1n0pcgw==",
-      "devOptional": true,
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-7.9.0.tgz",
+      "integrity": "sha512-lDWJp/pgSWCLfYsupmmNo96jfsbQnH1yjia8XVM2Kh8nRZhD0bQU2jCHuy3ZTPMLR3apRD3k145ybENalAYjYw==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "7.8.0",
-        "@prisma/engines-version": "7.8.0-6.3c6e192761c0362d496ed980de936e2f3cebcd3a",
-        "@prisma/fetch-engine": "7.8.0",
-        "@prisma/get-platform": "7.8.0"
+        "@prisma/debug": "7.9.0",
+        "@prisma/engines-version": "7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad",
+        "@prisma/fetch-engine": "7.9.0",
+        "@prisma/get-platform": "7.9.0"
       }
     },
     "node_modules/@prisma/engines-version": {
-      "version": "7.8.0-6.3c6e192761c0362d496ed980de936e2f3cebcd3a",
-      "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-7.8.0-6.3c6e192761c0362d496ed980de936e2f3cebcd3a.tgz",
-      "integrity": "sha512-fJPQxCkLgA5EayWaW8eArgCvjJ+N+Kz3VyeNKMEeYiQC4alNkxRKFVAGxv/ZUzuJISKqdw+zGeDbS6mn6RCPOA==",
-      "devOptional": true,
+      "version": "7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad",
+      "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad.tgz",
+      "integrity": "sha512-2BsPPFksz3CQUXG6af3rVCtJKg6+JJGJTtfgu2fU8DdXhOfkBjulCq8mwybCd6ge0/jhZq2kOtLAbmUDMyI1nA==",
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/engines/node_modules/@prisma/get-platform": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.8.0.tgz",
-      "integrity": "sha512-WlxgRGnolL8VH2EmkH1R/DkKNr/mVdS3G2h42IZFFZ3eUrH9OT6t73kIOSlkkrv50wG123Iq8d96ufv5LlZktw==",
-      "devOptional": true,
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.9.0.tgz",
+      "integrity": "sha512-4awv6ATdgrHdLms0XKikCyfArn8BrUHZfqg0mtCKrI4+WJe24nmpsdwsypM9ozd03wa846AngY+zSbnngkMrXQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "7.8.0"
+        "@prisma/debug": "7.9.0"
       }
     },
     "node_modules/@prisma/fetch-engine": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-7.8.0.tgz",
-      "integrity": "sha512-gwB0Euiz/DDRyxFRpLXYlK3RfaZUj1c5dAYMuhZYfApg7arknJlcb9bIsOHDppJmbqYaVA+yBIiFMDBfprsNPQ==",
-      "devOptional": true,
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-7.9.0.tgz",
+      "integrity": "sha512-F0XlIgjbE3EywRVR/HpCerNI/dxo40vK66tHcWpsWYwH/Jk9+FsICEzATeMsZ7bdnpZz93hkD4sAb5rKLsCCpA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "7.8.0",
-        "@prisma/engines-version": "7.8.0-6.3c6e192761c0362d496ed980de936e2f3cebcd3a",
-        "@prisma/get-platform": "7.8.0"
+        "@prisma/debug": "7.9.0",
+        "@prisma/engines-version": "7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad",
+        "@prisma/get-platform": "7.9.0"
       }
     },
     "node_modules/@prisma/fetch-engine/node_modules/@prisma/get-platform": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.8.0.tgz",
-      "integrity": "sha512-WlxgRGnolL8VH2EmkH1R/DkKNr/mVdS3G2h42IZFFZ3eUrH9OT6t73kIOSlkkrv50wG123Iq8d96ufv5LlZktw==",
-      "devOptional": true,
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.9.0.tgz",
+      "integrity": "sha512-4awv6ATdgrHdLms0XKikCyfArn8BrUHZfqg0mtCKrI4+WJe24nmpsdwsypM9ozd03wa846AngY+zSbnngkMrXQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "7.8.0"
+        "@prisma/debug": "7.9.0"
       }
     },
     "node_modules/@prisma/get-platform": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.2.0.tgz",
       "integrity": "sha512-k1V0l0Td1732EHpAfi2eySTezyllok9dXb6UQanajkJQzPUGi3vO2z7jdkz67SypFTdmbnyGYxvEvYZdZsMAVA==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@prisma/debug": "7.2.0"
@@ -1629,21 +1638,18 @@
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.2.0.tgz",
       "integrity": "sha512-YSGTiSlBAVJPzX4ONZmMotL+ozJwQjRmZweQNIq/ER0tQJKJynNkRB3kyvt37eOfsbMCXk3gnLF6J9OJ4QWftw==",
-      "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/query-plan-executor": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/@prisma/query-plan-executor/-/query-plan-executor-7.2.0.tgz",
       "integrity": "sha512-EOZmNzcV8uJ0mae3DhTsiHgoNCuu1J9mULQpGCh62zN3PxPTd+qI9tJvk5jOst8WHKQNwJWR3b39t0XvfBB0WQ==",
-      "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/streams-local": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/@prisma/streams-local/-/streams-local-0.1.2.tgz",
-      "integrity": "sha512-l49yTxKKF2odFxaAXTmwmkBKL3+bVQ1tFOooGifu4xkdb9NMNLxHj27XAhTylWZod8I+ISGM5erU1xcl/oBCtg==",
-      "devOptional": true,
+      "version": "0.1.11",
+      "resolved": "https://registry.npmjs.org/@prisma/streams-local/-/streams-local-0.1.11.tgz",
+      "integrity": "sha512-0TcebL559MByKqTJ+SsrFIEg228iw8UCVRFckzgfRSiJqczhs+MuAgWOF9lnOIV/IVqvu+KMnFTH0eDeTQMpUg==",
       "license": "Apache-2.0",
       "dependencies": {
         "ajv": "^8.12.0",
@@ -1652,7 +1658,7 @@
         "proper-lockfile": "^4.1.2"
       },
       "engines": {
-        "bun": ">=1.3.6",
+        "bun": ">=1.2.0",
         "node": ">=22.0.0"
       }
     },
@@ -1660,7 +1666,6 @@
       "version": "8.20.0",
       "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
       "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -1677,18 +1682,25 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
       "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@prisma/studio-core": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@prisma/studio-core/-/studio-core-0.27.3.tgz",
-      "integrity": "sha512-AADjNFPdsrglxHQVTmHFqv6DuKQZ5WY4p5/gVFY017twvNrSwpLJ9lqUbYYxEu2W7nbvVxTZA8deJ8LseNALsw==",
-      "devOptional": true,
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@prisma/studio-core/-/studio-core-0.33.0.tgz",
+      "integrity": "sha512-V2fX/nKEymNTrHXwfP26PGjoLStO35Ogu+ex7CFJbLrMYEcZxxZpiSNOs7px23Hk5mzLWvM5RsqG6Ka+rha+wg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@radix-ui/react-toggle": "1.1.10",
-        "chart.js": "4.5.1"
+        "@visx/curve": "4.0.1-alpha.0",
+        "@visx/event": "4.0.1-alpha.0",
+        "@visx/grid": "4.0.1-alpha.0",
+        "@visx/group": "4.0.1-alpha.0",
+        "@visx/responsive": "4.0.1-alpha.0",
+        "@visx/scale": "4.0.1-alpha.0",
+        "@visx/shape": "4.0.1-alpha.0",
+        "d3-array": "3.2.4",
+        "d3-shape": "3.2.0",
+        "elkjs": "0.11.1"
       },
       "engines": {
         "node": "^20.19 || ^22.12 || >=24.0",
@@ -1712,37 +1724,6 @@
       "integrity": "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==",
       "license": "MIT"
     },
-    "node_modules/@radix-ui/react-accordion": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-accordion/-/react-accordion-1.2.12.tgz",
-      "integrity": "sha512-T4nygeh9YE9dLRPhAHSeOZi7HBXo+0kYIPJXayZfvWOWA0+n3dESrZbjfDPUABkUNym6Hd+f2IR113To8D2GPA==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.3",
-        "@radix-ui/react-collapsible": "1.1.12",
-        "@radix-ui/react-collection": "1.1.7",
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-context": "1.1.2",
-        "@radix-ui/react-direction": "1.1.1",
-        "@radix-ui/react-id": "1.1.1",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-controllable-state": "1.2.2"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@radix-ui/react-arrow": {
       "version": "1.1.7",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.7.tgz",
@@ -1831,36 +1812,6 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-collapsible": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-collapsible/-/react-collapsible-1.1.12.tgz",
-      "integrity": "sha512-Uu+mSh4agx2ib1uIGPP4/CKNULyajb3p92LsVXmH2EHVMTfZWpll88XJ0j4W0z3f8NK1eYl1+Mf/szHPmcHzyA==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.3",
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-context": "1.1.2",
-        "@radix-ui/react-id": "1.1.1",
-        "@radix-ui/react-presence": "1.1.5",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-controllable-state": "1.2.2",
-        "@radix-ui/react-use-layout-effect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@radix-ui/react-collection": {
       "version": "1.1.7",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.7.tgz",
@@ -2521,52 +2472,6 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-separator": {
-      "version": "1.1.8",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-separator/-/react-separator-1.1.8.tgz",
-      "integrity": "sha512-sDvqVY4itsKwwSMEe0jtKgfTh+72Sy3gPmQpjqcQneqQ4PFmr/1I0YA+2/puilhggCe2gJcx5EBAYFkWkdpa5g==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-primitive": "2.1.4"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-separator/node_modules/@radix-ui/react-primitive": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.4.tgz",
-      "integrity": "sha512-9hQc4+GNVtJAIEPEqlYqW5RiYdrr8ea5XQ0ZOnD6fgru+83kqT15mq2OCcbe8KnjRZl5vF3ks69AKz3kh1jrhg==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-slot": "1.2.4"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@radix-ui/react-slot": {
       "version": "1.2.4",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.2.4.tgz",
@@ -2682,7 +2587,6 @@
       "version": "1.1.10",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-toggle/-/react-toggle-1.1.10.tgz",
       "integrity": "sha512-lS1odchhFTeZv3xwHH31YPObmJn8gOg7Lq12inrr0+BH/l3Tsq32VfjqH1oh80ARM3mlkfMic15n0kg4sD1poQ==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.3",
@@ -3162,7 +3066,6 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
       "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@subboost/config": {
@@ -3487,6 +3390,84 @@
         "assertion-error": "^2.0.1"
       }
     },
+    "node_modules/@types/d3-array": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.0.3.tgz",
+      "integrity": "sha512-Reoy+pKnvsksN0lQUlcH6dOGjRZ/3WRwXR//m+/8lt1BXeI4xyaUZoqULNjyXXRuh0Mj4LNpkCvhUpQlY3X5xQ==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-color": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.0.tgz",
+      "integrity": "sha512-HKuicPHJuvPgCD+np6Se9MQvS6OCbJmOjGvylzMJRlDwUXjKTTXs6Pwgk79O09Vj/ho3u1ofXnhFOaEWWPrlwA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-delaunay": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-delaunay/-/d3-delaunay-6.0.1.tgz",
+      "integrity": "sha512-tLxQ2sfT0p6sxdG75c6f/ekqxjyYR0+LwPrsO1mbC9YDBzPJhs2HbJJRrn8Ez1DBoHRo2yx7YEATI+8V1nGMnQ==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-format": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-format/-/d3-format-3.0.1.tgz",
+      "integrity": "sha512-5KY70ifCCzorkLuIkDe0Z9YTf9RR2CjBX1iaJG+rgM/cPP+sO+q9YdQ9WdhQcgPj1EQiJ2/0+yUkkziTG6Lubg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-geo": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-geo/-/d3-geo-3.1.0.tgz",
+      "integrity": "sha512-856sckF0oP/diXtS4jNsiQw/UuK5fQG8l/a9VVLeSouf1/PPbBE1i1W852zVwKwYCBkFJJB7nCFTbk6UMEXBOQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/geojson": "*"
+      }
+    },
+    "node_modules/@types/d3-interpolate": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
+      "integrity": "sha512-jx5leotSeac3jr0RePOH1KdR9rISG91QIE4Q2PYTu4OymLTZfA3SrnURSLzKH48HmXVUru50b8nje4E79oQSQw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-color": "*"
+      }
+    },
+    "node_modules/@types/d3-path": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.1.tgz",
+      "integrity": "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-scale": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha512-Yk4htunhPAwN0XGlIwArRomOjdoBFXC3+kCxK2Ubg7I9shQlVSJy/pG/Ht5ASN+gdMIalpk8TJ5xV74jFsetLA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-time": "*"
+      }
+    },
+    "node_modules/@types/d3-shape": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.1.7.tgz",
+      "integrity": "sha512-VLvUQ33C+3J+8p+Daf+nYSOsjB4GXp19/S/aGo60m9h1v6XaxjiT82lKVWJCfzhtuZ3yD7i/TPeC/fuKLLOSmg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-path": "*"
+      }
+    },
+    "node_modules/@types/d3-time": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.0.tgz",
+      "integrity": "sha512-sZLCdHvBUcNby1cB6Fd3ZBrABbjz3v1Vm90nysCQ6Vt7vd6e/h9Lt7SiJUoEX0l4Dzc7P5llKyhqSi1ycSf1Hg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-time-format": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-time-format/-/d3-time-format-2.1.0.tgz",
+      "integrity": "sha512-/myT3I7EwlukNOX2xVdMzb8FRgNzRMpsZddwst9Ld/VFe6LyJyRp0s32l/V9XoUzk+Gqu56F/oGk6507+8BxrA==",
+      "license": "MIT"
+    },
     "node_modules/@types/deep-eql": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
@@ -3501,6 +3482,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/geojson": {
+      "version": "7946.0.16",
+      "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.16.tgz",
+      "integrity": "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==",
+      "license": "MIT"
+    },
     "node_modules/@types/js-yaml": {
       "version": "4.0.9",
       "resolved": "https://registry.npmjs.org/@types/js-yaml/-/js-yaml-4.0.9.tgz",
@@ -3522,6 +3509,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/lodash": {
+      "version": "4.17.24",
+      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.24.tgz",
+      "integrity": "sha512-gIW7lQLZbue7lRSWEFql49QJJWThrTFFeIMJdp3eH4tKoxm1OvEPg02rm4wCCSHS0cL3/Fizimb35b7k8atwsQ==",
+      "license": "MIT"
+    },
     "node_modules/@types/node": {
       "version": "22.19.19",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.19.tgz",
@@ -3546,7 +3539,6 @@
       "version": "19.2.16",
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.16.tgz",
       "integrity": "sha512-esJiCAnl0kfpNdE69f3So4WJUXy95dLZydX0KwK46riIHDzHM7O9Vtf9xCHW0PXIqvgqNrswl522kA/5yx+F4w==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "csstype": "^3.2.2"
@@ -4156,19 +4148,160 @@
         "win32"
       ]
     },
-    "node_modules/@unrs/resolver-binding-win32-x64-msvc": {
-      "version": "1.12.2",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.12.2.tgz",
-      "integrity": "sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
+    "node_modules/@unrs/resolver-binding-win32-x64-msvc": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.12.2.tgz",
+      "integrity": "sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@visx/curve": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/curve/-/curve-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-jRu61Uz274pV1zyioXmboyrLutYbnKsgjj4njSGCnhdXj5GkZvZbg+ThDb6oOzoAnJOBRLz4rzPlWvNJOzuVMg==",
+      "license": "MIT",
+      "dependencies": {
+        "@visx/vendor": "4.0.0-alpha.0"
+      }
+    },
+    "node_modules/@visx/event": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/event/-/event-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-EQqCMSv/s8NbFjo+hz3FKsvvYfP+2QslsFJ/24/O5l/W+7UC6J6aAvO0ujVwrTwdYbuQ+vhxKi1xdPdKR/qj1g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/react": "*",
+        "@visx/point": "4.0.1-alpha.0"
+      }
+    },
+    "node_modules/@visx/grid": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/grid/-/grid-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-rycutGmTHO+znNdPumheWMglm7YfpffvRwUkVy5zy4WoORIuKTMkDxwnOzHG2xMxU3EE/YCd37xFV5AxA30yeg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/react": "*",
+        "@visx/curve": "4.0.1-alpha.0",
+        "@visx/group": "4.0.1-alpha.0",
+        "@visx/point": "4.0.1-alpha.0",
+        "@visx/scale": "4.0.1-alpha.0",
+        "@visx/shape": "4.0.1-alpha.0",
+        "classnames": "^2.3.1"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || ^17.0.0-0 || ^18.0.0-0 || ^19.0.0-0"
+      }
+    },
+    "node_modules/@visx/group": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/group/-/group-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-V19l7iQ7jccBv8kao/EByuI6o4xtxzzLV9nqVI1hRvmdzTVsuLpqlwzYCZUXJaTVvUWf8s4D2SQFjGkj/Nw+0w==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/react": "*",
+        "classnames": "^2.3.1"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || ^17.0.0-0 || ^18.0.0-0 || ^19.0.0-0"
+      }
+    },
+    "node_modules/@visx/point": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/point/-/point-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-ijTfr/Nx09f03vIj9nyTr3z4Xth4Y75427UaogJh6dnIRLMEFHQOwNu791sbfiNj0a+ZXuaE32h0vKrFe4/8Qg==",
+      "license": "MIT"
+    },
+    "node_modules/@visx/responsive": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/responsive/-/responsive-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-o+1zGywQZY0+yOx3Iw87wc4bbPJRr/HnIukTwfOz4UVyj9pB1OQNVHB7OORO1+LBHJceWpB31co/ZV9KHncKrA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/lodash": "^4.17.13",
+        "@types/react": "*",
+        "lodash": "^4.17.21"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || ^17.0.0-0 || ^18.0.0-0 || ^19.0.0-0"
+      }
+    },
+    "node_modules/@visx/scale": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/scale/-/scale-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-nzjeE87vFSAXGWFiiNfBpNLAf0Q8Qmf6syvKLjqNi4kGZkdhbUll3E/59YsgWXmjM8+llPLWzGsP+JPvo5eq1A==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
+      "dependencies": {
+        "@visx/vendor": "4.0.0-alpha.0"
+      }
+    },
+    "node_modules/@visx/shape": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/shape/-/shape-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-62QeiVNmPlterQGwhkEDcbq7M0MqY0lBsK5QKXtM9ZoPZWkuGV3aykA3+Xu20B2FAvyJq4LqJzBc7Sxr+EAdbA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/lodash": "^4.17.13",
+        "@types/react": "*",
+        "@visx/curve": "4.0.1-alpha.0",
+        "@visx/group": "4.0.1-alpha.0",
+        "@visx/scale": "4.0.1-alpha.0",
+        "@visx/vendor": "4.0.0-alpha.0",
+        "classnames": "^2.3.1",
+        "lodash": "^4.17.21"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || ^17.0.0-0 || ^18.0.0-0 || ^19.0.0-0"
+      }
+    },
+    "node_modules/@visx/vendor": {
+      "version": "4.0.0-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/vendor/-/vendor-4.0.0-alpha.0.tgz",
+      "integrity": "sha512-6I+MuqXBcv9jnlcVowHoHKSdk9gXTWkHLKyqBwRWg7LY6A3Ei8SHfubpqGV5rBUSppxMq2RszPJUS6w+H0YgmQ==",
+      "license": "MIT and ISC",
+      "dependencies": {
+        "@types/d3-array": "3.0.3",
+        "@types/d3-color": "3.1.0",
+        "@types/d3-delaunay": "6.0.1",
+        "@types/d3-format": "3.0.1",
+        "@types/d3-geo": "3.1.0",
+        "@types/d3-interpolate": "3.0.1",
+        "@types/d3-path": "3.1.1",
+        "@types/d3-scale": "4.0.2",
+        "@types/d3-shape": "3.1.7",
+        "@types/d3-time": "3.0.0",
+        "@types/d3-time-format": "2.1.0",
+        "d3-array": "3.2.1",
+        "d3-color": "3.1.0",
+        "d3-delaunay": "6.0.2",
+        "d3-format": "3.1.0",
+        "d3-geo": "3.1.0",
+        "d3-interpolate": "3.0.1",
+        "d3-path": "3.1.0",
+        "d3-scale": "4.0.2",
+        "d3-shape": "3.2.0",
+        "d3-time": "3.1.0",
+        "d3-time-format": "4.1.0",
+        "internmap": "2.0.3"
+      }
+    },
+    "node_modules/@visx/vendor/node_modules/d3-array": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.1.tgz",
+      "integrity": "sha512-gUY/qeHq/yNqqoCKNq4vtpFLdoCdvyNpWoC/KNjhGbhDuQpAM9sIQQKkXSNpXa9h5KySs/gzm7R88WkUutgwWQ==",
+      "license": "ISC",
+      "dependencies": {
+        "internmap": "1 - 2"
+      },
+      "engines": {
+        "node": ">=12"
+      }
     },
     "node_modules/@vitest/expect": {
       "version": "4.1.8",
@@ -4574,7 +4707,6 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/aws-ssl-profiles/-/aws-ssl-profiles-1.1.2.tgz",
       "integrity": "sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 6.0.0"
@@ -4629,10 +4761,9 @@
       }
     },
     "node_modules/better-result": {
-      "version": "2.9.2",
-      "resolved": "https://registry.npmjs.org/better-result/-/better-result-2.9.2.tgz",
-      "integrity": "sha512-WIFoBPCdnTOdk9inkE1ZRvCZ4P0CpSkAiLlchC65N7n9DcjZ3NhqkBOlafzpOVnO8ixyi37kicmSJ3ENhPZl7Q==",
-      "devOptional": true,
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/better-result/-/better-result-2.10.0.tgz",
+      "integrity": "sha512-oQhh0y1qo2/ZKdAAEvHZAqKKiHOFU5k/bW96fE2ScgQOVkJRiHwB+nOS1SgFsYqRlxMDWvefXi9Q3px7QvgNDw==",
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
@@ -4697,7 +4828,6 @@
       "version": "3.3.4",
       "resolved": "https://registry.npmjs.org/c12/-/c12-3.3.4.tgz",
       "integrity": "sha512-cM0ApFQSBXuourJejzwv/AuPRvAxordTyParRVcHjjtXirtkzM0uK2L9TTn9s0cXZbG7E55jCivRQzoxYmRAlA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "chokidar": "^5.0.0",
@@ -4829,24 +4959,10 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
-    "node_modules/chart.js": {
-      "version": "4.5.1",
-      "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-4.5.1.tgz",
-      "integrity": "sha512-GIjfiT9dbmHRiYi6Nl2yFCq7kkwdkp1W/lp2J99rX0yo9tgJGn3lKQATztIjb5tVtevcBtIdICNWqlq5+E8/Pw==",
-      "devOptional": true,
-      "license": "MIT",
-      "dependencies": {
-        "@kurkle/color": "^0.3.0"
-      },
-      "engines": {
-        "pnpm": ">=8"
-      }
-    },
     "node_modules/chokidar": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-5.0.0.tgz",
       "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "readdirp": "^5.0.0"
@@ -4870,6 +4986,12 @@
         "url": "https://polar.sh/cva"
       }
     },
+    "node_modules/classnames": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/classnames/-/classnames-2.5.1.tgz",
+      "integrity": "sha512-saHYOzhIQs6wy2sVxTM6bUDsQO4F50V9RQ22qBpEdCW+I+/Wmke2HOl6lS6dTpdxVhb88/I6+Hs+438c3lfUow==",
+      "license": "MIT"
+    },
     "node_modules/client-only": {
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
@@ -4925,7 +5047,6 @@
       "version": "0.2.4",
       "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.4.tgz",
       "integrity": "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/convert-source-map": {
@@ -4939,7 +5060,6 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
@@ -4954,9 +5074,135 @@
       "version": "3.2.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
       "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
-      "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/d3-array": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
+      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
+      "license": "ISC",
+      "dependencies": {
+        "internmap": "1 - 2"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-color": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
+      "integrity": "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-delaunay": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/d3-delaunay/-/d3-delaunay-6.0.2.tgz",
+      "integrity": "sha512-IMLNldruDQScrcfT+MWnazhHbDJhcRJyOEBAJfwQnHle1RPh6WDuLvxNArUju2VSMSUuKlY5BGHRJ2cYyoFLQQ==",
+      "license": "ISC",
+      "dependencies": {
+        "delaunator": "5"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-format": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.0.tgz",
+      "integrity": "sha512-YyUI6AEuY/Wpt8KWLgZHsIU86atmikuoOmCfommt0LYHiQSPjvX2AcFc38PX0CBpr2RCyZhjex+NS/LPOv6YqA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-geo": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-geo/-/d3-geo-3.1.0.tgz",
+      "integrity": "sha512-JEo5HxXDdDYXCaWdwLRt79y7giK8SbhZJbFWXqbRTolCHFI5jRqteLzCsq51NKbUoX0PjBVSohxrx+NoOUujYA==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2.5.0 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-interpolate": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
+      "integrity": "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-color": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-path": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
+      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-scale": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2.10.0 - 3",
+        "d3-format": "1 - 3",
+        "d3-interpolate": "1.2.0 - 3",
+        "d3-time": "2.1.1 - 3",
+        "d3-time-format": "2 - 4"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-path": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
+      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time-format": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
+      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-time": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/damerau-levenshtein": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/damerau-levenshtein/-/damerau-levenshtein-1.0.8.tgz",
@@ -5047,7 +5293,6 @@
       "version": "7.1.5",
       "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.5.tgz",
       "integrity": "sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==",
-      "devOptional": true,
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=16.0.0"
@@ -5093,14 +5338,21 @@
       "version": "6.1.7",
       "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
       "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
-      "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/delaunator": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/delaunator/-/delaunator-5.1.0.tgz",
+      "integrity": "sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ==",
+      "license": "ISC",
+      "dependencies": {
+        "robust-predicates": "^3.0.2"
+      }
+    },
     "node_modules/denque": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/denque/-/denque-2.1.0.tgz",
       "integrity": "sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">=0.10"
@@ -5110,7 +5362,6 @@
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/destr/-/destr-2.0.5.tgz",
       "integrity": "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/detect-libc": {
@@ -5173,7 +5424,6 @@
       "version": "3.20.0",
       "resolved": "https://registry.npmjs.org/effect/-/effect-3.20.0.tgz",
       "integrity": "sha512-qMLfDJscrNG8p/aw+IkT9W7fgj50Z4wG5bLBy0Txsxz8iUHjDIkOgO3SV0WZfnQbNG2VJYb0b+rDLMrhM4+Krw==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.0.0",
@@ -5187,6 +5437,12 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/elkjs": {
+      "version": "0.11.1",
+      "resolved": "https://registry.npmjs.org/elkjs/-/elkjs-0.11.1.tgz",
+      "integrity": "sha512-zxxR9k+rx5ktMwT/FwyLdPCrq7xN6e4VGGHH8hA01vVYKjTFik7nHOxBnAYtrgYUB1RpAiLvA1/U2YraWxyKKg==",
+      "license": "EPL-2.0"
+    },
     "node_modules/emoji-regex": {
       "version": "9.2.2",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
@@ -5198,7 +5454,6 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/empathic/-/empathic-2.0.0.tgz",
       "integrity": "sha512-i6UzDscO/XfAcNYD75CfICkmfLedpyPDdozrLMmQc5ORaQcdMoc21OnlEylMIqI7U8eniKrPMxxtj8k0vhmJhA==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=14"
@@ -5222,7 +5477,6 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-3.0.0.tgz",
       "integrity": "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
@@ -5499,13 +5753,13 @@
       }
     },
     "node_modules/eslint-config-next": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.2.7.tgz",
-      "integrity": "sha512-CQ2aNXkrsjaGA2oJBE1LYnlRdphIAQE9ZQfX9hSv1PNGPyiOMSaVeBfTIO29QxYz+ij/hZudK0cfpCG1HXWstg==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.2.12.tgz",
+      "integrity": "sha512-iaaf4vvKo5h2LBdGt0JuRv7t0Ysqr9FMCiFxbptDg8LqOE//mIKR80DdpOnSVM7qjLH3jT8P0aFiwXxBEGZRXw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@next/eslint-plugin-next": "16.2.7",
+        "@next/eslint-plugin-next": "16.2.12",
         "eslint-import-resolver-node": "^0.3.6",
         "eslint-import-resolver-typescript": "^3.5.2",
         "eslint-plugin-import": "^2.32.0",
@@ -5865,17 +6119,15 @@
       }
     },
     "node_modules/exsolve": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
-      "integrity": "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==",
-      "devOptional": true,
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.1.0.tgz",
+      "integrity": "sha512-D+42+T12DdIlJM3uepa55qGiL3sYdLBOxIl2ifQCzCHz4c7eiolaHsi3BIqEr7JxBzxv2pYZQX9kw16ziMcEmw==",
       "license": "MIT"
     },
     "node_modules/fast-check": {
       "version": "3.23.2",
       "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz",
       "integrity": "sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==",
-      "devOptional": true,
       "funding": [
         {
           "type": "individual",
@@ -5894,11 +6146,16 @@
         "node": ">=8.0.0"
       }
     },
+    "node_modules/fast-decode-uri-component": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/fast-decode-uri-component/-/fast-decode-uri-component-1.0.1.tgz",
+      "integrity": "sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==",
+      "license": "MIT"
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/fast-glob": {
@@ -5945,11 +6202,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/fast-querystring": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/fast-querystring/-/fast-querystring-1.1.2.tgz",
+      "integrity": "sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-decode-uri-component": "^1.0.1"
+      }
+    },
     "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
-      "devOptional": true,
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
       "funding": [
         {
           "type": "github",
@@ -5998,6 +6263,20 @@
         "node": ">=8"
       }
     },
+    "node_modules/find-my-way": {
+      "version": "9.7.0",
+      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-9.7.0.tgz",
+      "integrity": "sha512-f2JHn75x2JlwUwLenZypgczR7YWMb/uO9BvUXtus+JMgkbIkLADd38cI4EiV+OQqrGo1Zlq6V8wnqMJ8e62wUQ==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-querystring": "^1.0.0",
+        "safe-regex2": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/find-up": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
@@ -6056,7 +6335,6 @@
       "version": "3.3.1",
       "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
       "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
-      "devOptional": true,
       "license": "ISC",
       "dependencies": {
         "cross-spawn": "^7.0.6",
@@ -6129,7 +6407,6 @@
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-2.3.1.tgz",
       "integrity": "sha512-eeB5GfMNeevm/GRYq20ShmsaGcmI81kIX2K9XQx5miC8KdHaC6Jm0qQ8ZNeGOi7wYB8OsdxKs+Y2oVuTFuVwKQ==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "is-property": "^1.0.2"
@@ -6193,7 +6470,6 @@
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/get-port-please/-/get-port-please-3.2.0.tgz",
       "integrity": "sha512-I9QVvBw5U/hw3RmWpYKRumUeaDgxTPd401x364rLmWBJcOQ753eov1eTgzDqRG9bqFIfDc7gfzcQEWrUri3o1A==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/get-proto": {
@@ -6242,10 +6518,9 @@
       }
     },
     "node_modules/giget": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/giget/-/giget-3.2.0.tgz",
-      "integrity": "sha512-GvHTWcykIR/fP8cj8dMpuMMkvaeJfPvYnhq0oW+chSeIr+ldX21ifU2Ms6KBoyKZQZmVaUAAhQ2EZ68KJF8a7A==",
-      "devOptional": true,
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/giget/-/giget-3.3.1.tgz",
+      "integrity": "sha512-r+mvuDjrjMpsdw46Kmeydb8bdHm7wOKw8wNBtTndkjbPjgAp5oUJUxRE76wZFknxIPokfWvep2qSXK37aXE6zg==",
       "license": "MIT",
       "bin": {
         "giget": "dist/cli.mjs"
@@ -6311,21 +6586,18 @@
       "version": "4.2.11",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
       "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
-      "devOptional": true,
       "license": "ISC"
     },
     "node_modules/grammex": {
-      "version": "3.1.12",
-      "resolved": "https://registry.npmjs.org/grammex/-/grammex-3.1.12.tgz",
-      "integrity": "sha512-6ufJOsSA7LcQehIJNCO7HIBykfM7DXQual0Ny780/DEcJIpBlHRvcqEBWGPYd7hrXL2GJ3oJI1MIhaXjWmLQOQ==",
-      "devOptional": true,
+      "version": "3.1.13",
+      "resolved": "https://registry.npmjs.org/grammex/-/grammex-3.1.13.tgz",
+      "integrity": "sha512-LnPnhOBLEJEVKS8WFDVaA397L9Kq55Q9oSITJiVLHVdhAclfUkWzQv74KhvZHKL2Q09Pb1XdsrOsZ4LfTFFTEg==",
       "license": "MIT"
     },
     "node_modules/graphmatch": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/graphmatch/-/graphmatch-1.1.1.tgz",
       "integrity": "sha512-5ykVn/EXM1hF0XCaWh05VbYvEiOL2lY1kBxZtaYsyvjp7cmWOU1XsAdfQBwClraEofXDT197lFbXOEVMHpvQOg==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/has-bigints": {
@@ -6439,28 +6711,10 @@
         "hermes-estree": "0.25.1"
       }
     },
-    "node_modules/hono": {
-      "version": "4.12.25",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.25.tgz",
-      "integrity": "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==",
-      "devOptional": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.9.0"
-      }
-    },
-    "node_modules/http-status-codes": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/http-status-codes/-/http-status-codes-2.3.0.tgz",
-      "integrity": "sha512-RJ8XvFvpPM/Dmc5SV+dC4y5PCeOhT3x1Hq0NU3rjGeg5a/CqlhZ7uudknPwZFz4aeAXDcbAyaeP7GAo9lvngtA==",
-      "devOptional": true,
-      "license": "MIT"
-    },
     "node_modules/iconv-lite": {
       "version": "0.7.2",
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
       "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -6525,6 +6779,15 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/internmap": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
+      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/is-array-buffer": {
       "version": "3.0.5",
       "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.5.tgz",
@@ -6799,7 +7062,6 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/is-property/-/is-property-1.0.2.tgz",
       "integrity": "sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/is-regex": {
@@ -6958,7 +7220,6 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "devOptional": true,
       "license": "ISC"
     },
     "node_modules/iterator.prototype": {
@@ -6983,7 +7244,6 @@
       "version": "2.7.0",
       "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
       "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
-      "devOptional": true,
       "license": "MIT",
       "bin": {
         "jiti": "lib/jiti-cli.mjs"
@@ -7006,9 +7266,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "funding": [
         {
           "type": "github",
@@ -7411,6 +7671,12 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/lodash": {
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
+      "license": "MIT"
+    },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
       "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
@@ -7422,7 +7688,6 @@
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/loose-envify": {
@@ -7452,7 +7717,6 @@
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/lru.min/-/lru.min-1.1.4.tgz",
       "integrity": "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "bun": ">=1.0.0",
@@ -7551,7 +7815,6 @@
       "version": "3.15.3",
       "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.15.3.tgz",
       "integrity": "sha512-FBrGau0IXmuqg4haEZRBfHNWB5mUARw6hNwPDXXGg0XzVJ50mr/9hb267lvpVMnhZ1FON3qNd4Xfcez1rbFwSg==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "aws-ssl-profiles": "^1.1.1",
@@ -7572,7 +7835,6 @@
       "version": "1.1.6",
       "resolved": "https://registry.npmjs.org/named-placeholders/-/named-placeholders-1.1.6.tgz",
       "integrity": "sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "lru.min": "^1.1.0"
@@ -7582,9 +7844,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.16",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
       "funding": [
         {
           "type": "github",
@@ -7623,12 +7885,12 @@
       "license": "MIT"
     },
     "node_modules/next": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/next/-/next-16.2.7.tgz",
-      "integrity": "sha512-eMJxgjRzBaj3olkP4cBamHDXL79A8FC6u1GcsO1D1Tsx8bw/LLXUJCaoajVxtnhD3A1IJqIT8IcRJjgBIPJq4w==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/next/-/next-16.2.12.tgz",
+      "integrity": "sha512-iD59eYQWmbFcEbX7v/acG5DRym9iw1DdaPoD0WTA920naWsE25wShzJW4+UvAs8MK9EC2kBfIH6vtto1H1PHGw==",
       "license": "MIT",
       "dependencies": {
-        "@next/env": "16.2.7",
+        "@next/env": "16.2.12",
         "@swc/helpers": "0.5.15",
         "baseline-browser-mapping": "^2.9.19",
         "caniuse-lite": "^1.0.30001579",
@@ -7642,14 +7904,14 @@
         "node": ">=20.9.0"
       },
       "optionalDependencies": {
-        "@next/swc-darwin-arm64": "16.2.7",
-        "@next/swc-darwin-x64": "16.2.7",
-        "@next/swc-linux-arm64-gnu": "16.2.7",
-        "@next/swc-linux-arm64-musl": "16.2.7",
-        "@next/swc-linux-x64-gnu": "16.2.7",
-        "@next/swc-linux-x64-musl": "16.2.7",
-        "@next/swc-win32-arm64-msvc": "16.2.7",
-        "@next/swc-win32-x64-msvc": "16.2.7",
+        "@next/swc-darwin-arm64": "16.2.12",
+        "@next/swc-darwin-x64": "16.2.12",
+        "@next/swc-linux-arm64-gnu": "16.2.12",
+        "@next/swc-linux-arm64-musl": "16.2.12",
+        "@next/swc-linux-x64-gnu": "16.2.12",
+        "@next/swc-linux-x64-musl": "16.2.12",
+        "@next/swc-win32-arm64-msvc": "16.2.12",
+        "@next/swc-win32-x64-msvc": "16.2.12",
         "sharp": "^0.34.5"
       },
       "peerDependencies": {
@@ -7842,7 +8104,6 @@
       "version": "2.0.11",
       "resolved": "https://registry.npmjs.org/ohash/-/ohash-2.0.11.tgz",
       "integrity": "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/optionator": {
@@ -7940,7 +8201,6 @@
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7957,7 +8217,6 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
       "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/peggy": {
@@ -7981,7 +8240,6 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-2.1.0.tgz",
       "integrity": "sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/pg": {
@@ -8105,7 +8363,6 @@
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.1.tgz",
       "integrity": "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "confbox": "^0.2.4",
@@ -8124,9 +8381,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.23",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
+      "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
       "funding": [
         {
           "type": "opencollective",
@@ -8143,7 +8400,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -8155,7 +8412,6 @@
       "version": "3.4.7",
       "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.7.tgz",
       "integrity": "sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw==",
-      "devOptional": true,
       "license": "Unlicense",
       "engines": {
         "node": ">=12"
@@ -8215,17 +8471,16 @@
       }
     },
     "node_modules/prisma": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/prisma/-/prisma-7.8.0.tgz",
-      "integrity": "sha512-yfN4yrw7HV9kEJhoy1+jgah0jafEIQsf7uWouSsM8MvJtlubsk+kM7AIBWZ8+GJl74Yj3c+nbYqBkMOxtsZ3Lw==",
-      "devOptional": true,
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/prisma/-/prisma-7.9.0.tgz",
+      "integrity": "sha512-isQTJEK4pyOlAVzm6kBUDjzgdsgs0A/snpB38ycTHeOHW34qfepP+ClQltgDXqjZBnXALhEtE4duh9L3tN5fHw==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/config": "7.8.0",
-        "@prisma/dev": "0.24.3",
-        "@prisma/engines": "7.8.0",
-        "@prisma/studio-core": "0.27.3",
+        "@prisma/config": "7.9.0",
+        "@prisma/dev": "0.24.14",
+        "@prisma/engines": "7.9.0",
+        "@prisma/studio-core": "0.33.0",
         "mysql2": "3.15.3",
         "postgres": "3.4.7"
       },
@@ -8264,7 +8519,6 @@
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
       "integrity": "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
@@ -8276,7 +8530,6 @@
       "version": "3.0.7",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
       "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
-      "devOptional": true,
       "license": "ISC"
     },
     "node_modules/punycode": {
@@ -8293,7 +8546,6 @@
       "version": "6.1.0",
       "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz",
       "integrity": "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==",
-      "devOptional": true,
       "funding": [
         {
           "type": "individual",
@@ -8331,7 +8583,6 @@
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/rc9/-/rc9-3.0.1.tgz",
       "integrity": "sha512-gMDyleLWVE+i6Sgtc0QbbY6pEKqYs97NGi6isHQPqYlLemPoO8dxQ3uGi0f4NiP98c+jMW6cG1Kx9dDwfvqARQ==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "defu": "^6.1.6",
@@ -8439,7 +8690,6 @@
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.0.0.tgz",
       "integrity": "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 20.19.0"
@@ -8497,7 +8747,6 @@
       "version": "2.33.4",
       "resolved": "https://registry.npmjs.org/remeda/-/remeda-2.33.4.tgz",
       "integrity": "sha512-ygHswjlc/opg2VrtiYvUOPLjxjtdKvjGz1/plDhkG66hjNjFr1xmfrs2ClNFo/E6TyUFiwYNh53bKV26oBoMGQ==",
-      "devOptional": true,
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/remeda"
@@ -8507,7 +8756,6 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
       "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -8557,11 +8805,19 @@
         "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
       }
     },
+    "node_modules/ret": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/ret/-/ret-0.5.0.tgz",
+      "integrity": "sha512-I1XxrZSQ+oErkRR4jYbAyEEu2I0avBvvMM5JN+6EBprOGRCs63ENqZ3vjavq8fBw2+62G5LF5XelKwuJpcvcxw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/retry": {
       "version": "0.12.0",
       "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
       "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 4"
@@ -8578,6 +8834,12 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/robust-predicates": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",
+      "integrity": "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==",
+      "license": "Unlicense"
+    },
     "node_modules/rolldown": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
@@ -8691,11 +8953,32 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/safe-regex2": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/safe-regex2/-/safe-regex2-5.1.1.tgz",
+      "integrity": "sha512-mOSBvHGDZMuIEZMdOz/aCEYDCv0E7nfcNsIhUF+/P+xC7Hyf3FkvymqgPbg9D1EdSGu+uKbJgy09K/RKKc7kJA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "ret": "~0.5.0"
+      },
+      "bin": {
+        "safe-regex2": "bin/safe-regex2.js"
+      }
+    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/scheduler": {
@@ -8717,8 +9000,7 @@
     "node_modules/seq-queue": {
       "version": "0.0.5",
       "resolved": "https://registry.npmjs.org/seq-queue/-/seq-queue-0.0.5.tgz",
-      "integrity": "sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q==",
-      "devOptional": true
+      "integrity": "sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q=="
     },
     "node_modules/set-function-length": {
       "version": "1.2.2",
@@ -8770,54 +9052,59 @@
       }
     },
     "node_modules/sharp": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz",
-      "integrity": "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==",
-      "hasInstallScript": true,
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.3.tgz",
+      "integrity": "sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@img/colour": "^1.0.0",
+        "@img/colour": "^1.1.0",
         "detect-libc": "^2.1.2",
-        "semver": "^7.7.3"
+        "semver": "^7.8.5"
       },
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-darwin-arm64": "0.34.5",
-        "@img/sharp-darwin-x64": "0.34.5",
-        "@img/sharp-libvips-darwin-arm64": "1.2.4",
-        "@img/sharp-libvips-darwin-x64": "1.2.4",
-        "@img/sharp-libvips-linux-arm": "1.2.4",
-        "@img/sharp-libvips-linux-arm64": "1.2.4",
-        "@img/sharp-libvips-linux-ppc64": "1.2.4",
-        "@img/sharp-libvips-linux-riscv64": "1.2.4",
-        "@img/sharp-libvips-linux-s390x": "1.2.4",
-        "@img/sharp-libvips-linux-x64": "1.2.4",
-        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4",
-        "@img/sharp-libvips-linuxmusl-x64": "1.2.4",
-        "@img/sharp-linux-arm": "0.34.5",
-        "@img/sharp-linux-arm64": "0.34.5",
-        "@img/sharp-linux-ppc64": "0.34.5",
-        "@img/sharp-linux-riscv64": "0.34.5",
-        "@img/sharp-linux-s390x": "0.34.5",
-        "@img/sharp-linux-x64": "0.34.5",
-        "@img/sharp-linuxmusl-arm64": "0.34.5",
-        "@img/sharp-linuxmusl-x64": "0.34.5",
-        "@img/sharp-wasm32": "0.34.5",
-        "@img/sharp-win32-arm64": "0.34.5",
-        "@img/sharp-win32-ia32": "0.34.5",
-        "@img/sharp-win32-x64": "0.34.5"
+        "@img/sharp-darwin-arm64": "0.35.3",
+        "@img/sharp-darwin-x64": "0.35.3",
+        "@img/sharp-freebsd-wasm32": "0.35.3",
+        "@img/sharp-libvips-darwin-arm64": "1.3.2",
+        "@img/sharp-libvips-darwin-x64": "1.3.2",
+        "@img/sharp-libvips-linux-arm": "1.3.2",
+        "@img/sharp-libvips-linux-arm64": "1.3.2",
+        "@img/sharp-libvips-linux-ppc64": "1.3.2",
+        "@img/sharp-libvips-linux-riscv64": "1.3.2",
+        "@img/sharp-libvips-linux-s390x": "1.3.2",
+        "@img/sharp-libvips-linux-x64": "1.3.2",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.2",
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.2",
+        "@img/sharp-linux-arm": "0.35.3",
+        "@img/sharp-linux-arm64": "0.35.3",
+        "@img/sharp-linux-ppc64": "0.35.3",
+        "@img/sharp-linux-riscv64": "0.35.3",
+        "@img/sharp-linux-s390x": "0.35.3",
+        "@img/sharp-linux-x64": "0.35.3",
+        "@img/sharp-linuxmusl-arm64": "0.35.3",
+        "@img/sharp-linuxmusl-x64": "0.35.3",
+        "@img/sharp-webcontainers-wasm32": "0.35.3",
+        "@img/sharp-win32-arm64": "0.35.3",
+        "@img/sharp-win32-ia32": "0.35.3",
+        "@img/sharp-win32-x64": "0.35.3"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        }
       }
     },
     "node_modules/sharp/node_modules/semver": {
-      "version": "7.8.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.1.tgz",
-      "integrity": "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "license": "ISC",
       "optional": true,
       "bin": {
@@ -8831,7 +9118,6 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -8844,7 +9130,6 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -8937,7 +9222,6 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
       "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "devOptional": true,
       "license": "ISC",
       "engines": {
         "node": ">=14"
@@ -8977,7 +9261,6 @@
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/sqlstring/-/sqlstring-2.3.3.tgz",
       "integrity": "sha512-qC9iz2FlN7DQl3+wjwn3802RTyjCx7sDvfQEXchwa6CWOx07/WVfh91gBmQ9fahw8snwGEWU3xGzOt4tFyHLxg==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -9001,7 +9284,6 @@
       "version": "3.10.0",
       "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
       "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/stop-iteration-iterator": {
@@ -9653,10 +9935,9 @@
       }
     },
     "node_modules/valibot": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.2.0.tgz",
-      "integrity": "sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==",
-      "devOptional": true,
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.4.2.tgz",
+      "integrity": "sha512-gjdCvJ6d3RyHAneqxMYMW9QMCwYMb3jpOO0IyHZV1bnRHFBHrX3VkIILt5XYR0WhwHiH7Mty8ovuPZ/O3gamrg==",
       "license": "MIT",
       "peerDependencies": {
         "typescript": ">=5"
@@ -9872,7 +10153,6 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "devOptional": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -10033,7 +10313,6 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/zeptomatch/-/zeptomatch-2.1.0.tgz",
       "integrity": "sha512-KiGErG2J0G82LSpniV0CtIzjlJ10E04j02VOudJsPyPwNZgGnRKQy7I1R7GMyg/QswnE4l7ohSGrQbQbjXPPDA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "grammex": "^3.1.11",
@@ -10102,8 +10381,9 @@
       "version": "0.1.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "js-yaml": "^4.2.0",
-        "peggy": "^5.1.0"
+        "js-yaml": "^4.3.0",
+        "peggy": "^5.1.0",
+        "safe-regex2": "^5.1.1"
       }
     },
     "packages/server-core": {
@@ -10119,7 +10399,6 @@
       "version": "0.1.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "@radix-ui/react-accordion": "^1.2.0",
         "@radix-ui/react-avatar": "^1.1.0",
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -10127,7 +10406,6 @@
         "@radix-ui/react-popover": "^1.1.0",
         "@radix-ui/react-scroll-area": "^1.2.0",
         "@radix-ui/react-select": "^2.1.0",
-        "@radix-ui/react-separator": "^1.1.0",
         "@radix-ui/react-slot": "^1.1.0",
         "@radix-ui/react-switch": "^1.1.0",
         "@radix-ui/react-tabs": "^1.1.0",
@@ -10136,7 +10414,7 @@
         "class-variance-authority": "^0.7.0",
         "clsx": "^2.1.0",
         "lucide-react": "^1.17.0",
-        "next": "^16.2.7",
+        "next": "^16.2.12",
         "react": "^19.2.7",
         "react-dom": "^19.2.7",
         "react-remove-scroll-bar": "^2.3.8",
diff --git a/package.json b/package.json
index f95b720..76a2232 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,8 @@
     "build": "npm --workspace @subboost/local run build",
     "test:unit": "vitest run",
     "test:core": "vitest run --config vitest.core.config.ts",
-    "lint": "eslint local packages --max-warnings=0",
+    "lint": "eslint local packages --max-warnings=0 && npm run check:ui-consistency",
+    "check:ui-consistency": "node scripts/check-ui-consistency.cjs packages local",
     "check:local-app": "npm --prefix local run check",
     "local:db:generate": "npm --prefix local run db:generate",
     "local:lint": "npm --prefix local run lint",
@@ -23,9 +24,8 @@
     "local:build": "npm --prefix local run build"
   },
   "dependencies": {
-    "@prisma/adapter-pg": "^7.8.0",
-    "@prisma/client": "^7.8.0",
-    "@radix-ui/react-accordion": "^1.2.0",
+    "@prisma/adapter-pg": "^7.9.0",
+    "@prisma/client": "^7.9.0",
     "@radix-ui/react-avatar": "^1.1.0",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -33,7 +33,6 @@
     "@radix-ui/react-popover": "^1.1.0",
     "@radix-ui/react-scroll-area": "^1.2.0",
     "@radix-ui/react-select": "^2.1.0",
-    "@radix-ui/react-separator": "^1.1.0",
     "@radix-ui/react-slot": "^1.1.0",
     "@radix-ui/react-switch": "^1.1.0",
     "@radix-ui/react-tabs": "^1.1.0",
@@ -47,9 +46,9 @@
     "clsx": "^2.1.0",
     "dotenv": "^17.4.2",
     "jose": "^6.2.3",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.3.0",
     "lucide-react": "^1.17.0",
-    "next": "^16.2.7",
+    "next": "^16.2.12",
     "peggy": "^5.1.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
@@ -64,16 +63,17 @@
     "@types/react": "^19.2.16",
     "@types/react-dom": "^19.2.3",
     "eslint": "^9.39.4",
-    "eslint-config-next": "^16.2.7",
-    "postcss": "8.5.15",
-    "prisma": "^7.8.0",
+    "eslint-config-next": "^16.2.12",
+    "postcss": "8.5.23",
+    "prisma": "^7.9.0",
     "tailwindcss": "^4.3.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.7"
   },
   "overrides": {
-    "@hono/node-server": "1.19.13",
-    "hono": "4.12.25",
-    "postcss": "8.5.15"
+    "find-my-way": "9.7.0",
+    "postcss": "8.5.23",
+    "sharp": "0.35.3",
+    "valibot": "1.4.2"
   }
 }
diff --git a/packages/core/package.json b/packages/core/package.json
index 85859fb..1dd887e 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -31,7 +31,8 @@
     "./types/*": "./src/types/*.ts"
   },
   "dependencies": {
-    "js-yaml": "^4.2.0",
-    "peggy": "^5.1.0"
+    "js-yaml": "^4.3.0",
+    "peggy": "^5.1.0",
+    "safe-regex2": "^5.1.1"
   }
 }
diff --git a/packages/core/src/config/defaults.ts b/packages/core/src/config/defaults.ts
index fb0f8d8..24c870a 100644
--- a/packages/core/src/config/defaults.ts
+++ b/packages/core/src/config/defaults.ts
@@ -122,7 +122,7 @@ dns:
   fake-ip-range: 198.18.0.1/16
   default-nameserver: [180.76.76.76, 182.254.118.118, 8.8.8.8, 180.184.2.2]
   nameserver: [180.76.76.76, 119.29.29.29, 180.184.1.1, 223.5.5.5, 8.8.8.8, "https://223.6.6.6/dns-query#h3=true", "https://dns.alidns.com/dns-query", "https://cloudflare-dns.com/dns-query", "https://doh.pub/dns-query"]
-  fallback: ["https://000000.dns.nextdns.io/dns-query#h3=true", "https://dns.alidns.com/dns-query", "https://doh.pub/dns-query", "https://public.dns.iij.jp/dns-query", "https://101.101.101.101/dns-query", "https://208.67.220.220/dns-query", "tls://8.8.4.4", "tls://1.0.0.1:853", "https://cloudflare-dns.com/dns-query", "https://dns.google/dns-query"]
+  fallback: ["https://dns.quad9.net/dns-query", "https://dns.alidns.com/dns-query", "https://doh.pub/dns-query", "https://public.dns.iij.jp/dns-query", "https://101.101.101.101/dns-query", "https://208.67.220.220/dns-query", "tls://8.8.4.4", "tls://1.0.0.1:853", "https://cloudflare-dns.com/dns-query", "https://dns.google/dns-query"]
   fallback-filter: {geoip: true, ipcidr: [240.0.0.0/4, 0.0.0.0/32, 127.0.0.1/32], domain: ["+.google.com", "+.facebook.com", "+.twitter.com", "+.youtube.com", "+.xn--ngstr-lra8j.com", "+.google.cn", "+.googleapis.cn", "+.googleapis.com", "+.gvt1.com"]}
   fake-ip-filter: ["*.lan", "stun.*.*.*", "stun.*.*", time.windows.com, time.nist.gov, time.apple.com, time.asia.apple.com, "*.ntp.org.cn", "*.openwrt.pool.ntp.org", time1.cloud.tencent.com, time.ustc.edu.cn, pool.ntp.org, ntp.ubuntu.com, ntp.aliyun.com, ntp1.aliyun.com, ntp2.aliyun.com, ntp3.aliyun.com, ntp4.aliyun.com, ntp5.aliyun.com, ntp6.aliyun.com, ntp7.aliyun.com, time1.aliyun.com, time2.aliyun.com, time3.aliyun.com, time4.aliyun.com, time5.aliyun.com, time6.aliyun.com, time7.aliyun.com, "*.time.edu.cn", time1.apple.com, time2.apple.com, time3.apple.com, time4.apple.com, time5.apple.com, time6.apple.com, time7.apple.com, time1.google.com, time2.google.com, time3.google.com, time4.google.com, music.163.com, "*.music.163.com", "*.126.net", musicapi.taihe.com, music.taihe.com, songsearch.kugou.com, trackercdn.kugou.com, "*.kuwo.cn", api-jooxtt.sanook.com, api.joox.com, joox.com, y.qq.com, "*.y.qq.com", streamoc.music.tc.qq.com, mobileoc.music.tc.qq.com, isure.stream.qqmusic.qq.com, dl.stream.qqmusic.qq.com, aqqmusic.tc.qq.com, amobile.music.tc.qq.com, "*.xiami.com", "*.music.migu.cn", music.migu.cn, "*.msftconnecttest.com", "*.msftncsi.com", localhost.ptlogin2.qq.com, "*.*.*.srv.nintendo.net", "*.*.stun.playstation.net", "xbox.*.*.microsoft.com", "*.ipv6.microsoft.com", "*.*.xboxlive.com", speedtest.cros.wr.pvp.net]
   # nameserver-policy 示例（full）
diff --git a/packages/core/src/core-contracts.test.ts b/packages/core/src/core-contracts.test.ts
index 4279613..18ad9f5 100644
--- a/packages/core/src/core-contracts.test.ts
+++ b/packages/core/src/core-contracts.test.ts
@@ -173,14 +173,14 @@ describe("custom routing rule set contracts", () => {
     expect(parseRuleSetTargetValue("module:")).toBeNull();
     expect(parseRuleSetTargetValue("bad:value")).toBeNull();
     expect(extractRuleSetPathFromUrl("https://example.com/geo/geosite/youtube.mrs?raw=1")).toBe(
-      "geosite/youtube.mrs"
+      "https://example.com/geo/geosite/youtube.mrs?raw=1"
     );
     expect(normalizeRuleSetPathInput("/geoip/private.mrs")).toBe("geoip/private.mrs");
     expect(buildRuleSetUrlFromPath("geosite/youtube.mrs", "https://rules.example.com/geo/")).toBe(
       "https://rules.example.com/geo/geosite/youtube.mrs"
     );
     expect(buildRuleSetUrlFromPath("https://cdn.example.com/geosite/youtube.mrs", DEFAULT_RULE_PROVIDER_BASE_URL)).toBe(
-      `${DEFAULT_RULE_PROVIDER_BASE_URL}/geosite/youtube.mrs`
+      "https://cdn.example.com/geosite/youtube.mrs"
     );
   });
 
@@ -231,7 +231,7 @@ describe("custom routing rule set contracts", () => {
       id: "private",
       name: "private",
       behavior: "ipcidr",
-      path: "geoip/private.mrs",
+      path: "https://rules.example.com/geo/geoip/private.mrs",
       target: {
         kind: "module",
         id: moduleId,
@@ -246,7 +246,7 @@ describe("custom routing rule set contracts", () => {
       id: "youtube",
       name: "YouTube",
       behavior: "domain",
-      path: "geosite/youtube.mrs",
+      path: "https://rules.example.com/geo/geosite/youtube.mrs?download=1",
       target: {
         kind: "custom",
         id: "custom",
diff --git a/packages/core/src/generator/chain.test.ts b/packages/core/src/generator/chain.test.ts
index b0141fa..c0b44a5 100644
--- a/packages/core/src/generator/chain.test.ts
+++ b/packages/core/src/generator/chain.test.ts
@@ -6,7 +6,6 @@ import {
   generateDialerProxyGroups,
   getDialerRelayNodes,
   getDialerTargetNodes,
-  suggestDialerGroups,
   validateDialerConfig,
 } from "./chain";
 
@@ -184,25 +183,4 @@ describe("dialer proxy chain helpers", () => {
     });
   });
 
-  it("suggests regional relay groups from node names", () => {
-    const suggestions = suggestDialerGroups([
-      node("US Los Angeles 01"),
-      node("美国 New York 02"),
-      node("香港 HK 01"),
-      node("Unknown 01"),
-    ]);
-
-    expect(suggestions).toEqual([
-      {
-        name: "🇺🇸 美国中转",
-        relayNodes: ["US Los Angeles 01", "美国 New York 02"],
-        description: "使用美国节点作为中转",
-      },
-      {
-        name: "🇭🇰 香港中转",
-        relayNodes: ["香港 HK 01"],
-        description: "使用香港节点作为中转",
-      },
-    ]);
-  });
 });
diff --git a/packages/core/src/generator/chain.ts b/packages/core/src/generator/chain.ts
index 6ddd21f..4eb3487 100644
--- a/packages/core/src/generator/chain.ts
+++ b/packages/core/src/generator/chain.ts
@@ -151,53 +151,3 @@ export function validateDialerConfig(
     errors,
   };
 }
-
-/**
- * 从节点列表中推荐中转组合
- * 基于节点名称中的地区信息进行智能匹配
- */
-export function suggestDialerGroups(
-  nodes: ParsedNode[]
-): Array<{ name: string; relayNodes: string[]; description: string }> {
-  const suggestions: Array<{ name: string; relayNodes: string[]; description: string }> = [];
-
-  // 地区关键词
-  const regions: Record<string, { keywords: string[]; emoji: string; name: string }> = {
-    us: { keywords: ["美国", "US", "USA", "United States", "洛杉矶", "纽约", "西雅图"], emoji: "🇺🇸", name: "美国" },
-    hk: { keywords: ["香港", "HK", "Hong Kong", "港"], emoji: "🇭🇰", name: "香港" },
-    jp: { keywords: ["日本", "JP", "Japan", "东京", "大阪"], emoji: "🇯🇵", name: "日本" },
-    sg: { keywords: ["新加坡", "SG", "Singapore", "狮城"], emoji: "🇸🇬", name: "新加坡" },
-    tw: { keywords: ["台湾", "TW", "Taiwan", "台北"], emoji: "🇹🇼", name: "台湾" },
-    kr: { keywords: ["韩国", "KR", "Korea", "首尔"], emoji: "🇰🇷", name: "韩国" },
-  };
-
-  // 按地区分类节点
-  const nodesByRegion: Record<string, string[]> = {};
-
-  for (const node of nodes) {
-    const name = node.name.toLowerCase();
-    for (const [region, config] of Object.entries(regions)) {
-      if (config.keywords.some((kw) => name.includes(kw.toLowerCase()))) {
-        if (!nodesByRegion[region]) {
-          nodesByRegion[region] = [];
-        }
-        nodesByRegion[region].push(node.name);
-        break;
-      }
-    }
-  }
-
-  // 生成推荐的中转组
-  for (const [region, config] of Object.entries(regions)) {
-    const regionNodes = nodesByRegion[region] || [];
-    if (regionNodes.length > 0) {
-      suggestions.push({
-        name: `${config.emoji} ${config.name}中转`,
-        relayNodes: regionNodes.slice(0, 5), // 最多取5个节点
-        description: `使用${config.name}节点作为中转`,
-      });
-    }
-  }
-
-  return suggestions;
-}
diff --git a/packages/core/src/generator/dns.ts b/packages/core/src/generator/dns.ts
index dca1145..7917111 100644
--- a/packages/core/src/generator/dns.ts
+++ b/packages/core/src/generator/dns.ts
@@ -28,7 +28,7 @@ export const DEFAULT_DNS_CONFIG: DNSConfig = {
     "https://doh.pub/dns-query",
   ],
   fallback: [
-    "https://000000.dns.nextdns.io/dns-query#h3=true",
+    "https://dns.quad9.net/dns-query",
     "https://dns.alidns.com/dns-query",
     "https://doh.pub/dns-query",
     "https://public.dns.iij.jp/dns-query",
@@ -128,4 +128,3 @@ export const DEFAULT_DNS_CONFIG: DNSConfig = {
     "speedtest.cros.wr.pvp.net",
   ],
 };
-
diff --git a/packages/core/src/generator/proxy-groups.ts b/packages/core/src/generator/proxy-groups.ts
index 63d56d5..167549b 100644
--- a/packages/core/src/generator/proxy-groups.ts
+++ b/packages/core/src/generator/proxy-groups.ts
@@ -48,7 +48,7 @@ export const CATEGORY_INFO: Record<string, { name: string; order: number }> = {
   custom: { name: "自定义分组", order: 8 },
 };
 
-export interface GenerateOptions {
+export interface ProxyGroupGenerateOptions {
   nodes: ParsedNode[];
   proxyProviderNames?: string[];
   enabledModules: string[];
@@ -67,6 +67,9 @@ export interface GenerateOptions {
   ruleOrder?: string[];
 }
 
+/** @deprecated Use `ProxyGroupGenerateOptions`; retained for 2.x source compatibility. */
+export type GenerateOptions = ProxyGroupGenerateOptions;
+
 export { isSubscriptionInfoNodeName };
 
 function getEnabledCustomProxyGroups(customProxyGroups: CustomProxyGroup[]): CustomProxyGroup[] {
@@ -130,7 +133,7 @@ const PROXY_GROUP_ORDER: string[] = [
 /**
  * 生成代理组配置
  */
-export function generateProxyGroups(options: GenerateOptions): ProxyGroup[] {
+export function generateProxyGroups(options: ProxyGroupGenerateOptions): ProxyGroup[] {
   const {
     nodes,
     proxyProviderNames = [],
@@ -479,7 +482,7 @@ export function generateProxyGroups(options: GenerateOptions): ProxyGroup[] {
 /**
  * 生成规则提供者配置
  */
-export function generateRuleProviders(options: GenerateOptions): Record<string, RuleProvider> {
+export function generateRuleProviders(options: ProxyGroupGenerateOptions): Record<string, RuleProvider> {
   const {
     enabledModules,
     ruleProviderBaseUrl,
diff --git a/packages/core/src/generator/yaml.test.ts b/packages/core/src/generator/yaml.test.ts
index 6bb6555..6294e21 100644
--- a/packages/core/src/generator/yaml.test.ts
+++ b/packages/core/src/generator/yaml.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import yamlParser from "js-yaml";
 import { collectDnsPolicyEntries, configToYaml } from "./yaml";
 import type { ClashConfig } from "@subboost/core/types/config";
 
@@ -73,6 +74,25 @@ describe("configToYaml", () => {
     expect(yaml).toBe(["proxies:", "", "proxy-groups:", "", "rule-providers:", "", "rules:"].join("\n"));
   });
 
+  it("quotes rule scalars that YAML would otherwise truncate or reinterpret", () => {
+    const rules = [
+      "DOMAIN-SUFFIX,example.com,Netflix #1",
+      "DOMAIN,example.net,Group: Primary",
+      "MATCH,Select",
+    ];
+    const output = configToYaml({
+      proxies: [],
+      "proxy-groups": [],
+      "rule-providers": {},
+      rules,
+    } as unknown as ClashConfig);
+
+    expect((yamlParser.load(output) as ClashConfig).rules).toEqual(rules);
+    expect(output).toContain('  - "DOMAIN-SUFFIX,example.com,Netflix #1"');
+    expect(output).toContain('  - "DOMAIN,example.net,Group: Primary"');
+    expect(output).toContain("  - MATCH,Select");
+  });
+
   it("collects DNS policy entries from clean string and array values only", () => {
     expect(collectDnsPolicyEntries(null)).toEqual([]);
     expect(collectDnsPolicyEntries([])).toEqual([]);
diff --git a/packages/core/src/generator/yaml.ts b/packages/core/src/generator/yaml.ts
index 7efb8cd..840f589 100644
--- a/packages/core/src/generator/yaml.ts
+++ b/packages/core/src/generator/yaml.ts
@@ -237,6 +237,19 @@ function toInlineYaml(value: unknown): string {
   return String(value);
 }
 
+function toBlockSequenceScalar(value: string): string {
+  const trimmed = value.trim();
+  const ambiguous =
+    !value ||
+    trimmed !== value ||
+    /[\r\n#]/.test(value) ||
+    /:\s/.test(value) ||
+    /^[\-?:,\[\]{}&*!|>'"%@`]/.test(value) ||
+    /^(?:null|~|true|false|yes|no|on|off)$/i.test(value) ||
+    /^[+-]?(?:\d+|\d*\.\d+|\d+\.\d*)(?:[eE][+-]?\d+)?$/.test(value);
+  return ambiguous ? `"${escapeYamlDoubleQuotedString(value)}"` : value;
+}
+
 function normalizeDnsPolicyValue(value: unknown): DnsPolicyValue | null {
   if (Array.isArray(value)) {
     const servers = value
@@ -372,7 +385,7 @@ export function configToYaml(config: ClashConfig): string {
   lines.push("rules:");
   if (config.rules) {
     for (const rule of config.rules) {
-      lines.push(`  - ${rule}`);
+      lines.push(`  - ${toBlockSequenceScalar(rule)}`);
     }
   }
 
diff --git a/packages/core/src/mihomo/proxy-sanitizer-boundaries.test.ts b/packages/core/src/mihomo/proxy-sanitizer-boundaries.test.ts
new file mode 100644
index 0000000..eb34d5d
--- /dev/null
+++ b/packages/core/src/mihomo/proxy-sanitizer-boundaries.test.ts
@@ -0,0 +1,495 @@
+import { describe, expect, it } from "vitest";
+import {
+  isMihomoSupportedProxyNode,
+  isStandardBase64String,
+  normalizeMihomoVlessForGeneration,
+  sanitizeMihomoProxyNode,
+} from "./proxy-sanitizer";
+
+const REALITY_PUBLIC_KEY = "A".repeat(43);
+const WIREGUARD_KEY = `${"A".repeat(43)}=`;
+const PRIVATE_KEY = ["-----BEGIN OPENSSH ", "PRIVATE ", "KEY-----\nabc\n-----END OPENSSH ", "PRIVATE ", "KEY-----"].join("");
+
+describe("Mihomo proxy sanitizer boundaries", () => {
+  it("covers sanitizer boundary aliases and optional protocol fallbacks", () => {
+    const ecdsaSsh = sanitizeMihomoProxyNode({
+      name: "SSH",
+      type: "ssh",
+      server: "ssh.example.com",
+      port: 22,
+      password: "secret",
+      "host-key": [
+        "ssh-ecdsa-nistp256 AAAAC3NzaC1lZDI1NTE5AAAAIA==",
+        "ssh-ecdsa-!bad AAAAC3NzaC1lZDI1NTE5AAAAIA==",
+        "ssh-rsa bad!token",
+      ],
+    });
+    const certless = sanitizeMihomoProxyNode({
+      name: "HTTP",
+      type: "http",
+      server: "http.example.com",
+      port: 80,
+      fingerprint: 1,
+    });
+    const clientFingerprintAlreadySet = sanitizeMihomoProxyNode({
+      name: "Trojan",
+      type: "trojan",
+      server: "trojan.example.com",
+      port: 443,
+      password: "secret",
+      fingerprint: "Chrome",
+      "client-fingerprint": "safari",
+    });
+    const wireguardReservedArray = sanitizeMihomoProxyNode({
+      name: "WG",
+      type: "wireguard",
+      server: "wg.example.com",
+      port: 51820,
+      "private-key": WIREGUARD_KEY,
+      reserved: [1, "2", 3],
+    });
+    const xhttpNoReality = normalizeMihomoVlessForGeneration({
+      name: "XHTTP",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "xhttp-opts": {
+        "download-settings": {
+          "ech-opts": {
+            enable: false,
+            config: Buffer.from("ech").toString("base64"),
+            "query-server-name": " ech.example.com ",
+          },
+        },
+      },
+    });
+
+    expect(ecdsaSsh).toMatchObject({
+      "host-key": ["ssh-ecdsa-nistp256 AAAAC3NzaC1lZDI1NTE5AAAAIA=="],
+    });
+    expect(certless).not.toHaveProperty("fingerprint");
+    expect(clientFingerprintAlreadySet).toMatchObject({ "client-fingerprint": "safari" });
+    expect(clientFingerprintAlreadySet).not.toHaveProperty("fingerprint");
+    expect(wireguardReservedArray).toHaveProperty("reserved", [1, 2, 3]);
+    expect(xhttpNoReality).toMatchObject({
+      "xhttp-opts": {
+        "download-settings": {
+          "ech-opts": {
+            enable: false,
+            config: Buffer.from("ech").toString("base64"),
+            "query-server-name": "ech.example.com",
+          },
+        },
+      },
+    });
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "trojan",
+        name: "Trojan",
+        server: "trojan.example.com",
+        port: 443,
+        password: "secret",
+      })
+    ).toBe(true);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "ss",
+        name: "SS",
+        server: "ss.example.com",
+        port: 8388,
+        cipher: "aes-128-gcm",
+        password: "secret",
+        plugin: "v2ray-plugin",
+      })
+    ).toBe(true);
+  });
+
+  it("rejects explicit malformed optional transport fields", () => {
+    const ssh = sanitizeMihomoProxyNode({
+      name: "SSH",
+      type: "ssh",
+      server: "ssh.example.com",
+      port: 22,
+      password: "secret",
+      "host-key": [
+        "ssh-rsa AAAA",
+        "ssh-dss AAAA comment",
+        "ssh-ed25519",
+        "ssh-ecdsa-!bad AAAA",
+      ],
+    });
+    const invalidReserved = sanitizeMihomoProxyNode({
+      name: "WG",
+      type: "wireguard",
+      server: "wg.example.com",
+      port: 51820,
+      "private-key": WIREGUARD_KEY,
+      reserved: "1,2",
+    });
+    const explicitEmptyDownloadReality = normalizeMihomoVlessForGeneration({
+      name: "XHTTP",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "reality-opts": {
+        "public-key": REALITY_PUBLIC_KEY,
+      },
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": "",
+          },
+        },
+      },
+    });
+    const invalidDownloadReality = normalizeMihomoVlessForGeneration({
+      name: "XHTTP",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "reality-opts": {
+        "public-key": REALITY_PUBLIC_KEY,
+      },
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": "bad",
+          },
+        },
+      },
+    });
+    const invalidMainReality = normalizeMihomoVlessForGeneration({
+      name: "Reality",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      "reality-opts": "bad",
+    });
+    const prefixedCertificate = sanitizeMihomoProxyNode({
+      name: "HTTPS",
+      type: "https",
+      server: "https.example.com",
+      port: 443,
+      fingerprint: "SHA256=" + "C".repeat(64).match(/.{1,2}/g)?.join(":"),
+    });
+
+    expect(isMihomoSupportedProxyNode({ type: "ss", cipher: "", password: "secret" })).toBe(false);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "vless",
+        uuid: "11111111-1111-4111-8111-111111111111",
+        network: "xhttp",
+        "reality-opts": {
+          "public-key": REALITY_PUBLIC_KEY,
+        },
+        "xhttp-opts": {
+          "download-settings": {
+            "reality-opts": {
+              "public-key": "bad",
+            },
+          },
+        },
+      })
+    ).toBe(false);
+    expect(ssh).toMatchObject({ "host-key": ["ssh-rsa AAAA", "ssh-dss AAAA comment"] });
+    expect(invalidReserved).not.toHaveProperty("reserved");
+    expect(explicitEmptyDownloadReality).toMatchObject({
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": "",
+          },
+        },
+      },
+    });
+    expect(invalidDownloadReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
+    expect(invalidMainReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
+    expect(prefixedCertificate).toHaveProperty("fingerprint", "c".repeat(64));
+  });
+
+  it("covers conservative sanitizer fallbacks for omitted and malformed optional fields", () => {
+    const sshWithScalarHostKey = sanitizeMihomoProxyNode({
+      name: "SSH",
+      type: "ssh",
+      server: "ssh.example.com",
+      port: 22,
+      password: "secret",
+      "host-key": "ssh-rsa AAAA",
+      "private-key": undefined,
+      "server-fingerprint": 1,
+    });
+    const sshWithEmptyHostKeyMaterial = sanitizeMihomoProxyNode({
+      name: "SSH",
+      type: "ssh",
+      server: "ssh.example.com",
+      port: 22,
+      password: "secret",
+      "host-key": ["ssh-rsa ", "ssh-ecdsa- AAAA", "ssh-ed25519 AAAA"],
+    });
+    const wireguardWithUndefinedOptionalKeys = sanitizeMihomoProxyNode({
+      name: "WG",
+      type: "wireguard",
+      server: "wg.example.com",
+      port: 51820,
+      "private-key": WIREGUARD_KEY,
+      "public-key": undefined,
+      "pre-shared-key": undefined,
+      reserved: "",
+    });
+    const plainHttp = sanitizeMihomoProxyNode({
+      name: "HTTP",
+      type: "http",
+      server: "http.example.com",
+      port: 80,
+      udp: "TRUE",
+      tls: "FALSE",
+      alpn: [],
+      fingerprint: "Not-A-Known-Alias",
+      "ws-opts": {},
+    });
+    const vlessWithoutReality = sanitizeMihomoProxyNode({
+      name: "VLESS",
+      type: "vless",
+      server: "vless.example.com",
+      port: 443,
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": REALITY_PUBLIC_KEY,
+            "short-id": "not-hex",
+          },
+          "ech-opts": {
+            enable: "0",
+            config: "",
+            "query-server-name": " ",
+          },
+        },
+      },
+    });
+
+    expect(sshWithScalarHostKey).not.toHaveProperty("host-key");
+    expect(sshWithScalarHostKey).not.toHaveProperty("private-key");
+    expect(sshWithScalarHostKey).not.toHaveProperty("server-fingerprint");
+    expect(sshWithEmptyHostKeyMaterial).toHaveProperty("host-key", ["ssh-ed25519 AAAA"]);
+    expect(wireguardWithUndefinedOptionalKeys).toMatchObject({
+      "private-key": WIREGUARD_KEY,
+    });
+    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("public-key");
+    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("pre-shared-key");
+    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("reserved");
+    expect(plainHttp).toMatchObject({ udp: true, tls: false });
+    expect(plainHttp).not.toHaveProperty("alpn");
+    expect(plainHttp).not.toHaveProperty("fingerprint");
+    expect(plainHttp).not.toHaveProperty("ws-opts");
+    expect(vlessWithoutReality).toMatchObject({
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": REALITY_PUBLIC_KEY,
+          },
+          "ech-opts": {
+            enable: false,
+          },
+        },
+      },
+    });
+    expect(
+      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"][
+        "reality-opts"
+      ]
+    ).not.toHaveProperty("short-id");
+    expect(
+      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"]["ech-opts"]
+    ).not.toHaveProperty("config");
+    expect(
+      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"]["ech-opts"]
+    ).not.toHaveProperty("query-server-name");
+
+    expect(isMihomoSupportedProxyNode({ type: "http", name: "HTTP" })).toBe(true);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "wireguard",
+        name: "WG",
+        server: "wg.example.com",
+        port: 51820,
+        "private-key": WIREGUARD_KEY,
+        "public-key": undefined,
+        "pre-shared-key": WIREGUARD_KEY,
+      })
+    ).toBe(true);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "ssh",
+        name: "SSH",
+        server: "ssh.example.com",
+        port: 22,
+        "private-key": "bad",
+      })
+    ).toBe(false);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "ssh",
+        name: "SSH",
+        server: "ssh.example.com",
+        port: 22,
+        "private-key": PRIVATE_KEY,
+      })
+    ).toBe(true);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "ss",
+        name: "SS",
+        server: "ss.example.com",
+        port: 8388,
+        cipher: "aes-128-gcm",
+        password: "secret",
+        plugin: "simple-obfs",
+      })
+    ).toBe(true);
+  });
+
+  it("covers remaining protocol support and cleanup fallbacks", () => {
+    expect(isStandardBase64String("abcd!")).toBe(false);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "ssr",
+        name: "SSR",
+        server: "ssr.example.com",
+        port: 8388,
+        cipher: "aes-128-gcm",
+        password: "secret",
+        protocol: "",
+        obfs: "plain",
+      })
+    ).toBe(false);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "vless",
+        name: "XHTTP",
+        server: "vless.example.com",
+        port: 443,
+        uuid: "11111111-1111-4111-8111-111111111111",
+        network: "xhttp",
+        "reality-opts": { "public-key": REALITY_PUBLIC_KEY },
+        "xhttp-opts": {
+          mode: "stream-one",
+          "download-settings": {
+            path: "/download",
+          },
+        },
+      })
+    ).toBe(false);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "vless",
+        name: "XHTTP",
+        server: "vless.example.com",
+        port: 443,
+        uuid: "11111111-1111-4111-8111-111111111111",
+        network: "xhttp",
+        "reality-opts": { "public-key": REALITY_PUBLIC_KEY },
+        "xhttp-opts": {
+          "download-settings": {
+            "reality-opts": {
+              "public-key": "",
+            },
+          },
+        },
+      })
+    ).toBe(true);
+
+    const invalidContainers = sanitizeMihomoProxyNode({
+      name: "Containers",
+      type: "vmess",
+      server: "vmess.example.com",
+      port: 443,
+      uuid: "11111111-1111-4111-8111-111111111111",
+      ech: "bad",
+      alpn: 443,
+      "ech-opts": [],
+      "ws-opts": {},
+      fingerprint: "unknown",
+    });
+    const sshWithoutHostKey = sanitizeMihomoProxyNode({
+      name: "SSH",
+      type: "ssh",
+      server: "ssh.example.com",
+      port: 22,
+      password: "secret",
+      "host-key": "ssh-ed25519 AAAA",
+      "server-fingerprint": `SHA256:${"B".repeat(43)}=`,
+    });
+    const wireguardMissingReserved = sanitizeMihomoProxyNode({
+      name: "WG",
+      type: "wireguard",
+      server: "wg.example.com",
+      port: 51820,
+      "private-key": WIREGUARD_KEY,
+      reserved: "1,2",
+    });
+    const noRealityDownloadSettings = normalizeMihomoVlessForGeneration({
+      name: "XHTTP",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "xhttp-opts": {
+        "download-settings": {
+          path: "/download",
+        },
+      },
+    });
+    const invalidDownloadReality = normalizeMihomoVlessForGeneration({
+      name: "XHTTP",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": "bad",
+          },
+        },
+      },
+    });
+    const explicitTlsReality = normalizeMihomoVlessForGeneration({
+      name: "Reality",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      tls: true,
+      "client-fingerprint": "edge",
+      "reality-opts": {
+        "public-key": REALITY_PUBLIC_KEY,
+      },
+    });
+    const noEncryption = sanitizeMihomoProxyNode({
+      name: "VLESS",
+      type: "vless",
+      server: "vless.example.com",
+      port: 443,
+      uuid: "11111111-1111-4111-8111-111111111111",
+      encryption: " ",
+    });
+
+    expect(invalidContainers).not.toHaveProperty("alpn");
+    expect(invalidContainers).not.toHaveProperty("ech-opts");
+    expect(invalidContainers).not.toHaveProperty("fingerprint");
+    expect(invalidContainers).not.toHaveProperty("ws-opts");
+    expect(sshWithoutHostKey).not.toHaveProperty("host-key");
+    expect(sshWithoutHostKey).toHaveProperty("server-fingerprint", `SHA256:${"B".repeat(43)}=`);
+    expect(wireguardMissingReserved).not.toHaveProperty("reserved");
+    expect(noRealityDownloadSettings).toMatchObject({
+      "xhttp-opts": {
+        "download-settings": {
+          path: "/download",
+        },
+      },
+    });
+    expect(invalidDownloadReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
+    expect(explicitTlsReality).toMatchObject({
+      tls: true,
+      "client-fingerprint": "edge",
+    });
+    expect(noEncryption).not.toHaveProperty("encryption");
+  });
+});
diff --git a/packages/core/src/mihomo/proxy-sanitizer.test.ts b/packages/core/src/mihomo/proxy-sanitizer.test.ts
index 84cb7a9..7397ed2 100644
--- a/packages/core/src/mihomo/proxy-sanitizer.test.ts
+++ b/packages/core/src/mihomo/proxy-sanitizer.test.ts
@@ -545,485 +545,4 @@ describe("Mihomo proxy sanitizer", () => {
     });
   });
 
-  it("covers sanitizer boundary aliases and optional protocol fallbacks", () => {
-    const ecdsaSsh = sanitizeMihomoProxyNode({
-      name: "SSH",
-      type: "ssh",
-      server: "ssh.example.com",
-      port: 22,
-      password: "secret",
-      "host-key": [
-        "ssh-ecdsa-nistp256 AAAAC3NzaC1lZDI1NTE5AAAAIA==",
-        "ssh-ecdsa-!bad AAAAC3NzaC1lZDI1NTE5AAAAIA==",
-        "ssh-rsa bad!token",
-      ],
-    });
-    const certless = sanitizeMihomoProxyNode({
-      name: "HTTP",
-      type: "http",
-      server: "http.example.com",
-      port: 80,
-      fingerprint: 1,
-    });
-    const clientFingerprintAlreadySet = sanitizeMihomoProxyNode({
-      name: "Trojan",
-      type: "trojan",
-      server: "trojan.example.com",
-      port: 443,
-      password: "secret",
-      fingerprint: "Chrome",
-      "client-fingerprint": "safari",
-    });
-    const wireguardReservedArray = sanitizeMihomoProxyNode({
-      name: "WG",
-      type: "wireguard",
-      server: "wg.example.com",
-      port: 51820,
-      "private-key": WIREGUARD_KEY,
-      reserved: [1, "2", 3],
-    });
-    const xhttpNoReality = normalizeMihomoVlessForGeneration({
-      name: "XHTTP",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "xhttp-opts": {
-        "download-settings": {
-          "ech-opts": {
-            enable: false,
-            config: Buffer.from("ech").toString("base64"),
-            "query-server-name": " ech.example.com ",
-          },
-        },
-      },
-    });
-
-    expect(ecdsaSsh).toMatchObject({
-      "host-key": ["ssh-ecdsa-nistp256 AAAAC3NzaC1lZDI1NTE5AAAAIA=="],
-    });
-    expect(certless).not.toHaveProperty("fingerprint");
-    expect(clientFingerprintAlreadySet).toMatchObject({ "client-fingerprint": "safari" });
-    expect(clientFingerprintAlreadySet).not.toHaveProperty("fingerprint");
-    expect(wireguardReservedArray).toHaveProperty("reserved", [1, 2, 3]);
-    expect(xhttpNoReality).toMatchObject({
-      "xhttp-opts": {
-        "download-settings": {
-          "ech-opts": {
-            enable: false,
-            config: Buffer.from("ech").toString("base64"),
-            "query-server-name": "ech.example.com",
-          },
-        },
-      },
-    });
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "trojan",
-        name: "Trojan",
-        server: "trojan.example.com",
-        port: 443,
-        password: "secret",
-      })
-    ).toBe(true);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "ss",
-        name: "SS",
-        server: "ss.example.com",
-        port: 8388,
-        cipher: "aes-128-gcm",
-        password: "secret",
-        plugin: "v2ray-plugin",
-      })
-    ).toBe(true);
-  });
-
-  it("rejects explicit malformed optional transport fields", () => {
-    const ssh = sanitizeMihomoProxyNode({
-      name: "SSH",
-      type: "ssh",
-      server: "ssh.example.com",
-      port: 22,
-      password: "secret",
-      "host-key": [
-        "ssh-rsa AAAA",
-        "ssh-dss AAAA comment",
-        "ssh-ed25519",
-        "ssh-ecdsa-!bad AAAA",
-      ],
-    });
-    const invalidReserved = sanitizeMihomoProxyNode({
-      name: "WG",
-      type: "wireguard",
-      server: "wg.example.com",
-      port: 51820,
-      "private-key": WIREGUARD_KEY,
-      reserved: "1,2",
-    });
-    const explicitEmptyDownloadReality = normalizeMihomoVlessForGeneration({
-      name: "XHTTP",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "reality-opts": {
-        "public-key": REALITY_PUBLIC_KEY,
-      },
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": "",
-          },
-        },
-      },
-    });
-    const invalidDownloadReality = normalizeMihomoVlessForGeneration({
-      name: "XHTTP",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "reality-opts": {
-        "public-key": REALITY_PUBLIC_KEY,
-      },
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": "bad",
-          },
-        },
-      },
-    });
-    const invalidMainReality = normalizeMihomoVlessForGeneration({
-      name: "Reality",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      "reality-opts": "bad",
-    });
-    const prefixedCertificate = sanitizeMihomoProxyNode({
-      name: "HTTPS",
-      type: "https",
-      server: "https.example.com",
-      port: 443,
-      fingerprint: "SHA256=" + "C".repeat(64).match(/.{1,2}/g)?.join(":"),
-    });
-
-    expect(isMihomoSupportedProxyNode({ type: "ss", cipher: "", password: "secret" })).toBe(false);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "vless",
-        uuid: "11111111-1111-4111-8111-111111111111",
-        network: "xhttp",
-        "reality-opts": {
-          "public-key": REALITY_PUBLIC_KEY,
-        },
-        "xhttp-opts": {
-          "download-settings": {
-            "reality-opts": {
-              "public-key": "bad",
-            },
-          },
-        },
-      })
-    ).toBe(false);
-    expect(ssh).toMatchObject({ "host-key": ["ssh-rsa AAAA", "ssh-dss AAAA comment"] });
-    expect(invalidReserved).not.toHaveProperty("reserved");
-    expect(explicitEmptyDownloadReality).toMatchObject({
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": "",
-          },
-        },
-      },
-    });
-    expect(invalidDownloadReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
-    expect(invalidMainReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
-    expect(prefixedCertificate).toHaveProperty("fingerprint", "c".repeat(64));
-  });
-
-  it("covers conservative sanitizer fallbacks for omitted and malformed optional fields", () => {
-    const sshWithScalarHostKey = sanitizeMihomoProxyNode({
-      name: "SSH",
-      type: "ssh",
-      server: "ssh.example.com",
-      port: 22,
-      password: "secret",
-      "host-key": "ssh-rsa AAAA",
-      "private-key": undefined,
-      "server-fingerprint": 1,
-    });
-    const sshWithEmptyHostKeyMaterial = sanitizeMihomoProxyNode({
-      name: "SSH",
-      type: "ssh",
-      server: "ssh.example.com",
-      port: 22,
-      password: "secret",
-      "host-key": ["ssh-rsa ", "ssh-ecdsa- AAAA", "ssh-ed25519 AAAA"],
-    });
-    const wireguardWithUndefinedOptionalKeys = sanitizeMihomoProxyNode({
-      name: "WG",
-      type: "wireguard",
-      server: "wg.example.com",
-      port: 51820,
-      "private-key": WIREGUARD_KEY,
-      "public-key": undefined,
-      "pre-shared-key": undefined,
-      reserved: "",
-    });
-    const plainHttp = sanitizeMihomoProxyNode({
-      name: "HTTP",
-      type: "http",
-      server: "http.example.com",
-      port: 80,
-      udp: "TRUE",
-      tls: "FALSE",
-      alpn: [],
-      fingerprint: "Not-A-Known-Alias",
-      "ws-opts": {},
-    });
-    const vlessWithoutReality = sanitizeMihomoProxyNode({
-      name: "VLESS",
-      type: "vless",
-      server: "vless.example.com",
-      port: 443,
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": REALITY_PUBLIC_KEY,
-            "short-id": "not-hex",
-          },
-          "ech-opts": {
-            enable: "0",
-            config: "",
-            "query-server-name": " ",
-          },
-        },
-      },
-    });
-
-    expect(sshWithScalarHostKey).not.toHaveProperty("host-key");
-    expect(sshWithScalarHostKey).not.toHaveProperty("private-key");
-    expect(sshWithScalarHostKey).not.toHaveProperty("server-fingerprint");
-    expect(sshWithEmptyHostKeyMaterial).toHaveProperty("host-key", ["ssh-ed25519 AAAA"]);
-    expect(wireguardWithUndefinedOptionalKeys).toMatchObject({
-      "private-key": WIREGUARD_KEY,
-    });
-    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("public-key");
-    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("pre-shared-key");
-    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("reserved");
-    expect(plainHttp).toMatchObject({ udp: true, tls: false });
-    expect(plainHttp).not.toHaveProperty("alpn");
-    expect(plainHttp).not.toHaveProperty("fingerprint");
-    expect(plainHttp).not.toHaveProperty("ws-opts");
-    expect(vlessWithoutReality).toMatchObject({
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": REALITY_PUBLIC_KEY,
-          },
-          "ech-opts": {
-            enable: false,
-          },
-        },
-      },
-    });
-    expect(
-      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"][
-        "reality-opts"
-      ]
-    ).not.toHaveProperty("short-id");
-    expect(
-      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"]["ech-opts"]
-    ).not.toHaveProperty("config");
-    expect(
-      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"]["ech-opts"]
-    ).not.toHaveProperty("query-server-name");
-
-    expect(isMihomoSupportedProxyNode({ type: "http", name: "HTTP" })).toBe(true);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "wireguard",
-        name: "WG",
-        server: "wg.example.com",
-        port: 51820,
-        "private-key": WIREGUARD_KEY,
-        "public-key": undefined,
-        "pre-shared-key": WIREGUARD_KEY,
-      })
-    ).toBe(true);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "ssh",
-        name: "SSH",
-        server: "ssh.example.com",
-        port: 22,
-        "private-key": "bad",
-      })
-    ).toBe(false);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "ssh",
-        name: "SSH",
-        server: "ssh.example.com",
-        port: 22,
-        "private-key": PRIVATE_KEY,
-      })
-    ).toBe(true);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "ss",
-        name: "SS",
-        server: "ss.example.com",
-        port: 8388,
-        cipher: "aes-128-gcm",
-        password: "secret",
-        plugin: "simple-obfs",
-      })
-    ).toBe(true);
-  });
-
-  it("covers remaining protocol support and cleanup fallbacks", () => {
-    expect(isStandardBase64String("abcd!")).toBe(false);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "ssr",
-        name: "SSR",
-        server: "ssr.example.com",
-        port: 8388,
-        cipher: "aes-128-gcm",
-        password: "secret",
-        protocol: "",
-        obfs: "plain",
-      })
-    ).toBe(false);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "vless",
-        name: "XHTTP",
-        server: "vless.example.com",
-        port: 443,
-        uuid: "11111111-1111-4111-8111-111111111111",
-        network: "xhttp",
-        "reality-opts": { "public-key": REALITY_PUBLIC_KEY },
-        "xhttp-opts": {
-          mode: "stream-one",
-          "download-settings": {
-            path: "/download",
-          },
-        },
-      })
-    ).toBe(false);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "vless",
-        name: "XHTTP",
-        server: "vless.example.com",
-        port: 443,
-        uuid: "11111111-1111-4111-8111-111111111111",
-        network: "xhttp",
-        "reality-opts": { "public-key": REALITY_PUBLIC_KEY },
-        "xhttp-opts": {
-          "download-settings": {
-            "reality-opts": {
-              "public-key": "",
-            },
-          },
-        },
-      })
-    ).toBe(true);
-
-    const invalidContainers = sanitizeMihomoProxyNode({
-      name: "Containers",
-      type: "vmess",
-      server: "vmess.example.com",
-      port: 443,
-      uuid: "11111111-1111-4111-8111-111111111111",
-      ech: "bad",
-      alpn: 443,
-      "ech-opts": [],
-      "ws-opts": {},
-      fingerprint: "unknown",
-    });
-    const sshWithoutHostKey = sanitizeMihomoProxyNode({
-      name: "SSH",
-      type: "ssh",
-      server: "ssh.example.com",
-      port: 22,
-      password: "secret",
-      "host-key": "ssh-ed25519 AAAA",
-      "server-fingerprint": `SHA256:${"B".repeat(43)}=`,
-    });
-    const wireguardMissingReserved = sanitizeMihomoProxyNode({
-      name: "WG",
-      type: "wireguard",
-      server: "wg.example.com",
-      port: 51820,
-      "private-key": WIREGUARD_KEY,
-      reserved: "1,2",
-    });
-    const noRealityDownloadSettings = normalizeMihomoVlessForGeneration({
-      name: "XHTTP",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "xhttp-opts": {
-        "download-settings": {
-          path: "/download",
-        },
-      },
-    });
-    const invalidDownloadReality = normalizeMihomoVlessForGeneration({
-      name: "XHTTP",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": "bad",
-          },
-        },
-      },
-    });
-    const explicitTlsReality = normalizeMihomoVlessForGeneration({
-      name: "Reality",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      tls: true,
-      "client-fingerprint": "edge",
-      "reality-opts": {
-        "public-key": REALITY_PUBLIC_KEY,
-      },
-    });
-    const noEncryption = sanitizeMihomoProxyNode({
-      name: "VLESS",
-      type: "vless",
-      server: "vless.example.com",
-      port: 443,
-      uuid: "11111111-1111-4111-8111-111111111111",
-      encryption: " ",
-    });
-
-    expect(invalidContainers).not.toHaveProperty("alpn");
-    expect(invalidContainers).not.toHaveProperty("ech-opts");
-    expect(invalidContainers).not.toHaveProperty("fingerprint");
-    expect(invalidContainers).not.toHaveProperty("ws-opts");
-    expect(sshWithoutHostKey).not.toHaveProperty("host-key");
-    expect(sshWithoutHostKey).toHaveProperty("server-fingerprint", `SHA256:${"B".repeat(43)}=`);
-    expect(wireguardMissingReserved).not.toHaveProperty("reserved");
-    expect(noRealityDownloadSettings).toMatchObject({
-      "xhttp-opts": {
-        "download-settings": {
-          path: "/download",
-        },
-      },
-    });
-    expect(invalidDownloadReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
-    expect(explicitTlsReality).toMatchObject({
-      tls: true,
-      "client-fingerprint": "edge",
-    });
-    expect(noEncryption).not.toHaveProperty("encryption");
-  });
 });
diff --git a/packages/core/src/parser/clash-yaml.test.ts b/packages/core/src/parser/clash-yaml.test.ts
index 102aef5..d36ad65 100644
--- a/packages/core/src/parser/clash-yaml.test.ts
+++ b/packages/core/src/parser/clash-yaml.test.ts
@@ -208,6 +208,25 @@ proxies:
     expect(mixed.errors[0]).toContain('节点 "Bad" 解析失败');
   });
 
+  it("repairs large malformed proxy lists without quadratic scanning", () => {
+    const count = 2_000;
+    const rows = ["proxies:"];
+    for (let index = 0; index < count; index += 1) {
+      rows.push(`  - name: Node ${index}`);
+      rows.push("      type: ss");
+      rows.push(`      server: node-${index}.example.com`);
+      rows.push("      port: 8388");
+    }
+
+    const startedAt = performance.now();
+    const result = parseClashYaml(rows.join("\n"));
+    const elapsedMs = performance.now() - startedAt;
+
+    expect(result.errors).toEqual([]);
+    expect(result.nodes).toHaveLength(count);
+    expect(elapsedMs).toBeLessThan(1_500);
+  }, 10_000);
+
   it("parses consistently indented root flow proxy lists", () => {
     for (const spaces of [0, 1, 2, 4]) {
       const indent = " ".repeat(spaces);
diff --git a/packages/core/src/parser/clash-yaml.ts b/packages/core/src/parser/clash-yaml.ts
index 26381e6..3d5245b 100644
--- a/packages/core/src/parser/clash-yaml.ts
+++ b/packages/core/src/parser/clash-yaml.ts
@@ -106,6 +106,53 @@ function repairRootFlowProxyListIndent(input: string): string {
   return lines.join("\n");
 }
 
+function repairInlineListIndent(input: string): string {
+  // 修复常见的“列表项首行内联 key（- name: xxx）但后续 key 又多缩进”的不合法 YAML。
+  // 逐个列表项消费其后续块，确保每一行最多检查一次，避免大型订阅退化为 O(n²)。
+  const lines = input.split(/\r?\n/);
+  const out: string[] = [];
+
+  for (let index = 0; index < lines.length; ) {
+    const line = lines[index];
+    const match = line.match(/^(\s*)-\s*(name\s*:\s*.+)$/);
+    if (!match) {
+      out.push(line);
+      index += 1;
+      continue;
+    }
+
+    const dashIndent = match[1].length;
+    const keyIndent = dashIndent + 2;
+    let minIndent = Number.POSITIVE_INFINITY;
+    let blockEnd = index + 1;
+
+    while (blockEnd < lines.length) {
+      const nextLine = lines[blockEnd];
+      const trimmed = nextLine.trim();
+      if (!trimmed || trimmed.startsWith("#")) {
+        blockEnd += 1;
+        continue;
+      }
+
+      const indent = countLeadingSpaces(nextLine);
+      if (indent <= dashIndent) break;
+      minIndent = Math.min(minIndent, indent);
+      blockEnd += 1;
+    }
+
+    if (minIndent !== Number.POSITIVE_INFINITY && minIndent > keyIndent) {
+      out.push(`${" ".repeat(dashIndent)}-`);
+      out.push(`${" ".repeat(minIndent)}${match[2]}`);
+    } else {
+      out.push(line);
+    }
+    out.push(...lines.slice(index + 1, blockEnd));
+    index = blockEnd;
+  }
+
+  return out.join("\n");
+}
+
 /**
  * 解析 Clash YAML 配置
  */
@@ -116,55 +163,6 @@ export function parseClashYaml(content: string): ParseResult {
   try {
     const normalizeTabs = (s: string) => s.replace(/\t/g, "  ");
 
-    const repairInlineListIndent = (input: string): string => {
-      // 修复常见的“列表项首行内联 key（- name: xxx）但后续 key 又多缩进”的不合法 YAML
-      // 例如（不合法）：
-      //  - name: ss-A
-      //     type: ss
-      // 修复为（合法）：
-      //  -
-      //     name: ss-A
-      //     type: ss
-      const lines = input.split(/\r?\n/);
-      const out: string[] = [];
-
-      for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-        const m = line.match(/^(\s*)-\s*(name\s*:\s*.+)$/);
-        if (!m) {
-          out.push(line);
-          continue;
-        }
-
-        const dashIndent = m[1].length;
-        const namePair = m[2];
-        const keyIndent = dashIndent + 2;
-
-        // 计算该列表项后续块内最小缩进（用于对齐 name/type/server 等）
-        let minIndent = Number.POSITIVE_INFINITY;
-        for (let j = i + 1; j < lines.length; j++) {
-          const l = lines[j];
-          if (!l.trim() || l.trim().startsWith("#")) continue;
-
-          const indent = (l.match(/^(\s*)/)?.[1].length ?? 0);
-          // 缩进回退到当前列表项的 '-' 缩进（或更浅）时，说明已经离开该列表项
-          if (indent <= dashIndent) break;
-          minIndent = Math.min(minIndent, indent);
-        }
-
-        // 仅当后续 key 明显比内联 key 更深时才修复，避免误改合法 YAML
-        if (minIndent !== Number.POSITIVE_INFINITY && minIndent > keyIndent) {
-          out.push(`${" ".repeat(dashIndent)}-`);
-          out.push(`${" ".repeat(minIndent)}${namePair}`);
-          continue;
-        }
-
-        out.push(line);
-      }
-
-      return out.join("\n");
-    };
-
     const tryLoad = (raw: string): unknown => yaml.load(raw) as unknown;
     const normalizedContent = normalizeClashYamlScalarText(normalizeTabs(content));
 
diff --git a/packages/core/src/parser/config-line-parser.test.ts b/packages/core/src/parser/config-line-parser.test.ts
index c21ae05..bf90f70 100644
--- a/packages/core/src/parser/config-line-parser.test.ts
+++ b/packages/core/src/parser/config-line-parser.test.ts
@@ -1,216 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { looksLikeConfigLine } from "./config-line-parser";
 import { mustParseConfigLine } from "./config-line-parser.test-helpers";
-import {
-  applyCommonNodeParams,
-  applyTransport,
-  inferSkipCertVerify,
-  isUuidLike,
-  parseBooleanish,
-  parseIntParam,
-  parseStringList,
-  parseWsHeaders,
-  tokenizeConfigLine,
-} from "./config-line-tokenizer";
-
-describe("config line tokenizer helpers", () => {
-  it("tokenizes quoted config lines and mirrors dashed/underscored params", () => {
-    expect(looksLikeConfigLine("Node = ss, example.com, 8388")).toBe(true);
-    expect(looksLikeConfigLine("# Node = ss, example.com, 8388")).toBe(false);
-
-    const tokenized = tokenizeConfigLine(
-      '"My Node" = ss, "ss.example.com", 8388, encrypt_method=aes-128-gcm, password=secret, extra'
-    );
-
-    expect(tokenized).toMatchObject({
-      name: "My Node",
-      type: "ss",
-      host: "ss.example.com",
-      port: 8388,
-      params: {
-        encrypt_method: "aes-128-gcm",
-        "encrypt-method": "aes-128-gcm",
-        password: "secret",
-      },
-      extras: ["extra"],
-    });
-    expect(() => tokenizeConfigLine("broken")).toThrow("无效的配置行格式");
-    expect(() => tokenizeConfigLine("Bad = ss, example.com, 70000")).toThrow("配置行中的地址或端口无效");
-    expect(tokenizeConfigLine("Ignored = ss, ignored.example.com, 8388, =empty, flag")).toMatchObject({
-      params: {},
-      extras: ["flag"],
-    });
-  });
-
-  it("normalizes common primitive params", () => {
-    expect(parseBooleanish("yes")).toBe(true);
-    expect(parseBooleanish("off")).toBe(false);
-    expect(parseBooleanish("maybe")).toBeUndefined();
-    expect(parseStringList(undefined)).toBeUndefined();
-    expect(parseStringList(" , ")).toBeUndefined();
-    expect(parseStringList("a, b,,c")).toEqual(["a", "b", "c"]);
-    expect(parseWsHeaders(undefined)).toBeUndefined();
-    expect(parseWsHeaders("bad|also-bad")).toBeUndefined();
-    expect(parseWsHeaders("Host:|:missing|Good:yes")).toEqual({ Good: "yes" });
-    expect(parseWsHeaders('Host:cdn.example.com|X-Test:"yes"')).toEqual({
-      Host: "cdn.example.com",
-      "X-Test": "yes",
-    });
-    expect(parseIntParam(undefined)).toBeUndefined();
-    expect(parseIntParam("42ms")).toBe(42);
-    expect(parseIntParam("x")).toBeUndefined();
-    expect(isUuidLike("11111111-1111-4111-8111-111111111111")).toBe(true);
-    expect(isUuidLike("not-a-uuid")).toBe(false);
-    expect(inferSkipCertVerify({ "skip-cert-verify": "false" })).toBe(false);
-    expect(inferSkipCertVerify({ "tls-verification": "false" })).toBe(true);
-    expect(inferSkipCertVerify({ "tls-verification": "true" })).toBeUndefined();
-    expect(inferSkipCertVerify({ "allow-insecure": "0" })).toBe(false);
-  });
-
-  it("applies shared node params to non-VMess protocols and rare TLS aliases", () => {
-    const trojan: Record<string, unknown> = { type: "trojan" };
-    applyCommonNodeParams(trojan, {
-      peer: "trojan-sni.example.com",
-      "tls-cert-sha256": "cert",
-      "tls_pubkey_sha256": "pub",
-      "disable-sni": "true",
-      "block-quic": "true",
-      "udp-port": "53",
-      "fast-open": "false",
-      "shadow-tls-version": "3",
-      "shadow-tls-sni": "shadow.example.com",
-      "shadow-tls-password": "shadow-secret",
-    });
-
-    expect(trojan).toMatchObject({
-      sni: "trojan-sni.example.com",
-      "tls-cert-sha256": "cert",
-      "tls-pubkey-sha256": "pub",
-      "disable-sni": true,
-      "block-quic": true,
-      "udp-port": 53,
-      tfo: false,
-      "shadow-tls-version": 3,
-      "shadow-tls-sni": "shadow.example.com",
-      "shadow-tls-password": "shadow-secret",
-    });
-
-    const hysteria2: Record<string, unknown> = { type: "hysteria2" };
-    applyCommonNodeParams(hysteria2, { fingerprint: "chrome" });
-    expect(hysteria2).toMatchObject({ fingerprint: "chrome" });
-  });
-
-  it("applies transport helpers across default, header, and xHTTP edge branches", () => {
-    const defaultWs: Record<string, unknown> = {};
-    applyTransport(defaultWs, { "ws-path": "/ws?ed=128", "ws-headers": "Host:from-header.example.com|X-Test:yes" }, {
-      defaultTransport: "ws",
-    });
-    expect(defaultWs).toMatchObject({
-      network: "ws",
-      "ws-opts": {
-        path: "/ws",
-        headers: {
-          Host: "from-header.example.com",
-          "X-Test": "yes",
-        },
-        "early-data-header-name": "Sec-WebSocket-Protocol",
-        "max-early-data": 128,
-      },
-    });
-
-    const plainGrpc: Record<string, unknown> = {};
-    applyTransport(plainGrpc, { transport: "grpc", path: "/svc" });
-    expect(plainGrpc).toMatchObject({
-      network: "grpc",
-      "grpc-opts": {
-        "grpc-service-name": "svc",
-      },
-    });
-
-    const blankHttp: Record<string, unknown> = {};
-    applyTransport(blankHttp, { transport: "http", method: "   ", path: " , " });
-    expect(blankHttp).toMatchObject({
-      network: "http",
-      "http-opts": {
-        method: "GET",
-        path: ["/"],
-        headers: undefined,
-      },
-    });
-
-    const xhttp: Record<string, unknown> = {};
-    applyTransport(xhttp, {
-      transport: "xhttp",
-      path: "/x",
-      host: "cdn.example.com",
-      mode: "packet-up",
-      "xhttp-headers": "User-Agent:SubBoost",
-      "no-grpc-header": "off",
-      "sc-max-each-post-bytes": "bad",
-      "download-headers": "Accept:yaml",
-    }, {
-      allowedTransports: ["tcp", "xhttp"],
-    });
-    expect(xhttp).toMatchObject({
-      network: "xhttp",
-      "xhttp-opts": {
-        path: "/x",
-        host: "cdn.example.com",
-        mode: "packet-up",
-        headers: { "User-Agent": "SubBoost" },
-        "no-grpc-header": false,
-        "download-settings": {
-          headers: { Accept: "yaml" },
-        },
-      },
-    });
-
-    expect(() => applyTransport({}, { transport: "udp" }, { allowedTransports: ["tcp"], protocolName: "测试" })).toThrow(
-      "不支持的 测试 传输层"
-    );
-    expect(() => applyTransport({}, { transport: " " }, { allowedTransports: ["tcp"] })).toThrow(
-      "transport=(empty)"
-    );
-
-    const tcp: Record<string, unknown> = {};
-    applyTransport(tcp, { transport: "tcp" });
-    expect(tcp).toMatchObject({ network: "tcp" });
-
-    const xhttpAliases: Record<string, unknown> = {};
-    applyTransport(xhttpAliases, {
-      network: "xhttp",
-      path: "/alias",
-      headers: "Host:edge.example.com",
-      "max-connections": "2",
-      "c-max-reuse-times": "3",
-      "h-max-request-times": "4",
-      "h-max-reusable-secs": "5",
-      no_grpc_header: "yes",
-      sc_max_each_post_bytes: "4096",
-      downloadheaders: "Accept:yaml",
-    }, {
-      allowedTransports: ["tcp", "xhttp"],
-    });
-    expect(xhttpAliases).toMatchObject({
-      network: "xhttp",
-      "xhttp-opts": {
-        path: "/alias",
-        headers: { Host: "edge.example.com" },
-        "no-grpc-header": true,
-        "sc-max-each-post-bytes": 4096,
-        "reuse-settings": {
-          "max-connections": "2",
-          "c-max-reuse-times": "3",
-          "h-max-request-times": "4",
-          "h-max-reusable-secs": "5",
-        },
-        "download-settings": {
-          headers: { Accept: "yaml" },
-        },
-      },
-    });
-  });
-});
 
 describe("config line parser", () => {
   it("builds VMess and VLESS transport options", () => {
diff --git a/packages/core/src/parser/config-line-tokenizer.test.ts b/packages/core/src/parser/config-line-tokenizer.test.ts
new file mode 100644
index 0000000..7894147
--- /dev/null
+++ b/packages/core/src/parser/config-line-tokenizer.test.ts
@@ -0,0 +1,217 @@
+import { describe, expect, it } from "vitest";
+import { looksLikeConfigLine } from "./config-line-parser";
+import {
+  applyCommonNodeParams,
+  applyTransport,
+  inferSkipCertVerify,
+  isUuidLike,
+  parseBooleanish,
+  parseIntParam,
+  parseStringList,
+  parseWsHeaders,
+  tokenizeConfigLine,
+} from "./config-line-tokenizer";
+
+describe("config line tokenizer helpers", () => {
+  it("tokenizes quoted config lines and mirrors dashed/underscored params", () => {
+    expect(looksLikeConfigLine("Node = ss, example.com, 8388")).toBe(true);
+    expect(looksLikeConfigLine("# Node = ss, example.com, 8388")).toBe(false);
+
+    const tokenized = tokenizeConfigLine(
+      '"My Node" = ss, "ss.example.com", 8388, encrypt_method=aes-128-gcm, password=secret, extra'
+    );
+
+    expect(tokenized).toMatchObject({
+      name: "My Node",
+      type: "ss",
+      host: "ss.example.com",
+      port: 8388,
+      params: {
+        encrypt_method: "aes-128-gcm",
+        "encrypt-method": "aes-128-gcm",
+        password: "secret",
+      },
+      extras: ["extra"],
+    });
+    expect(() => tokenizeConfigLine("broken")).toThrow("无效的配置行格式");
+    expect(() => tokenizeConfigLine("Bad = ss, example.com, 70000")).toThrow("配置行中的地址或端口无效");
+    for (const invalidPort of ["1.5", "0x50", "8e3", "+80", "-1"]) {
+      expect(() => tokenizeConfigLine(`Bad = ss, example.com, ${invalidPort}`), invalidPort).toThrow(
+        "配置行中的地址或端口无效"
+      );
+    }
+    expect(tokenizeConfigLine("Ignored = ss, ignored.example.com, 8388, =empty, flag")).toMatchObject({
+      params: {},
+      extras: ["flag"],
+    });
+  });
+
+  it("normalizes common primitive params", () => {
+    expect(parseBooleanish("yes")).toBe(true);
+    expect(parseBooleanish("off")).toBe(false);
+    expect(parseBooleanish("maybe")).toBeUndefined();
+    expect(parseStringList(undefined)).toBeUndefined();
+    expect(parseStringList(" , ")).toBeUndefined();
+    expect(parseStringList("a, b,,c")).toEqual(["a", "b", "c"]);
+    expect(parseWsHeaders(undefined)).toBeUndefined();
+    expect(parseWsHeaders("bad|also-bad")).toBeUndefined();
+    expect(parseWsHeaders("Host:|:missing|Good:yes")).toEqual({ Good: "yes" });
+    expect(parseWsHeaders('Host:cdn.example.com|X-Test:"yes"')).toEqual({
+      Host: "cdn.example.com",
+      "X-Test": "yes",
+    });
+    expect(parseIntParam(undefined)).toBeUndefined();
+    expect(parseIntParam("42ms")).toBe(42);
+    expect(parseIntParam("x")).toBeUndefined();
+    expect(isUuidLike("11111111-1111-4111-8111-111111111111")).toBe(true);
+    expect(isUuidLike("not-a-uuid")).toBe(false);
+    expect(inferSkipCertVerify({ "skip-cert-verify": "false" })).toBe(false);
+    expect(inferSkipCertVerify({ "tls-verification": "false" })).toBe(true);
+    expect(inferSkipCertVerify({ "tls-verification": "true" })).toBeUndefined();
+    expect(inferSkipCertVerify({ "allow-insecure": "0" })).toBe(false);
+  });
+
+  it("applies shared node params to non-VMess protocols and rare TLS aliases", () => {
+    const trojan: Record<string, unknown> = { type: "trojan" };
+    applyCommonNodeParams(trojan, {
+      peer: "trojan-sni.example.com",
+      "tls-cert-sha256": "cert",
+      "tls_pubkey_sha256": "pub",
+      "disable-sni": "true",
+      "block-quic": "true",
+      "udp-port": "53",
+      "fast-open": "false",
+      "shadow-tls-version": "3",
+      "shadow-tls-sni": "shadow.example.com",
+      "shadow-tls-password": "shadow-secret",
+    });
+
+    expect(trojan).toMatchObject({
+      sni: "trojan-sni.example.com",
+      "tls-cert-sha256": "cert",
+      "tls-pubkey-sha256": "pub",
+      "disable-sni": true,
+      "block-quic": true,
+      "udp-port": 53,
+      tfo: false,
+      "shadow-tls-version": 3,
+      "shadow-tls-sni": "shadow.example.com",
+      "shadow-tls-password": "shadow-secret",
+    });
+
+    const hysteria2: Record<string, unknown> = { type: "hysteria2" };
+    applyCommonNodeParams(hysteria2, { fingerprint: "chrome" });
+    expect(hysteria2).toMatchObject({ fingerprint: "chrome" });
+  });
+
+  it("applies transport helpers across default, header, and xHTTP edge branches", () => {
+    const defaultWs: Record<string, unknown> = {};
+    applyTransport(defaultWs, { "ws-path": "/ws?ed=128", "ws-headers": "Host:from-header.example.com|X-Test:yes" }, {
+      defaultTransport: "ws",
+    });
+    expect(defaultWs).toMatchObject({
+      network: "ws",
+      "ws-opts": {
+        path: "/ws",
+        headers: {
+          Host: "from-header.example.com",
+          "X-Test": "yes",
+        },
+        "early-data-header-name": "Sec-WebSocket-Protocol",
+        "max-early-data": 128,
+      },
+    });
+
+    const plainGrpc: Record<string, unknown> = {};
+    applyTransport(plainGrpc, { transport: "grpc", path: "/svc" });
+    expect(plainGrpc).toMatchObject({
+      network: "grpc",
+      "grpc-opts": {
+        "grpc-service-name": "svc",
+      },
+    });
+
+    const blankHttp: Record<string, unknown> = {};
+    applyTransport(blankHttp, { transport: "http", method: "   ", path: " , " });
+    expect(blankHttp).toMatchObject({
+      network: "http",
+      "http-opts": {
+        method: "GET",
+        path: ["/"],
+        headers: undefined,
+      },
+    });
+
+    const xhttp: Record<string, unknown> = {};
+    applyTransport(xhttp, {
+      transport: "xhttp",
+      path: "/x",
+      host: "cdn.example.com",
+      mode: "packet-up",
+      "xhttp-headers": "User-Agent:SubBoost",
+      "no-grpc-header": "off",
+      "sc-max-each-post-bytes": "bad",
+      "download-headers": "Accept:yaml",
+    }, {
+      allowedTransports: ["tcp", "xhttp"],
+    });
+    expect(xhttp).toMatchObject({
+      network: "xhttp",
+      "xhttp-opts": {
+        path: "/x",
+        host: "cdn.example.com",
+        mode: "packet-up",
+        headers: { "User-Agent": "SubBoost" },
+        "no-grpc-header": false,
+        "download-settings": {
+          headers: { Accept: "yaml" },
+        },
+      },
+    });
+
+    expect(() => applyTransport({}, { transport: "udp" }, { allowedTransports: ["tcp"], protocolName: "测试" })).toThrow(
+      "不支持的 测试 传输层"
+    );
+    expect(() => applyTransport({}, { transport: " " }, { allowedTransports: ["tcp"] })).toThrow(
+      "transport=(empty)"
+    );
+
+    const tcp: Record<string, unknown> = {};
+    applyTransport(tcp, { transport: "tcp" });
+    expect(tcp).toMatchObject({ network: "tcp" });
+
+    const xhttpAliases: Record<string, unknown> = {};
+    applyTransport(xhttpAliases, {
+      network: "xhttp",
+      path: "/alias",
+      headers: "Host:edge.example.com",
+      "max-connections": "2",
+      "c-max-reuse-times": "3",
+      "h-max-request-times": "4",
+      "h-max-reusable-secs": "5",
+      no_grpc_header: "yes",
+      sc_max_each_post_bytes: "4096",
+      downloadheaders: "Accept:yaml",
+    }, {
+      allowedTransports: ["tcp", "xhttp"],
+    });
+    expect(xhttpAliases).toMatchObject({
+      network: "xhttp",
+      "xhttp-opts": {
+        path: "/alias",
+        headers: { Host: "edge.example.com" },
+        "no-grpc-header": true,
+        "sc-max-each-post-bytes": 4096,
+        "reuse-settings": {
+          "max-connections": "2",
+          "c-max-reuse-times": "3",
+          "h-max-request-times": "4",
+          "h-max-reusable-secs": "5",
+        },
+        "download-settings": {
+          headers: { Accept: "yaml" },
+        },
+      },
+    });
+  });
+});
diff --git a/packages/core/src/parser/config-line-tokenizer.ts b/packages/core/src/parser/config-line-tokenizer.ts
index 4c95cc1..f177746 100644
--- a/packages/core/src/parser/config-line-tokenizer.ts
+++ b/packages/core/src/parser/config-line-tokenizer.ts
@@ -39,8 +39,9 @@ export function tokenizeConfigLine(line: string): {
 
   const type = tokens[0].toLowerCase();
   const host = stripQuotes(tokens[1]);
-  const port = Number(tokens[2]);
-  if (!host || !Number.isFinite(port) || port < 1 || port > 65535) {
+  const portText = stripQuotes(tokens[2]);
+  const port = Number(portText);
+  if (!host || !/^\d+$/.test(portText) || !Number.isInteger(port) || port < 1 || port > 65535) {
     throw new Error("配置行中的地址或端口无效");
   }
 
diff --git a/packages/core/src/parser/content-parsers.test.ts b/packages/core/src/parser/content-parsers.test.ts
index 81749a6..1f461e0 100644
--- a/packages/core/src/parser/content-parsers.test.ts
+++ b/packages/core/src/parser/content-parsers.test.ts
@@ -30,6 +30,15 @@ describe("content parser registry helpers", () => {
     expect(isClashYamlContent("proxy-providers: {}")).toBe(true);
     expect(isClashYamlContent("- type: hysteria2\n  server: hy2.example.com\n  ports: 10000-10100")).toBe(true);
     expect(isClashYamlContent("ss://not-yaml")).toBe(false);
+    expect(isClashYamlContent(ssLink("proxies:"))).toBe(false);
+  });
+
+  it("does not misclassify a link fragment as YAML and falls through zero-node YAML parsers", () => {
+    expect(parseSubscription(ssLink("proxies:")).nodes[0]).toMatchObject({ name: "proxies:", type: "ss" });
+
+    const mixed = parseSubscription(`proxy-providers: {}\n${ssLink("Link after YAML")}`);
+    expect(mixed.nodes[0]).toMatchObject({ name: "Link after YAML", type: "ss" });
+    expect(mixed.errors.length).toBeGreaterThan(0);
   });
 
   it("detects and parses top-level inline flow proxy arrays", () => {
diff --git a/packages/core/src/parser/content-parsers.ts b/packages/core/src/parser/content-parsers.ts
index c1a0432..578b493 100644
--- a/packages/core/src/parser/content-parsers.ts
+++ b/packages/core/src/parser/content-parsers.ts
@@ -80,11 +80,7 @@ function looksLikeInlineFlowProxyList(content: string): boolean {
 }
 
 export function isClashYamlContent(content: string): boolean {
-  if (
-    content.includes("proxies:") ||
-    content.includes("proxy-groups:") ||
-    content.includes("proxy-providers:")
-  ) {
+  if (/^(?:[ \t]*)(?:proxies|proxy-groups|proxy-providers)[ \t]*:/m.test(content)) {
     return true;
   }
 
@@ -188,7 +184,8 @@ export function parseSubscriptionContentByRegistry(content: string): ParseResult
       if (parser.name === "link-lines") {
         return buildParseResult(result.nodes, [...accumulatedErrors, ...result.errors]);
       }
-      return result;
+      if (result.nodes.length > 0) return result;
+      accumulatedErrors.push(...result.errors);
     } catch (error) {
       if (parser.name === "clash-yaml") {
         accumulatedErrors.push(`Clash YAML 解析失败: ${error instanceof Error ? error.message : "未知错误"}`);
@@ -201,4 +198,3 @@ export function parseSubscriptionContentByRegistry(content: string): ParseResult
   return buildParseResult([], accumulatedErrors);
 }
 
-
diff --git a/packages/core/src/parser/platform/parse-platform-proxy-line.test.ts b/packages/core/src/parser/platform/parse-platform-proxy-line.test.ts
index 59f1228..e6708a4 100644
--- a/packages/core/src/parser/platform/parse-platform-proxy-line.test.ts
+++ b/packages/core/src/parser/platform/parse-platform-proxy-line.test.ts
@@ -34,6 +34,20 @@ describe("parsePlatformProxyLine", () => {
     });
   });
 
+  it("keeps ws=false disabled and accepts IP or single-label SNI values", () => {
+    const disabledWs = parsePlatformProxyLine(
+      "No WS = vmess, vmess.example.com, 443, username=11111111-1111-4111-8111-111111111111, ws=false, ws-path=/ignored, tls=true, sni=127.0.0.1"
+    );
+    const localSni = parsePlatformProxyLine(
+      "Local SNI = anytls, anytls.example.com, 443, password=secret, sni=localhost"
+    );
+
+    expect(disabledWs).toMatchObject({ servername: "127.0.0.1" });
+    expect(disabledWs).not.toHaveProperty("network");
+    expect(disabledWs).not.toHaveProperty("ws-opts");
+    expect(localSni).toMatchObject({ sni: "localhost" });
+  });
+
   it("parses Surge WireGuard through its referenced section", () => {
     const sections = new Map<string, string[]>([
       [
diff --git a/packages/core/src/parser/platform/peggy/surge.js b/packages/core/src/parser/platform/peggy/surge.js
index 2998758..5d426e8 100644
--- a/packages/core/src/parser/platform/peggy/surge.js
+++ b/packages/core/src/parser/platform/peggy/surge.js
@@ -191,7 +191,7 @@ username = & {
 password = comma match:[^,]+ { proxy.password = match.join("").replace(/^"(.*)"$/, '$1').replace(/^'(.*?)'$/, '$1'); }
 
 tls = comma "tls" equals flag:bool { proxy.tls = flag; }
-sni = comma "sni" equals sni:("off"/domain) { 
+sni = comma "sni" equals sni:("off"/server) {
     if (sni === "off") {
         proxy["disable-sni"] = true;
     } else {
@@ -214,7 +214,7 @@ method = comma "encrypt-method" equals cipher:cipher {
 }
 cipher = ("aes-128-cfb"/"aes-128-ctr"/"aes-128-gcm"/"aes-192-cfb"/"aes-192-ctr"/"aes-192-gcm"/"aes-256-cfb"/"aes-256-ctr"/"aes-256-gcm"/"bf-cfb"/"camellia-128-cfb"/"camellia-192-cfb"/"camellia-256-cfb"/"cast5-cfb"/"chacha20-ietf-poly1305"/"chacha20-ietf"/"chacha20-poly1305"/"chacha20"/"des-cfb"/"idea-cfb"/"none"/"rc2-cfb"/"rc4-md5"/"rc4"/"salsa20"/"seed-cfb"/"xchacha20-ietf-poly1305"/"2022-blake3-aes-128-gcm"/"2022-blake3-aes-256-gcm");
 
-ws = comma "ws" equals flag:bool { obfs.type = "ws"; }
+ws = comma "ws" equals flag:bool { if (flag) obfs.type = "ws"; }
 ws_headers = comma "ws-headers" equals headers:$[^,]+ {
     const pairs = headers.split("|");
     const result = {};
diff --git a/packages/core/src/parser/protocols/simple-proxy.test.ts b/packages/core/src/parser/protocols/simple-proxy.test.ts
index 489e131..e1987ca 100644
--- a/packages/core/src/parser/protocols/simple-proxy.test.ts
+++ b/packages/core/src/parser/protocols/simple-proxy.test.ts
@@ -15,6 +15,7 @@ describe("simple proxy parsers", () => {
     const colonAuth = parseHttp("http://colon.example.com:8080:user:p%40ss#Colon");
     const headerAlias = parseHttp("http://alias.example.com:8080?header=bad|:skip|X-Empty:&skip_cert_verify=no&peer=peer.example.com");
     const ipv6 = parseHttp("http://[2001:db8::1]:8080#IPv6");
+    const ipv6DefaultPort = parseHttp("http://[2001:db8::2]");
     const tlsVerified = parseHttp("http://verified.example.com:8080?tls-verification=true#Verified");
 
     expect(http).toMatchObject({
@@ -67,6 +68,10 @@ describe("simple proxy parsers", () => {
       server: "2001:db8::1",
       port: 8080,
     });
+    expect(ipv6DefaultPort).toMatchObject({
+      server: "2001:db8::2",
+      port: 80,
+    });
     expect(tlsVerified).toMatchObject({
       name: "Verified",
       "skip-cert-verify": false,
diff --git a/packages/core/src/parser/protocols/simple-proxy.ts b/packages/core/src/parser/protocols/simple-proxy.ts
index 0ed34e8..1977f09 100644
--- a/packages/core/src/parser/protocols/simple-proxy.ts
+++ b/packages/core/src/parser/protocols/simple-proxy.ts
@@ -42,7 +42,10 @@ function stripMetaSuffix(input: string): { value: string; name?: string } {
   }
 
   const bracket = takeTerminalEnclosedValue(remaining, "[", "]");
-  if (bracket.enclosed !== undefined) {
+  const bracketIsIpv6Host =
+    bracket.enclosed?.includes(":") &&
+    (remaining.startsWith("[") || /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/(?:[^/?#@]+@)?\[[^\]]+\]$/.test(remaining));
+  if (bracket.enclosed !== undefined && !bracketIsIpv6Host) {
     remaining = bracket.value;
   }
 
@@ -531,4 +534,3 @@ export function parseTelegramProxyLink(uri: string): SocksNode | HttpNode {
 
   return buildNode(kind, { name, server, port, username, password }) as HttpNode;
 }
-
diff --git a/packages/core/src/parser/protocols/ssr-snell.test.ts b/packages/core/src/parser/protocols/ssr-snell.test.ts
index 6515052..9b27b01 100644
--- a/packages/core/src/parser/protocols/ssr-snell.test.ts
+++ b/packages/core/src/parser/protocols/ssr-snell.test.ts
@@ -74,6 +74,19 @@ describe("SSR and Snell parsers", () => {
     });
   });
 
+  it("preserves literal plus and percent sequences after SSR base64 decoding", () => {
+    const literal = "A+B%20C";
+    const node = parseSSR(
+      `ssr://${b64(`literal.example.com:8388:origin:aes-256-cfb:plain:${b64("secret")}/?remarks=${b64(literal)}&protoparam=${b64(literal)}&obfsparam=${b64(literal)}`)}`
+    );
+
+    expect(node).toMatchObject({
+      name: literal,
+      "protocol-param": literal,
+      "obfs-param": literal,
+    });
+  });
+
   it("keeps SSR validation errors explicit", () => {
     expect(() => parseSSR("http://bad")).toThrow("无效的 SSR 链接");
     expect(() => parseSSR("ssr://")).toThrow("无效的 SSR 链接");
diff --git a/packages/core/src/parser/protocols/ssr.ts b/packages/core/src/parser/protocols/ssr.ts
index 686db20..4e8f46a 100644
--- a/packages/core/src/parser/protocols/ssr.ts
+++ b/packages/core/src/parser/protocols/ssr.ts
@@ -98,7 +98,7 @@ export function parseSSR(uri: string): SSRNode {
   const params = parseSsrQuery(query);
 
   const remarks = safeDecodeSsrBase64(params.remarks || params.remark || "");
-  const name = remarks ? safeDecodeFormUrlEncoded(remarks) : `SSR-${server}:${port}`;
+  const name = remarks || `SSR-${server}:${port}`;
 
   const node: SSRNode = {
     name,
@@ -114,14 +114,13 @@ export function parseSSR(uri: string): SSRNode {
 
   const protoparam = safeDecodeSsrBase64(params.protoparam || params["protocol-param"] || "");
   if (protoparam) {
-    node["protocol-param"] = safeDecodeFormUrlEncoded(protoparam);
+    node["protocol-param"] = protoparam;
   }
 
   const obfsparam = safeDecodeSsrBase64(params.obfsparam || params["obfs-param"] || "");
   if (obfsparam) {
-    node["obfs-param"] = safeDecodeFormUrlEncoded(obfsparam);
+    node["obfs-param"] = obfsparam;
   }
 
   return node;
 }
-
diff --git a/packages/core/src/proxy-group-targets.test.ts b/packages/core/src/proxy-group-targets.test.ts
index 27b51b3..8bf1c05 100644
--- a/packages/core/src/proxy-group-targets.test.ts
+++ b/packages/core/src/proxy-group-targets.test.ts
@@ -42,6 +42,9 @@ describe("proxy group target helpers", () => {
     expect(resolveProxyGroupTargetName({ kind: "custom", id: "media" }, options)).toBe("Media");
     expect(resolveProxyGroupTargetName({ kind: "custom", id: "missing" }, options)).toBe("DIRECT");
     expect(resolveProxyGroupTargetName({ kind: "module", id: "missing" }, options)).toBe("DIRECT");
+    expect(resolveProxyGroupTargetName({ kind: "module", id: "toString" }, options)).toBe("DIRECT");
+    expect(resolveProxyGroupTargetName({ kind: "module", id: "constructor" }, options)).toBe("DIRECT");
+    expect(resolveProxyGroupTargetName({ kind: "module", id: "hasOwnProperty" }, options)).toBe("DIRECT");
     expect(resolveProxyGroupTargetName({ kind: "node" } as never, options)).toBe("DIRECT");
     expect(ruleTargetMatchesName(" Proxy ", "Proxy")).toBe(true);
     expect(ruleTargetMatchesName({ kind: "module", id: "auto" }, "Auto")).toBe(false);
diff --git a/packages/core/src/proxy-group-targets.ts b/packages/core/src/proxy-group-targets.ts
index 3ca3f6d..862f88c 100644
--- a/packages/core/src/proxy-group-targets.ts
+++ b/packages/core/src/proxy-group-targets.ts
@@ -55,7 +55,10 @@ export function resolveProxyGroupTargetName(
   if (!normalized) return options.fallbackTarget || "";
 
   if (normalized.kind === "module") {
-    return options.moduleNames[normalized.id]?.trim() || options.fallbackTarget || "";
+    const moduleName = Object.prototype.hasOwnProperty.call(options.moduleNames, normalized.id)
+      ? options.moduleNames[normalized.id]
+      : undefined;
+    return (typeof moduleName === "string" ? moduleName.trim() : "") || options.fallbackTarget || "";
   }
 
   const customName = (options.customProxyGroups || []).find((group) => group.id === normalized.id)?.name?.trim();
diff --git a/packages/core/src/rules-database.test.ts b/packages/core/src/rules-database.test.ts
index 35863be..976a3e7 100644
--- a/packages/core/src/rules-database.test.ts
+++ b/packages/core/src/rules-database.test.ts
@@ -5,12 +5,6 @@ import {
   GEOSITE_RULES,
   RULE_CATEGORIES,
   TOTAL_RULES_COUNT,
-  createCustomRule,
-  generateRuleUrl,
-  getRuleById,
-  getRulesByCategory,
-  isValidRuleUrl,
-  searchRules,
 } from "./rules-database";
 
 describe("rules database index", () => {
@@ -28,75 +22,4 @@ describe("rules database index", () => {
       format: "mrs",
     });
   });
-
-  it("searches by id, English name, Chinese display name, and ignores empty input", () => {
-    expect(searchRules(" openai ")).toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({
-          id: "openai",
-          category: "ai",
-        }),
-      ])
-    );
-    expect(searchRules("TELEGRAM")).toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({
-          id: "telegram",
-          category: "social",
-        }),
-      ])
-    );
-    expect(searchRules("电报")).toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({
-          id: "telegram",
-        }),
-      ])
-    );
-    expect(searchRules("   ")).toEqual([]);
-  });
-
-  it("finds rules by category and exact id", () => {
-    const aiRules = getRulesByCategory("ai");
-
-    expect(aiRules.length).toBeGreaterThan(0);
-    expect(aiRules.every((rule) => rule.category === "ai")).toBe(true);
-    expect(getRuleById("netflix")).toMatchObject({
-      nameZh: "奈飞",
-      category: "media",
-    });
-    expect(getRuleById("missing-rule")).toBeUndefined();
-  });
-
-  it("generates and validates rule URLs for built-in and custom sources", () => {
-    expect(generateRuleUrl("openai")).toMatch(/\/geosite\/openai\.mrs$/);
-    expect(generateRuleUrl("telegram", "geoip")).toMatch(/\/geoip\/telegram\.mrs$/);
-
-    expect(
-      createCustomRule("custom-domain", "custom-domain", "自定义域名", "domain")
-    ).toMatchObject({
-      id: "custom-domain",
-      category: "other",
-      behavior: "domain",
-      url: expect.stringMatching(/\/geosite\/custom-domain\.mrs$/),
-    });
-    expect(
-      createCustomRule(
-        "custom-ip",
-        "custom-ip",
-        "自定义 IP",
-        "ipcidr",
-        "https://raw.githubusercontent.com/example/rules/custom-ip.mrs"
-      )
-    ).toMatchObject({
-      id: "custom-ip",
-      behavior: "ipcidr",
-      url: "https://raw.githubusercontent.com/example/rules/custom-ip.mrs",
-    });
-
-    expect(isValidRuleUrl(generateRuleUrl("openai"))).toBe(true);
-    expect(isValidRuleUrl("https://raw.githubusercontent.com/example/rules/list.mrs")).toBe(true);
-    expect(isValidRuleUrl("https://cdn.jsdelivr.net/gh/example/rules/list.mrs")).toBe(true);
-    expect(isValidRuleUrl("https://example.com/list.mrs")).toBe(false);
-  });
 });
diff --git a/packages/core/src/rules-database.ts b/packages/core/src/rules-database.ts
index 0d89898..7dc0ee7 100644
--- a/packages/core/src/rules-database.ts
+++ b/packages/core/src/rules-database.ts
@@ -397,72 +397,5 @@ export const GEOIP_RULES: RuleSetInfo[] = GEOIP_RULES_RAW;
 // 合并所有规则
 export const ALL_RULES: RuleSetInfo[] = [...GEOSITE_RULES, ...GEOIP_RULES];
 
-/**
- * 搜索规则集（支持中英文）
- */
-export function searchRules(keyword: string): RuleSetInfo[] {
-  const lowerKeyword = keyword.toLowerCase().trim();
-  if (!lowerKeyword) return [];
-  
-  return ALL_RULES.filter(
-    (rule) =>
-      rule.id.toLowerCase().includes(lowerKeyword) ||
-      rule.name.toLowerCase().includes(lowerKeyword) ||
-      rule.nameZh.toLowerCase().includes(keyword.toLowerCase())
-  );
-}
-
-/**
- * 按分类获取规则
- */
-export function getRulesByCategory(category: RuleSetInfo["category"]): RuleSetInfo[] {
-  return ALL_RULES.filter((rule) => rule.category === category);
-}
-
-/**
- * 获取规则详情
- */
-export function getRuleById(id: string): RuleSetInfo | undefined {
-  return ALL_RULES.find((rule) => rule.id === id);
-}
-
-/**
- * 根据规则名称生成 URL（用于用户输入自定义规则名）
- */
-export function generateRuleUrl(ruleName: string, type: "geosite" | "geoip" = "geosite"): string {
-  return `${BASE_URL}/${type}/${ruleName}.mrs`;
-}
-
-/**
- * 创建自定义规则
- */
-export function createCustomRule(
-  id: string,
-  name: string,
-  nameZh: string,
-  behavior: "domain" | "ipcidr",
-  url?: string
-): RuleSetInfo {
-  const type = behavior === "ipcidr" ? "geoip" : "geosite";
-  return {
-    id,
-    name,
-    nameZh,
-    category: "other",
-    behavior,
-    format: "mrs",
-    url: url || generateRuleUrl(name, type),
-  };
-}
-
-/**
- * 验证规则 URL 是否有效
- */
-export function isValidRuleUrl(url: string): boolean {
-  return url.startsWith(BASE_URL) || 
-         url.startsWith("https://raw.githubusercontent.com/") ||
-         url.startsWith("https://cdn.jsdelivr.net/");
-}
-
 // 导出规则总数
 export const TOTAL_RULES_COUNT = ALL_RULES.length;
diff --git a/packages/core/src/rules/custom-rule-helpers.test.ts b/packages/core/src/rules/custom-rule-helpers.test.ts
index 76a626a..c4fbce6 100644
--- a/packages/core/src/rules/custom-rule-helpers.test.ts
+++ b/packages/core/src/rules/custom-rule-helpers.test.ts
@@ -15,7 +15,6 @@ import {
   getCustomRuleOrderKey,
   isCustomRuleType,
   listEditableRuleOrderKeys,
-  reconcileRuleOrder,
 } from "./custom-rule-utils";
 import type { CustomProxyGroup, CustomRule, CustomRuleSet } from "@subboost/core/types/config";
 
@@ -29,7 +28,7 @@ describe("custom routing rule set helpers", () => {
     expect(parseRuleSetTargetValue("other:select")).toBeNull();
 
     expect(extractRuleSetPathFromUrl("https://cdn.example/rules/geosite/openai.mrs?token=1")).toBe(
-      "geosite/openai.mrs"
+      "https://cdn.example/rules/geosite/openai.mrs?token=1"
     );
     expect(extractRuleSetPathFromUrl("plain/rule.txt")).toBe("plain/rule.txt");
     expect(normalizeRuleSetPathInput(" /geoip/cn.mrs ")).toBe("geoip/cn.mrs");
@@ -98,7 +97,7 @@ describe("custom routing rule set helpers", () => {
           source: { kind: "custom-rule-set", id: "custom-rule" },
           id: "custom-rule",
           name: "custom-rule",
-          path: "geosite/custom.mrs",
+          path: "https://cdn.example/geosite/custom.mrs",
           target: expect.objectContaining({ id: "custom-a", value: "custom:custom-a" }),
           noResolve: true,
         }),
@@ -153,15 +152,6 @@ describe("custom rule id and order helpers", () => {
       `custom-rule:${ruleWithoutId.id}`,
       "custom-rule-set:rule-a",
     ]);
-    expect(reconcileRuleOrder(undefined, [], [])).toEqual([]);
-    expect(
-      reconcileRuleOrder(
-        [" missing ", "custom-rule-set:rule-a", "custom-rule-set:rule-a"],
-        customRules,
-        customRuleSets
-      )
-    ).toEqual(["custom-rule-set:rule-a", `custom-rule:${ruleWithoutId.id}`]);
-    expect(reconcileRuleOrder("bad" as never, customRules, [])).toEqual([`custom-rule:${ruleWithoutId.id}`]);
   });
 });
 
diff --git a/packages/core/src/rules/custom-rule-utils.ts b/packages/core/src/rules/custom-rule-utils.ts
index ad17ddd..0dc3527 100644
--- a/packages/core/src/rules/custom-rule-utils.ts
+++ b/packages/core/src/rules/custom-rule-utils.ts
@@ -93,33 +93,3 @@ export function listEditableRuleOrderKeys(customRules: CustomRule[], customRuleS
   }
   return keys;
 }
-
-export function reconcileRuleOrder(
-  ruleOrder: string[] | undefined,
-  customRules: CustomRule[],
-  customRuleSets: CustomRuleSet[] = []
-): string[] {
-  const available = listEditableRuleOrderKeys(customRules, customRuleSets);
-  if (available.length === 0) return [];
-
-  const availableSet = new Set(available);
-  const next: string[] = [];
-  const seen = new Set<string>();
-
-  if (Array.isArray(ruleOrder)) {
-    for (const rawKey of ruleOrder) {
-      const key = toTrimmedString(rawKey);
-      if (!key || seen.has(key) || !availableSet.has(key)) continue;
-      seen.add(key);
-      next.push(key);
-    }
-  }
-
-  for (const key of available) {
-    if (seen.has(key)) continue;
-    seen.add(key);
-    next.push(key);
-  }
-
-  return next;
-}
diff --git a/packages/core/src/rules/rule-model.test.ts b/packages/core/src/rules/rule-model.test.ts
index c625390..327370b 100644
--- a/packages/core/src/rules/rule-model.test.ts
+++ b/packages/core/src/rules/rule-model.test.ts
@@ -10,13 +10,16 @@ import {
 
 describe("rule model normalization", () => {
   it("normalizes rule set paths, URLs, and builtin edits", () => {
-    expect(extractRuleSetPathFromUrl(" https://example.com/meta/geosite/google.mrs?download=1 ")).toBe("geosite/google.mrs");
+    expect(extractRuleSetPathFromUrl(" https://example.com/meta/geosite/google.mrs?download=1 ")).toBe(
+      "https://example.com/meta/geosite/google.mrs?download=1"
+    );
     expect(extractRuleSetPathFromUrl("custom/list.txt")).toBe("custom/list.txt");
     expect(normalizeRuleSetPathInput("////geoip/private.mrs")).toBe("geoip/private.mrs");
     expect(isValidRuleSetPathOrUrl("geosite/google.mrs")).toBe(true);
     expect(isValidRuleSetPathOrUrl("https://example.com/rules/list.txt")).toBe(true);
     expect(isValidRuleSetPathOrUrl("plain.txt")).toBe(false);
     expect(buildRuleSetUrlFromPath("https://cdn.example.com/custom.mrs", "https://base.example.com/")).toBe("https://cdn.example.com/custom.mrs");
+    expect(normalizeRuleSetPathInput("geosite/google.mrs.bak")).toBe("geosite/google.mrs.bak");
     expect(buildRuleSetUrlFromPath("/geosite/google.mrs", "https://base.example.com////")).toBe("https://base.example.com/geosite/google.mrs");
     expect(normalizeBuiltinRuleEdits(null)).toEqual({});
     expect(
diff --git a/packages/core/src/rules/rule-model.ts b/packages/core/src/rules/rule-model.ts
index 399c74a..91a65a3 100644
--- a/packages/core/src/rules/rule-model.ts
+++ b/packages/core/src/rules/rule-model.ts
@@ -33,7 +33,8 @@ function trimTrailingSlashes(value: string): string {
 
 export function extractRuleSetPathFromUrl(url: string): string {
   const trimmed = url.trim();
-  const match = trimmed.match(/(?:^|\/)(geosite|geoip)\/[^/?#\s]+\.mrs/i);
+  if (/^https?:\/\//i.test(trimmed)) return trimmed;
+  const match = trimmed.match(/^(?:\/+)?(geosite|geoip)\/[^/?#\s]+\.mrs$/i);
   if (!match) return trimmed;
   return trimLeadingSlashes(match[0]);
 }
diff --git a/packages/core/src/rules/rules-utils.test.ts b/packages/core/src/rules/rules-utils.test.ts
index 895b4ed..01efd23 100644
--- a/packages/core/src/rules/rules-utils.test.ts
+++ b/packages/core/src/rules/rules-utils.test.ts
@@ -14,7 +14,6 @@ import {
   getCustomRuleOrderKey,
   isCustomRuleType,
   listEditableRuleOrderKeys,
-  reconcileRuleOrder,
 } from "./custom-rule-utils";
 
 describe("custom rule helpers", () => {
@@ -53,24 +52,6 @@ describe("custom rule helpers", () => {
       "custom-rule:custom-rule-domain-suffix-example-com-direct-3",
       "custom-rule-set:nested",
     ]);
-    expect(
-      reconcileRuleOrder(
-        ["missing", "custom-rule-set:nested", "custom-rule-set:nested"],
-        [rule],
-        [
-          {
-            id: "nested",
-            name: "Nested",
-            behavior: "domain",
-            path: "https://rules.example.com/a.mrs",
-            target: "Group",
-          },
-        ]
-      )
-    ).toEqual([
-      "custom-rule-set:nested",
-      "custom-rule:custom-rule-domain-suffix-example-com-direct-3",
-    ]);
   });
 
   it("previews batch custom rule imports with ready, skipped, error, and duplicate rows", () => {
diff --git a/packages/core/src/subscription/config-utils-legacy.test.ts b/packages/core/src/subscription/config-utils-legacy.test.ts
new file mode 100644
index 0000000..ecfdc15
--- /dev/null
+++ b/packages/core/src/subscription/config-utils-legacy.test.ts
@@ -0,0 +1,350 @@
+import { describe, expect, it, vi } from "vitest";
+import { buildGenerateOptionsFromConfig } from "./config-utils";
+import type { ParsedNode } from "@subboost/core/types/node";
+
+function node(patch: Partial<ParsedNode> = {}): ParsedNode {
+  return {
+    name: "Node",
+    type: "ss",
+    server: "ss.example.com",
+    port: 8388,
+    cipher: "aes-128-gcm",
+    password: "secret",
+    "dialer-proxy": "Imported Control",
+    ...patch,
+  } as ParsedNode;
+}
+
+describe("subscription config utils legacy and mixed persistence", () => {
+  it("uses legacy custom group fallback when rule model normalization returns no groups", async () => {
+    vi.resetModules();
+    vi.doMock("@subboost/core/rules/rule-model", () => ({
+      normalizeRuleModelFromConfig: () => ({
+        customProxyGroups: [],
+        customRuleSets: [],
+        builtinRuleEdits: {},
+      }),
+    }));
+
+    try {
+      const { buildGenerateOptionsFromConfig: buildWithMockedRuleModel } = await import("./config-utils");
+      const options = buildWithMockedRuleModel(
+        {
+          template: "minimal",
+          customProxyGroups: [
+            "bad",
+            { id: "", name: "Bad", emoji: "B", groupType: "select" },
+            { id: "select", name: " Select ", emoji: null, groupType: "select", enabled: true },
+            { id: "auto", name: "Auto", emoji: "A", groupType: "url-test" },
+            { id: "fallback", name: "Fallback", emoji: "F", groupType: "fallback" },
+            { id: "direct", name: "Direct", emoji: "D", groupType: "direct-first" },
+            { id: "reject", name: "Reject", emoji: "R", groupType: "reject-first" },
+            { id: "balance", name: "Balance", emoji: "B", groupType: "load-balance", strategy: "bad" },
+          ],
+          dialerProxyGroups: [
+            {
+              id: "direct-dialer",
+              name: "Direct Dialer",
+              type: "direct-first",
+              enabled: true,
+              relayNodes: [" Relay ", ""],
+              targetNodes: "bad",
+            },
+            {
+              id: "reject-dialer",
+              name: "Reject Dialer",
+              type: "reject-first",
+              strategy: "round-robin",
+            },
+          ],
+        },
+        { nodes: [node()] },
+      );
+
+      expect(options.customProxyGroups?.map((group) => group.groupType)).toEqual([
+        "select",
+        "url-test",
+        "fallback",
+        "direct-first",
+        "reject-first",
+        "load-balance",
+      ]);
+      expect(options.customProxyGroups?.find((group) => group.id === "balance")).toMatchObject({
+        strategy: "consistent-hashing",
+      });
+      expect(options.dialerProxyGroups).toEqual([
+        {
+          enabled: true,
+          id: "direct-dialer",
+          name: "Direct Dialer",
+          relayNodes: ["Relay"],
+          targetNodes: [],
+          type: "direct-first",
+        },
+        {
+          id: "reject-dialer",
+          name: "Reject Dialer",
+          relayNodes: [],
+          targetNodes: [],
+          type: "reject-first",
+        },
+      ]);
+
+      const sparse = buildWithMockedRuleModel(
+        {
+          customProxyGroups: "bad",
+          dialerProxyGroups: "bad",
+          proxyGroupAdvanced: {
+            " missing ": "bad",
+            " select ": { groupType: "select" },
+            " empty ": { regions: ["bad"] },
+          },
+        },
+        { nodes: [node()] },
+      );
+
+      expect(sparse.customProxyGroups).toBeUndefined();
+      expect(sparse.dialerProxyGroups).toBeUndefined();
+      expect(sparse.proxyGroupAdvanced).toEqual({ select: { groupType: "select" } });
+    } finally {
+      vi.doUnmock("@subboost/core/rules/rule-model");
+      vi.resetModules();
+    }
+  });
+
+  it("normalizes legacy custom groups with dense optional field variants", async () => {
+    vi.resetModules();
+    vi.doMock("@subboost/core/rules/rule-model", () => ({
+      normalizeRuleModelFromConfig: () => ({
+        customProxyGroups: [],
+        customRuleSets: [],
+        builtinRuleEdits: {},
+      }),
+    }));
+
+    try {
+      const { buildGenerateOptionsFromConfig: buildWithMockedRuleModel } = await import("./config-utils");
+      const options = buildWithMockedRuleModel(
+        {
+          customProxyGroups: [
+            { id: "missing-name", name: "", emoji: "M", groupType: "select" },
+            { id: "missing-type", name: "Missing Type", emoji: "M", groupType: "invalid" },
+            {
+              id: "select",
+              name: " Select ",
+              emoji: " S ",
+              enabled: false,
+              description: " Primary group ",
+              memberSource: "filtered-nodes",
+              includeInGroupMembers: false,
+              groupType: "select",
+              strategy: "round-robin",
+              advanced: {
+                includeRegex: "JP",
+                regions: ["jp"],
+              },
+            },
+            {
+              id: "balance",
+              name: "Balance",
+              emoji: undefined,
+              enabled: true,
+              description: " ",
+              memberSource: "all",
+              includeInGroupMembers: "yes",
+              groupType: "load-balance",
+              strategy: "round-robin",
+              advanced: { regions: ["bad"] },
+            },
+          ],
+          dialerProxyGroups: [
+            { id: "missing-name", name: "", type: "select" },
+            { id: "missing-type", name: "Missing Type", type: "invalid" },
+            {
+              id: "balance-dialer",
+              name: "Balance Dialer",
+              type: "load-balance",
+              enabled: "yes",
+              relayNodes: [" Relay "],
+              targetNodes: [" Target "],
+            },
+          ],
+        },
+        { nodes: [node()] },
+      );
+
+      expect(options.customProxyGroups).toEqual([
+        {
+          id: "select",
+          name: "Select",
+          emoji: "S",
+          enabled: false,
+          description: "Primary group",
+          memberSource: "filtered-nodes",
+          includeInGroupMembers: false,
+          groupType: "select",
+          advanced: {
+            includeRegex: "JP",
+            regions: ["jp"],
+          },
+        },
+        {
+          id: "balance",
+          name: "Balance",
+          emoji: "",
+          groupType: "load-balance",
+          strategy: "round-robin",
+        },
+      ]);
+      expect(options.dialerProxyGroups).toEqual([
+        {
+          id: "balance-dialer",
+          name: "Balance Dialer",
+          type: "load-balance",
+          strategy: "consistent-hashing",
+          relayNodes: ["Relay"],
+          targetNodes: ["Target"],
+        },
+      ]);
+    } finally {
+      vi.doUnmock("@subboost/core/rules/rule-model");
+      vi.resetModules();
+    }
+  });
+
+  it("normalizes mixed persisted options without emitting empty optional sections", () => {
+    const options = buildGenerateOptionsFromConfig(
+      {
+        template: "full",
+        testUrl: " http://probe.example.com/204 ",
+        testInterval: 0,
+        enabledGroups: [1, " ", "auto", "auto", "cn"],
+        enabledRules: [null, "global", " "],
+        customRules: [
+          { id: "", type: "DST-PORT", value: " 443 ", target: { kind: "module", id: " auto " } },
+          { id: "bad-target", type: "DOMAIN", value: "bad.example", target: { kind: "node", name: "" } },
+          { id: "src-port", type: "SRC-PORT", value: " 6881 ", target: { kind: "custom", id: " media " } },
+        ],
+        customProxyGroups: [
+          {
+            id: "media",
+            name: " Media ",
+            emoji: undefined,
+            enabled: false,
+            description: " Media group ",
+            memberSource: "filtered-nodes",
+            includeInGroupMembers: true,
+            groupType: "load-balance",
+            strategy: "round-robin",
+            advanced: {
+              sourceIds: ["source-a"],
+              regions: ["tw"],
+              includeRegex: "TW",
+              excludeRegex: "test",
+              extraMembers: [{ kind: "reject" }],
+              excludedMembers: [{ kind: "direct" }],
+              memberOrder: [{ kind: "reject" }],
+            },
+          },
+        ],
+        customRuleSets: [
+          {
+            id: "manual",
+            name: " Manual ",
+            behavior: "classical",
+            path: "https://rules.example.com/manual.yaml",
+            target: { kind: "module", id: " cn " },
+            noResolve: true,
+          },
+        ],
+        dialerProxyGroups: [
+          {
+            id: "direct",
+            name: " Direct Dialer ",
+            type: "direct-first",
+            strategy: "round-robin",
+            relayNodes: ["Relay", "Relay", ""],
+            targetNodes: ["Target", null, "Target"],
+          },
+        ],
+        listenerPorts: {
+          socks: 65535,
+          negative: -1,
+          nan: Number.NaN,
+        },
+        proxyGroupNameOverrides: {
+          cn: " China ",
+        },
+        proxyGroupOrder: [" cn ", "cn", "", null],
+        mixedPort: 65535,
+        allowLan: false,
+        autoSelectStrategy: "load-balance",
+        cnIpNoResolve: true,
+        experimentalCnUseCnRuleSet: false,
+      },
+      { nodes: [node({ name: "TW Node" })] },
+    );
+
+    expect(options.template).toBe("full");
+    expect(options.userConfig).toMatchObject({
+      enabledGroups: ["auto", "auto", "cn"],
+      enabledRules: ["global"],
+      mixedPort: 65535,
+      allowLan: false,
+      autoSelectStrategy: "load-balance",
+      cnIpNoResolve: true,
+      experimentalCnUseCnRuleSet: false,
+      listenerPorts: { socks: 65535 },
+      testUrl: "http://probe.example.com/204",
+      testInterval: 0,
+    });
+    expect(options.userConfig?.customRules).toEqual([
+      {
+        id: "custom-rule-dst-port-443-module-auto-1",
+        type: "DST-PORT",
+        value: "443",
+        target: { kind: "module", id: "auto" },
+      },
+      {
+        id: "src-port",
+        type: "SRC-PORT",
+        value: "6881",
+        target: { kind: "custom", id: "media" },
+      },
+    ]);
+    expect(options.customProxyGroups).toEqual([
+      {
+        id: "media",
+        name: "Media",
+        emoji: "",
+        enabled: false,
+        description: "Media group",
+        memberSource: "filtered-nodes",
+        includeInGroupMembers: true,
+        groupType: "load-balance",
+        strategy: "round-robin",
+        advanced: {
+          sourceIds: ["source-a"],
+          regions: ["tw"],
+          includeRegex: "TW",
+          excludeRegex: "test",
+          extraMembers: [{ kind: "reject" }],
+          excludedMembers: [{ kind: "direct" }],
+          memberOrder: [{ kind: "reject" }],
+        },
+      },
+    ]);
+    expect(options.customRuleSets).toBeUndefined();
+    expect(options.dialerProxyGroups).toEqual([
+      {
+        id: "direct",
+        name: "Direct Dialer",
+        type: "direct-first",
+        relayNodes: ["Relay", "Relay"],
+        targetNodes: ["Target", "Target"],
+      },
+    ]);
+    expect(options.proxyGroupNameOverrides).toEqual({ cn: "China" });
+    expect(options.proxyGroupOrder).toEqual(["cn", "cn"]);
+  });
+});
diff --git a/packages/core/src/subscription/config-utils.test.ts b/packages/core/src/subscription/config-utils.test.ts
index 27bbf7a..4771a3f 100644
--- a/packages/core/src/subscription/config-utils.test.ts
+++ b/packages/core/src/subscription/config-utils.test.ts
@@ -1,8 +1,9 @@
-import { describe, expect, it, vi } from "vitest";
+import { describe, expect, it } from "vitest";
 import {
   buildGenerateOptionsFromConfig,
   getEffectiveTestOptions,
 } from "./config-utils";
+import { generateClashConfig } from "@subboost/core/generator";
 import type { ParsedNode } from "@subboost/core/types/node";
 
 function node(patch: Partial<ParsedNode> = {}): ParsedNode {
@@ -156,6 +157,107 @@ describe("subscription config utils", () => {
     expect(options.proxyGroupOrder).toEqual(["auto"]);
   });
 
+  it("generates from effective nodes while matching persisted original names", () => {
+    const kept = node({ name: "Singapore", _originName: "SG Premium" });
+    const excluded = node({ name: "Pinned Hong Kong", _originName: "HK IPLC" });
+    const options = buildGenerateOptionsFromConfig(
+      {
+        nodeNameFilter: {
+          enabled: true,
+          excludeRegexes: ["^hk"],
+        },
+      },
+      { nodes: [kept, excluded] }
+    );
+
+    expect(options.nodes).toHaveLength(1);
+    expect(options.nodes[0]).toMatchObject({
+      name: "Singapore",
+      _originName: "SG Premium",
+    });
+    expect(options.nodes[0]).not.toHaveProperty("dialer-proxy");
+  });
+
+  it("temporarily ignores filtered listener and dialer references and restores them when disabled", () => {
+    const nodes = [
+      node({ name: "Relay", _originName: "Relay" }),
+      node({ name: "Target", _originName: "Target" }),
+    ];
+    const config = {
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["^target$"],
+      },
+      listenerPorts: {
+        Relay: 12000,
+        Target: 12001,
+      },
+      dialerProxyGroups: [
+        {
+          id: "chain",
+          name: "Chain",
+          enabled: true,
+          type: "select",
+          relayNodes: ["Relay"],
+          targetNodes: ["Target"],
+        },
+      ],
+    };
+
+    const filteredOptions = buildGenerateOptionsFromConfig(config, { nodes });
+    const filtered = generateClashConfig(filteredOptions);
+    expect(filteredOptions.userConfig?.listenerPorts).toEqual(config.listenerPorts);
+    expect(filteredOptions.dialerProxyGroups?.[0]).toMatchObject({
+      relayNodes: ["Relay"],
+      targetNodes: ["Target"],
+    });
+    expect(filtered.proxies?.map((proxy) => proxy.name)).toEqual(["Relay"]);
+    expect(filtered.listeners).toEqual([
+      { name: "mixed0", type: "mixed", port: 12000, proxy: "Relay" },
+    ]);
+    expect(filtered["proxy-groups"]?.find((group) => group.name === "Chain")).toMatchObject({
+      proxies: ["Relay"],
+    });
+
+    const restored = generateClashConfig(
+      buildGenerateOptionsFromConfig(
+        {
+          ...config,
+          nodeNameFilter: {
+            ...config.nodeNameFilter,
+            enabled: false,
+          },
+        },
+        { nodes }
+      )
+    );
+    expect(restored.proxies?.map((proxy) => proxy.name)).toEqual(["Relay", "Target"]);
+    expect(restored.proxies?.find((proxy) => proxy.name === "Target")).toMatchObject({
+      "dialer-proxy": "Chain",
+    });
+    expect(restored.listeners).toEqual([
+      { name: "mixed0", type: "mixed", port: 12000, proxy: "Relay" },
+      { name: "mixed1", type: "mixed", port: 12001, proxy: "Target" },
+    ]);
+    expect(restored["proxy-groups"]?.find((group) => group.name === "Chain")).toMatchObject({
+      proxies: ["Relay"],
+    });
+  });
+
+  it("rejects invalid persisted node-name filters", () => {
+    expect(() =>
+      buildGenerateOptionsFromConfig(
+        {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["(a+)+$"],
+          },
+        },
+        { nodes: [node()] }
+      )
+    ).toThrow("节点名称过滤配置无效");
+  });
+
   it("drops malformed persisted config while keeping safe defaults", () => {
     const options = buildGenerateOptionsFromConfig(
       {
@@ -448,335 +550,4 @@ describe("subscription config utils", () => {
     expect(options.dialerProxyGroups).toBeUndefined();
   });
 
-  it("uses legacy custom group fallback when rule model normalization returns no groups", async () => {
-    vi.resetModules();
-    vi.doMock("@subboost/core/rules/rule-model", () => ({
-      normalizeRuleModelFromConfig: () => ({
-        customProxyGroups: [],
-        customRuleSets: [],
-        builtinRuleEdits: {},
-      }),
-    }));
-
-    try {
-      const { buildGenerateOptionsFromConfig: buildWithMockedRuleModel } = await import("./config-utils");
-      const options = buildWithMockedRuleModel(
-        {
-          template: "minimal",
-          customProxyGroups: [
-            "bad",
-            { id: "", name: "Bad", emoji: "B", groupType: "select" },
-            { id: "select", name: " Select ", emoji: null, groupType: "select", enabled: true },
-            { id: "auto", name: "Auto", emoji: "A", groupType: "url-test" },
-            { id: "fallback", name: "Fallback", emoji: "F", groupType: "fallback" },
-            { id: "direct", name: "Direct", emoji: "D", groupType: "direct-first" },
-            { id: "reject", name: "Reject", emoji: "R", groupType: "reject-first" },
-            { id: "balance", name: "Balance", emoji: "B", groupType: "load-balance", strategy: "bad" },
-          ],
-          dialerProxyGroups: [
-            {
-              id: "direct-dialer",
-              name: "Direct Dialer",
-              type: "direct-first",
-              enabled: true,
-              relayNodes: [" Relay ", ""],
-              targetNodes: "bad",
-            },
-            {
-              id: "reject-dialer",
-              name: "Reject Dialer",
-              type: "reject-first",
-              strategy: "round-robin",
-            },
-          ],
-        },
-        { nodes: [node()] },
-      );
-
-      expect(options.customProxyGroups?.map((group) => group.groupType)).toEqual([
-        "select",
-        "url-test",
-        "fallback",
-        "direct-first",
-        "reject-first",
-        "load-balance",
-      ]);
-      expect(options.customProxyGroups?.find((group) => group.id === "balance")).toMatchObject({
-        strategy: "consistent-hashing",
-      });
-      expect(options.dialerProxyGroups).toEqual([
-        {
-          enabled: true,
-          id: "direct-dialer",
-          name: "Direct Dialer",
-          relayNodes: ["Relay"],
-          targetNodes: [],
-          type: "direct-first",
-        },
-        {
-          id: "reject-dialer",
-          name: "Reject Dialer",
-          relayNodes: [],
-          targetNodes: [],
-          type: "reject-first",
-        },
-      ]);
-
-      const sparse = buildWithMockedRuleModel(
-        {
-          customProxyGroups: "bad",
-          dialerProxyGroups: "bad",
-          proxyGroupAdvanced: {
-            " missing ": "bad",
-            " select ": { groupType: "select" },
-            " empty ": { regions: ["bad"] },
-          },
-        },
-        { nodes: [node()] },
-      );
-
-      expect(sparse.customProxyGroups).toBeUndefined();
-      expect(sparse.dialerProxyGroups).toBeUndefined();
-      expect(sparse.proxyGroupAdvanced).toEqual({ select: { groupType: "select" } });
-    } finally {
-      vi.doUnmock("@subboost/core/rules/rule-model");
-      vi.resetModules();
-    }
-  });
-
-  it("normalizes legacy custom groups with dense optional field variants", async () => {
-    vi.resetModules();
-    vi.doMock("@subboost/core/rules/rule-model", () => ({
-      normalizeRuleModelFromConfig: () => ({
-        customProxyGroups: [],
-        customRuleSets: [],
-        builtinRuleEdits: {},
-      }),
-    }));
-
-    try {
-      const { buildGenerateOptionsFromConfig: buildWithMockedRuleModel } = await import("./config-utils");
-      const options = buildWithMockedRuleModel(
-        {
-          customProxyGroups: [
-            { id: "missing-name", name: "", emoji: "M", groupType: "select" },
-            { id: "missing-type", name: "Missing Type", emoji: "M", groupType: "invalid" },
-            {
-              id: "select",
-              name: " Select ",
-              emoji: " S ",
-              enabled: false,
-              description: " Primary group ",
-              memberSource: "filtered-nodes",
-              includeInGroupMembers: false,
-              groupType: "select",
-              strategy: "round-robin",
-              advanced: {
-                includeRegex: "JP",
-                regions: ["jp"],
-              },
-            },
-            {
-              id: "balance",
-              name: "Balance",
-              emoji: undefined,
-              enabled: true,
-              description: " ",
-              memberSource: "all",
-              includeInGroupMembers: "yes",
-              groupType: "load-balance",
-              strategy: "round-robin",
-              advanced: { regions: ["bad"] },
-            },
-          ],
-          dialerProxyGroups: [
-            { id: "missing-name", name: "", type: "select" },
-            { id: "missing-type", name: "Missing Type", type: "invalid" },
-            {
-              id: "balance-dialer",
-              name: "Balance Dialer",
-              type: "load-balance",
-              enabled: "yes",
-              relayNodes: [" Relay "],
-              targetNodes: [" Target "],
-            },
-          ],
-        },
-        { nodes: [node()] },
-      );
-
-      expect(options.customProxyGroups).toEqual([
-        {
-          id: "select",
-          name: "Select",
-          emoji: "S",
-          enabled: false,
-          description: "Primary group",
-          memberSource: "filtered-nodes",
-          includeInGroupMembers: false,
-          groupType: "select",
-          advanced: {
-            includeRegex: "JP",
-            regions: ["jp"],
-          },
-        },
-        {
-          id: "balance",
-          name: "Balance",
-          emoji: "",
-          groupType: "load-balance",
-          strategy: "round-robin",
-        },
-      ]);
-      expect(options.dialerProxyGroups).toEqual([
-        {
-          id: "balance-dialer",
-          name: "Balance Dialer",
-          type: "load-balance",
-          strategy: "consistent-hashing",
-          relayNodes: ["Relay"],
-          targetNodes: ["Target"],
-        },
-      ]);
-    } finally {
-      vi.doUnmock("@subboost/core/rules/rule-model");
-      vi.resetModules();
-    }
-  });
-
-  it("normalizes mixed persisted options without emitting empty optional sections", () => {
-    const options = buildGenerateOptionsFromConfig(
-      {
-        template: "full",
-        testUrl: " http://probe.example.com/204 ",
-        testInterval: 0,
-        enabledGroups: [1, " ", "auto", "auto", "cn"],
-        enabledRules: [null, "global", " "],
-        customRules: [
-          { id: "", type: "DST-PORT", value: " 443 ", target: { kind: "module", id: " auto " } },
-          { id: "bad-target", type: "DOMAIN", value: "bad.example", target: { kind: "node", name: "" } },
-          { id: "src-port", type: "SRC-PORT", value: " 6881 ", target: { kind: "custom", id: " media " } },
-        ],
-        customProxyGroups: [
-          {
-            id: "media",
-            name: " Media ",
-            emoji: undefined,
-            enabled: false,
-            description: " Media group ",
-            memberSource: "filtered-nodes",
-            includeInGroupMembers: true,
-            groupType: "load-balance",
-            strategy: "round-robin",
-            advanced: {
-              sourceIds: ["source-a"],
-              regions: ["tw"],
-              includeRegex: "TW",
-              excludeRegex: "test",
-              extraMembers: [{ kind: "reject" }],
-              excludedMembers: [{ kind: "direct" }],
-              memberOrder: [{ kind: "reject" }],
-            },
-          },
-        ],
-        customRuleSets: [
-          {
-            id: "manual",
-            name: " Manual ",
-            behavior: "classical",
-            path: "https://rules.example.com/manual.yaml",
-            target: { kind: "module", id: " cn " },
-            noResolve: true,
-          },
-        ],
-        dialerProxyGroups: [
-          {
-            id: "direct",
-            name: " Direct Dialer ",
-            type: "direct-first",
-            strategy: "round-robin",
-            relayNodes: ["Relay", "Relay", ""],
-            targetNodes: ["Target", null, "Target"],
-          },
-        ],
-        listenerPorts: {
-          socks: 65535,
-          negative: -1,
-          nan: Number.NaN,
-        },
-        proxyGroupNameOverrides: {
-          cn: " China ",
-        },
-        proxyGroupOrder: [" cn ", "cn", "", null],
-        mixedPort: 65535,
-        allowLan: false,
-        autoSelectStrategy: "load-balance",
-        cnIpNoResolve: true,
-        experimentalCnUseCnRuleSet: false,
-      },
-      { nodes: [node({ name: "TW Node" })] },
-    );
-
-    expect(options.template).toBe("full");
-    expect(options.userConfig).toMatchObject({
-      enabledGroups: ["auto", "auto", "cn"],
-      enabledRules: ["global"],
-      mixedPort: 65535,
-      allowLan: false,
-      autoSelectStrategy: "load-balance",
-      cnIpNoResolve: true,
-      experimentalCnUseCnRuleSet: false,
-      listenerPorts: { socks: 65535 },
-      testUrl: "http://probe.example.com/204",
-      testInterval: 0,
-    });
-    expect(options.userConfig?.customRules).toEqual([
-      {
-        id: "custom-rule-dst-port-443-module-auto-1",
-        type: "DST-PORT",
-        value: "443",
-        target: { kind: "module", id: "auto" },
-      },
-      {
-        id: "src-port",
-        type: "SRC-PORT",
-        value: "6881",
-        target: { kind: "custom", id: "media" },
-      },
-    ]);
-    expect(options.customProxyGroups).toEqual([
-      {
-        id: "media",
-        name: "Media",
-        emoji: "",
-        enabled: false,
-        description: "Media group",
-        memberSource: "filtered-nodes",
-        includeInGroupMembers: true,
-        groupType: "load-balance",
-        strategy: "round-robin",
-        advanced: {
-          sourceIds: ["source-a"],
-          regions: ["tw"],
-          includeRegex: "TW",
-          excludeRegex: "test",
-          extraMembers: [{ kind: "reject" }],
-          excludedMembers: [{ kind: "direct" }],
-          memberOrder: [{ kind: "reject" }],
-        },
-      },
-    ]);
-    expect(options.customRuleSets).toBeUndefined();
-    expect(options.dialerProxyGroups).toEqual([
-      {
-        id: "direct",
-        name: "Direct Dialer",
-        type: "direct-first",
-        relayNodes: ["Relay", "Relay"],
-        targetNodes: ["Target", "Target"],
-      },
-    ]);
-    expect(options.proxyGroupNameOverrides).toEqual({ cn: "China" });
-    expect(options.proxyGroupOrder).toEqual(["cn", "cn"]);
-  });
 });
diff --git a/packages/core/src/subscription/config-utils.ts b/packages/core/src/subscription/config-utils.ts
index 09d4517..e867494 100644
--- a/packages/core/src/subscription/config-utils.ts
+++ b/packages/core/src/subscription/config-utils.ts
@@ -14,6 +14,7 @@ import {
 } from "@subboost/core/types/config";
 import { stripImportedNodeControlFieldsFromList } from "@subboost/core/subscription/imported-node-controls";
 import { buildProxyProvidersFromConfig } from "@subboost/core/subscription/proxy-providers";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import { ensureCustomRuleId } from "@subboost/core/rules/custom-rule-utils";
 import { DEFAULT_SUBBOOST_CONFIG } from "@subboost/core/config/defaults";
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
@@ -298,7 +299,8 @@ export function buildGenerateOptionsFromConfig(
 
   const dialerProxyGroups = normalizeDialerProxyGroups(config.dialerProxyGroups);
   const proxyGroupOrder = normalizeProxyGroupOrder(config.proxyGroupOrder);
-  const sanitizedNodes = stripImportedNodeControlFieldsFromList(opts.nodes);
+  const effectiveNodes = resolveNodeNameFilter(opts.nodes, config.nodeNameFilter).effectiveNodes;
+  const sanitizedNodes = stripImportedNodeControlFieldsFromList(effectiveNodes);
   const proxyGroupAdvanced = isRecord(config.proxyGroupAdvanced)
     ? Object.fromEntries(
         Object.entries(config.proxyGroupAdvanced)
diff --git a/packages/core/src/subscription/import-error.test.ts b/packages/core/src/subscription/import-error.test.ts
index afab71d..e6b3ecb 100644
--- a/packages/core/src/subscription/import-error.test.ts
+++ b/packages/core/src/subscription/import-error.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
   SubscriptionImportError,
   createSubscriptionImportErrorInfo,
+  extractHttpStatus,
   getSubscriptionImportErrorBadgeText,
   getSubscriptionImportErrorCategoryLabel,
   inferSubscriptionImportErrorCategory,
@@ -11,6 +12,18 @@ import {
   sanitizePublicErrorText,
 } from "./import-error";
 
+describe("extractHttpStatus", () => {
+  it("only extracts explicit HTTP error status context", () => {
+    expect(extractHttpStatus("upstream HTTP 503 then 404")).toBe(503);
+    expect(extractHttpStatus("upstream HTTP: 503")).toBe(503);
+    expect(extractHttpStatus("request failed with status code 429")).toBe(429);
+    expect(extractHttpStatus("request failed with status=404")).toBe(404);
+    expect(extractHttpStatus("upstream returned 502")).toBe(502);
+    expect(extractHttpStatus("成功解析 502 个节点")).toBeNull();
+    expect(extractHttpStatus("HTTP 200")).toBeNull();
+  });
+});
+
 describe("sanitizePublicErrorText", () => {
   it("does not mistake protocol URIs for Windows file paths", () => {
     const protocols = [
diff --git a/packages/core/src/subscription/import-error.ts b/packages/core/src/subscription/import-error.ts
index 2bf513f..4f73e1c 100644
--- a/packages/core/src/subscription/import-error.ts
+++ b/packages/core/src/subscription/import-error.ts
@@ -71,13 +71,21 @@ const NETWORK_CODE_BADGE: Record<string, string> = {
   EAI_AGAIN: "DNS",
 };
 
-function extractHttpStatusFromText(text: string): number | null {
-  const match = text.match(/\b(4\d{2}|5\d{2})\b/);
-  if (match) {
-    const code = parseInt(match[1], 10);
-    if (code >= 400 && code < 600) return code;
+export function extractHttpStatus(text: string): number | null {
+  const prefix = text.match(
+    /\b(?:HTTP(?:\/\d(?:\.\d)?)?|status(?:\s+code)?|returned|responded(?:\s+with)?)/i
+  );
+  if (!prefix || prefix.index === undefined) return null;
+
+  let remainder = text.slice(prefix.index + prefix[0].length).trimStart();
+  if (remainder.startsWith(":") || remainder.startsWith("=")) {
+    remainder = remainder.slice(1).trimStart();
   }
-  return null;
+  const match = remainder.match(/^(\d{3})\b/);
+  if (!match) return null;
+
+  const code = Number.parseInt(match[1], 10);
+  return code >= 400 && code < 600 ? code : null;
 }
 
 function extractNetworkCodeFromText(text: string): string | null {
@@ -166,7 +174,7 @@ export function getSubscriptionImportErrorBadgeText(
   if (info.httpStatus && HTTP_STATUS_BADGE[info.httpStatus]) {
     return HTTP_STATUS_BADGE[info.httpStatus];
   }
-  const httpFromText = extractHttpStatusFromText(info.message) ?? extractHttpStatusFromText(info.detail || "");
+  const httpFromText = extractHttpStatus(info.message) ?? extractHttpStatus(info.detail || "");
   if (httpFromText && HTTP_STATUS_BADGE[httpFromText]) {
     return HTTP_STATUS_BADGE[httpFromText];
   }
diff --git a/packages/core/src/subscription/node-name-filter.test.ts b/packages/core/src/subscription/node-name-filter.test.ts
new file mode 100644
index 0000000..49e96fa
--- /dev/null
+++ b/packages/core/src/subscription/node-name-filter.test.ts
@@ -0,0 +1,213 @@
+import { describe, expect, it } from "vitest";
+import type { ParsedNode } from "../types/node";
+import {
+  NODE_NAME_FILTER_MAX_REGEXES,
+  NodeNameFilterConfigError,
+  normalizeNodeNameFilterConfig,
+  parseNodeNameFilterConfig,
+  resolveNodeNameFilter,
+  validateNodeNameFilterConfig,
+} from "./node-name-filter";
+
+function node(name: string, originName?: string): ParsedNode {
+  return {
+    name,
+    type: "trojan",
+    server: `${name.toLowerCase()}.example.com`,
+    port: 443,
+    password: "secret",
+    ...(originName === undefined ? {} : { _originName: originName }),
+  };
+}
+
+function unsafeNestedQuantifierPattern(): string {
+  const plus = String.fromCharCode(43);
+  return `(a${plus})${plus}$`;
+}
+
+describe("node name filter config", () => {
+  it("treats a missing config as disabled and disables an empty enabled config", () => {
+    expect(parseNodeNameFilterConfig(undefined)).toEqual({
+      enabled: false,
+      excludeRegexes: [],
+    });
+    expect(
+      parseNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: ["", "   "],
+      })
+    ).toEqual({
+      enabled: false,
+      excludeRegexes: [],
+    });
+  });
+
+  it("trims rules, ignores empty lines, and deduplicates repeated lines", () => {
+    expect(
+      parseNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: ["  hk|hong kong  ", "", "hk|hong kong", "  "],
+      })
+    ).toEqual({
+      enabled: true,
+      excludeRegexes: ["hk|hong kong"],
+    });
+  });
+
+  it("keeps valid rules while the filter is disabled", () => {
+    expect(
+      parseNodeNameFilterConfig({
+        enabled: false,
+        excludeRegexes: ["expired", "traffic"],
+      })
+    ).toEqual({
+      enabled: false,
+      excludeRegexes: ["expired", "traffic"],
+    });
+  });
+
+  it("reports the original line for invalid, unsafe, and non-string rules", () => {
+    const result = validateNodeNameFilterConfig({
+      enabled: true,
+      excludeRegexes: ["valid", 123, "[", unsafeNestedQuantifierPattern()],
+    });
+
+    expect(result).toEqual({
+      ok: false,
+      errors: [
+        { code: "invalid_line", line: 2, message: "规则必须是文本" },
+        { code: "invalid_regex", line: 3, message: "正则语法无效" },
+        { code: "unsafe_regex", line: 4, message: "正则可能导致运行时间过长" },
+      ],
+    });
+  });
+
+  it("enforces the unique rule count and per-rule length limits", () => {
+    const tooMany = validateNodeNameFilterConfig({
+      enabled: true,
+      excludeRegexes: Array.from(
+        { length: NODE_NAME_FILTER_MAX_REGEXES + 1 },
+        (_, index) => `node-${index}`
+      ),
+    });
+    expect(tooMany).toMatchObject({
+      ok: false,
+      errors: [
+        {
+          code: "too_many_regexes",
+          line: NODE_NAME_FILTER_MAX_REGEXES + 1,
+        },
+      ],
+    });
+
+    expect(
+      validateNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: ["a".repeat(201)],
+      })
+    ).toMatchObject({
+      ok: false,
+      errors: [{ code: "regex_too_long", line: 1 }],
+    });
+  });
+
+  it("counts limits after empty-line removal and deduplication", () => {
+    expect(
+      parseNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: [
+          "",
+          ...Array.from({ length: NODE_NAME_FILTER_MAX_REGEXES }, (_, index) => `rule-${index}`),
+          "rule-0",
+          " ",
+        ],
+      }).excludeRegexes
+    ).toHaveLength(NODE_NAME_FILTER_MAX_REGEXES);
+  });
+
+  it("strictly rejects malformed persisted config while normalize offers an explicit fallback", () => {
+    expect(() => parseNodeNameFilterConfig({ enabled: "yes", excludeRegexes: [] })).toThrow(
+      NodeNameFilterConfigError
+    );
+
+    try {
+      parseNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: ["(", unsafeNestedQuantifierPattern()],
+      });
+      throw new Error("Expected parsing to fail");
+    } catch (error) {
+      expect(error).toBeInstanceOf(NodeNameFilterConfigError);
+      expect((error as NodeNameFilterConfigError).errors).toEqual([
+        { code: "invalid_regex", line: 1, message: "正则语法无效" },
+        { code: "unsafe_regex", line: 2, message: "正则可能导致运行时间过长" },
+      ]);
+    }
+
+    expect(normalizeNodeNameFilterConfig({ enabled: "yes", excludeRegexes: [] })).toEqual({
+      enabled: false,
+      excludeRegexes: [],
+    });
+  });
+});
+
+describe("resolveNodeNameFilter", () => {
+  it("matches original names case-insensitively and falls back to display names", () => {
+    const renamed = node("Japan Premium", "HK IPLC");
+    const legacy = node("hK legacy");
+    const kept = node("Singapore", "SG IEPL");
+    const result = resolveNodeNameFilter(
+      [renamed, legacy, kept],
+      {
+        enabled: true,
+        excludeRegexes: ["^hk"],
+      }
+    );
+
+    expect(result).toEqual({
+      rawNodes: [renamed, legacy, kept],
+      effectiveNodes: [kept],
+      excludedNodes: [renamed, legacy],
+      rawCount: 3,
+      excludedCount: 2,
+      effectiveCount: 1,
+    });
+  });
+
+  it("does not let display-name edits or duplicate origin names change matching semantics", () => {
+    const first = node("Pinned Name", "Expired");
+    const second = node("Expired (2)", "Expired");
+    const renamedKeep = node("Expired", "Available");
+    const result = resolveNodeNameFilter(
+      [first, second, renamedKeep],
+      {
+        enabled: true,
+        excludeRegexes: ["^expired$"],
+      }
+    );
+
+    expect(result.excludedNodes).toEqual([first, second]);
+    expect(result.effectiveNodes).toEqual([renamedKeep]);
+  });
+
+  it("returns the complete snapshot unchanged when disabled", () => {
+    const nodes = [node("Expired")];
+    const result = resolveNodeNameFilter(nodes, {
+      enabled: false,
+      excludeRegexes: ["expired"],
+    });
+
+    expect(result.rawNodes).toBe(nodes);
+    expect(result.effectiveNodes).toBe(nodes);
+    expect(result.excludedNodes).toEqual([]);
+  });
+
+  it("rejects invalid rules instead of exposing the unfiltered node list", () => {
+    expect(() =>
+      resolveNodeNameFilter([node("Node")], {
+        enabled: true,
+        excludeRegexes: [unsafeNestedQuantifierPattern()],
+      })
+    ).toThrow(NodeNameFilterConfigError);
+  });
+});
diff --git a/packages/core/src/subscription/node-name-filter.ts b/packages/core/src/subscription/node-name-filter.ts
new file mode 100644
index 0000000..9d2defa
--- /dev/null
+++ b/packages/core/src/subscription/node-name-filter.ts
@@ -0,0 +1,251 @@
+import safeRegex from "safe-regex2";
+import type { ParsedNode } from "../types/node";
+import { getNodeOriginName } from "./node-source-state";
+
+export const NODE_NAME_FILTER_MAX_REGEXES = 20;
+export const NODE_NAME_FILTER_MAX_REGEX_LENGTH = 200;
+
+export type NodeNameFilterConfig = {
+  enabled: boolean;
+  excludeRegexes: string[];
+};
+
+export const DEFAULT_NODE_NAME_FILTER_CONFIG: NodeNameFilterConfig = {
+  enabled: false,
+  excludeRegexes: [],
+};
+
+export type NodeNameFilterValidationErrorCode =
+  | "invalid_config"
+  | "invalid_line"
+  | "too_many_regexes"
+  | "regex_too_long"
+  | "invalid_regex"
+  | "unsafe_regex";
+
+export type NodeNameFilterValidationError = {
+  code: NodeNameFilterValidationErrorCode;
+  message: string;
+  line?: number;
+};
+
+export type NodeNameFilterValidationResult =
+  | {
+      ok: true;
+      config: NodeNameFilterConfig;
+    }
+  | {
+      ok: false;
+      errors: NodeNameFilterValidationError[];
+    };
+
+export type NodeNameFilterResult = {
+  rawNodes: ParsedNode[];
+  effectiveNodes: ParsedNode[];
+  excludedNodes: ParsedNode[];
+  rawCount: number;
+  excludedCount: number;
+  effectiveCount: number;
+};
+
+type ParsedNodeNameFilterConfig = {
+  config: NodeNameFilterConfig;
+  compiledRegexes: RegExp[];
+};
+
+export class NodeNameFilterConfigError extends Error {
+  readonly errors: NodeNameFilterValidationError[];
+
+  constructor(errors: NodeNameFilterValidationError[]) {
+    const first = errors[0];
+    const detail = first
+      ? `${first.line ? `第 ${first.line} 行：` : ""}${first.message}`
+      : "配置格式无效";
+    super(`节点名称过滤配置无效：${detail}`);
+    this.name = "NodeNameFilterConfigError";
+    this.errors = errors;
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function defaultConfig(): NodeNameFilterConfig {
+  return {
+    enabled: DEFAULT_NODE_NAME_FILTER_CONFIG.enabled,
+    excludeRegexes: [],
+  };
+}
+
+function inspectNodeNameFilterConfig(
+  value: unknown
+):
+  | { ok: true; parsed: ParsedNodeNameFilterConfig }
+  | { ok: false; errors: NodeNameFilterValidationError[] } {
+  if (value === undefined) {
+    return {
+      ok: true,
+      parsed: {
+        config: defaultConfig(),
+        compiledRegexes: [],
+      },
+    };
+  }
+
+  if (!isRecord(value)) {
+    return {
+      ok: false,
+      errors: [{ code: "invalid_config", message: "配置必须是对象" }],
+    };
+  }
+
+  const errors: NodeNameFilterValidationError[] = [];
+  const enabled = value.enabled === true;
+  if (typeof value.enabled !== "boolean") {
+    errors.push({ code: "invalid_config", message: "enabled 必须是布尔值" });
+  }
+  if (!Array.isArray(value.excludeRegexes)) {
+    errors.push({ code: "invalid_config", message: "excludeRegexes 必须是字符串数组" });
+  }
+  if (errors.length > 0 || !Array.isArray(value.excludeRegexes)) {
+    return { ok: false, errors };
+  }
+
+  const excludeRegexes: string[] = [];
+  const compiledRegexes: RegExp[] = [];
+  const seen = new Set<string>();
+  let reportedTooMany = false;
+
+  for (let index = 0; index < value.excludeRegexes.length; index += 1) {
+    const line = index + 1;
+    const rawPattern = value.excludeRegexes[index];
+    if (typeof rawPattern !== "string") {
+      errors.push({
+        code: "invalid_line",
+        line,
+        message: "规则必须是文本",
+      });
+      continue;
+    }
+
+    const pattern = rawPattern.trim();
+    if (!pattern || seen.has(pattern)) continue;
+    seen.add(pattern);
+
+    if (seen.size > NODE_NAME_FILTER_MAX_REGEXES) {
+      if (!reportedTooMany) {
+        errors.push({
+          code: "too_many_regexes",
+          line,
+          message: `最多允许 ${NODE_NAME_FILTER_MAX_REGEXES} 条规则`,
+        });
+        reportedTooMany = true;
+      }
+      continue;
+    }
+
+    if (pattern.length > NODE_NAME_FILTER_MAX_REGEX_LENGTH) {
+      errors.push({
+        code: "regex_too_long",
+        line,
+        message: `每条规则最多 ${NODE_NAME_FILTER_MAX_REGEX_LENGTH} 个字符`,
+      });
+      continue;
+    }
+
+    let compiled: RegExp;
+    try {
+      compiled = new RegExp(pattern, "i");
+    } catch {
+      errors.push({
+        code: "invalid_regex",
+        line,
+        message: "正则语法无效",
+      });
+      continue;
+    }
+
+    if (!safeRegex(compiled)) {
+      errors.push({
+        code: "unsafe_regex",
+        line,
+        message: "正则可能导致运行时间过长",
+      });
+      continue;
+    }
+
+    excludeRegexes.push(pattern);
+    compiledRegexes.push(compiled);
+  }
+
+  if (errors.length > 0) return { ok: false, errors };
+
+  return {
+    ok: true,
+    parsed: {
+      config: {
+        enabled: enabled && excludeRegexes.length > 0,
+        excludeRegexes,
+      },
+      compiledRegexes,
+    },
+  };
+}
+
+export function validateNodeNameFilterConfig(value: unknown): NodeNameFilterValidationResult {
+  const result = inspectNodeNameFilterConfig(value);
+  return result.ok
+    ? { ok: true, config: result.parsed.config }
+    : { ok: false, errors: result.errors };
+}
+
+export function parseNodeNameFilterConfig(value: unknown): NodeNameFilterConfig {
+  const result = inspectNodeNameFilterConfig(value);
+  if (!result.ok) throw new NodeNameFilterConfigError(result.errors);
+  return result.parsed.config;
+}
+
+export function normalizeNodeNameFilterConfig(value: unknown): NodeNameFilterConfig {
+  const result = inspectNodeNameFilterConfig(value);
+  return result.ok ? result.parsed.config : defaultConfig();
+}
+
+export function resolveNodeNameFilter(
+  rawNodes: ParsedNode[],
+  configValue: unknown
+): NodeNameFilterResult {
+  const parsed = inspectNodeNameFilterConfig(configValue);
+  if (!parsed.ok) throw new NodeNameFilterConfigError(parsed.errors);
+
+  if (!parsed.parsed.config.enabled) {
+    return {
+      rawNodes,
+      effectiveNodes: rawNodes,
+      excludedNodes: [],
+      rawCount: rawNodes.length,
+      excludedCount: 0,
+      effectiveCount: rawNodes.length,
+    };
+  }
+
+  const effectiveNodes: ParsedNode[] = [];
+  const excludedNodes: ParsedNode[] = [];
+  for (const node of rawNodes) {
+    const originName = getNodeOriginName(node);
+    if (parsed.parsed.compiledRegexes.some((regex) => regex.test(originName))) {
+      excludedNodes.push(node);
+    } else {
+      effectiveNodes.push(node);
+    }
+  }
+
+  return {
+    rawNodes,
+    effectiveNodes,
+    excludedNodes,
+    rawCount: rawNodes.length,
+    excludedCount: excludedNodes.length,
+    effectiveCount: effectiveNodes.length,
+  };
+}
diff --git a/packages/core/src/subscription/subscription-userinfo.test.ts b/packages/core/src/subscription/subscription-userinfo.test.ts
index 6c881cc..23b66a8 100644
--- a/packages/core/src/subscription/subscription-userinfo.test.ts
+++ b/packages/core/src/subscription/subscription-userinfo.test.ts
@@ -36,6 +36,12 @@ describe("subscription user info helpers", () => {
     });
   });
 
+  it("normalizes millisecond expiry values and rejects implausible magnitudes", () => {
+    expect(parseSubscriptionUserInfo("expire=1760000000000").expire).toBe(1760000000);
+    expect(parseSubscriptionUserInfo("expire=9999999999999999").expire).toBeUndefined();
+    expect(normalizeSubscriptionUserInfo({ expire: 1760000000000 }).expire).toBe(1760000000);
+  });
+
   it("normalizes plausibility and merges traffic snapshots", () => {
     expect(hasSubscriptionUserInfo(null)).toBe(false);
     expect(hasSubscriptionUserInfo(undefined)).toBe(false);
diff --git a/packages/core/src/subscription/subscription-userinfo.ts b/packages/core/src/subscription/subscription-userinfo.ts
index d668e27..35f9376 100644
--- a/packages/core/src/subscription/subscription-userinfo.ts
+++ b/packages/core/src/subscription/subscription-userinfo.ts
@@ -17,7 +17,8 @@ export function parseSubscriptionUserInfo(header: string): SubscriptionUserInfo
     if (key && value) {
       const numeric = parseHeaderNumericValue(value);
       if (numeric !== undefined) {
-        info[key] = numeric;
+        const normalizedNumeric = key === "expire" ? normalizeExpireTimestampSeconds(numeric) : numeric;
+        if (normalizedNumeric !== undefined) info[key] = normalizedNumeric;
         continue;
       }
 
@@ -72,9 +73,23 @@ function isFiniteNonNegativeNumber(value: unknown): value is number {
   return typeof value === "number" && Number.isFinite(value) && value >= 0;
 }
 
+const MIN_EXPIRE_TIMESTAMP_SECONDS = 946684800; // 2000-01-01
+const MAX_EXPIRE_TIMESTAMP_SECONDS = 253402300799; // 9999-12-31T23:59:59Z
+const MIN_EXPIRE_TIMESTAMP_MILLISECONDS = MIN_EXPIRE_TIMESTAMP_SECONDS * 1000;
+const MAX_EXPIRE_TIMESTAMP_MILLISECONDS = MAX_EXPIRE_TIMESTAMP_SECONDS * 1000;
+
+function normalizeExpireTimestampSeconds(value: unknown): number | undefined {
+  if (!isFiniteNonNegativeNumber(value)) return undefined;
+  const integer = Math.floor(value);
+  if (integer > MIN_EXPIRE_TIMESTAMP_SECONDS && integer <= MAX_EXPIRE_TIMESTAMP_SECONDS) return integer;
+  if (integer > MIN_EXPIRE_TIMESTAMP_MILLISECONDS && integer <= MAX_EXPIRE_TIMESTAMP_MILLISECONDS) {
+    return Math.floor(integer / 1000);
+  }
+  return undefined;
+}
+
 function isValidExpireTimestampSeconds(value: unknown): value is number {
-  // expire 通常为秒级 Unix 时间戳；过滤掉 0/1970 等无意义值
-  return isFiniteNonNegativeNumber(value) && value > 946684800; // 2000-01-01
+  return typeof value === "number" && normalizeExpireTimestampSeconds(value) === value;
 }
 
 function hasMeaningfulTrafficSnapshot(info: SubscriptionUserInfo): boolean {
@@ -257,7 +272,8 @@ export function normalizeSubscriptionUserInfo(info: SubscriptionUserInfo | null
   if (isFiniteNonNegativeNumber(info.upload)) out.upload = info.upload;
   if (isFiniteNonNegativeNumber(info.download)) out.download = info.download;
   if (isFiniteNonNegativeNumber(info.total)) out.total = info.total;
-  if (isValidExpireTimestampSeconds(info.expire)) out.expire = info.expire;
+  const expire = normalizeExpireTimestampSeconds(info.expire);
+  if (expire !== undefined) out.expire = expire;
   return out;
 }
 
diff --git a/packages/core/src/templates/config-template.fields.test.ts b/packages/core/src/templates/config-template.fields.test.ts
index a81947b..a7d8618 100644
--- a/packages/core/src/templates/config-template.fields.test.ts
+++ b/packages/core/src/templates/config-template.fields.test.ts
@@ -254,7 +254,7 @@ describe("validateSubBoostTemplateConfig field validation", () => {
           "module:cn:geolocation-cn": { target: 1 },
         } as never,
       },
-      "builtinRuleEdits.target 必须是字符串"
+      "builtinRuleEdits.target 必须是字符串或有效代理组引用"
     );
     expectInvalid(
       {
diff --git a/packages/core/src/templates/config-template.test.ts b/packages/core/src/templates/config-template.test.ts
index 14bfc77..6bb4603 100644
--- a/packages/core/src/templates/config-template.test.ts
+++ b/packages/core/src/templates/config-template.test.ts
@@ -59,6 +59,7 @@ describe("validateSubBoostTemplateConfig", () => {
             id: "custom",
             name: "Custom",
             emoji: "",
+            enabled: false,
             memberSource: "filtered-nodes",
             includeInGroupMembers: false,
             groupType: "load-balance",
@@ -70,7 +71,7 @@ describe("validateSubBoostTemplateConfig", () => {
             name: "Custom Rule",
             behavior: "domain",
             path: "https://rules.example.com/custom.mrs",
-            target: "Custom",
+            target: { kind: "custom", id: "custom" },
             noResolve: false,
           },
           {
@@ -87,7 +88,7 @@ describe("validateSubBoostTemplateConfig", () => {
             id: "custom-rule-a",
             type: "DOMAIN-SUFFIX",
             value: " example.com ",
-            target: "DIRECT",
+            target: { kind: "module", id: "select" },
             noResolve: true,
           },
         ],
@@ -102,7 +103,7 @@ describe("validateSubBoostTemplateConfig", () => {
           },
         ],
         builtinRuleEdits: {
-          [`module:${moduleId}:openai`]: { enabled: false },
+          [`module:${moduleId}:openai`]: { enabled: false, target: { kind: "custom", id: "custom" } },
         },
         proxyGroupNameOverrides: {
           [moduleId]: " Renamed ",
@@ -120,6 +121,7 @@ describe("validateSubBoostTemplateConfig", () => {
       emoji: "",
       memberSource: "filtered-nodes",
       includeInGroupMembers: false,
+      enabled: false,
       groupType: "load-balance",
       strategy: DEFAULT_LOAD_BALANCE_STRATEGY,
     });
@@ -130,7 +132,7 @@ describe("validateSubBoostTemplateConfig", () => {
           name: "Custom Rule",
           behavior: "domain",
           path: "https://rules.example.com/custom.mrs",
-          target: "Custom",
+          target: { kind: "custom", id: "custom" },
         }),
         expect.objectContaining({
           id: "extra",
@@ -145,6 +147,7 @@ describe("validateSubBoostTemplateConfig", () => {
       id: "custom-rule-a",
       value: "example.com",
       noResolve: true,
+      target: { kind: "module", id: "select" },
     });
     expect(result.config.dialerProxyGroups[0]).toMatchObject({
       id: "relay",
@@ -153,7 +156,10 @@ describe("validateSubBoostTemplateConfig", () => {
       targetNodes: ["Target A"],
       enabled: false,
     });
-    expect(result.config.builtinRuleEdits?.[`module:${moduleId}:openai`]).toEqual({ enabled: false });
+    expect(result.config.builtinRuleEdits?.[`module:${moduleId}:openai`]).toEqual({
+      enabled: false,
+      target: { kind: "custom", id: "custom" },
+    });
     expect(result.config.proxyGroupNameOverrides).toEqual({ [moduleId]: "Renamed" });
     expect(result.config).not.toHaveProperty("moduleRuleOverrides");
     expect(result.config).not.toHaveProperty("moduleRuleExclusions");
diff --git a/packages/core/src/templates/config-template.ts b/packages/core/src/templates/config-template.ts
index 0af2254..17547d3 100644
--- a/packages/core/src/templates/config-template.ts
+++ b/packages/core/src/templates/config-template.ts
@@ -3,6 +3,7 @@ import { normalizePersistedRuleOrder } from "@subboost/core/generator/rules";
 import { ensureCustomRuleId, isCustomRuleType } from "@subboost/core/rules/custom-rule-utils";
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
+import { normalizeProxyGroupTargetRef } from "@subboost/core/proxy-group-targets";
 import {
   isValidRuleSetPathOrUrl,
   normalizeRuleModelFromConfig,
@@ -15,6 +16,7 @@ import {
   type CustomProxyGroup,
   type CustomRule,
   type LoadBalanceStrategy,
+  type ProxyGroupRuleTarget,
   type ProxyGroupGroupType,
   type TemplateType,
 } from "@subboost/core/types/config";
@@ -185,6 +187,16 @@ function parseRequiredString(
   return { ok: true, value: opts.allowEmpty ? value : trimmed };
 }
 
+function parseRuleTarget(
+  value: unknown,
+  field: string
+): { ok: true; value: ProxyGroupRuleTarget } | { ok: false; error: string } {
+  const ref = normalizeProxyGroupTargetRef(value);
+  if (ref) return { ok: true, value: ref };
+  if (typeof value === "string") return parseRequiredString(value, field);
+  return invalid(`${field} 必须是字符串或有效代理组引用`);
+}
+
 function parseBoolean(value: unknown, field: string): { ok: true; value: boolean } | { ok: false; error: string } {
   if (typeof value !== "boolean") return invalid(`${field} 必须是布尔值`);
   return { ok: true, value };
@@ -289,7 +301,7 @@ function parseCustomRules(value: unknown): { ok: true; value: CustomRule[] } | {
     if (typeof item.type !== "string" || !isCustomRuleType(item.type)) return invalid("customRules 包含无效类型");
     const ruleValue = parseRequiredString(item.value, "customRules.value");
     if (!ruleValue.ok) return ruleValue;
-    const target = parseRequiredString(item.target, "customRules.target");
+    const target = parseRuleTarget(item.target, "customRules.target");
     if (!target.ok) return target;
     const noResolve = parseOptionalBoolean(item.noResolve, "customRules.noResolve");
     if (!noResolve.ok) return noResolve;
@@ -324,6 +336,8 @@ function parseCustomProxyGroups(value: unknown): { ok: true; value: CustomProxyG
     if (!groupType.ok) return groupType;
     const strategy = parseOptionalLoadBalanceStrategy(item.strategy, "customProxyGroups.strategy");
     if (!strategy.ok) return strategy;
+    const enabled = parseOptionalBoolean(item.enabled, "customProxyGroups.enabled");
+    if (!enabled.ok) return enabled;
     if (item.memberSource !== undefined && item.memberSource !== "filtered-nodes") {
       return invalid("customProxyGroups.memberSource 无效");
     }
@@ -335,6 +349,7 @@ function parseCustomProxyGroups(value: unknown): { ok: true; value: CustomProxyG
       id: id.value,
       name: name.value,
       emoji: emoji.value,
+      ...(enabled.value !== undefined ? { enabled: enabled.value } : {}),
       ...(description ? { description } : {}),
       ...(item.memberSource === "filtered-nodes" ? { memberSource: "filtered-nodes" as const } : {}),
       ...(typeof item.includeInGroupMembers === "boolean"
@@ -378,7 +393,7 @@ function parseCustomRuleSets(value: unknown): { ok: true; value: true } | { ok:
     if (!path.ok) return path;
     const normalizedPath = normalizeRuleSetPathInput(path.value);
     if (!isValidRuleSetPathOrUrl(normalizedPath)) return invalid("customRuleSets.path 无效");
-    const target = parseRequiredString(item.target, "customRuleSets.target");
+    const target = parseRuleTarget(item.target, "customRuleSets.target");
     if (!target.ok) return target;
     const noResolve = parseOptionalBoolean(item.noResolve, "customRuleSets.noResolve");
     if (!noResolve.ok) return noResolve;
@@ -393,8 +408,9 @@ function parseBuiltinRuleEdits(value: unknown): { ok: true; value: true } | { ok
     const key = rawKey.trim();
     if (!BUILTIN_RULE_KEYS.has(key)) return invalid("builtinRuleEdits 包含未知内置规则");
     if (!isRecord(rawEdit)) return invalid("builtinRuleEdits 的值必须是对象");
-    if ("target" in rawEdit && typeof rawEdit.target !== "string") {
-      return invalid("builtinRuleEdits.target 必须是字符串");
+    if ("target" in rawEdit) {
+      const target = parseRuleTarget(rawEdit.target, "builtinRuleEdits.target");
+      if (!target.ok) return target;
     }
     if ("enabled" in rawEdit && rawEdit.enabled !== false) {
       return invalid("builtinRuleEdits.enabled 只能是 false");
diff --git a/packages/server-core/src/cron-auth.test.ts b/packages/server-core/src/cron-auth.test.ts
index ef22541..6ede0c2 100644
--- a/packages/server-core/src/cron-auth.test.ts
+++ b/packages/server-core/src/cron-auth.test.ts
@@ -19,6 +19,10 @@ describe("server-core cron auth helpers", () => {
       ok: false,
       reason: "unauthorized",
     });
+    expect(validateCronSecret({ cronSecret: "a-much-longer-secret", authorization: "Bearer short" })).toEqual({
+      ok: false,
+      reason: "unauthorized",
+    });
     expect(validateCronSecret({ cronSecret: "secret", authorization: "bearer secret  " })).toEqual({
       ok: true,
     });
diff --git a/packages/server-core/src/cron-auth.ts b/packages/server-core/src/cron-auth.ts
index 86a0478..19ed5a8 100644
--- a/packages/server-core/src/cron-auth.ts
+++ b/packages/server-core/src/cron-auth.ts
@@ -1,3 +1,5 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+
 export type CronSecretValidationResult =
   | { ok: true }
   | { ok: false; reason: "missing-secret" | "unauthorized" };
@@ -13,7 +15,9 @@ export function validateCronSecret(params: {
   authorization: string | null | undefined;
 }): CronSecretValidationResult {
   if (!params.cronSecret) return { ok: false, reason: "missing-secret" };
-  if (extractBearerToken(params.authorization) !== params.cronSecret) {
+  const suppliedDigest = createHash("sha256").update(extractBearerToken(params.authorization)).digest();
+  const expectedDigest = createHash("sha256").update(params.cronSecret).digest();
+  if (!timingSafeEqual(suppliedDigest, expectedDigest)) {
     return { ok: false, reason: "unauthorized" };
   }
   return { ok: true };
diff --git a/packages/server-core/src/crypto/encrypted-field.test.ts b/packages/server-core/src/crypto/encrypted-field.test.ts
index 2ba4176..d0000ad 100644
--- a/packages/server-core/src/crypto/encrypted-field.test.ts
+++ b/packages/server-core/src/crypto/encrypted-field.test.ts
@@ -24,4 +24,32 @@ describe("encrypted field crypto", () => {
     expect(() => decryptEncryptedFieldV2(oldShapeCiphertext, masterKey)).toThrow("Invalid ciphertext v2 format");
   });
 
+  it("round-trips an empty plaintext", () => {
+    const ciphertext = encryptEncryptedFieldV2("", masterKey);
+
+    expect(ciphertext.endsWith(":")).toBe(true);
+    expect(decryptEncryptedFieldV2(ciphertext, masterKey)).toBe("");
+  });
+
+  it("rejects missing segments and invalid hex encodings", () => {
+    expect(() =>
+      decryptEncryptedFieldV2(
+        "v2:00112233445566778899aabb:00112233445566778899aabbccddeeff",
+        masterKey
+      )
+    ).toThrow("Invalid ciphertext v2 format");
+    expect(() =>
+      decryptEncryptedFieldV2(
+        "v2:zz112233445566778899aabb:00112233445566778899aabbccddeeff:",
+        masterKey
+      )
+    ).toThrow("Invalid ciphertext v2 encoding");
+    expect(() =>
+      decryptEncryptedFieldV2(
+        "v2:00112233445566778899aabb:00112233445566778899aabbccddeeff:f",
+        masterKey
+      )
+    ).toThrow("Invalid ciphertext v2 encoding");
+  });
+
 });
diff --git a/packages/server-core/src/crypto/encrypted-field.ts b/packages/server-core/src/crypto/encrypted-field.ts
index 7821b9c..83dc9b8 100644
--- a/packages/server-core/src/crypto/encrypted-field.ts
+++ b/packages/server-core/src/crypto/encrypted-field.ts
@@ -40,10 +40,18 @@ export function decryptEncryptedFieldV2(ciphertext: string, masterKey: string):
 
   const parts = ciphertext.split(":");
   const [prefix, ivHex, authTagHex, encrypted] = parts;
-  if (prefix !== V2_PREFIX || !ivHex || !authTagHex || !encrypted || parts.length !== 4) {
+  if (prefix !== V2_PREFIX || !ivHex || !authTagHex || encrypted === undefined || parts.length !== 4) {
     throw new Error("Invalid ciphertext v2 format");
   }
 
+  if (
+    !/^[0-9a-f]{24}$/i.test(ivHex)
+    || !/^[0-9a-f]{32}$/i.test(authTagHex)
+    || !/^(?:[0-9a-f]{2})*$/i.test(encrypted)
+  ) {
+    throw new Error("Invalid ciphertext v2 encoding");
+  }
+
   const iv = Buffer.from(ivHex, "hex");
   const authTag = Buffer.from(authTagHex, "hex");
   if (iv.length !== IV_LENGTH || authTag.length !== TAG_LENGTH) {
diff --git a/packages/server-core/src/subscription/auto-update-failure.test.ts b/packages/server-core/src/subscription/auto-update-failure.test.ts
index 44d7942..c178204 100644
--- a/packages/server-core/src/subscription/auto-update-failure.test.ts
+++ b/packages/server-core/src/subscription/auto-update-failure.test.ts
@@ -75,7 +75,7 @@ describe("classifyStableExternalAutoUpdateFailure", () => {
   it("separates stable external failures from project-side or transient failures", () => {
     expect(classifyStableExternalAutoUpdateFailure({ errorMessage: "当前解析任务较多" })).toEqual({
       isStableExternalFailure: false,
-      reason: "项目侧队列或代理资源暂不可用",
+      reason: "服务暂时不可用",
     });
     expect(classifyStableExternalAutoUpdateFailure({ httpStatus: 502 })).toEqual({
       isStableExternalFailure: false,
diff --git a/packages/server-core/src/subscription/auto-update-failure.ts b/packages/server-core/src/subscription/auto-update-failure.ts
index 24e7ad2..ee72429 100644
--- a/packages/server-core/src/subscription/auto-update-failure.ts
+++ b/packages/server-core/src/subscription/auto-update-failure.ts
@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { safeParseJsonObject } from "@subboost/core/json";
+import { extractHttpStatus } from "@subboost/core/subscription/import-error";
 
 // Product-neutral failure policy shared by server adapters.
 export const AUTO_UPDATE_EXTERNAL_FAILURE_THRESHOLD = 3;
@@ -96,13 +97,6 @@ export function serializeAutoUpdateFailureSourceState(state: AutoUpdateFailureSo
   return Object.keys(state).length > 0 ? JSON.stringify(state) : null;
 }
 
-function extractHttpStatus(text: string): number | null {
-  const match = text.match(/\bHTTP\s+(\d{3})\b/i) ?? text.match(/\b(4\d{2}|5\d{2})\b/);
-  if (!match) return null;
-  const status = Number.parseInt(match[1], 10);
-  return Number.isFinite(status) ? status : null;
-}
-
 export function classifyStableExternalAutoUpdateFailure(
   source: AutoUpdateFailureSourceLike
 ): AutoUpdateFailureClassification {
@@ -115,10 +109,9 @@ export function classifyStableExternalAutoUpdateFailure(
 
   if (
     text.includes("当前解析任务较多") ||
-    text.includes("服务暂时不可用，请稍后再试") ||
-    text.includes("没有可用的代理服务器")
+    text.includes("服务暂时不可用，请稍后再试")
   ) {
-    return { isStableExternalFailure: false, reason: "项目侧队列或代理资源暂不可用" };
+    return { isStableExternalFailure: false, reason: "服务暂时不可用" };
   }
 
   if (
diff --git a/packages/server-core/src/subscription/crud.test.ts b/packages/server-core/src/subscription/crud.test.ts
index 7339f2a..59c0a53 100644
--- a/packages/server-core/src/subscription/crud.test.ts
+++ b/packages/server-core/src/subscription/crud.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import { NodeNameFilterConfigError } from "@subboost/core/subscription/node-name-filter";
 import {
   areSubscriptionUrlListsEquivalent,
   normalizeSubscriptionConfigForPersistence,
@@ -8,6 +9,7 @@ import {
   normalizeSubscriptionUrlList,
   serializeSubscriptionDetailData,
   serializeSubscriptionSummaryData,
+  validateSubscriptionNodeList,
 } from "./crud";
 
 describe("subscription CRUD shared helpers", () => {
@@ -29,6 +31,33 @@ describe("subscription CRUD shared helpers", () => {
     expect(areSubscriptionUrlListsEquivalent(["a"], ["a", "b"])).toBe(false);
   });
 
+  it("strictly validates persisted node lists without blocking unknown forward-compatible types", () => {
+    expect(
+      validateSubscriptionNodeList([
+        { name: "Future", type: "future-protocol", server: "future.example.com", port: 443, "dialer-proxy": "x" },
+        { name: "Direct", type: "direct" },
+        { name: "DNS", type: "dns" },
+        { name: "Relay", type: "relay", proxies: ["Future"] },
+      ])
+    ).toEqual([
+      { name: "Future", type: "future-protocol", server: "future.example.com", port: 443 },
+      { name: "Direct", type: "direct" },
+      { name: "DNS", type: "dns" },
+      { name: "Relay", type: "relay", proxies: ["Future"] },
+    ]);
+
+    for (const [value, message] of [
+      ["bad", "节点列表必须是数组"],
+      [[null], "节点 #1 必须是对象"],
+      [[{ name: "", type: "ss", server: "x", port: 1 }], "节点 #1 缺少有效名称"],
+      [[{ name: "A", type: "ss", server: "", port: 1 }], "节点 #1 缺少有效服务器地址"],
+      [[{ name: "A", type: "ss", server: "x", port: 0 }], "节点 #1 的端口"],
+      [[{ name: "A", type: "relay", proxies: [""] }], "relay proxies"],
+    ] as const) {
+      expect(() => validateSubscriptionNodeList(value)).toThrow(message);
+    }
+  });
+
   it("normalizes config, sources, and smart node matching state", () => {
     expect(
       normalizeSubscriptionConfigForPersistence(
@@ -71,6 +100,100 @@ describe("subscription CRUD shared helpers", () => {
     ).toEqual({ old: true, smartNodeMatchingEnabled: true });
   });
 
+  it("strictly normalizes a persisted node name filter after config merge", () => {
+    expect(
+      normalizeSubscriptionConfigForPersistence(
+        { config: { theme: "light" } },
+        {
+          existingConfig: {
+            keep: true,
+            nodeNameFilter: {
+              enabled: true,
+              excludeRegexes: ["  expired  ", "", "expired", "Traffic"],
+            },
+          },
+        }
+      )
+    ).toEqual({
+      keep: true,
+      theme: "light",
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["expired", "Traffic"],
+      },
+    });
+  });
+
+  it("keeps node name filter absent for legacy configs", () => {
+    const merged = normalizeSubscriptionConfigForPersistence(
+      { config: { theme: "light" } },
+      { existingConfig: { keep: true } }
+    );
+    expect(merged).toEqual({ keep: true, theme: "light" });
+    expect(merged).not.toHaveProperty("nodeNameFilter");
+
+    const replaced = normalizeSubscriptionConfigForPersistence(
+      { config: { theme: "light" } },
+      {
+        existingConfig: {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["expired"],
+          },
+        },
+        mergeExistingConfig: false,
+      }
+    );
+    expect(replaced).toEqual({ theme: "light" });
+    expect(replaced).not.toHaveProperty("nodeNameFilter");
+  });
+
+  it("rejects invalid node name filter syntax with structured line errors", () => {
+    try {
+      normalizeSubscriptionConfigForPersistence({
+        config: {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["valid", "["],
+          },
+        },
+      });
+      throw new Error("Expected invalid node name filter syntax to be rejected");
+    } catch (error) {
+      expect(error).toBeInstanceOf(NodeNameFilterConfigError);
+      expect((error as NodeNameFilterConfigError).errors).toEqual([
+        {
+          code: "invalid_regex",
+          line: 2,
+          message: "正则语法无效",
+        },
+      ]);
+    }
+  });
+
+  it("rejects unsafe node name filter regexes with structured line errors", () => {
+    try {
+      normalizeSubscriptionConfigForPersistence({
+        config: {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["safe", "(a+)+$"],
+          },
+        },
+      });
+      throw new Error("Expected unsafe node name filter regex to be rejected");
+    } catch (error) {
+      expect(error).toBeInstanceOf(NodeNameFilterConfigError);
+      expect((error as NodeNameFilterConfigError).errors).toEqual([
+        {
+          code: "unsafe_regex",
+          line: 2,
+          message: "正则可能导致运行时间过长",
+        },
+      ]);
+    }
+  });
+
   it("serializes summary and detail response data", () => {
     const subscription = {
       id: "sub-1",
diff --git a/packages/server-core/src/subscription/crud.ts b/packages/server-core/src/subscription/crud.ts
index 142c19c..de049f7 100644
--- a/packages/server-core/src/subscription/crud.ts
+++ b/packages/server-core/src/subscription/crud.ts
@@ -1,4 +1,5 @@
 import { stripImportedNodeControlFieldsFromList } from "@subboost/core/subscription/imported-node-controls";
+import { parseNodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import { normalizeSubscriptionResponseInfo } from "@subboost/core/subscription/subscription-response-info";
 import { tryNormalizeSubscriptionUrlInput } from "@subboost/core/subscription/url-input";
 import type { ParsedNode } from "@subboost/core/types/node";
@@ -72,6 +73,38 @@ export function normalizeSubscriptionNodeList(value: unknown): ParsedNode[] {
   return Array.isArray(value) ? stripImportedNodeControlFieldsFromList(value as ParsedNode[]) : [];
 }
 
+export function validateSubscriptionNodeList(value: unknown): ParsedNode[] {
+  if (!Array.isArray(value)) throw new Error("节点列表必须是数组");
+
+  for (let index = 0; index < value.length; index += 1) {
+    const item = value[index];
+    if (!isRecord(item)) throw new Error(`节点 #${index + 1} 必须是对象`);
+
+    const name = typeof item.name === "string" ? item.name.trim() : "";
+    const type = typeof item.type === "string" ? item.type.trim().toLowerCase() : "";
+    if (!name) throw new Error(`节点 #${index + 1} 缺少有效名称`);
+    if (!type) throw new Error(`节点 #${index + 1} 缺少有效类型`);
+
+    if (type === "relay") {
+      if (!Array.isArray(item.proxies) || item.proxies.length === 0 || item.proxies.some((proxy) => typeof proxy !== "string" || !proxy.trim())) {
+        throw new Error(`节点 #${index + 1} 的 relay proxies 必须是非空字符串数组`);
+      }
+      continue;
+    }
+
+    if (type === "direct" || type === "dns") continue;
+
+    if (typeof item.server !== "string" || !item.server.trim()) {
+      throw new Error(`节点 #${index + 1} 缺少有效服务器地址`);
+    }
+    if (typeof item.port !== "number" || !Number.isInteger(item.port) || item.port < 1 || item.port > 65535) {
+      throw new Error(`节点 #${index + 1} 的端口必须是 1 到 65535 的整数`);
+    }
+  }
+
+  return stripImportedNodeControlFieldsFromList(value as ParsedNode[]);
+}
+
 export function normalizeSubscriptionInfoForPersistence(value: unknown): Record<string, unknown> | null {
   return normalizeSubscriptionResponseInfo(value);
 }
@@ -108,6 +141,10 @@ export function normalizeSubscriptionConfigForPersistence(
     }
   }
 
+  if ("nodeNameFilter" in baseConfig) {
+    baseConfig.nodeNameFilter = parseNodeNameFilterConfig(baseConfig.nodeNameFilter);
+  }
+
   if (typeof input.smartNodeMatchingEnabled === "boolean") {
     baseConfig.smartNodeMatchingEnabled = input.smartNodeMatchingEnabled;
   } else if (typeof baseConfig.smartNodeMatchingEnabled !== "boolean" && options.defaultSmartNodeMatchingEnabled !== undefined) {
diff --git a/packages/server-core/src/subscription/refresh-cache-result.test.ts b/packages/server-core/src/subscription/refresh-cache-result.test.ts
index c260b1b..cd3000d 100644
--- a/packages/server-core/src/subscription/refresh-cache-result.test.ts
+++ b/packages/server-core/src/subscription/refresh-cache-result.test.ts
@@ -79,6 +79,64 @@ describe("prepareRefreshCacheResult", () => {
     expect(providerOnly.nodeCount).toBe(0);
     expect(providerOnly.generatedYaml).toContain("proxy-providers:");
     expect(providerOnly.cacheEntry.nodes).toEqual([]);
+
+    expect(
+      prepareRefreshCacheResult({
+        config: {},
+        snapshot: snapshot({ nodes: [] }),
+        maxNodesPerSubscription: 10,
+        proxyProviders: {},
+      })
+    ).toMatchObject({
+      ok: false,
+      reason: "empty_result",
+    });
+  });
+
+  it("keeps the raw cache snapshot but rejects refreshes with no effective nodes", () => {
+    const filtered = prepareRefreshCacheResult({
+      config: {
+        nodeNameFilter: {
+          enabled: true,
+          excludeRegexes: ["^node-a$"],
+        },
+      },
+      snapshot: snapshot({ nodes: [node] }),
+      maxNodesPerSubscription: 10,
+    });
+
+    expect(filtered).toMatchObject({
+      ok: false,
+      reason: "empty_result",
+      nodeCount: 1,
+    });
+  });
+
+  it("allows provider output when all raw nodes are excluded and caches the raw snapshot", () => {
+    const filtered = prepareRefreshCacheResult({
+      config: {
+        nodeNameFilter: {
+          enabled: true,
+          excludeRegexes: ["^node-a$"],
+        },
+      },
+      snapshot: snapshot({ nodes: [node] }),
+      maxNodesPerSubscription: 10,
+      proxyProviders: {
+        remote: {
+          type: "http",
+          url: "https://provider.example.com/sub.yaml",
+          path: "./remote.yaml",
+        },
+      },
+    });
+
+    expect(filtered.ok).toBe(true);
+    if (!filtered.ok) return;
+    expect(filtered.nodeCount).toBe(1);
+    expect(filtered.cacheEntry.nodes).toEqual([node]);
+    expect(filtered.generatedYaml).toContain("proxy-providers:");
+    expect(filtered.generatedYaml).not.toContain("node-a.example.com");
   });
 
   it("enforces node quota before generating YAML", () => {
@@ -94,6 +152,24 @@ describe("prepareRefreshCacheResult", () => {
       nodeCount: 2,
       maxNodesPerSubscription: 1,
     });
+
+    expect(
+      prepareRefreshCacheResult({
+        config: {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: [".*"],
+          },
+        },
+        snapshot: snapshot({ nodes: [node, { ...node, name: "node-b" }] }),
+        maxNodesPerSubscription: 1,
+      })
+    ).toMatchObject({
+      ok: false,
+      reason: "node_quota_exceeded",
+      nodeCount: 2,
+      maxNodesPerSubscription: 1,
+    });
   });
 
   it("returns cache entries with generated YAML for valid snapshots", () => {
@@ -125,4 +201,19 @@ describe("prepareRefreshCacheResult", () => {
       },
     });
   });
+
+  it("rejects invalid persisted filters before publishing refresh output", () => {
+    expect(() =>
+      prepareRefreshCacheResult({
+        config: {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["(a+)+$"],
+          },
+        },
+        snapshot: snapshot(),
+        maxNodesPerSubscription: 10,
+      })
+    ).toThrow("节点名称过滤配置无效");
+  });
 });
diff --git a/packages/server-core/src/subscription/refresh-cache-result.ts b/packages/server-core/src/subscription/refresh-cache-result.ts
index 1225b68..433b40d 100644
--- a/packages/server-core/src/subscription/refresh-cache-result.ts
+++ b/packages/server-core/src/subscription/refresh-cache-result.ts
@@ -4,6 +4,7 @@ import {
   getEffectiveTestOptions,
 } from "@subboost/core/subscription/config-utils";
 import { buildProxyProvidersFromConfig } from "@subboost/core/subscription/proxy-providers";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import type { ParsedNode } from "@subboost/core/types/node";
 import type { SubscriptionResponseInfo } from "@subboost/core/subscription/subscription-response-info";
 import type { RefreshNodeSnapshotResult } from "./refresh-node-snapshot";
@@ -48,10 +49,17 @@ export function prepareRefreshCacheResult(params: {
       testUrl,
       testInterval,
     });
+  const hasProxyProviders = Boolean(
+    proxyProviders && Object.keys(proxyProviders).length > 0
+  );
   const common = {
     proxyProviders,
     nodeCount: params.snapshot.nodes.length,
   };
+  const nodeNameFilterResult = resolveNodeNameFilter(
+    params.snapshot.nodes,
+    params.config.nodeNameFilter
+  );
 
   if (params.snapshot.refreshableSourceCount > 0 && params.snapshot.refreshedSourceCount === 0) {
     return {
@@ -61,19 +69,19 @@ export function prepareRefreshCacheResult(params: {
     };
   }
 
-  if (params.snapshot.nodes.length === 0 && !proxyProviders) {
+  if (params.snapshot.nodes.length > params.maxNodesPerSubscription) {
     return {
       ok: false,
-      reason: "empty_result",
+      reason: "node_quota_exceeded",
+      maxNodesPerSubscription: params.maxNodesPerSubscription,
       ...common,
     };
   }
 
-  if (params.snapshot.nodes.length > params.maxNodesPerSubscription) {
+  if (nodeNameFilterResult.effectiveCount === 0 && !hasProxyProviders) {
     return {
       ok: false,
-      reason: "node_quota_exceeded",
-      maxNodesPerSubscription: params.maxNodesPerSubscription,
+      reason: "empty_result",
       ...common,
     };
   }
diff --git a/packages/server-core/src/subscription/ssrf-ip.test.ts b/packages/server-core/src/subscription/ssrf-ip.test.ts
index fb9b2a5..ee0d7e8 100644
--- a/packages/server-core/src/subscription/ssrf-ip.test.ts
+++ b/packages/server-core/src/subscription/ssrf-ip.test.ts
@@ -36,6 +36,7 @@ describe("SSRF IP classification", () => {
       "::",
       "0:0:0:0:0:0:0:0",
       "::1",
+      "0:0:0:0:0:0:0:1",
       "fc00::1",
       "fd00::1",
       "fe80::1",
@@ -43,8 +44,20 @@ describe("SSRF IP classification", () => {
       "ff00::1",
       "2001:db8::1",
       "2001:0db8::1",
+      "100::1",
+      "100:0:0:1::1",
+      "2001:2::1",
+      "3fff::1",
+      "5f00::1",
+      "4000::1",
       "::ffff:127.0.0.1",
       "::ffff:c0a8:1",
+      "0:0:0:0:0:ffff:7f00:1",
+      "0:0:0:0:0:ffff:c0a8:1",
+      "::127.0.0.1",
+      "64:ff9b::127.0.0.1",
+      "64:ff9b:1:7f00:0:100::",
+      "2002:7f00:1::",
     ]) {
       expect(isPrivateOrReservedIp(ip), ip).toBe(true);
     }
@@ -52,6 +65,11 @@ describe("SSRF IP classification", () => {
     expect(isPrivateOrReservedIp("2001:db80::1")).toBe(false);
     expect(isPrivateOrReservedIp("::ffff:8.8.8.8")).toBe(false);
     expect(isPrivateOrReservedIp("::ffff:808:808")).toBe(false);
+    expect(isPrivateOrReservedIp("::8.8.8.8")).toBe(false);
+    expect(isPrivateOrReservedIp("64:ff9b::8.8.8.8")).toBe(false);
+    expect(isPrivateOrReservedIp("2002:0808:0808::")).toBe(false);
+    expect(isPrivateOrReservedIp("2001:3::1")).toBe(false);
+    expect(isPrivateOrReservedIp("2001:4:112::1")).toBe(false);
   });
 
   it("identifies the benchmark range commonly used by fake-ip DNS", () => {
diff --git a/packages/server-core/src/subscription/ssrf-ip.ts b/packages/server-core/src/subscription/ssrf-ip.ts
index 03e7c14..2ae5aa0 100644
--- a/packages/server-core/src/subscription/ssrf-ip.ts
+++ b/packages/server-core/src/subscription/ssrf-ip.ts
@@ -58,52 +58,134 @@ function isBenchmarkReservedIPv4(ip: string): boolean {
   return ipv4InCidr(ipInt, baseInt, 15);
 }
 
-function ipv4FromMappedHexTail(value: string): string | null {
-  const parts = value.split(":");
-  if (parts.length !== 2) return null;
-  const nums = parts.map((part) => Number.parseInt(part, 16));
-  if (nums.some((num) => !Number.isInteger(num) || num < 0 || num > 0xffff)) return null;
+function ipv4FromHextets(high: number, low: number): string {
   return [
-    nums[0] >> 8,
-    nums[0] & 0xff,
-    nums[1] >> 8,
-    nums[1] & 0xff,
+    high >> 8,
+    high & 0xff,
+    low >> 8,
+    low & 0xff,
   ].join(".");
 }
 
-function isDocumentationIPv6(ip: string): boolean {
-  const [first = "", second = ""] = ip.split(":");
-  return Number.parseInt(first, 16) === 0x2001 && Number.parseInt(second, 16) === 0x0db8;
+type Ipv6CidrRule = {
+  base: string;
+  mask: number;
+  unsafe: boolean;
+};
+
+// Ordered from the most-specific globally reachable exceptions to their
+// enclosing special-purpose ranges. Keep this table aligned with the IANA
+// IPv6 Special-Purpose Address Registry.
+const IPV6_SPECIAL_PURPOSE_RULES: readonly Ipv6CidrRule[] = [
+  { base: "2001:1::1", mask: 128, unsafe: false },
+  { base: "2001:1::2", mask: 128, unsafe: false },
+  { base: "2001:1::3", mask: 128, unsafe: false },
+  { base: "2001:3::", mask: 32, unsafe: false },
+  { base: "2001:4:112::", mask: 48, unsafe: false },
+  { base: "2001:20::", mask: 28, unsafe: false },
+  { base: "2001:30::", mask: 28, unsafe: false },
+  { base: "::", mask: 128, unsafe: true },
+  { base: "::1", mask: 128, unsafe: true },
+  { base: "64:ff9b:1::", mask: 48, unsafe: true },
+  { base: "100::", mask: 64, unsafe: true },
+  { base: "100:0:0:1::", mask: 64, unsafe: true },
+  { base: "2001::", mask: 23, unsafe: true },
+  { base: "2001:db8::", mask: 32, unsafe: true },
+  { base: "3fff::", mask: 20, unsafe: true },
+  { base: "5f00::", mask: 16, unsafe: true },
+  { base: "fc00::", mask: 7, unsafe: true },
+  { base: "fe80::", mask: 10, unsafe: true },
+  { base: "ff00::", mask: 8, unsafe: true },
+];
+
+function expandIpv6Hextets(ip: string): number[] | null {
+  let normalized = ip.toLowerCase();
+  if (normalized.includes(".")) {
+    const lastColon = normalized.lastIndexOf(":");
+    if (lastColon < 0) return null;
+    const ipv4Int = ipv4ToInt(normalized.slice(lastColon + 1));
+    if (ipv4Int === null) return null;
+    normalized = `${normalized.slice(0, lastColon)}:${((ipv4Int >>> 16) & 0xffff).toString(16)}:${(
+      ipv4Int & 0xffff
+    ).toString(16)}`;
+  }
+
+  const compressionIndex = normalized.indexOf("::");
+  if (compressionIndex !== normalized.lastIndexOf("::")) return null;
+
+  const left = (compressionIndex === -1 ? normalized : normalized.slice(0, compressionIndex))
+    .split(":")
+    .filter(Boolean);
+  const right = (compressionIndex === -1 ? "" : normalized.slice(compressionIndex + 2))
+    .split(":")
+    .filter(Boolean);
+  const missing = 8 - left.length - right.length;
+  if ((compressionIndex === -1 && missing !== 0) || (compressionIndex !== -1 && missing < 1)) return null;
+
+  const parts = compressionIndex === -1 ? left : [...left, ...Array(missing).fill("0"), ...right];
+  const hextets = parts.map((part) => Number.parseInt(part, 16));
+  if (hextets.length !== 8 || hextets.some((part) => !Number.isInteger(part) || part < 0 || part > 0xffff)) {
+    return null;
+  }
+  return hextets;
 }
 
-function isPrivateOrReservedIPv6(ip: string): boolean {
-  const normalized = ip.toLowerCase();
-  if (normalized === "::" || normalized === "0:0:0:0:0:0:0:0") return true;
-  if (normalized === "::1") return true;
-
-  const firstHextet = normalized.split(":")[0] || "";
-  if (firstHextet.startsWith("fc") || firstHextet.startsWith("fd")) return true;
-  if (
-    firstHextet.startsWith("fe8") ||
-    firstHextet.startsWith("fe9") ||
-    firstHextet.startsWith("fea") ||
-    firstHextet.startsWith("feb")
-  ) {
-    return true;
+function ipv6InCidr(hextets: readonly number[], base: string, maskBits: number): boolean {
+  const baseHextets = expandIpv6Hextets(base);
+  if (!baseHextets) return false;
+  const fullHextets = Math.floor(maskBits / 16);
+  for (let index = 0; index < fullHextets; index += 1) {
+    if (hextets[index] !== baseHextets[index]) return false;
+  }
+  const remainingBits = maskBits % 16;
+  if (remainingBits === 0) return true;
+  const mask = (0xffff << (16 - remainingBits)) & 0xffff;
+  return (hextets[fullHextets] & mask) === (baseHextets[fullHextets] & mask);
+}
+
+function classifySpecialPurposeIpv6(hextets: readonly number[]): boolean | null {
+  for (const rule of IPV6_SPECIAL_PURPOSE_RULES) {
+    if (ipv6InCidr(hextets, rule.base, rule.mask)) return rule.unsafe;
   }
-  if (firstHextet.startsWith("ff")) return true;
-  if (isDocumentationIPv6(normalized)) return true;
+  return null;
+}
 
-  const lastSegment = normalized.split(":").slice(-1)[0] || "";
-  if (lastSegment.includes(".")) {
-    return isPrivateOrReservedIPv4(lastSegment);
+function extractEmbeddedIpv4(hextets: readonly number[]): string | null {
+  const isIpv4Compatible = hextets.slice(0, 6).every((part) => part === 0);
+  const isIpv4Mapped = hextets.slice(0, 5).every((part) => part === 0) && hextets[5] === 0xffff;
+  const isWellKnownNat64 = hextets[0] === 0x0064 && hextets[1] === 0xff9b && hextets[2] === 0;
+  if (isIpv4Compatible || isIpv4Mapped || isWellKnownNat64) {
+    return ipv4FromHextets(hextets[6], hextets[7]);
   }
-  if (normalized.startsWith("::ffff:")) {
-    const mappedIpv4 = ipv4FromMappedHexTail(normalized.slice("::ffff:".length));
-    return mappedIpv4 ? isPrivateOrReservedIPv4(mappedIpv4) : false;
+
+  // RFC 6052 /48 form: v4[0..15] occupies bits 48..63, the u octet
+  // at bits 64..71 is zero, and v4[16..31] occupies bits 72..87.
+  const isLocalUseNat64 = hextets[0] === 0x0064 && hextets[1] === 0xff9b && hextets[2] === 1;
+  if (isLocalUseNat64 && (hextets[4] >> 8) === 0) {
+    const low = ((hextets[4] & 0xff) << 8) | (hextets[5] >> 8);
+    return ipv4FromHextets(hextets[3], low);
   }
 
-  return false;
+  if (hextets[0] === 0x2002) {
+    return ipv4FromHextets(hextets[1], hextets[2]);
+  }
+
+  return null;
+}
+
+function isPrivateOrReservedIPv6(ip: string): boolean {
+  const hextets = expandIpv6Hextets(ip);
+  if (!hextets) return true;
+
+  const specialPurpose = classifySpecialPurposeIpv6(hextets);
+  if (specialPurpose !== null) return specialPurpose;
+
+  const embeddedIpv4 = extractEmbeddedIpv4(hextets);
+  if (embeddedIpv4) return isPrivateOrReservedIPv4(embeddedIpv4);
+
+  // IANA currently assigns globally routable IPv6 unicast space from
+  // 2000::/3. Other unicast blocks are reserved and must not be SSRF targets.
+  return !ipv6InCidr(hextets, "2000::", 3);
 }
 
 export function isPrivateOrReservedIp(hostname: string): boolean {
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 395a731..316fb97 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -9,7 +9,6 @@
     "./*": "./src/*"
   },
   "dependencies": {
-    "@radix-ui/react-accordion": "^1.2.0",
     "@radix-ui/react-avatar": "^1.1.0",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -17,7 +16,6 @@
     "@radix-ui/react-popover": "^1.1.0",
     "@radix-ui/react-scroll-area": "^1.2.0",
     "@radix-ui/react-select": "^2.1.0",
-    "@radix-ui/react-separator": "^1.1.0",
     "@radix-ui/react-slot": "^1.1.0",
     "@radix-ui/react-switch": "^1.1.0",
     "@radix-ui/react-tabs": "^1.1.0",
@@ -26,7 +24,7 @@
     "class-variance-authority": "^0.7.0",
     "clsx": "^2.1.0",
     "lucide-react": "^1.17.0",
-    "next": "^16.2.7",
+    "next": "^16.2.12",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "react-remove-scroll-bar": "^2.3.8",
diff --git a/packages/ui/src/components/auth/user-menu.test.ts b/packages/ui/src/components/auth/user-menu.test.ts
index 7c7e2d8..9a38d5b 100644
--- a/packages/ui/src/components/auth/user-menu.test.ts
+++ b/packages/ui/src/components/auth/user-menu.test.ts
@@ -5,6 +5,8 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 const mocks = vi.hoisted(() => ({
   captureAuthConfigHandoff: vi.fn(),
   documentHandlers: {} as Record<string, (event: any) => void>,
+  dropdownRoots: [] as any[],
+  dropdownItems: [] as any[],
   fetchUser: vi.fn(),
   intrinsics: [] as any[],
   links: [] as any[],
@@ -71,7 +73,24 @@ vi.mock("lucide-react", () => ({
 }));
 
 vi.mock("@subboost/ui/components/ui/button", () => ({
-  Button: (props: any) => React.createElement("button", props, props.children),
+  Button: ({ asChild: _asChild, ...props }: any) => React.createElement("button", props, props.children),
+}));
+
+vi.mock("@subboost/ui/components/ui/dropdown-menu", () => ({
+  DropdownMenu: (props: any) => {
+    mocks.dropdownRoots.push(props);
+    return React.createElement("div", null, props.children);
+  },
+  DropdownMenuContent: (props: any) => React.createElement("div", props, props.children),
+  DropdownMenuItem: ({ asChild, children, onSelect, ...props }: any) => {
+    mocks.dropdownItems.push({ asChild, children, onSelect, ...props });
+    return asChild
+      ? React.createElement(React.Fragment, null, children)
+      : React.createElement("button", { ...props, onClick: () => onSelect?.() }, children);
+  },
+  DropdownMenuLabel: (props: any) => React.createElement("div", props, props.children),
+  DropdownMenuSeparator: (props: any) => React.createElement("hr", props),
+  DropdownMenuTrigger: (props: any) => React.createElement(React.Fragment, null, props.children),
 }));
 
 vi.mock("@subboost/ui/components/ui/safe-image", () => ({
@@ -109,6 +128,8 @@ describe("UserMenu", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mocks.documentHandlers = {};
+    mocks.dropdownRoots = [];
+    mocks.dropdownItems = [];
     mocks.intrinsics = [];
     mocks.refContains.mockReturnValue(false);
     vi.stubGlobal("document", {
@@ -177,9 +198,11 @@ describe("UserMenu", () => {
     expect(html).toContain("我的订阅");
     expect(html).toContain("账户设置");
     expect(html).toContain("退出登录");
+    expect(html).toContain('aria-label="用户菜单"');
+    expect(mocks.dropdownRoots[0].open).toBe(true);
   });
 
-  it("closes the menu from document, toggle, overlay, links, and logout actions", async () => {
+  it("delegates close behavior to DropdownMenu and logs out", async () => {
     mocks.stateOverride = true;
     mocks.userState = {
       fetchUser: mocks.fetchUser,
@@ -199,26 +222,12 @@ describe("UserMenu", () => {
 
     renderToStaticMarkup(React.createElement(UserMenu, { privilegedMenuItem: { href: "/ops", label: "Privileged" } }));
 
-    mocks.documentHandlers.mousedown({ target: {} });
-    expect(mocks.stateSetter).toHaveBeenCalledWith(false);
-
-    mocks.stateSetter.mockClear();
-    mocks.refContains.mockReturnValueOnce(true);
-    mocks.documentHandlers.mousedown({ target: {} });
-    expect(mocks.stateSetter).not.toHaveBeenCalled();
-
-    findIntrinsic("button", (props) => typeof props.className === "string" && props.className.includes("px-2 py-1.5")).onClick();
-    expect(mocks.stateSetter).toHaveBeenCalledWith(false);
-
-    findIntrinsic("div", (props) => typeof props.className === "string" && props.className.includes("fixed inset-0")).onClick();
-    expect(mocks.stateSetter).toHaveBeenCalledWith(false);
-
-    for (const link of mocks.links) {
-      link.onClick?.();
-    }
+    mocks.dropdownRoots[0].onOpenChange(false);
     expect(mocks.stateSetter).toHaveBeenCalledWith(false);
 
-    await findIntrinsic("button", (props) => textOf(props.children).includes("退出登录")).onClick();
+    const logoutItem = mocks.dropdownItems.find((item) => textOf(item.children).includes("退出登录"));
+    expect(logoutItem).toBeTruthy();
+    await logoutItem.onSelect();
     expect(mocks.logout).toHaveBeenCalled();
     expect(mocks.stateSetter).toHaveBeenCalledWith(false);
     expect(window.location.href).toBe("/");
diff --git a/packages/ui/src/components/auth/user-menu.tsx b/packages/ui/src/components/auth/user-menu.tsx
index f013ddf..1341dcc 100644
--- a/packages/ui/src/components/auth/user-menu.tsx
+++ b/packages/ui/src/components/auth/user-menu.tsx
@@ -3,6 +3,14 @@
 import * as React from "react";
 import Link from "next/link";
 import { Button } from "@subboost/ui/components/ui/button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@subboost/ui/components/ui/dropdown-menu";
 import { SafeImage } from "@subboost/ui/components/ui/safe-image";
 import { captureAuthConfigHandoff } from "@subboost/ui/store/config-store/auth-handoff";
 import { useConfigStore } from "@subboost/ui/store/config-store";
@@ -25,23 +33,11 @@ export type AccountMenuItem = {
 export function UserMenu({ privilegedMenuItem }: { privilegedMenuItem?: AccountMenuItem }) {
   const { user, isLoading: userLoading, fetchUser, logout: userLogout } = useUserStore();
   const [isOpen, setIsOpen] = React.useState(false);
-  const menuRef = React.useRef<HTMLDivElement>(null);
 
   React.useEffect(() => {
     fetchUser();
   }, [fetchUser]);
 
-  React.useEffect(() => {
-    const handleClickOutside = (event: MouseEvent) => {
-      if (menuRef.current && !menuRef.current.contains(event.target as Node)) {
-        setIsOpen(false);
-      }
-    };
-
-    document.addEventListener("mousedown", handleClickOutside);
-    return () => document.removeEventListener("mousedown", handleClickOutside);
-  }, []);
-
   const handleLogout = async () => {
     if (user) await userLogout();
     setIsOpen(false);
@@ -59,53 +55,48 @@ export function UserMenu({ privilegedMenuItem }: { privilegedMenuItem?: AccountM
   // 未登录
   if (!user) {
     return (
-      <Link href="/login" onClick={() => captureAuthConfigHandoff(useConfigStore.getState())}>
-        <Button size="sm" className="gap-2">
+      <Button asChild size="sm" className="gap-2">
+        <Link href="/login" onClick={() => captureAuthConfigHandoff(useConfigStore.getState())}>
           <LogIn className="h-4 w-4" />
           登录
-        </Button>
-      </Link>
+        </Link>
+      </Button>
     );
   }
 
   return (
-    <div className="relative" ref={menuRef}>
-      <button
-        onClick={() => setIsOpen(!isOpen)}
-        className="flex items-center gap-2 px-2 py-1.5 rounded-lg hover:bg-white/5 transition-colors"
-      >
-        <SafeImage
-          src={user.avatarUrl}
-          alt={user.name || user.username}
-          className="h-8 w-8 rounded-full border border-white/20"
-          fallback={
-            <div className="h-8 w-8 rounded-full bg-gradient-to-br from-indigo-500 to-purple-600 flex items-center justify-center">
-              <UserIcon className="h-4 w-4 text-white" />
-            </div>
-          }
-        />
-        <span className="text-sm font-medium hidden sm:block">{user.name || user.username}</span>
-        <ChevronDown className={`h-4 w-4 text-white/50 transition-transform ${isOpen ? "rotate-180" : ""}`} />
-      </button>
-
-      {isOpen && (
-        <>
-          <div 
-            className="fixed inset-0 z-40" 
-            onClick={() => setIsOpen(false)}
+    <DropdownMenu open={isOpen} onOpenChange={setIsOpen}>
+      <DropdownMenuTrigger asChild>
+        <Button
+          variant="ghost"
+          aria-label="用户菜单"
+          className="h-auto gap-2 px-2 py-1.5"
+        >
+          <SafeImage
+            src={user.avatarUrl}
+            alt={user.name || user.username}
+            className="h-8 w-8 rounded-full border border-white/20"
+            fallback={
+              <span className="flex h-8 w-8 items-center justify-center rounded-full bg-gradient-to-br from-indigo-500 to-purple-600">
+                <UserIcon className="h-4 w-4 text-white" />
+              </span>
+            }
           />
-          <div className="absolute right-0 mt-2 w-64 rounded-2xl bg-[#1a1a1a] border border-white/10 shadow-xl py-2 z-50">
-            {/* User Info Header */}
-            <div className="px-4 py-3 border-b border-white/10">
+          <span className="hidden text-sm font-medium sm:block">{user.name || user.username}</span>
+          <ChevronDown className={`h-4 w-4 text-white/50 transition-transform ${isOpen ? "rotate-180" : ""}`} />
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end" className="w-64 border-white/10 bg-[#1a1a1a] p-0 text-white">
+        <DropdownMenuLabel className="border-b border-white/10 px-4 py-3 font-normal text-white">
               <div className="flex items-center gap-3">
                 <SafeImage
                   src={user.avatarUrl}
                   alt={user.name || user.username}
                   className="h-12 w-12 rounded-full border border-white/20"
                   fallback={
-                    <div className="h-12 w-12 rounded-full bg-gradient-to-br from-indigo-500 to-purple-600 flex items-center justify-center">
+                    <span className="flex h-12 w-12 items-center justify-center rounded-full bg-gradient-to-br from-indigo-500 to-purple-600">
                       <UserIcon className="h-6 w-6 text-white" />
-                    </div>
+                    </span>
                   }
                 />
                 <div className="flex-1 min-w-0">
@@ -128,51 +119,47 @@ export function UserMenu({ privilegedMenuItem }: { privilegedMenuItem?: AccountM
                   {user.subscriptionCount}/{user.quota.maxSubscriptions} 订阅
                 </div>
               </div>
-            </div>
-
-            {/* Menu Items */}
-            <div className="py-1">
-              {privilegedMenuItem && user.isAdmin && !user.isBanned && (
+        </DropdownMenuLabel>
+        <div className="py-1">
+          {privilegedMenuItem && user.isAdmin && !user.isBanned && (
+            <DropdownMenuItem asChild className="rounded-none px-4 py-2 text-indigo-400/80 focus:bg-white/5 focus:text-indigo-400">
                 <Link
                   href={privilegedMenuItem.href}
-                  onClick={() => setIsOpen(false)}
-                  className="flex items-center gap-3 px-4 py-2 text-sm text-indigo-400/80 hover:bg-white/5 hover:text-indigo-400 transition-colors"
+                  className="flex items-center gap-3 text-sm"
                 >
                   <Settings className="h-4 w-4" />
                   {privilegedMenuItem.label}
                 </Link>
-              )}
+            </DropdownMenuItem>
+          )}
+          <DropdownMenuItem asChild className="rounded-none px-4 py-2 text-white/60 focus:bg-white/5 focus:text-white">
               <Link
                 href="/dashboard"
-                onClick={() => setIsOpen(false)}
-                className="flex items-center gap-3 px-4 py-2 text-sm text-white/60 hover:bg-white/5 hover:text-white transition-colors"
+                className="flex items-center gap-3 text-sm"
               >
                 <LayoutDashboard className="h-4 w-4" />
                 我的订阅
               </Link>
+          </DropdownMenuItem>
+          <DropdownMenuItem asChild className="rounded-none px-4 py-2 text-white/60 focus:bg-white/5 focus:text-white">
               <Link
                 href="/dashboard/settings"
-                onClick={() => setIsOpen(false)}
-                className="flex items-center gap-3 px-4 py-2 text-sm text-white/60 hover:bg-white/5 hover:text-white transition-colors"
+                className="flex items-center gap-3 text-sm"
               >
                 <Settings className="h-4 w-4" />
                 账户设置
               </Link>
-            </div>
-
-            {/* Logout */}
-            <div className="border-t border-white/10 pt-1">
-              <button
-                onClick={handleLogout}
-                className="flex items-center gap-3 w-full px-4 py-2 text-sm text-red-400 hover:bg-white/5 hover:text-red-300 transition-colors"
-              >
-                <LogOut className="h-4 w-4" />
-                退出登录
-              </button>
-            </div>
-          </div>
-        </>
-      )}
-    </div>
+          </DropdownMenuItem>
+        </div>
+        <DropdownMenuSeparator className="m-0 bg-white/10" />
+        <DropdownMenuItem
+          onSelect={() => void handleLogout()}
+          className="rounded-none px-4 py-2 text-red-400 focus:bg-white/5 focus:text-red-300"
+        >
+          <LogOut className="h-4 w-4" />
+          退出登录
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
   );
 }
diff --git a/packages/ui/src/components/layout/header.tsx b/packages/ui/src/components/layout/header.tsx
index c4a2b5a..d7c75e5 100644
--- a/packages/ui/src/components/layout/header.tsx
+++ b/packages/ui/src/components/layout/header.tsx
@@ -16,6 +16,7 @@ import {
   type LucideIcon,
 } from "lucide-react";
 import { cn } from "@subboost/ui/lib/utils";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { UserMenu, type AccountMenuItem } from "@subboost/ui/components/auth/user-menu";
 import { captureAuthConfigHandoff } from "@subboost/ui/store/config-store/auth-handoff";
 import { useConfigStore } from "@subboost/ui/store/config-store";
@@ -189,8 +190,12 @@ export function Header({
             <UserMenu privilegedMenuItem={privilegedMenuItem} />
 
             {/* Mobile Menu Button */}
-            <button
-              className="md:hidden p-2 rounded-lg hover:bg-white/5 transition-colors"
+            <IconButton
+              label={mobileMenuOpen ? "关闭导航菜单" : "打开导航菜单"}
+              variant="ghost"
+              aria-expanded={mobileMenuOpen}
+              aria-controls="subboost-mobile-navigation"
+              className="rounded-lg p-2 transition-colors hover:bg-white/5 md:hidden"
               onClick={() => setMobileMenuOpen(!mobileMenuOpen)}
             >
               {mobileMenuOpen ? (
@@ -198,13 +203,13 @@ export function Header({
               ) : (
                 <Menu className="w-5 h-5 text-white/60" />
               )}
-            </button>
+            </IconButton>
           </div>
         </div>
 
         {/* Mobile Navigation */}
         {mobileMenuOpen && (
-          <div className="md:hidden border-t border-white/10 py-4">
+          <div id="subboost-mobile-navigation" className="md:hidden border-t border-white/10 py-4">
             <nav className="flex flex-col gap-1">
               {visibleNavItems.map((item) => {
                 const isActive = isNavItemActive(pathname, item.href);
diff --git a/packages/ui/src/components/layout/layout-components.test.ts b/packages/ui/src/components/layout/layout-components.test.ts
index 9a8730d..5a41949 100644
--- a/packages/ui/src/components/layout/layout-components.test.ts
+++ b/packages/ui/src/components/layout/layout-components.test.ts
@@ -80,6 +80,9 @@ describe("shared layout components", () => {
     expect(html).toContain("FAQ");
     expect(html).not.toContain("我的订阅");
     expect(html).toContain("UserMenu:none");
+    expect(html).toContain('aria-label="打开导航菜单"');
+    expect(html).toContain('aria-expanded="false"');
+    expect(html).toContain('aria-controls="subboost-mobile-navigation"');
   });
 
   it("renders local mode header links and privileged menu item", () => {
diff --git a/packages/ui/src/components/subscription/smart-node-matching-help.test.ts b/packages/ui/src/components/subscription/smart-node-matching-help.test.ts
index 73b677b..3556d48 100644
--- a/packages/ui/src/components/subscription/smart-node-matching-help.test.ts
+++ b/packages/ui/src/components/subscription/smart-node-matching-help.test.ts
@@ -3,14 +3,17 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it, vi } from "vitest";
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => React.createElement("span", null, props.children),
+  Close: (props: any) => React.createElement("button", null, props.children),
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("span", null, props.children),
   Portal: (props: any) => React.createElement("div", null, props.children),
-  Content: (props: any) => React.createElement("div", props, props.children),
+  Content: ({ children, sideOffset: _sideOffset, ...props }: any) => React.createElement("div", props, children),
   Arrow: (props: any) => React.createElement("span", props),
 }));
 
 vi.mock("lucide-react", () => ({
+  CircleHelp: () => React.createElement("span", null, "circle-help-icon"),
   HelpCircle: () => React.createElement("span", null, "help-icon"),
 }));
 
diff --git a/packages/ui/src/components/subscription/smart-node-matching-help.tsx b/packages/ui/src/components/subscription/smart-node-matching-help.tsx
index ac914ea..cee4432 100644
--- a/packages/ui/src/components/subscription/smart-node-matching-help.tsx
+++ b/packages/ui/src/components/subscription/smart-node-matching-help.tsx
@@ -1,7 +1,7 @@
 "use client";
 
-import * as Popover from "@radix-ui/react-popover";
 import { HelpCircle } from "lucide-react";
+import { HelpPopover } from "@subboost/ui/components/ui/popover";
 
 type Props = {
   enabled: boolean;
@@ -15,37 +15,22 @@ const SUMMARY_DESCRIPTION = "智能匹配可减少订阅换地址后配置丢失
 
 export function SmartNodeMatchingHelp({ enabled }: Props) {
   return (
-    <Popover.Root>
-      <Popover.Trigger asChild>
-        <button
-          type="button"
-          className="inline-flex h-6 w-6 shrink-0 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-          aria-label="更新时智能匹配节点说明"
-          title="更新时智能匹配节点说明"
-        >
-          <HelpCircle className="h-3.5 w-3.5" />
-        </button>
-      </Popover.Trigger>
-      <Popover.Portal>
-        <Popover.Content
-          side="bottom"
-          align="start"
-          sideOffset={8}
-          className="z-50 w-[340px] max-w-[calc(100vw-2rem)] rounded-xl border border-white/10 bg-black/90 p-3 shadow-2xl backdrop-blur-md"
-        >
-          <div className="space-y-2 text-xs">
-            <div className="flex items-center gap-2">
-              <HelpCircle className="h-4 w-4 text-amber-300" />
-              <div className="font-medium text-white">更新时智能匹配节点</div>
-            </div>
-            <div className="leading-relaxed text-white/60">
-              {enabled ? ENABLED_DESCRIPTION : DISABLED_DESCRIPTION}
-            </div>
-            <div className="leading-relaxed text-white/50">{SUMMARY_DESCRIPTION}</div>
-          </div>
-          <Popover.Arrow className="fill-white/10" />
-        </Popover.Content>
-      </Popover.Portal>
-    </Popover.Root>
+    <HelpPopover
+      label="更新时智能匹配节点说明"
+      side="bottom"
+      align="start"
+      contentClassName="w-[340px] max-w-[calc(100vw-2rem)] bg-black/90 p-3"
+    >
+      <div className="space-y-2 text-xs">
+        <div className="flex items-center gap-2">
+          <HelpCircle className="h-4 w-4 text-amber-300" aria-hidden="true" />
+          <p className="font-medium text-white">更新时智能匹配节点</p>
+        </div>
+        <p className="leading-relaxed text-white/60">
+          {enabled ? ENABLED_DESCRIPTION : DISABLED_DESCRIPTION}
+        </p>
+        <p className="leading-relaxed text-white/50">{SUMMARY_DESCRIPTION}</p>
+      </div>
+    </HelpPopover>
   );
 }
diff --git a/packages/ui/src/components/ui/accordion.tsx b/packages/ui/src/components/ui/accordion.tsx
deleted file mode 100644
index b7e1c85..0000000
--- a/packages/ui/src/components/ui/accordion.tsx
+++ /dev/null
@@ -1,56 +0,0 @@
-"use client";
-
-import * as React from "react";
-import * as AccordionPrimitive from "@radix-ui/react-accordion";
-import { ChevronDown } from "lucide-react";
-import { cn } from "@subboost/ui/lib/utils";
-
-const Accordion = AccordionPrimitive.Root;
-
-const AccordionItem = React.forwardRef<
-  React.ElementRef<typeof AccordionPrimitive.Item>,
-  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Item>
->(({ className, ...props }, ref) => (
-  <AccordionPrimitive.Item
-    ref={ref}
-    className={cn("border-b border-white/10", className)}
-    {...props}
-  />
-));
-AccordionItem.displayName = "AccordionItem";
-
-const AccordionTrigger = React.forwardRef<
-  React.ElementRef<typeof AccordionPrimitive.Trigger>,
-  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Trigger>
->(({ className, children, ...props }, ref) => (
-  <AccordionPrimitive.Header className="flex">
-    <AccordionPrimitive.Trigger
-      ref={ref}
-      className={cn(
-        "flex flex-1 items-center justify-between py-4 px-2 text-sm font-medium text-white/80 hover:text-white transition-all [&[data-state=open]>svg]:rotate-180",
-        className
-      )}
-      {...props}
-    >
-      {children}
-      <ChevronDown className="h-4 w-4 shrink-0 text-white/50 transition-transform duration-200" />
-    </AccordionPrimitive.Trigger>
-  </AccordionPrimitive.Header>
-));
-AccordionTrigger.displayName = AccordionPrimitive.Trigger.displayName;
-
-const AccordionContent = React.forwardRef<
-  React.ElementRef<typeof AccordionPrimitive.Content>,
-  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Content>
->(({ className, children, ...props }, ref) => (
-  <AccordionPrimitive.Content
-    ref={ref}
-    className="overflow-hidden text-sm data-[state=closed]:animate-accordion-up data-[state=open]:animate-accordion-down"
-    {...props}
-  >
-    <div className={cn("pb-4 pt-0 px-2 text-white/60", className)}>{children}</div>
-  </AccordionPrimitive.Content>
-));
-AccordionContent.displayName = AccordionPrimitive.Content.displayName;
-
-export { Accordion, AccordionItem, AccordionTrigger, AccordionContent };
diff --git a/packages/ui/src/components/ui/choice-group.tsx b/packages/ui/src/components/ui/choice-group.tsx
new file mode 100644
index 0000000..994cc4a
--- /dev/null
+++ b/packages/ui/src/components/ui/choice-group.tsx
@@ -0,0 +1,50 @@
+"use client";
+
+import * as React from "react";
+import { cn } from "@subboost/ui/lib/utils";
+
+export interface ChoiceGroupProps extends React.HTMLAttributes<HTMLDivElement> {
+  label: string;
+}
+
+const ChoiceGroup = React.forwardRef<HTMLDivElement, ChoiceGroupProps>(
+  ({ label, className, ...props }, ref) => (
+    <div
+      ref={ref}
+      role="group"
+      aria-label={label}
+      className={cn("flex flex-wrap items-center gap-2", className)}
+      {...props}
+    />
+  )
+);
+ChoiceGroup.displayName = "ChoiceGroup";
+
+export interface ChoiceChipProps
+  extends Omit<React.ButtonHTMLAttributes<HTMLButtonElement>, "aria-pressed"> {
+  label: React.ReactNode;
+  selected: boolean;
+}
+
+const ChoiceChip = React.forwardRef<HTMLButtonElement, ChoiceChipProps>(
+  ({ label, selected, className, type = "button", ...props }, ref) => (
+    <button
+      ref={ref}
+      type={type}
+      aria-pressed={selected}
+      className={cn(
+        "inline-flex min-h-9 items-center justify-center gap-2 rounded-xl border px-3 py-2 text-sm font-medium transition-all focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 disabled:cursor-not-allowed disabled:opacity-50",
+        selected
+          ? "border-primary-500/50 bg-primary-500/20 text-white"
+          : "border-white/15 bg-white/5 text-white/60 hover:bg-white/10 hover:text-white",
+        className
+      )}
+      {...props}
+    >
+      {label}
+    </button>
+  )
+);
+ChoiceChip.displayName = "ChoiceChip";
+
+export { ChoiceGroup, ChoiceChip };
diff --git a/packages/ui/src/components/ui/dialog.tsx b/packages/ui/src/components/ui/dialog.tsx
index b259c16..5c88637 100644
--- a/packages/ui/src/components/ui/dialog.tsx
+++ b/packages/ui/src/components/ui/dialog.tsx
@@ -20,7 +20,7 @@ const DialogOverlay = React.forwardRef<
   <DialogPrimitive.Overlay
     ref={ref}
     className={cn(
-      "fixed inset-0 z-50 bg-black/70 backdrop-blur-sm data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+      "fixed inset-0 z-50 bg-black/70 backdrop-blur-sm",
       className
     )}
     {...props}
@@ -37,7 +37,7 @@ const DialogContent = React.forwardRef<
     <DialogPrimitive.Content
       ref={ref}
       className={cn(
-        "fixed left-[50%] top-[50%] z-50 grid w-full max-w-lg translate-x-[-50%] translate-y-[-50%] gap-4 p-6 duration-200 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[state=closed]:slide-out-to-left-1/2 data-[state=closed]:slide-out-to-top-[48%] data-[state=open]:slide-in-from-left-1/2 data-[state=open]:slide-in-from-top-[48%] rounded-2xl glass-card max-h-[85vh] overflow-y-auto custom-scrollbar",
+        "fixed left-[50%] top-[50%] z-50 grid w-full max-w-lg translate-x-[-50%] translate-y-[-50%] gap-4 p-6 rounded-2xl glass-card max-h-[85vh] overflow-y-auto custom-scrollbar",
         className
       )}
       {...props}
@@ -45,7 +45,7 @@ const DialogContent = React.forwardRef<
       {children}
       <DialogPrimitive.Close className="absolute right-4 top-4 rounded-lg p-1 opacity-70 transition-all hover:opacity-100 hover:bg-white/5 focus:outline-none focus:ring-2 focus:ring-indigo-500/50 disabled:pointer-events-none">
         <X className="h-4 w-4 text-white/60" />
-        <span className="sr-only">Close</span>
+        <span className="sr-only">关闭</span>
       </DialogPrimitive.Close>
     </DialogPrimitive.Content>
   </DialogPortal>
diff --git a/packages/ui/src/components/ui/form-controls.test.ts b/packages/ui/src/components/ui/form-controls.test.ts
new file mode 100644
index 0000000..f8a7681
--- /dev/null
+++ b/packages/ui/src/components/ui/form-controls.test.ts
@@ -0,0 +1,136 @@
+import * as React from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, expectTypeOf, it, vi } from "vitest";
+import { ChoiceChip, ChoiceGroup } from "./choice-group";
+import { FormField } from "./form-field";
+import { IconButton, type IconButtonProps } from "./icon-button";
+import { Input } from "./input";
+import { PasswordField } from "./password-field";
+import { SwitchField } from "./switch-field";
+import {
+  Table,
+  TableBody,
+  TableCaption,
+  TableCell,
+  TableContainer,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "./table";
+
+describe("composed form controls", () => {
+  it("associates labels, descriptions, errors, required state, and existing IDs", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(
+        FormField,
+        {
+          id: "account-name",
+          label: "账号",
+          description: "用于登录",
+          error: "不能为空",
+          required: true,
+        },
+        React.createElement(Input, { "aria-describedby": "external-help" })
+      )
+    );
+
+    expect(html).toContain('for="account-name"');
+    expect(html).toContain('id="account-name"');
+    expect(html).toContain('aria-describedby="external-help account-name-description account-name-error"');
+    expect(html).toContain('aria-invalid="true"');
+    expect(html).toContain('aria-required="true"');
+    expect(html).toContain('role="alert"');
+  });
+
+  it("renders a disabled, labelled switch with its description", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(SwitchField, {
+        label: "监听端口",
+        description: "允许局域网访问",
+        checked: true,
+        disabled: true,
+        density: "compact",
+        onCheckedChange: vi.fn(),
+      })
+    );
+
+    expect(html).toContain("监听端口");
+    expect(html).toContain("允许局域网访问");
+    expect(html).toContain('aria-labelledby="switch-field-');
+    expect(html).toContain('aria-describedby="switch-field-');
+    expect(html).toContain('disabled=""');
+  });
+
+  it("requires a label and gives icon links one accessible focus target", () => {
+    expectTypeOf<IconButtonProps>().toHaveProperty("label");
+
+    const html = renderToStaticMarkup(
+      React.createElement(
+        IconButton,
+        { label: "返回首页", asChild: true, variant: "ghost" },
+        React.createElement("a", { href: "/" }, React.createElement("svg"))
+      )
+    );
+
+    expect(html.match(/<a /g)).toHaveLength(1);
+    expect(html).not.toContain("<button");
+    expect(html).toContain('aria-label="返回首页"');
+    expect(html).toContain('title="返回首页"');
+  });
+
+  it("renders password reveal state with an associated field label", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(PasswordField, {
+        id: "password",
+        label: "密码",
+        description: "至少八位",
+        autoComplete: "current-password",
+        value: "secret123",
+        readOnly: true,
+      })
+    );
+
+    expect(html).toContain('for="password"');
+    expect(html).toContain('type="password"');
+    expect(html).toContain('aria-label="显示密码"');
+    expect(html).toContain('aria-describedby="password-description"');
+  });
+
+  it("exposes selected choice state and group naming", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(
+        ChoiceGroup,
+        { label: "源类型" },
+        React.createElement(ChoiceChip, { label: "订阅链接", selected: true }),
+        React.createElement(ChoiceChip, { label: "文件", selected: false, disabled: true })
+      )
+    );
+
+    expect(html).toContain('role="group"');
+    expect(html).toContain('aria-label="源类型"');
+    expect(html).toContain('aria-pressed="true"');
+    expect(html).toContain('aria-pressed="false"');
+  });
+
+  it("renders the thin table elements inside a horizontal scroll container", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(
+        TableContainer,
+        null,
+        React.createElement(
+          Table,
+          null,
+          React.createElement(TableCaption, null, "用户列表"),
+          React.createElement(TableHeader, null, React.createElement(TableRow, null, React.createElement(TableHead, null, "用户"))),
+          React.createElement(TableBody, null, React.createElement(TableRow, null, React.createElement(TableCell, null, "Ry")))
+        )
+      )
+    );
+
+    expect(html).toContain("overflow-x-auto");
+    expect(html).toContain("<table");
+    expect(html).toContain("<thead");
+    expect(html).toContain("<tbody");
+    expect(html).toContain("<caption");
+  });
+});
diff --git a/packages/ui/src/components/ui/form-field.tsx b/packages/ui/src/components/ui/form-field.tsx
new file mode 100644
index 0000000..9cfc3b9
--- /dev/null
+++ b/packages/ui/src/components/ui/form-field.tsx
@@ -0,0 +1,76 @@
+"use client";
+
+import * as React from "react";
+import { Label } from "@subboost/ui/components/ui/label";
+import { cn } from "@subboost/ui/lib/utils";
+
+type FormFieldControlProps = {
+  id?: string;
+  "aria-describedby"?: string;
+  "aria-invalid"?: React.AriaAttributes["aria-invalid"];
+  "aria-required"?: React.AriaAttributes["aria-required"];
+};
+
+export interface FormFieldProps {
+  id?: string;
+  label: React.ReactNode;
+  description?: React.ReactNode;
+  error?: React.ReactNode;
+  required?: boolean;
+  className?: string;
+  children?: React.ReactElement<FormFieldControlProps>;
+}
+
+function mergeIds(...values: Array<string | undefined>) {
+  return values.filter(Boolean).join(" ") || undefined;
+}
+
+function FormField({
+  id,
+  label,
+  description,
+  error,
+  required = false,
+  className,
+  children,
+}: FormFieldProps) {
+  const controlChild = React.Children.only(children) as React.ReactElement<FormFieldControlProps>;
+  const generatedId = React.useId();
+  const controlId = id ?? `form-field-${generatedId.replaceAll(":", "")}`;
+  const descriptionId = description ? `${controlId}-description` : undefined;
+  const errorId = error ? `${controlId}-error` : undefined;
+  const describedBy = mergeIds(
+    controlChild.props["aria-describedby"],
+    descriptionId,
+    errorId
+  );
+
+  const control = React.cloneElement(controlChild, {
+    id: controlChild.props.id ?? controlId,
+    "aria-describedby": describedBy,
+    "aria-invalid": error ? true : controlChild.props["aria-invalid"],
+    "aria-required": required || controlChild.props["aria-required"] || undefined,
+  });
+
+  return (
+    <div className={cn("space-y-2", className)}>
+      <Label htmlFor={controlChild.props.id ?? controlId}>
+        {label}
+        {required ? <span aria-hidden="true" className="ml-1 text-red-400">*</span> : null}
+      </Label>
+      {control}
+      {description ? (
+        <p id={descriptionId} className="text-xs leading-relaxed text-white/45">
+          {description}
+        </p>
+      ) : null}
+      {error ? (
+        <p id={errorId} className="text-xs leading-relaxed text-red-400" role="alert">
+          {error}
+        </p>
+      ) : null}
+    </div>
+  );
+}
+
+export { FormField };
diff --git a/packages/ui/src/components/ui/icon-button.tsx b/packages/ui/src/components/ui/icon-button.tsx
new file mode 100644
index 0000000..b726df9
--- /dev/null
+++ b/packages/ui/src/components/ui/icon-button.tsx
@@ -0,0 +1,24 @@
+"use client";
+
+import * as React from "react";
+import { Button, type ButtonProps } from "@subboost/ui/components/ui/button";
+
+export interface IconButtonProps extends Omit<ButtonProps, "aria-label" | "size"> {
+  label: string;
+}
+
+const IconButton = React.forwardRef<HTMLButtonElement, IconButtonProps>(
+  ({ label, title, type = "button", ...props }, ref) => (
+    <Button
+      ref={ref}
+      size="icon"
+      type={type}
+      aria-label={label}
+      title={title ?? label}
+      {...props}
+    />
+  )
+);
+IconButton.displayName = "IconButton";
+
+export { IconButton };
diff --git a/packages/ui/src/components/ui/more-basic-components.test.ts b/packages/ui/src/components/ui/more-basic-components.test.ts
index 43df280..7bfb5c1 100644
--- a/packages/ui/src/components/ui/more-basic-components.test.ts
+++ b/packages/ui/src/components/ui/more-basic-components.test.ts
@@ -11,7 +11,6 @@ function mockPrimitive(tag: keyof React.JSX.IntrinsicElements, displayName: stri
 }
 
 vi.mock("@radix-ui/react-label", () => ({ Root: mockPrimitive("label", "LabelRoot") }));
-vi.mock("@radix-ui/react-separator", () => ({ Root: mockPrimitive("hr", "SeparatorRoot") }));
 
 import {
   artisticNavContainerClassName,
@@ -24,17 +23,15 @@ import {
 import { Label } from "./label";
 import { ProtocolBadge, getProtocolBadgeClass } from "./protocol-badge";
 import { SafeImage } from "./safe-image";
-import { Separator } from "./separator";
 import { Textarea } from "./textarea";
 
 describe("additional basic UI components", () => {
-  it("renders label, separator, textarea, protocol badges, and safe images", () => {
+  it("renders label, textarea, protocol badges, and safe images", () => {
     const html = renderToStaticMarkup(
       React.createElement(
         "div",
         null,
         React.createElement(Label, { htmlFor: "name", className: "label-extra" }, "Name"),
-        React.createElement(Separator, { orientation: "vertical", className: "separator-extra" }),
         React.createElement(Textarea, { placeholder: "Write", className: "textarea-extra", readOnly: true }),
         React.createElement(ProtocolBadge, { type: "VMess", className: "badge-extra" }),
         React.createElement(SafeImage, { src: "https://example.test/a.png", alt: "avatar", fallback: React.createElement("span", null, "fallback") }),
@@ -44,8 +41,6 @@ describe("additional basic UI components", () => {
 
     expect(html).toContain("label-extra");
     expect(html).toContain("Name");
-    expect(html).toContain("separator-extra");
-    expect(html).toContain("h-full w-[1px]");
     expect(html).toContain("textarea-extra");
     expect(html).toContain("placeholder=\"Write\"");
     expect(html).toContain("VMess");
diff --git a/packages/ui/src/components/ui/page-pager.tsx b/packages/ui/src/components/ui/page-pager.tsx
index feccfb5..ec7c52c 100644
--- a/packages/ui/src/components/ui/page-pager.tsx
+++ b/packages/ui/src/components/ui/page-pager.tsx
@@ -2,7 +2,7 @@
 
 import * as React from "react";
 import { ChevronLeft, ChevronRight } from "lucide-react";
-import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
 import { cn } from "@subboost/ui/lib/utils";
 
@@ -26,16 +26,15 @@ export function PagePager({ page, totalPages, onPageChange, className, disabled
 
   return (
     <div className={cn("flex items-center gap-2", className)}>
-      <Button
+      <IconButton
+        label="上一页"
         variant="outline"
-        size="icon"
         className="h-10 w-10 rounded-xl bg-white/5 hover:bg-white/10"
         onClick={() => goToPage(page - 1)}
         disabled={disabled || page <= 1 || isSinglePage}
-        aria-label="上一页"
       >
         <ChevronLeft className="h-4 w-4" />
-      </Button>
+      </IconButton>
 
       <div className="flex items-center gap-1">
         <Input
@@ -58,16 +57,15 @@ export function PagePager({ page, totalPages, onPageChange, className, disabled
         <span className="text-sm text-white/60 whitespace-nowrap">/ {safeTotalPages}</span>
       </div>
 
-      <Button
+      <IconButton
+        label="下一页"
         variant="outline"
-        size="icon"
         className="h-10 w-10 rounded-xl bg-white/5 hover:bg-white/10"
         onClick={() => goToPage(page + 1)}
         disabled={disabled || page >= safeTotalPages || isSinglePage}
-        aria-label="下一页"
       >
         <ChevronRight className="h-4 w-4" />
-      </Button>
+      </IconButton>
     </div>
   );
 }
diff --git a/packages/ui/src/components/ui/password-field.tsx b/packages/ui/src/components/ui/password-field.tsx
new file mode 100644
index 0000000..c6ca81d
--- /dev/null
+++ b/packages/ui/src/components/ui/password-field.tsx
@@ -0,0 +1,72 @@
+"use client";
+
+import * as React from "react";
+import { Eye, EyeOff } from "lucide-react";
+import { FormField } from "@subboost/ui/components/ui/form-field";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
+import { Input, type InputProps } from "@subboost/ui/components/ui/input";
+import { cn } from "@subboost/ui/lib/utils";
+
+interface PasswordControlProps extends Omit<InputProps, "type"> {
+  visible: boolean;
+  onVisibleChange: () => void;
+}
+
+const PasswordControl = React.forwardRef<HTMLInputElement, PasswordControlProps>(
+  ({ visible, onVisibleChange, className, disabled, ...props }, ref) => (
+    <span className="relative block">
+      <Input
+        ref={ref}
+        type={visible ? "text" : "password"}
+        className={cn("pr-12", className)}
+        disabled={disabled}
+        {...props}
+      />
+      <IconButton
+        label={visible ? "隐藏密码" : "显示密码"}
+        variant="ghost"
+        disabled={disabled}
+        onClick={onVisibleChange}
+        className="absolute right-1 top-1/2 h-8 w-8 -translate-y-1/2 rounded-lg text-white/50 hover:text-white"
+      >
+        {visible ? <EyeOff aria-hidden="true" /> : <Eye aria-hidden="true" />}
+      </IconButton>
+    </span>
+  )
+);
+PasswordControl.displayName = "PasswordControl";
+
+export interface PasswordFieldProps extends Omit<InputProps, "type"> {
+  label: React.ReactNode;
+  description?: React.ReactNode;
+  error?: React.ReactNode;
+  required?: boolean;
+  fieldClassName?: string;
+}
+
+const PasswordField = React.forwardRef<HTMLInputElement, PasswordFieldProps>(
+  ({ label, description, error, required, fieldClassName, id, ...props }, ref) => {
+    const [visible, setVisible] = React.useState(false);
+
+    return (
+      <FormField
+        id={id}
+        label={label}
+        description={description}
+        error={error}
+        required={required}
+        className={fieldClassName}
+      >
+        <PasswordControl
+          ref={ref}
+          visible={visible}
+          onVisibleChange={() => setVisible((current) => !current)}
+          {...props}
+        />
+      </FormField>
+    );
+  }
+);
+PasswordField.displayName = "PasswordField";
+
+export { PasswordField };
diff --git a/packages/ui/src/components/ui/popover.tsx b/packages/ui/src/components/ui/popover.tsx
new file mode 100644
index 0000000..b1f7635
--- /dev/null
+++ b/packages/ui/src/components/ui/popover.tsx
@@ -0,0 +1,96 @@
+"use client";
+
+import * as React from "react";
+import * as PopoverPrimitive from "@radix-ui/react-popover";
+import { CircleHelp } from "lucide-react";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
+import { cn } from "@subboost/ui/lib/utils";
+
+const Popover = PopoverPrimitive.Root;
+const PopoverTrigger = PopoverPrimitive.Trigger;
+const PopoverAnchor = PopoverPrimitive.Anchor;
+const PopoverClose = PopoverPrimitive.Close;
+const PopoverPortal = PopoverPrimitive.Portal;
+
+const PopoverContent = React.forwardRef<
+  React.ElementRef<typeof PopoverPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Content>
+>(({ className, align = "center", sideOffset = 8, children, ...props }, ref) => (
+  <PopoverPortal>
+    <PopoverPrimitive.Content
+      ref={ref}
+      align={align}
+      sideOffset={sideOffset}
+      collisionPadding={12}
+      className={cn(
+        "z-50 w-72 rounded-xl border border-white/15 bg-zinc-950/95 p-4 text-sm text-white/70 shadow-2xl shadow-black/40 outline-none backdrop-blur-xl",
+        className
+      )}
+      {...props}
+    >
+      {children}
+    </PopoverPrimitive.Content>
+  </PopoverPortal>
+));
+PopoverContent.displayName = PopoverPrimitive.Content.displayName;
+
+const PopoverArrow = React.forwardRef<
+  React.ElementRef<typeof PopoverPrimitive.Arrow>,
+  React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Arrow>
+>(({ className, ...props }, ref) => (
+  <PopoverPrimitive.Arrow
+    ref={ref}
+    className={cn("fill-zinc-950 stroke-white/15", className)}
+    {...props}
+  />
+));
+PopoverArrow.displayName = PopoverPrimitive.Arrow.displayName;
+
+export interface HelpPopoverProps {
+  label: string;
+  children: React.ReactNode;
+  className?: string;
+  contentClassName?: string;
+  side?: React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Content>["side"];
+  align?: React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Content>["align"];
+  sideOffset?: React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Content>["sideOffset"];
+}
+
+function HelpPopover({
+  label,
+  children,
+  className,
+  contentClassName,
+  side,
+  align,
+  sideOffset,
+}: HelpPopoverProps) {
+  return (
+    <Popover>
+      <PopoverTrigger asChild>
+        <IconButton
+          label={label}
+          variant="ghost"
+          className={cn("h-6 w-6 rounded-md text-white/40 hover:text-white/80", className)}
+        >
+          <CircleHelp aria-hidden="true" />
+        </IconButton>
+      </PopoverTrigger>
+      <PopoverContent side={side} align={align} sideOffset={sideOffset} className={contentClassName}>
+        {children}
+        <PopoverArrow />
+      </PopoverContent>
+    </Popover>
+  );
+}
+
+export {
+  HelpPopover,
+  Popover,
+  PopoverAnchor,
+  PopoverArrow,
+  PopoverClose,
+  PopoverContent,
+  PopoverPortal,
+  PopoverTrigger,
+};
diff --git a/packages/ui/src/components/ui/radix-wrappers.test.ts b/packages/ui/src/components/ui/radix-wrappers.test.ts
index 5d85972..2e15ce9 100644
--- a/packages/ui/src/components/ui/radix-wrappers.test.ts
+++ b/packages/ui/src/components/ui/radix-wrappers.test.ts
@@ -1,7 +1,6 @@
 import * as React from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it, vi } from "vitest";
-import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from "./accordion";
 import { Avatar, AvatarFallback, AvatarImage } from "./avatar";
 import {
   Dialog,
@@ -42,21 +41,11 @@ vi.mock("@radix-ui/react-dialog", async () => {
 });
 
 describe("Radix UI wrappers", () => {
-  it("renders accordion, avatar, dialog, switch, and tabs wrappers with merged classes", () => {
+  it("renders avatar, dialog, switch, and tabs wrappers with merged classes", () => {
     const html = renderToStaticMarkup(
       React.createElement(
         "div",
         null,
-        React.createElement(
-          Accordion,
-          { type: "single", collapsible: true, defaultValue: "item-1" },
-          React.createElement(
-            AccordionItem,
-            { value: "item-1", className: "item-extra" },
-            React.createElement(AccordionTrigger, { className: "trigger-extra" }, "Question"),
-            React.createElement(AccordionContent, { className: "content-extra" }, "Answer")
-          )
-        ),
         React.createElement(
           Avatar,
           { className: "avatar-extra" },
@@ -85,14 +74,10 @@ describe("Radix UI wrappers", () => {
       )
     );
 
-    expect(html).toContain("Question");
-    expect(html).toContain("Answer");
-    expect(html).toContain("item-extra");
-    expect(html).toContain("trigger-extra");
-    expect(html).toContain("content-extra");
     expect(html).toContain("avatar-extra");
     expect(html).toContain("fallback-extra");
     expect(html).toContain("dialog-extra");
+    expect(html).toContain("关闭");
     expect(html).toContain("header-extra");
     expect(html).toContain("footer-extra");
     expect(html).toContain("switch-extra");
diff --git a/packages/ui/src/components/ui/select-dropdown-wrappers.test.ts b/packages/ui/src/components/ui/select-dropdown-wrappers.test.ts
index a0acff9..8ecbb9b 100644
--- a/packages/ui/src/components/ui/select-dropdown-wrappers.test.ts
+++ b/packages/ui/src/components/ui/select-dropdown-wrappers.test.ts
@@ -3,8 +3,11 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it, vi } from "vitest";
 
 function mockPrimitive(tag: keyof React.JSX.IntrinsicElements, displayName: string) {
-  const Component = React.forwardRef<HTMLElement, React.HTMLAttributes<HTMLElement>>(
-    ({ children, ...props }, ref) => React.createElement(tag, { ...props, ref }, children)
+  const Component = React.forwardRef<
+    HTMLElement,
+    React.HTMLAttributes<HTMLElement> & { sideOffset?: number }
+  >(
+    ({ children, sideOffset: _sideOffset, ...props }, ref) => React.createElement(tag, { ...props, ref }, children)
   );
   Component.displayName = displayName;
   return Component;
diff --git a/packages/ui/src/components/ui/select.tsx b/packages/ui/src/components/ui/select.tsx
index 694eed9..ab774a4 100644
--- a/packages/ui/src/components/ui/select.tsx
+++ b/packages/ui/src/components/ui/select.tsx
@@ -75,7 +75,7 @@ const SelectContent = React.forwardRef<
     <SelectPrimitive.Content
       ref={ref}
       className={cn(
-        "relative z-50 max-h-[min(var(--radix-select-content-available-height,24rem),24rem)] min-w-[8rem] overflow-hidden rounded-xl border border-white/10 bg-[#1a1a1a] text-white shadow-md data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+        "relative z-50 max-h-[min(var(--radix-select-content-available-height,24rem),24rem)] min-w-[8rem] overflow-hidden rounded-xl border border-white/10 bg-[#1a1a1a] text-white shadow-md",
         position === "popper" &&
           "data-[side=bottom]:translate-y-1 data-[side=left]:-translate-x-1 data-[side=right]:translate-x-1 data-[side=top]:-translate-y-1",
         className
@@ -157,4 +157,3 @@ export {
   SelectScrollUpButton,
   SelectScrollDownButton,
 };
-
diff --git a/packages/ui/src/components/ui/separator.tsx b/packages/ui/src/components/ui/separator.tsx
deleted file mode 100644
index 6eefaa1..0000000
--- a/packages/ui/src/components/ui/separator.tsx
+++ /dev/null
@@ -1,31 +0,0 @@
-"use client";
-
-import * as React from "react";
-import * as SeparatorPrimitive from "@radix-ui/react-separator";
-import { cn } from "@subboost/ui/lib/utils";
-
-const Separator = React.forwardRef<
-  React.ElementRef<typeof SeparatorPrimitive.Root>,
-  React.ComponentPropsWithoutRef<typeof SeparatorPrimitive.Root>
->(
-  (
-    { className, orientation = "horizontal", decorative = true, ...props },
-    ref
-  ) => (
-    <SeparatorPrimitive.Root
-      ref={ref}
-      decorative={decorative}
-      orientation={orientation}
-      className={cn(
-        "shrink-0 bg-dark-300",
-        orientation === "horizontal" ? "h-[1px] w-full" : "h-full w-[1px]",
-        className
-      )}
-      {...props}
-    />
-  )
-);
-Separator.displayName = SeparatorPrimitive.Root.displayName;
-
-export { Separator };
-
diff --git a/packages/ui/src/components/ui/switch-field.tsx b/packages/ui/src/components/ui/switch-field.tsx
new file mode 100644
index 0000000..4c583b7
--- /dev/null
+++ b/packages/ui/src/components/ui/switch-field.tsx
@@ -0,0 +1,67 @@
+"use client";
+
+import * as React from "react";
+import { Label } from "@subboost/ui/components/ui/label";
+import { Switch } from "@subboost/ui/components/ui/switch";
+import { cn } from "@subboost/ui/lib/utils";
+
+export interface SwitchFieldProps {
+  label: React.ReactNode;
+  description?: React.ReactNode;
+  checked: boolean;
+  onCheckedChange: (checked: boolean) => void;
+  disabled?: boolean;
+  density?: "default" | "compact";
+}
+
+function SwitchField({
+  label,
+  description,
+  checked,
+  onCheckedChange,
+  disabled = false,
+  density = "default",
+}: SwitchFieldProps) {
+  const generatedId = React.useId().replaceAll(":", "");
+  const controlId = `switch-field-${generatedId}`;
+  const labelId = `${controlId}-label`;
+  const descriptionId = description ? `${controlId}-description` : undefined;
+
+  return (
+    <Label
+      htmlFor={controlId}
+      className={cn(
+        "flex w-full items-center justify-between rounded-xl border border-white/10 bg-white/5 transition-colors hover:bg-white/[0.07]",
+        density === "compact" ? "gap-2 rounded-md px-2 py-1" : "gap-4 px-4 py-3",
+        disabled && "cursor-not-allowed opacity-60"
+      )}
+    >
+      <span className="min-w-0 space-y-1">
+        <span
+          id={labelId}
+          className={cn(
+            "block font-medium leading-snug text-white/80",
+            density === "compact" ? "text-xs" : "text-sm"
+          )}
+        >
+          {label}
+        </span>
+        {description ? (
+          <span id={descriptionId} className="block text-xs font-normal leading-relaxed text-white/45">
+            {description}
+          </span>
+        ) : null}
+      </span>
+      <Switch
+        id={controlId}
+        checked={checked}
+        onCheckedChange={onCheckedChange}
+        disabled={disabled}
+        aria-labelledby={labelId}
+        aria-describedby={descriptionId}
+      />
+    </Label>
+  );
+}
+
+export { SwitchField };
diff --git a/packages/ui/src/components/ui/table.tsx b/packages/ui/src/components/ui/table.tsx
new file mode 100644
index 0000000..17c71c9
--- /dev/null
+++ b/packages/ui/src/components/ui/table.tsx
@@ -0,0 +1,79 @@
+"use client";
+
+import * as React from "react";
+import { cn } from "@subboost/ui/lib/utils";
+
+const TableContainer = React.forwardRef<HTMLDivElement, React.HTMLAttributes<HTMLDivElement>>(
+  ({ className, ...props }, ref) => (
+    <div ref={ref} className={cn("relative w-full overflow-x-auto", className)} {...props} />
+  )
+);
+TableContainer.displayName = "TableContainer";
+
+const Table = React.forwardRef<HTMLTableElement, React.TableHTMLAttributes<HTMLTableElement>>(
+  ({ className, ...props }, ref) => (
+    <table ref={ref} className={cn("w-full caption-bottom text-sm", className)} {...props} />
+  )
+);
+Table.displayName = "Table";
+
+const TableHeader = React.forwardRef<HTMLTableSectionElement, React.HTMLAttributes<HTMLTableSectionElement>>(
+  ({ className, ...props }, ref) => (
+    <thead ref={ref} className={cn("[&_tr]:border-b [&_tr]:border-white/10", className)} {...props} />
+  )
+);
+TableHeader.displayName = "TableHeader";
+
+const TableBody = React.forwardRef<HTMLTableSectionElement, React.HTMLAttributes<HTMLTableSectionElement>>(
+  ({ className, ...props }, ref) => (
+    <tbody ref={ref} className={cn("[&_tr:last-child]:border-0", className)} {...props} />
+  )
+);
+TableBody.displayName = "TableBody";
+
+const TableHead = React.forwardRef<HTMLTableCellElement, React.ThHTMLAttributes<HTMLTableCellElement>>(
+  ({ className, ...props }, ref) => (
+    <th
+      ref={ref}
+      className={cn("h-11 px-4 text-left align-middle text-xs font-medium text-white/50", className)}
+      {...props}
+    />
+  )
+);
+TableHead.displayName = "TableHead";
+
+const TableRow = React.forwardRef<HTMLTableRowElement, React.HTMLAttributes<HTMLTableRowElement>>(
+  ({ className, ...props }, ref) => (
+    <tr
+      ref={ref}
+      className={cn("border-b border-white/10 transition-colors hover:bg-white/[0.03]", className)}
+      {...props}
+    />
+  )
+);
+TableRow.displayName = "TableRow";
+
+const TableCell = React.forwardRef<HTMLTableCellElement, React.TdHTMLAttributes<HTMLTableCellElement>>(
+  ({ className, ...props }, ref) => (
+    <td ref={ref} className={cn("p-4 align-middle text-white/70", className)} {...props} />
+  )
+);
+TableCell.displayName = "TableCell";
+
+const TableCaption = React.forwardRef<HTMLTableCaptionElement, React.HTMLAttributes<HTMLTableCaptionElement>>(
+  ({ className, ...props }, ref) => (
+    <caption ref={ref} className={cn("mt-4 text-sm text-white/45", className)} {...props} />
+  )
+);
+TableCaption.displayName = "TableCaption";
+
+export {
+  Table,
+  TableBody,
+  TableCaption,
+  TableCell,
+  TableContainer,
+  TableHead,
+  TableHeader,
+  TableRow,
+};
diff --git a/packages/ui/src/components/ui/toaster.test.ts b/packages/ui/src/components/ui/toaster.test.ts
index 41b0b6c..00cab65 100644
--- a/packages/ui/src/components/ui/toaster.test.ts
+++ b/packages/ui/src/components/ui/toaster.test.ts
@@ -16,10 +16,13 @@ vi.mock("@radix-ui/react-toast", async () => {
   const createPrimitive = (
     tag: keyof React.JSX.IntrinsicElements,
     displayName: string,
-    capture?: (props: React.HTMLAttributes<HTMLElement>) => void,
+    capture?: (props: React.HTMLAttributes<HTMLElement> & { altText?: string }) => void,
   ) => {
-    const Component = React.forwardRef<HTMLElement, React.HTMLAttributes<HTMLElement>>(
-      ({ children, ...props }, ref) => {
+    const Component = React.forwardRef<
+      HTMLElement,
+      React.HTMLAttributes<HTMLElement> & { altText?: string }
+    >(
+      ({ children, altText: _altText, ...props }, ref) => {
         capture?.(props);
         return React.createElement(tag, { ...props, ref }, children);
       }
diff --git a/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts b/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
index 775253b..ffd5c7f 100644
--- a/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
+++ b/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
@@ -248,6 +248,7 @@ describe("SubscriptionDashboardSurface", () => {
   });
 
   afterEach(() => {
+    vi.restoreAllMocks();
     vi.unstubAllGlobals();
   });
 
@@ -262,6 +263,8 @@ describe("SubscriptionDashboardSurface", () => {
     mocks.userStore = { user, isLoading: false, fetchUser: vi.fn() };
     const { html } = renderSurface(createAdapter(), { 0: [], 1: false });
     expect(html).toContain("暂无订阅");
+    expect(html).not.toContain("完整订阅链接是持有者凭证");
+    expect(html).not.toContain("账号临时封禁");
     expect(html).toContain("announcement");
     expect(html).toContain("extra-action");
     expect(mocks.captures.stats).toEqual({ subscriptionCount: 0, user });
@@ -269,6 +272,7 @@ describe("SubscriptionDashboardSurface", () => {
   });
 
   it("runs mount effects, handles fetch failures, and shows disabled auto-update notices", async () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     const adapter = createAdapter({ fetchSubscriptions: vi.fn(async () => [subscription]) });
     const mounted = renderSurface(adapter, {}, { runEffects: true });
     await flushPromises();
@@ -280,6 +284,7 @@ describe("SubscriptionDashboardSurface", () => {
     const failed = renderSurface(failingAdapter, {}, { runEffects: true });
     await flushPromises();
     expect(failed.setters[0]).toHaveBeenCalledWith([]);
+    expect(errorSpy).toHaveBeenCalledWith("Failed to fetch subscriptions:", expect.objectContaining({ message: "offline" }));
 
     renderSurface(adapter, { 0: [disabledSubscription], 1: false }, { runEffects: true });
     await flushPromises();
@@ -372,6 +377,7 @@ describe("SubscriptionDashboardSurface", () => {
   });
 
   it("reports download failures without opening the subscription URL", async () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     const dom = stubDocumentActions();
     vi.stubGlobal("fetch", vi.fn(async () => {
       throw new Error("cors");
@@ -386,6 +392,10 @@ describe("SubscriptionDashboardSurface", () => {
       title: "下载失败",
       variant: "destructive",
     }));
+    expect(errorSpy).toHaveBeenCalledWith(
+      "Failed to fetch subscription YAML for download:",
+      expect.objectContaining({ message: "cors" })
+    );
   });
 
   it("uses the adapter download URL resolver before fetching subscription YAML", async () => {
@@ -418,6 +428,7 @@ describe("SubscriptionDashboardSurface", () => {
   });
 
   it("guards cancelled delete and in-flight refresh failures", async () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     const adapter = createAdapter({ refreshSubscription: vi.fn(async () => { throw new Error("refresh failed"); }) });
     renderSurface(adapter, { 0: [subscription], 1: false, 2: null, 3: "sub-1" });
     mocks.captures.buttons.find((props: any) => props.title === "重新生成配置并刷新缓存").onClick();
@@ -445,9 +456,19 @@ describe("SubscriptionDashboardSurface", () => {
     mocks.captures.buttons.find((props: any) => props.className?.includes("text-red-400")).onClick();
     await flushPromises();
     expect(mocks.toast).toHaveBeenCalledWith(expect.objectContaining({ title: "删除失败，请稍后重试", variant: "destructive" }));
+    expect(errorSpy).toHaveBeenCalledWith(
+      "Failed to refresh subscription:",
+      expect.objectContaining({ message: "refresh failed" })
+    );
+    expect(errorSpy).toHaveBeenCalledWith("Failed to refresh subscription:", "bad");
+    expect(errorSpy).toHaveBeenCalledWith(
+      "Failed to delete subscription:",
+      expect.objectContaining({ message: "delete failed" })
+    );
   });
 
   it("validates and saves subscription settings", async () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     const adapter = createAdapter();
     renderSurface(adapter, { 0: [subscription], 1: false, 4: true, 5: subscription, 6: "  ", 7: true, 8: true, 9: 24, 10: false });
     await mocks.captures.settingsDialog.onSave();
@@ -494,5 +515,9 @@ describe("SubscriptionDashboardSurface", () => {
     renderSurface(failingAdapter, { 0: [subscription], 1: false, 4: true, 5: subscription, 6: "Renamed", 7: true, 8: false, 9: 24, 10: false });
     await mocks.captures.settingsDialog.onSave();
     expect(mocks.toast).toHaveBeenCalledWith(expect.objectContaining({ title: "save failed", variant: "destructive" }));
+    expect(errorSpy).toHaveBeenCalledWith(
+      "Failed to save subscription settings:",
+      expect.objectContaining({ message: "save failed" })
+    );
   });
 });
diff --git a/packages/ui/src/dashboard/subscription-dashboard-surface.tsx b/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
index 5326baf..b8e8bc6 100644
--- a/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
+++ b/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
@@ -354,12 +354,12 @@ export function SubscriptionDashboardSurface({ adapter }: Props) {
         </div>
         <div className="flex items-center gap-2">
           {adapter.renderHeaderActions?.({ user })}
-          <Link href={newSubscriptionHref}>
-            <Button className="gap-2">
+          <Button asChild className="gap-2">
+            <Link href={newSubscriptionHref}>
               <Plus className="h-4 w-4" />
               新建订阅
-            </Button>
-          </Link>
+            </Link>
+          </Button>
         </div>
       </div>
 
@@ -383,12 +383,12 @@ export function SubscriptionDashboardSurface({ adapter }: Props) {
               <FileCode className="h-12 w-12 mx-auto text-white/40 mb-4" />
               <h3 className="text-lg font-medium mb-2">暂无订阅</h3>
               <p className="text-white/50 mb-4">创建您的第一个订阅配置</p>
-              <Link href={newSubscriptionHref}>
-                <Button>
+              <Button asChild>
+                <Link href={newSubscriptionHref}>
                   <Plus className="mr-2 h-4 w-4" />
                   新建订阅
-                </Button>
-              </Link>
+                </Link>
+              </Button>
             </div>
           ) : (
             <div className="space-y-4">
@@ -478,9 +478,9 @@ function LoginPrompt({ loginHref }: { loginHref: string }) {
         <Shield className="h-16 w-16 mx-auto text-white/50" />
         <h1 className="text-2xl font-bold">请先登录</h1>
         <p className="text-white/50">登录后可以管理您的订阅和模板</p>
-        <Link href={loginHref}>
-          <Button size="lg">登录</Button>
-        </Link>
+        <Button asChild size="lg">
+          <Link href={loginHref}>登录</Link>
+        </Button>
       </div>
     </div>
   );
@@ -543,12 +543,12 @@ function SubscriptionRow({
       </div>
 
       <div className="flex flex-wrap items-center gap-2 sm:shrink-0 sm:justify-end">
-        <Link href={editHref}>
-          <Button variant="ghost" size="sm" className="gap-0 sm:gap-2" title="回到首页编辑该订阅（更新后链接不变）">
+        <Button asChild variant="ghost" size="sm" className="gap-0 sm:gap-2" title="回到首页编辑该订阅（更新后链接不变）">
+          <Link href={editHref}>
             <Settings className="h-4 w-4" />
             <span className="hidden sm:inline">编辑</span>
-          </Button>
-        </Link>
+          </Link>
+        </Button>
         <Button
           variant="ghost"
           size="sm"
diff --git a/packages/ui/src/dashboard/subscription-settings-dialog.tsx b/packages/ui/src/dashboard/subscription-settings-dialog.tsx
index 932bde7..f3f7b9b 100644
--- a/packages/ui/src/dashboard/subscription-settings-dialog.tsx
+++ b/packages/ui/src/dashboard/subscription-settings-dialog.tsx
@@ -10,8 +10,9 @@ import {
   DialogTitle,
 } from "@subboost/ui/components/ui/dialog";
 import { Input } from "@subboost/ui/components/ui/input";
-import { Label } from "@subboost/ui/components/ui/label";
+import { FormField } from "@subboost/ui/components/ui/form-field";
 import { Switch } from "@subboost/ui/components/ui/switch";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { SmartNodeMatchingHelp } from "@subboost/ui/components/subscription/smart-node-matching-help";
 import {
   getAutoUpdateIntervalPolicyMinLabel,
@@ -67,15 +68,14 @@ export function SubscriptionSettingsDialog({
         </DialogHeader>
 
         <div className="space-y-4 py-2">
-          <div className="space-y-2">
-            <Label>订阅名称</Label>
+          <FormField label="订阅名称">
             <Input
               value={settingsName}
               onChange={(e) => setSettingsName(e.target.value)}
               maxLength={100}
               placeholder="例如：我的配置"
             />
-          </div>
+          </FormField>
 
           <div className="flex items-center justify-between gap-4">
             <div className="min-w-0">
@@ -84,16 +84,19 @@ export function SubscriptionSettingsDialog({
                 <SmartNodeMatchingHelp enabled={smartNodeMatchingEnabled} />
               </div>
             </div>
-            <Switch checked={smartNodeMatchingEnabled} onCheckedChange={setSmartNodeMatchingEnabled} />
+            <Switch
+              checked={smartNodeMatchingEnabled}
+              onCheckedChange={setSmartNodeMatchingEnabled}
+              aria-label="更新时智能匹配节点"
+            />
           </div>
 
-          <div className="flex items-center justify-between gap-4">
-            <div className="min-w-0">
-              <p className="text-sm text-white/70">启用自动更新</p>
-              <p className="text-xs text-white/40 mt-1">开启后服务器会按间隔刷新缓存</p>
-            </div>
-            <Switch checked={autoUpdateEnabled} onCheckedChange={setAutoUpdateEnabled} />
-          </div>
+          <SwitchField
+            label="启用自动更新"
+            description="开启后服务器会按间隔刷新缓存"
+            checked={autoUpdateEnabled}
+            onCheckedChange={setAutoUpdateEnabled}
+          />
 
           {!autoUpdateEnabled && subscription?.autoUpdateState.disabledAt && subscription.autoUpdateState.disabledReason && (
             <div className="rounded-md border border-amber-400/25 bg-amber-500/10 px-3 py-2 text-xs leading-relaxed text-amber-100">
@@ -102,8 +105,7 @@ export function SubscriptionSettingsDialog({
           )}
 
           {autoUpdateEnabled && (
-            <div className="space-y-2">
-              <Label>自动更新间隔（小时）</Label>
+            <FormField label="自动更新间隔（小时）">
               <Input
                 type="number"
                 min={policy.minHours}
@@ -111,7 +113,7 @@ export function SubscriptionSettingsDialog({
                 value={autoUpdateHours}
                 onChange={(e) => setAutoUpdateHours(Number(e.target.value))}
               />
-            </div>
+            </FormField>
           )}
         </div>
 
diff --git a/packages/ui/src/product/converter/advanced-mode/constants.ts b/packages/ui/src/product/converter/advanced-mode/constants.ts
index 9514aa0..adf713e 100644
--- a/packages/ui/src/product/converter/advanced-mode/constants.ts
+++ b/packages/ui/src/product/converter/advanced-mode/constants.ts
@@ -1,20 +1 @@
-import { FileCode, Link2, Server } from "lucide-react";
-import type { SourceType } from "@subboost/ui/store/config-store";
-
-export const sourceTypeInfo: Record<
-  SourceType,
-  {
-    label: string;
-    icon: typeof Link2;
-    placeholder: string;
-  }
-> = {
-  url: { label: "订阅链接", icon: Link2, placeholder: "https://example.com/sub?token=xxx" },
-  yaml: { label: "YAML 配置", icon: FileCode, placeholder: "proxies:\n  - name: 节点名称\n    type: vmess\n    ..." },
-  nodes: {
-    label: "节点链接",
-    icon: Server,
-    placeholder:
-      "ss://...\nssr://...\nvmess://...\nvless://...\ntrojan://...\nanytls://...\nhysteria2://... / hy2://...\ntuic://...\n(socks5://... / socks4://...)",
-  },
-};
+export { sourceTypeInfo } from "@subboost/ui/product/converter/source-type-info";
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
index fadddcf..d436709 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
@@ -77,8 +77,17 @@ vi.mock("@subboost/ui/components/ui/button", () => ({
     return null;
   },
 }));
+vi.mock("@subboost/ui/components/ui/icon-button", () => ({
+  IconButton: (props: any) => {
+    mocks.captures.iconButtons.push(props);
+    return null;
+  },
+}));
 vi.mock("@subboost/ui/components/ui/dropdown-menu", () => ({
-  DropdownMenu: (props: any) => props.children,
+  DropdownMenu: (props: any) => {
+    mocks.captures.dropdownRoots.push(props);
+    return props.children;
+  },
   DropdownMenuTrigger: (props: any) => props.children,
   DropdownMenuContent: (props: any) => {
     mocks.captures.dropdownContents.push(props);
@@ -94,6 +103,8 @@ vi.mock("@subboost/ui/components/ui/dropdown-menu", () => ({
     mocks.captures.menuItems.push(props);
     return props.children;
   },
+  DropdownMenuLabel: (props: any) => props.children,
+  DropdownMenuSeparator: () => null,
 }));
 vi.mock("@subboost/ui/components/ui/input", () => ({
   Input: (props: any) => {
@@ -170,9 +181,11 @@ function renderSection(overrides: Record<number, unknown> = {}, props = { isExpa
   stateMock.setters = [];
   mocks.captures.buttons = [];
   mocks.captures.inputs = [];
+  mocks.captures.iconButtons = [];
   mocks.captures.switches = [];
   mocks.captures.menuItems = [];
   mocks.captures.dropdownContents = [];
+  mocks.captures.dropdownRoots = [];
   mocks.captures.intrinsics = [];
   try {
     const html = renderToStaticMarkup(React.createElement(DialerProxyGroupsSection, props));
@@ -204,7 +217,7 @@ function findIntrinsics(type: string, predicate: (props: any) => boolean) {
 describe("DialerProxyGroupsSection", () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    mocks.captures = { buttons: [], dropdownContents: [], inputs: [], menuItems: [], switches: [], intrinsics: [] };
+    mocks.captures = { buttons: [], dropdownContents: [], dropdownRoots: [], iconButtons: [], inputs: [], menuItems: [], switches: [], intrinsics: [] };
     mocks.store = {
       nodes,
       dialerProxyGroups: [groupA, groupB],
@@ -227,7 +240,7 @@ describe("DialerProxyGroupsSection", () => {
     mocks.store.dialerProxyGroups = [];
     renderSection();
     expect(mocks.captures.header).toEqual(expect.objectContaining({ title: "中转代理组", isExpanded: true }));
-    expect(mocks.captures.buttons.at(-1)).toEqual(expect.objectContaining({ className: expect.stringContaining("border-dashed") }));
+    expect(mocks.captures.buttons.find((props: any) => String(props.className).includes("border-dashed"))).toBeTruthy();
 
     mocks.store.nodes = nodes;
     mocks.store.dialerProxyGroups = [groupA, groupB];
@@ -237,6 +250,34 @@ describe("DialerProxyGroupsSection", () => {
     expect(mocks.captures.switches[1]).toEqual(expect.objectContaining({ checked: false }));
   });
 
+  it("offers only effective nodes while retaining configured group references", () => {
+    mocks.store.nodes = nodes;
+    mocks.store.nodeNameFilter = {
+      enabled: true,
+      excludeRegexes: ["^alpha$"],
+    };
+    mocks.store.dialerProxyGroups = [
+      groupA,
+      {
+        ...groupB,
+        relayNodes: ["Alpha", "DIRECT"],
+        targetNodes: ["Alpha"],
+      },
+    ];
+
+    const { html } = renderSection({ 0: new Set(["g-a"]) });
+
+    expect(html).not.toContain(">Alpha<");
+    expect(html).toContain("Beta");
+    expect(mocks.store.dialerProxyGroups[0].relayNodes).toEqual(["Alpha"]);
+    mocks.captures.switches[1].onCheckedChange(true);
+    expect(mocks.store.updateDialerProxyGroup).toHaveBeenCalledWith("g-b", {
+      enabled: true,
+      relayNodes: ["Alpha", "DIRECT"],
+      targetNodes: ["Alpha"],
+    });
+  });
+
   it("adds custom groups, rejects duplicates, and records interactions", () => {
     const { setters } = renderSection({ 1: true, 2: { emoji: "🧩", name: "New Dialer" } });
 
@@ -292,12 +333,11 @@ describe("DialerProxyGroupsSection", () => {
   it("opens the add menu and creates preset dialer groups", () => {
     const { setters } = renderSection();
 
-    const addMenuButton = mocks.captures.buttons.find((props: any) => textOf(props.children).includes("添加中转组"));
-    addMenuButton.onClick();
+    mocks.captures.dropdownRoots.find((props: any) => typeof props.onOpenChange === "function").onOpenChange(true);
     expect((setters[1] as any).lastValue).toBe(true);
 
     renderSection({ 1: true });
-    findIntrinsic("button", (props) => textOf(props.children).includes("香港中转")).onClick();
+    mocks.captures.menuItems.find((props: any) => textOf(props.children).includes("香港中转")).onSelect();
     expect(mocks.store.addDialerProxyGroup).toHaveBeenCalledWith({
       name: "香港中转",
       enabled: true,
@@ -373,7 +413,7 @@ describe("DialerProxyGroupsSection", () => {
       })
     );
 
-    findIntrinsic("button", (props) => props.title === "删除").onClick({ stopPropagation: vi.fn() });
+    mocks.captures.iconButtons.find((props: any) => props.label === "删除 Group A 中转组").onClick({ stopPropagation: vi.fn() });
     expect(mocks.store.removeDialerProxyGroup).toHaveBeenCalledWith("g-a");
   });
 
@@ -434,25 +474,25 @@ describe("DialerProxyGroupsSection", () => {
 
   it("toggles expansion and relay or target membership from native rows", () => {
     let result = renderSection();
-    findIntrinsic("div", (props) => typeof props.className === "string" && props.className.includes("cursor-pointer")).onClick();
+    findIntrinsic("button", (props) => props["aria-label"] === "展开 Group A").onClick();
     expect((result.setters[0] as any).lastValue).toEqual(new Set(["g-a"]));
 
     result = renderSection({ 0: new Set(["g-a"]) });
-    findIntrinsic("div", (props) => typeof props.className === "string" && props.className.includes("cursor-pointer")).onClick();
+    findIntrinsic("button", (props) => props["aria-label"] === "收起 Group A").onClick();
     expect((result.setters[0] as any).lastValue).toEqual(new Set());
 
     renderSection({ 0: new Set(["g-a"]) });
-    findIntrinsic("div", (props) => textOf(props.children).includes("Alpha")).onClick();
+    findIntrinsic("button", (props) => textOf(props.children).includes("Alpha") && props["aria-pressed"] === true).onClick();
     expect(mocks.store.removeNodeFromDialerGroup).toHaveBeenCalledWith("g-a", "Alpha", true);
 
-    findIntrinsic("div", (props) => textOf(props.children).includes("DIRECT（直连）")).onClick();
+    findIntrinsic("button", (props) => textOf(props.children).includes("DIRECT（直连）")).onClick();
     expect(mocks.store.addNodeToDialerGroup).toHaveBeenCalledWith("g-a", "DIRECT", true);
 
-    findIntrinsic("div", (props) => textOf(props.children).includes("Beta")).onClick();
+    findIntrinsic("button", (props) => textOf(props.children).includes("Beta") && props["aria-pressed"] === true).onClick();
     expect(mocks.store.removeNodeFromDialerGroup).toHaveBeenCalledWith("g-a", "Beta", false);
 
     const gammaTargetRow = findIntrinsics(
-      "div",
+      "button",
       (props) => textOf(props.children).includes("Gamma") && typeof props.onClick === "function"
     ).at(-1);
     expect(gammaTargetRow).toBeTruthy();
@@ -466,7 +506,7 @@ describe("DialerProxyGroupsSection", () => {
     mocks.store.addNodeToDialerGroup.mockClear();
     renderSection({ 0: new Set(["g-a"]) });
     const blockedGammaTargetRow = findIntrinsics(
-      "div",
+      "button",
       (props) => textOf(props.children).includes("Gamma") && typeof props.onClick === "function"
     ).at(-1);
     expect(blockedGammaTargetRow).toBeTruthy();
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
index 1e74f58..ebe112e 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
@@ -4,12 +4,22 @@ import * as React from "react";
 import { Check, ChevronDown, ChevronRight, Link as LinkIcon, Pencil, Plus, Search, SlidersHorizontal, Trash2, X } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@subboost/ui/components/ui/dropdown-menu";
 import { Input } from "@subboost/ui/components/ui/input";
 import { Switch } from "@subboost/ui/components/ui/switch";
 import { toast } from "@subboost/ui/components/ui/toaster";
 import { DEFAULT_LOAD_BALANCE_STRATEGY, type ProxyGroupGroupType } from "@subboost/core/types/config";
 import { PROXY_GROUP_MODULES } from "@subboost/core/generator/proxy-groups";
 import { resolveProxyGroupModuleName } from "@subboost/core/proxy-group-name";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import { cn } from "@subboost/ui/lib/utils";
 import { useConfigStore, PRESET_RELAY_NAMES } from "@subboost/ui/store/config-store";
 import { useProductInteractionAdapter } from "@subboost/ui/product/interactions";
@@ -44,6 +54,7 @@ export function DialerProxyGroupsSection({
 }) {
   const {
     nodes,
+    nodeNameFilter,
     dialerProxyGroups,
     customProxyGroups,
     proxyGroupNameOverrides,
@@ -68,6 +79,18 @@ export function DialerProxyGroupsSection({
   const [relaySearchByGroupId, setRelaySearchByGroupId] = React.useState<Record<string, string>>({});
   const [targetSearchByGroupId, setTargetSearchByGroupId] = React.useState<Record<string, string>>({});
   const interactions = useProductInteractionAdapter();
+  const effectiveNodes = React.useMemo(
+    () => resolveNodeNameFilter(nodes, nodeNameFilter).effectiveNodes,
+    [nodeNameFilter, nodes],
+  );
+  const rawNodeNameSet = React.useMemo(
+    () => new Set(nodes.map((node) => node.name)),
+    [nodes],
+  );
+  const effectiveNodeNameSet = React.useMemo(
+    () => new Set(effectiveNodes.map((node) => node.name)),
+    [effectiveNodes],
+  );
 
   const toggleDialerGroupExpand = (groupId: string) => {
     setExpandedDialerGroups((prev) => {
@@ -133,7 +156,7 @@ export function DialerProxyGroupsSection({
       }
     }
 
-    const available = nodes
+    const available = effectiveNodes
       .filter((n) => !usedTargets.has(n.name))
       .map((n) => ({
         name: n.name,
@@ -190,6 +213,12 @@ export function DialerProxyGroupsSection({
           {/* 已有的中转组 */}
           {dialerProxyGroups.map((group) => {
             const isEnabled = group.enabled !== false;
+            const visibleRelayCount = group.relayNodes.filter(
+              (name) => !rawNodeNameSet.has(name) || effectiveNodeNameSet.has(name),
+            ).length;
+            const visibleTargetCount = group.targetNodes.filter((name) =>
+              effectiveNodeNameSet.has(name),
+            ).length;
             const isEditing = editingDialerGroupId === group.id;
             const dialerGroupType: ProxyGroupGroupType = group.type;
             const dialerStrategy = group.strategy ?? DEFAULT_LOAD_BALANCE_STRATEGY;
@@ -206,7 +235,7 @@ export function DialerProxyGroupsSection({
                   return displayName.toLowerCase().includes(relaySearchKeyword);
                 })
               : availableRelayNodes;
-            const availableTargetNodes = nodes.filter((node) => !group.relayNodes.includes(node.name));
+            const availableTargetNodes = effectiveNodes.filter((node) => !group.relayNodes.includes(node.name));
             const visibleTargetNodes = targetSearchKeyword
               ? availableTargetNodes.filter((node) => node.name.toLowerCase().includes(targetSearchKeyword))
               : availableTargetNodes;
@@ -236,16 +265,25 @@ export function DialerProxyGroupsSection({
               <div key={group.id} className="bg-white/5 rounded-lg border border-white/10">
               {/* 组标题 */}
               <div
-                className="flex items-center gap-2 px-3 py-2 cursor-pointer hover:bg-white/5"
-                onClick={() => {
-                  if (isEditing) return;
-                  toggleDialerGroupExpand(group.id);
-                }}
+                className={cn(
+                  "relative flex items-center gap-2 px-3 py-2",
+                  !isEditing && "cursor-pointer",
+                )}
               >
+                {!isEditing && (
+                  <button
+                    type="button"
+                    className="absolute inset-0 z-0 cursor-pointer rounded-none transition-colors hover:bg-white/5 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-indigo-500/60"
+                    aria-label={expandedDialerGroups.has(group.id) ? `收起 ${group.name}` : `展开 ${group.name}`}
+                    aria-expanded={expandedDialerGroups.has(group.id)}
+                    onClick={() => toggleDialerGroupExpand(group.id)}
+                    title={expandedDialerGroups.has(group.id) ? "收起" : "展开"}
+                  />
+                )}
                 {expandedDialerGroups.has(group.id) ? (
-                  <ChevronDown className="h-4 w-4 text-white/50" />
+                  <ChevronDown className="pointer-events-none relative z-10 h-4 w-4 text-white/50" aria-hidden="true" />
                 ) : (
-                  <ChevronRight className="h-4 w-4 text-white/50" />
+                  <ChevronRight className="pointer-events-none relative z-10 h-4 w-4 text-white/50" aria-hidden="true" />
                 )}
 
                 {isEditing ? (
@@ -259,14 +297,14 @@ export function DialerProxyGroupsSection({
                     }}
                   />
                 ) : (
-                  <div className="flex items-center gap-1 min-w-0">
+                  <div className="pointer-events-none relative z-10 flex min-w-0 items-center gap-1">
                     <span className="text-sm font-medium text-white truncate" title={group.name}>
                       {group.name}
                     </span>
                     <Button
                       variant="ghost"
                       size="sm"
-                      className="h-7 px-2"
+                      className="pointer-events-auto h-7 px-2"
                       onClick={(e) => {
                         e.stopPropagation();
                         setEditingDialerGroupId(group.id);
@@ -280,7 +318,7 @@ export function DialerProxyGroupsSection({
                 )}
 
                 {isEditing ? (
-                  <div className="flex items-center gap-1" onClick={(e) => e.stopPropagation()}>
+                  <div className="flex items-center gap-1">
                     <Button variant="ghost" size="sm" className="h-7 px-2" onClick={commitRename} title="保存">
                       <Check className="h-3.5 w-3.5" />
                     </Button>
@@ -291,15 +329,17 @@ export function DialerProxyGroupsSection({
                 ) : (
                   <>
                     <ProxyGroupSummary
-                      className="ml-auto flex"
+                      className="pointer-events-none relative z-10 ml-auto flex"
                       disabled={!isEnabled}
                       items={[
-                        { label: `${group.relayNodes.length} 中转`, tone: "accent" },
-                        { label: `${group.targetNodes.length} 落地`, tone: "success", separator: "arrow" },
+                        { label: `${visibleRelayCount} 中转`, tone: "accent" },
+                        { label: `${visibleTargetCount} 落地`, tone: "success", separator: "arrow" },
                       ]}
                     />
                     <Switch
+                      aria-label={`启用 ${group.name} 中转组`}
                       checked={isEnabled}
+                      className="pointer-events-auto relative z-10"
                       onCheckedChange={(checked) => {
                         const nextEnabled = Boolean(checked);
                         if (!nextEnabled) {
@@ -307,25 +347,29 @@ export function DialerProxyGroupsSection({
                           return;
                         }
 
-                        const nodeNameSet = new Set(nodes.map((n) => n.name));
                         const otherEnabledGroups = dialerProxyGroups.filter(
                           (g) => g.id !== group.id && g.enabled !== false
                         );
                         const otherTargets = new Set<string>();
                         const otherRelayNodeNames = new Set<string>();
                         for (const g of otherEnabledGroups) {
-                          for (const t of g.targetNodes) otherTargets.add(t);
+                          for (const t of g.targetNodes) {
+                            if (effectiveNodeNameSet.has(t)) otherTargets.add(t);
+                          }
                           for (const r of g.relayNodes) {
-                            if (nodeNameSet.has(r)) otherRelayNodeNames.add(r);
+                            if (effectiveNodeNameSet.has(r)) otherRelayNodeNames.add(r);
                           }
                         }
 
                         const nextTargetNodes = group.targetNodes.filter(
-                          (n) => !otherTargets.has(n) && !otherRelayNodeNames.has(n)
+                          (n) =>
+                            !effectiveNodeNameSet.has(n) ||
+                            (!otherTargets.has(n) && !otherRelayNodeNames.has(n))
                         );
                         const nextRelayNodes = group.relayNodes.filter((n) => {
                           if (n === "DIRECT") return true;
-                          if (!nodeNameSet.has(n)) return true; // 代理组等
+                          if (!rawNodeNameSet.has(n)) return true; // 代理组等
+                          if (!effectiveNodeNameSet.has(n)) return true;
                           return !otherTargets.has(n);
                         });
 
@@ -370,7 +414,7 @@ export function DialerProxyGroupsSection({
                           type="button"
                           variant="ghost"
                           size="sm"
-                          className="h-7 shrink-0 px-2 text-white/35 hover:text-indigo-200"
+                          className="pointer-events-auto relative z-10 h-7 shrink-0 px-2 text-white/35 hover:text-indigo-200"
                           title={`类型：${dialerTypeLabel}`}
                           aria-label={`修改 ${group.name} 类型`}
                           onClick={(event) => event.stopPropagation()}
@@ -379,16 +423,17 @@ export function DialerProxyGroupsSection({
                         </Button>
                       }
                     />
-                    <button
+                    <IconButton
+                      label={`删除 ${group.name} 中转组`}
+                      variant="ghost"
                       onClick={(e) => {
                         e.stopPropagation();
                         removeDialerProxyGroup(group.id);
                       }}
-                      className="p-1 text-white/30 hover:text-red-400"
-                      title="删除"
+                      className="pointer-events-auto relative z-10 h-7 w-7 p-1 text-white/30 hover:text-red-400"
                     >
                       <Trash2 className="h-3.5 w-3.5" />
-                    </button>
+                    </IconButton>
                   </>
                 )}
               </div>
@@ -399,7 +444,7 @@ export function DialerProxyGroupsSection({
                   {/* 中转节点选择 */}
                   <div className="mt-3">
                     <div className="mb-1 flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
-                      <label className="text-xs text-white/50">中转节点（流量入口）</label>
+                      <p className="text-xs text-white/50">中转节点（流量入口）</p>
                       <div className="relative w-full sm:max-w-[220px]">
                         <Search className="absolute left-2 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-white/30" />
                         <Input
@@ -419,7 +464,9 @@ export function DialerProxyGroupsSection({
                         const isSelected = group.relayNodes.includes(node.name);
                         const displayName = node.name === "DIRECT" ? "DIRECT（直连）" : node.name;
                         return (
-                          <div
+                          <button
+                            type="button"
+                            aria-pressed={isSelected}
                             key={node.name}
                             className={cn(
                               "flex items-center gap-2 px-2 py-1 rounded text-xs cursor-pointer transition-colors",
@@ -447,7 +494,7 @@ export function DialerProxyGroupsSection({
                               {node.type}
                             </Badge>
                             <span className="truncate">{displayName}</span>
-                          </div>
+                          </button>
                         );
                       })}
                       {availableRelayNodes.length === 0 ? (
@@ -461,7 +508,7 @@ export function DialerProxyGroupsSection({
                   {/* 目标节点选择 */}
                   <div>
                     <div className="mb-1 flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
-                      <label className="text-xs text-white/50">落地节点（流量出口）</label>
+                      <p className="text-xs text-white/50">落地节点（流量出口）</p>
                       <div className="relative w-full sm:max-w-[220px]">
                         <Search className="absolute left-2 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-white/30" />
                         <Input
@@ -484,8 +531,11 @@ export function DialerProxyGroupsSection({
                             (g) => g.id !== group.id && g.enabled !== false && g.targetNodes.includes(node.name)
                           );
                           return (
-                            <div
+                            <button
+                              type="button"
+                              aria-pressed={isSelected}
                               key={node.name}
+                              disabled={usedByOther}
                               className={cn(
                                 "flex items-center gap-2 px-2 py-1 rounded text-xs transition-colors",
                                 usedByOther ? "opacity-40 cursor-not-allowed" : "cursor-pointer",
@@ -519,7 +569,7 @@ export function DialerProxyGroupsSection({
                               {usedByOther && (
                                 <span className="text-[10px] text-white/30 ml-auto">已被其他组使用</span>
                               )}
-                            </div>
+                            </button>
                           );
                         })}
                       {availableTargetNodes.length === 0 ? (
@@ -535,36 +585,34 @@ export function DialerProxyGroupsSection({
             );
           })}
 
-          {nodes.length === 0 && dialerProxyGroups.length === 0 && (
+          {effectiveNodes.length === 0 && dialerProxyGroups.length === 0 && (
             <p className="text-xs text-white/30 text-center py-2">请先导入节点后配置中转代理组</p>
           )}
 
           {/* 添加中转组按钮 */}
-          <div className="relative">
-            <Button
-              variant="outline"
-              size="sm"
-              className="w-full h-7 text-xs border-dashed border-white/20 text-white/50 hover:text-white/70 hover:border-white/30"
-              onClick={() => setShowDialerMenu(!showDialerMenu)}
-            >
-              <Plus className="h-3.5 w-3.5 mr-1" />
-              添加中转组
-            </Button>
-
-            {showDialerMenu && (
-              <div className="absolute top-full left-0 right-0 mt-1 bg-[#1a1a1a] border border-white/10 rounded-lg shadow-xl z-10 overflow-hidden">
-                {/* 预设地区选项 */}
-                {PRESET_RELAY_NAMES.map((name) => (
-                  <button
-                    key={name}
-                    onClick={() => handleAddDialerGroup(name)}
-                    className="w-full flex items-center gap-3 px-3 py-2 text-left hover:bg-white/5 transition-colors text-sm text-white/70 hover:text-white"
-                  >
-                    <span>{name}</span>
-                  </button>
-                ))}
-                {/* 自定义选项 */}
-                <div className="border-t border-white/10 p-2">
+          <DropdownMenu open={showDialerMenu} onOpenChange={setShowDialerMenu}>
+            <DropdownMenuTrigger asChild>
+              <Button
+                variant="outline"
+                size="sm"
+                className="h-7 w-full border-dashed border-white/20 text-xs text-white/50 hover:border-white/30 hover:text-white/70"
+              >
+                <Plus className="h-3.5 w-3.5" />
+                添加中转组
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="start" className="w-[var(--radix-dropdown-menu-trigger-width)] border-white/10 bg-[#1a1a1a] text-white">
+              {PRESET_RELAY_NAMES.map((name) => (
+                <DropdownMenuItem
+                  key={name}
+                  onSelect={() => handleAddDialerGroup(name)}
+                  className="text-white/70 focus:bg-white/5 focus:text-white"
+                >
+                  {name}
+                </DropdownMenuItem>
+              ))}
+              <DropdownMenuSeparator className="bg-white/10" />
+              <DropdownMenuLabel className="p-2 font-normal text-white">
                   <div className="flex gap-2">
                     <ProxyGroupNameEditor
                       value={customDialerDraft}
@@ -587,10 +635,9 @@ export function DialerProxyGroupsSection({
                       <Plus className="h-3.5 w-3.5" />
                     </Button>
                   </div>
-                </div>
-              </div>
-            )}
-          </div>
+              </DropdownMenuLabel>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </div>
       )}
     </div>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/input-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/input-section.test.ts
index 8ed3683..23263b4 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/input-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/input-section.test.ts
@@ -77,6 +77,8 @@ vi.mock("react/jsx-runtime", async (importOriginal) => {
 });
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => props.children,
+  Close: (props: any) => props.children,
   Root: (props: any) => props.children,
   Trigger: (props: any) => props.children,
   Portal: (props: any) => props.children,
@@ -88,8 +90,11 @@ vi.mock("lucide-react", () => ({
   Check: () => null,
   ChevronDown: () => null,
   ChevronUp: () => null,
+  CircleHelp: () => null,
+  FileCode: () => null,
   HelpCircle: () => null,
   Loader2: () => null,
+  Link2: () => null,
   Maximize2: () => null,
   Menu: () => null,
   Plus: () => null,
@@ -123,6 +128,12 @@ vi.mock("@subboost/core/node-name-template", () => ({
   DEFAULT_NODE_NAME_TEMPLATE: "[{tag}] {name}",
   formatNodeNameFromTemplate: ({ originName, tag, template }: any) => `${template || "{name}"}:${tag || ""}:${originName}`,
 }));
+vi.mock("@subboost/ui/components/ui/icon-button", () => ({
+  IconButton: (props: any) => {
+    mocks.captures.iconButtons.push(props);
+    return null;
+  },
+}));
 vi.mock("@subboost/ui/lib/utils", () => ({ cn: (...parts: unknown[]) => parts.filter(Boolean).join(" ") }));
 vi.mock("@subboost/ui/store/config-store", () => {
   const useConfigStore = () => mocks.store;
@@ -143,6 +154,20 @@ vi.mock("@subboost/ui/product/subscription/source-order", () => ({ moveSubscript
 vi.mock("@subboost/ui/product/converter/source-display-label", () => ({
   buildSourceDisplayLabel: ({ typeLabel, order, total, tag }: any) => `${typeLabel} ${order}/${total}${tag ? ` ${tag}` : ""}`,
 }));
+vi.mock("@subboost/ui/product/converter/source-controls", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@subboost/ui/product/converter/source-controls")>();
+  return {
+    ...actual,
+    AddSourceMenu: (props: any) => {
+      mocks.captures.addSourceMenus.push(props);
+      return null;
+    },
+    SourceTypeChoices: (props: any) => {
+      mocks.captures.sourceTypeChoices.push(props);
+      return null;
+    },
+  };
+});
 vi.mock("@subboost/ui/product/interactions", () => ({ useProductInteractionAdapter: () => mocks.interactions }));
 vi.mock("../constants", () => ({
   sourceTypeInfo: {
@@ -202,7 +227,10 @@ function renderSection(overrides: Record<number, unknown> = {}, props = { isExpa
   stateMock.setters = [];
   mocks.captures.buttons = [];
   mocks.captures.inputs = [];
+  mocks.captures.iconButtons = [];
+  mocks.captures.addSourceMenus = [];
   mocks.captures.rawButtons = [];
+  mocks.captures.sourceTypeChoices = [];
   mocks.captures.textareas = [];
   try {
     const html = renderToStaticMarkup(React.createElement(InputSection, props));
@@ -212,17 +240,18 @@ function renderSection(overrides: Record<number, unknown> = {}, props = { isExpa
   }
 }
 
-function findRawButton(match: (props: any) => boolean): any {
-  const button = mocks.captures.rawButtons.find(match);
-  expect(button).toBeTruthy();
-  return button;
-}
-
 describe("advanced mode InputSection", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     stateMock.runEffects = false;
-    mocks.captures = { buttons: [], inputs: [], textareas: [] };
+    mocks.captures = {
+      addSourceMenus: [],
+      buttons: [],
+      iconButtons: [],
+      inputs: [],
+      sourceTypeChoices: [],
+      textareas: [],
+    };
     mocks.userInfoDisplay = { traffic: "1 GB", expire: "2026-01-01" };
     mocks.markSourceAsPendingImport.mockImplementation((source) => ({ ...source, pendingImport: true }));
     mocks.moveSubscriptionSource.mockImplementation((sources) => sources.slice().reverse());
@@ -252,7 +281,7 @@ describe("advanced mode InputSection", () => {
     );
     expect(mocks.captures.inputs.some((props: any) => props.value === "https://example.com/sub")).toBe(true);
     expect(mocks.captures.textareas.some((props: any) => props.value === "ss://node")).toBe(true);
-    expect(mocks.captures.buttons.at(-1)).toEqual(expect.objectContaining({ variant: "outline", size: "sm" }));
+    expect(mocks.captures.addSourceMenus[0]).toEqual(expect.objectContaining({ open: true, compact: true }));
   });
 
   it("updates source content and metadata through captured fields", () => {
@@ -371,10 +400,7 @@ describe("advanced mode InputSection", () => {
     const now = vi.spyOn(Date, "now").mockReturnValue(123456);
     try {
       renderSection({ 0: true });
-      const addYamlButton = mocks.captures.rawButtons.filter((props: any) =>
-        String(props.className).includes("w-full flex items-center")
-      )[1];
-      addYamlButton.onClick();
+      mocks.captures.addSourceMenus[0].onAdd("yaml");
 
       expect(mocks.store.setSources).toHaveBeenCalledWith([
         urlSource,
@@ -391,15 +417,12 @@ describe("advanced mode InputSection", () => {
       mocks.store.setSources.mockClear();
       mocks.interactions.sourceAdded.mockClear();
       renderSection({ 0: true });
-      const addUrlButton = mocks.captures.rawButtons.filter((props: any) =>
-        String(props.className).includes("w-full flex items-center")
-      )[0];
-      addUrlButton.onClick();
+      mocks.captures.addSourceMenus[0].onAdd("url");
       expect(mocks.toast).not.toHaveBeenCalled();
 
       mocks.userStore = { user: { isAdmin: false, quota: { maxImportSourcesPerType: 1 } } };
       renderSection({ 0: true });
-      findRawButton((props) => String(props.className).includes("w-full flex items-center")).onClick();
+      mocks.captures.addSourceMenus[0].onAdd("url");
       expect(mocks.toast).toHaveBeenCalledWith({ title: "每种导入方式最多 1 个", variant: "warning" });
 
       mocks.toast.mockClear();
@@ -409,7 +432,7 @@ describe("advanced mode InputSection", () => {
         { ...urlSource, id: "s2" },
       ];
       renderSection({ 0: true });
-      findRawButton((props) => String(props.className).includes("w-full flex items-center")).onClick();
+      mocks.captures.addSourceMenus[0].onAdd("url");
       expect(mocks.toast).toHaveBeenCalledWith({
         title: "未登录用户每种导入方式最多 2 个（登录后可提升）",
         variant: "warning",
@@ -419,7 +442,7 @@ describe("advanced mode InputSection", () => {
       mocks.userStore = { user: { isAdmin: false, quota: { maxImportSourcesPerType: "bad" } } };
       mocks.store.sources = Array.from({ length: 5 }, (_, index) => ({ ...urlSource, id: `url-${index}` }));
       renderSection({ 0: true });
-      findRawButton((props) => String(props.className).includes("w-full flex items-center")).onClick();
+      mocks.captures.addSourceMenus[0].onAdd("url");
       expect(mocks.toast).toHaveBeenCalledWith({ title: "每种导入方式最多 5 个", variant: "warning" });
     } finally {
       now.mockRestore();
@@ -429,7 +452,7 @@ describe("advanced mode InputSection", () => {
   it("switches source types, moves sources, and removes sources", () => {
     renderSection();
 
-    findRawButton((props) => props.title === "YAML 配置").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("yaml");
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(
       expect.objectContaining({
         content: "",
@@ -445,7 +468,7 @@ describe("advanced mode InputSection", () => {
     expect(mocks.store.setSources).toHaveBeenCalledWith(expect.any(Array));
 
     mocks.store.setSources.mockClear();
-    findRawButton((props) => props.title === "订阅链接").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("url");
     expect(mocks.store.setSources).not.toHaveBeenCalled();
 
     mocks.store.sources = [
@@ -459,7 +482,7 @@ describe("advanced mode InputSection", () => {
       },
     ];
     renderSection();
-    findRawButton((props) => props.title === "订阅链接").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "yaml").onChange("url");
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(
       expect.objectContaining({
         type: "url",
@@ -471,19 +494,19 @@ describe("advanced mode InputSection", () => {
 
     mocks.store.sources = [urlSource, nodesSource];
     renderSection();
-    findRawButton((props) => props["aria-label"] === "下移" && !props.disabled).onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "下移" && !props.disabled).onClick();
     expect(mocks.moveSubscriptionSource).toHaveBeenCalledWith(mocks.store.sources, "s1", "down");
     expect(mocks.store.setSources).toHaveBeenCalledWith([nodesSource, urlSource]);
 
     mocks.store.setSources.mockClear();
-    findRawButton((props) => props["aria-label"] === "上移" && !props.disabled).onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "上移" && !props.disabled).onClick();
     expect(mocks.moveSubscriptionSource).toHaveBeenCalledWith(mocks.store.sources, "s2", "up");
 
-    findRawButton((props) => props.title === "高级编辑").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "高级编辑").onClick();
     expect(stateMock.setters[1]).toHaveBeenCalledWith(expect.any(String));
 
     mocks.store.setSources.mockClear();
-    findRawButton((props) => props.title === "删除").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "删除导入源").onClick();
     expect(mocks.store.setSources).toHaveBeenCalledWith([nodesSource]);
   });
 
@@ -491,7 +514,7 @@ describe("advanced mode InputSection", () => {
     mocks.userStore = { user: { isAdmin: false, quota: { maxImportSourcesPerType: 1 } } };
     renderSection();
 
-    findRawButton((props) => props.title === "节点链接").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("nodes");
 
     expect(mocks.toast).toHaveBeenCalledWith({ title: "每种导入方式最多 1 个", variant: "warning" });
     expect(mocks.store.setSources).not.toHaveBeenCalled();
@@ -499,7 +522,7 @@ describe("advanced mode InputSection", () => {
 
   it("imports sources and reports success, runtime, and validation outcomes", async () => {
     renderSection();
-    findRawButton((props) => props.title === "重新导入").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "重新导入").onClick();
     await Promise.resolve();
     await Promise.resolve();
     expect(mocks.store.parseSingleSource).toHaveBeenCalledWith("s1");
@@ -516,7 +539,7 @@ describe("advanced mode InputSection", () => {
     mocks.store.parseSingleSource.mockClear();
     mocks.store.sources = [{ ...urlSource, parsed: false, error: "failed", nodeCount: 0 }];
     renderSection();
-    findRawButton((props) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     await Promise.resolve();
     expect(mocks.interactions.sourceImported).toHaveBeenCalledWith(expect.objectContaining({ result: "runtimeError" }));
@@ -524,7 +547,7 @@ describe("advanced mode InputSection", () => {
     mocks.interactions.sourceImported.mockClear();
     mocks.store.sources = [{ ...urlSource, parsed: false, error: undefined, errorInfo: undefined, nodeCount: undefined }];
     renderSection();
-    findRawButton((props) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     await Promise.resolve();
     expect(mocks.interactions.sourceImported).toHaveBeenCalledWith(expect.objectContaining({ result: "validationError" }));
@@ -535,7 +558,7 @@ describe("advanced mode InputSection", () => {
       mocks.store.sources = [];
     });
     renderSection();
-    findRawButton((props) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     await Promise.resolve();
     expect(mocks.interactions.sourceImported).toHaveBeenCalledWith(expect.objectContaining({ result: "runtimeError" }));
@@ -553,7 +576,7 @@ describe("advanced mode InputSection", () => {
     const { setters } = renderSection();
     expect(mocks.captures.editor).toEqual(expect.objectContaining({ source: null }));
 
-    mocks.captures.buttons.at(-1).onClick();
+    mocks.captures.addSourceMenus[0].onOpenChange(true);
     expect(setters[0]).toHaveBeenCalledWith(true);
 
     mocks.userInfoDisplay = { traffic: "", expire: "" };
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/input-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/input-section.tsx
index e769332..a8b551e 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/input-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/input-section.tsx
@@ -1,15 +1,13 @@
 "use client";
 
-import * as Popover from "@radix-ui/react-popover";
-import { AlertCircle, Check, HelpCircle, Loader2, Maximize2, Plus, Server, X, Menu, ChevronUp, ChevronDown } from "lucide-react";
+import { AlertCircle, Check, Loader2, Maximize2, Server, X, ChevronUp, ChevronDown } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
-import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
 import { Textarea } from "@subboost/ui/components/ui/textarea";
 import { cn } from "@subboost/ui/lib/utils";
-import type { SourceType } from "@subboost/ui/store/config-store";
-import { getSubscriptionUserInfoDisplay } from "@subboost/ui/product/subscription/subscription-userinfo-display";
 import { buildSourceDisplayLabel } from "@subboost/ui/product/converter/source-display-label";
+import { AddSourceMenu, SourceStatusPopover, SourceTypeChoices } from "@subboost/ui/product/converter/source-controls";
 import { useSubscriptionSourcesController } from "@subboost/ui/product/converter/use-subscription-sources-controller";
 import { sourceTypeInfo } from "../constants";
 import { SectionHeader } from "../section-header";
@@ -70,113 +68,59 @@ export function InputSection({
               total: sources.length,
             });
             const sourceNodes = nodesBySourceId.get(source.id) ?? [];
-            const userInfoDisplay = getSubscriptionUserInfoDisplay(source.subscriptionUserInfo, sourceNodes);
-            const hasUserInfoDisplay = Boolean(userInfoDisplay && (userInfoDisplay.traffic || userInfoDisplay.expire));
             return (
               <div key={source.id} className="space-y-1">
                 <div className="flex items-center justify-between">
                   <div className="flex items-center gap-2">
-                    <div className="flex gap-0.5">
-                      {(Object.keys(sourceTypeInfo) as SourceType[]).map((type) => {
-                        const info = sourceTypeInfo[type];
-                        const Icon = info.icon;
-                        return (
-                          <button
-                            key={type}
-                            onClick={() => updateSourceType(source.id, type)}
-                            className={cn(
-                              "p-1 rounded transition-colors",
-                              source.type === type
-                                ? "bg-indigo-500/20 text-indigo-400"
-                                : "text-white/30 hover:text-white/50 hover:bg-white/5"
-                            )}
-                            title={info.label}
-                          >
-                            <Icon className="h-3.5 w-3.5" />
-                          </button>
-                        );
-                      })}
-                    </div>
+                    <SourceTypeChoices
+                      value={source.type}
+                      onChange={(type) => updateSourceType(source.id, type)}
+                      compact
+                    />
                     <span className="text-xs text-white/50">
                       {sourceDisplayLabel}
                     </span>
-                    {source.parsed && source.nodeCount !== undefined && (
-                      <Popover.Root>
-                        <Popover.Trigger asChild>
-                          <button
-                            type="button"
-                            className="inline-flex items-center gap-1 rounded-full border border-green-500/50 bg-green-500/5 px-2 py-0.5 text-xs font-semibold text-green-300 transition-colors hover:bg-green-500/10 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black whitespace-nowrap"
-                            title="查看流量/到期"
-                            aria-label="查看流量/到期"
-                          >
-                            ✓ {source.nodeCount} 节点
-                            <Menu className="h-3 w-3 text-green-300/70" aria-hidden="true" />
-                          </button>
-                        </Popover.Trigger>
-                        <Popover.Portal>
-                          <Popover.Content
-                            side="bottom"
-                            align="start"
-                            sideOffset={8}
-                            className="z-50 w-[260px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-                          >
-                            <div className="space-y-2 text-xs">
-                              <div className="flex items-center gap-2">
-                                <HelpCircle className="h-4 w-4 text-green-300" />
-                                <div className="text-white font-medium">订阅信息</div>
-                              </div>
-                              {hasUserInfoDisplay && userInfoDisplay ? (
-                                <div className="space-y-1 text-white/60">
-                                  {userInfoDisplay.traffic ? <div>已用流量：{userInfoDisplay.traffic}</div> : null}
-                                  {userInfoDisplay.expire ? <div>到期时间：{userInfoDisplay.expire}</div> : null}
-                                </div>
-                              ) : (
-                                <div className="text-white/60 leading-relaxed">暂无已用流量/到期时间信息</div>
-                              )}
-                            </div>
-                            <Popover.Arrow className="fill-white/10" />
-                          </Popover.Content>
-                        </Popover.Portal>
-                      </Popover.Root>
-                    )}
+                    <SourceStatusPopover source={source} nodes={sourceNodes} />
                     {(source.errorInfo || source.error) && (
                       <SubscriptionImportErrorBadge errorInfo={source.errorInfo} errorMessage={source.error} />
                     )}
                   </div>
                   <div className="flex items-center gap-0.5">
                     <div className="flex flex-col">
-                      <button
+                      <IconButton
+                        label="上移"
+                        variant="ghost"
                         onClick={() => moveSource(source.id, "up")}
                         disabled={index <= 0}
                         className="flex h-3.5 w-4 items-center justify-center text-white/30 transition-colors hover:text-indigo-300 disabled:cursor-not-allowed disabled:opacity-30"
-                        title="上移"
-                        aria-label="上移"
                       >
-                        <ChevronUp className="h-2.5 w-2.5" />
-                      </button>
-                      <button
+                        <ChevronUp className="h-2.5 w-2.5" aria-hidden="true" />
+                      </IconButton>
+                      <IconButton
+                        label="下移"
+                        variant="ghost"
                         onClick={() => moveSource(source.id, "down")}
                         disabled={index >= sources.length - 1}
                         className="flex h-3.5 w-4 items-center justify-center text-white/30 transition-colors hover:text-indigo-300 disabled:cursor-not-allowed disabled:opacity-30"
-                        title="下移"
-                        aria-label="下移"
                       >
-                        <ChevronDown className="h-2.5 w-2.5" />
-                      </button>
+                        <ChevronDown className="h-2.5 w-2.5" aria-hidden="true" />
+                      </IconButton>
                     </div>
-                    <button
+                    <IconButton
+                      label="高级编辑"
+                      variant="ghost"
                       onClick={() => setExpandedSourceId(source.id)}
-                      className="p-1 rounded transition-colors text-white/30 hover:text-white/50 hover:bg-white/5"
-                      title="高级编辑"
+                      className="h-6 w-6 rounded p-1 text-white/30 hover:bg-white/5 hover:text-white/50"
                     >
-                      <Maximize2 className="h-3.5 w-3.5" />
-                    </button>
-                    {/* 导入按钮 */}
-                    <button
+                      <Maximize2 className="h-3.5 w-3.5" aria-hidden="true" />
+                    </IconButton>
+                    <IconButton
+                      label={source.parsing ? "导入中" : source.parsed ? "重新导入" : "导入此源"}
+                      variant="ghost"
                       onClick={() => void handleImportSource(source.id)}
                       disabled={!source.content.trim() || source.parsing}
                       className={cn(
-                        "p-1 rounded transition-colors disabled:opacity-100",
+                        "h-6 w-6 rounded p-1 transition-colors disabled:opacity-100",
                         source.parsing
                           ? "text-indigo-400"
                           : source.parsed
@@ -188,20 +132,20 @@ export function InputSection({
                       title={source.parsing ? "导入中..." : source.parsed ? "重新导入" : "导入此源"}
                     >
                       {source.parsing ? (
-                        <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                        <Loader2 className="h-3.5 w-3.5 animate-spin" aria-hidden="true" />
                       ) : (
-                        <Check className="h-3.5 w-3.5" />
+                        <Check className="h-3.5 w-3.5" aria-hidden="true" />
                       )}
-                    </button>
-                    {/* 删除按钮 */}
+                    </IconButton>
                     {sources.length > 1 && (
-                      <button
+                      <IconButton
+                        label="删除导入源"
+                        variant="ghost"
                         onClick={() => removeSource(source.id)}
-                        className="p-1 text-white/50 hover:text-red-400 transition-colors"
-                        title="删除"
+                        className="h-6 w-6 rounded p-1 text-white/50 transition-colors hover:text-red-400"
                       >
-                        <X className="h-3.5 w-3.5" />
-                      </button>
+                        <X className="h-3.5 w-3.5" aria-hidden="true" />
+                      </IconButton>
                     )}
                   </div>
                 </div>
@@ -229,39 +173,7 @@ export function InputSection({
               <span className="break-all">{globalError}</span>
             </div>
           )}
-          {/* Add Source Button with Menu */}
-          <div className="relative">
-            <Button
-              variant="outline"
-              size="sm"
-              className="w-full h-7 text-xs border-dashed border-white/20 text-white/50 hover:text-white/70 hover:border-white/30"
-              onClick={() => setShowAddMenu(!showAddMenu)}
-            >
-              <Plus className="h-3.5 w-3.5 mr-1" />
-              添加订阅/节点源
-            </Button>
-
-            {showAddMenu && (
-              <div className="absolute top-full left-0 right-0 mt-1 bg-[#1a1a1a] border border-white/10 rounded-lg shadow-xl z-10 overflow-hidden">
-                {(Object.keys(sourceTypeInfo) as SourceType[]).map((type) => {
-                  const info = sourceTypeInfo[type];
-                  const Icon = info.icon;
-                  return (
-                    <button
-                      key={type}
-                      onClick={() => addSource(type)}
-                      className="w-full flex items-center gap-3 px-3 py-2 text-left hover:bg-white/5 transition-colors"
-                    >
-                      <Icon className="h-4 w-4 text-indigo-400" />
-                      <div>
-                        <div className="text-xs font-medium text-white">{info.label}</div>
-                      </div>
-                    </button>
-                  );
-                })}
-              </div>
-            )}
-          </div>
+          <AddSourceMenu open={showAddMenu} onOpenChange={setShowAddMenu} onAdd={addSource} compact />
         </div>
       )}
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts
index 534b03c..6bef7a6 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts
@@ -11,14 +11,20 @@ const mocks = vi.hoisted(() => ({
 }));
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => React.createElement("span", null, props.children),
   Arrow: () => React.createElement("span", null, "arrow"),
-  Content: (props: any) => React.createElement("div", props, props.children),
+  Content: ({ children, sideOffset: _sideOffset, ...props }: any) => React.createElement("div", props, children),
+  Close: (props: any) => React.createElement("button", null, props.children),
   Portal: (props: any) => React.createElement("div", null, props.children),
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("div", null, props.children),
 }));
 vi.mock("lucide-react", () => ({
+  CircleHelp: () => React.createElement("span", null, "circle-help-icon"),
+  FileCode: () => React.createElement("span", null, "file-code-icon"),
   HelpCircle: () => React.createElement("span", null, "help-icon"),
+  Link2: () => React.createElement("span", null, "link-icon"),
+  Server: () => React.createElement("span", null, "server-icon"),
 }));
 vi.mock("@subboost/ui/components/ui/button", () => ({
   Button: (props: any) => {
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.tsx b/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.tsx
index 9903d9d..5abccde 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.tsx
@@ -1,186 +1 @@
-"use client";
-
-import * as Popover from "@radix-ui/react-popover";
-import { HelpCircle } from "lucide-react";
-import { Button } from "@subboost/ui/components/ui/button";
-import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@subboost/ui/components/ui/dialog";
-import { Input } from "@subboost/ui/components/ui/input";
-import { Switch } from "@subboost/ui/components/ui/switch";
-import { Textarea } from "@subboost/ui/components/ui/textarea";
-import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
-import type { SubscriptionSource } from "@subboost/ui/store/config-store";
-import { sourceTypeInfo } from "../constants";
-
-type InputSourceEditorDialogProps = {
-  source: SubscriptionSource | null;
-  previewName: string;
-  onClose: () => void;
-  onUpdateContent: (id: string, content: string) => void;
-  onUpdateMeta: (id: string, patch: Partial<SubscriptionSource>) => void;
-};
-
-export function InputSourceEditorDialog({
-  source,
-  previewName,
-  onClose,
-  onUpdateContent,
-  onUpdateMeta,
-}: InputSourceEditorDialogProps) {
-  return (
-    <Dialog
-      open={Boolean(source)}
-      onOpenChange={(open) => {
-        if (!open) onClose();
-      }}
-    >
-      <DialogContent className="w-[calc(100vw-2rem)] sm:max-w-4xl">
-        <DialogHeader>
-          <DialogTitle>
-            {source ? `高级编辑：${sourceTypeInfo[source.type].label}` : "高级编辑"}
-          </DialogTitle>
-        </DialogHeader>
-
-        {source && (
-          <div className="space-y-3">
-            <div className="grid gap-3 sm:grid-cols-3">
-              <div className="space-y-1">
-                <div className="text-xs text-white/60">标签（tag）</div>
-                <Input
-                  value={source.tag ?? ""}
-                  onChange={(e) => onUpdateMeta(source.id, { tag: e.target.value })}
-                  placeholder="例如：A / 订阅1 / 自建1"
-                  className="text-xs"
-                />
-              </div>
-              <div className="space-y-1">
-                <div className="text-xs text-white/60">节点命名模板</div>
-                  <Input
-                    value={source.nameTemplate ?? DEFAULT_NODE_NAME_TEMPLATE}
-                    onChange={(e) => onUpdateMeta(source.id, { nameTemplate: e.target.value })}
-                    className="text-xs font-mono"
-                  />
-              </div>
-              <div className="space-y-1">
-                <div className="text-xs text-white/60">预览</div>
-                <Input value={previewName} readOnly className="text-xs font-mono" />
-              </div>
-            </div>
-
-            <div className="text-[11px] text-white/40">
-              可用占位符：{"{tag}"}、{"{name}"}；留空则默认：{DEFAULT_NODE_NAME_TEMPLATE}
-            </div>
-
-            <div className="space-y-1">
-              <div className="text-xs text-white/60">{sourceTypeInfo[source.type].label}</div>
-              {source.type === "url" ? (
-                <div className="space-y-3">
-                  <div className="flex items-center gap-3">
-                    <Input
-                      value={source.content}
-                      onChange={(e) => onUpdateContent(source.id, e.target.value)}
-                      placeholder={sourceTypeInfo[source.type].placeholder}
-                      className="text-xs min-w-0 flex-1"
-                    />
-
-                    <div className="flex h-10 flex-none items-center gap-2 rounded-xl border border-white/10 bg-white/5 px-3">
-                      <div className="text-xs text-white/70 whitespace-nowrap">proxy-providers模式</div>
-                      <Popover.Root>
-                        <Popover.Trigger asChild>
-                          <button
-                            type="button"
-                            className="inline-flex h-6 w-6 flex-none items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-                            aria-label="proxy-providers 模式说明"
-                            title="proxy-providers 模式说明"
-                          >
-                            <HelpCircle className="h-3.5 w-3.5" />
-                          </button>
-                        </Popover.Trigger>
-                        <Popover.Portal>
-                          <Popover.Content
-                            side="bottom"
-                            align="end"
-                            sideOffset={8}
-                            className="z-50 w-[360px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-                          >
-                            <div className="space-y-2 text-xs">
-                              <div className="flex items-center gap-2">
-                                <HelpCircle className="h-4 w-4 text-amber-300" />
-                                <div className="text-white font-medium">proxy-providers 模式</div>
-                              </div>
-                              <div className="text-white/60 leading-relaxed">
-                                部分订阅限制 CN IP 导入，url 无法在 SubBoost 内拉取解析。开启后 SubBoost
-                                不再拉取/解析该 url，而是在最终配置中写入{" "}
-                                <span className="font-mono">proxy-providers</span>，交由客户端自行拉取节点。
-                              </div>
-                              <div className="pt-2 border-t border-white/10 text-white/60 space-y-1">
-                                <div className="font-medium text-white/80">注意开启后：</div>
-                                <ul className="ml-4 list-disc space-y-1">
-                                  <li>无法在预览中查看/管理该 url 的节点</li>
-                                  <li>无法将这些节点用于中转代理组、分流组高级模式等高级功能</li>
-                                  <li>节点命名模板与 tag 在该模式下不生效</li>
-                                </ul>
-                              </div>
-                              <div className="pt-2 border-t border-white/10 text-[10px] text-white/40">
-                                若导入 url 报“未解析到有效节点/获取失败”等，可尝试开启此模式。
-                              </div>
-                            </div>
-                            <Popover.Arrow className="fill-white/10" />
-                          </Popover.Content>
-                        </Popover.Portal>
-                      </Popover.Root>
-                      <Switch
-                        checked={Boolean(source.useProxyProviders)}
-                        onCheckedChange={(checked) =>
-                          onUpdateMeta(source.id, { useProxyProviders: Boolean(checked) })
-                        }
-                      />
-                    </div>
-                  </div>
-
-                  <div className="grid gap-3 sm:grid-cols-2">
-                    <div className="space-y-1">
-                      <div className="text-xs text-white/60">流量/到期信息 URL（可选）</div>
-                      <Input
-                        value={source.userinfoUrl ?? ""}
-                        onChange={(e) => onUpdateMeta(source.id, { userinfoUrl: e.target.value })}
-                        placeholder="留空则默认使用当前订阅源 URL"
-                        className="text-xs"
-                      />
-                    </div>
-                    <div className="space-y-1">
-                      <div className="text-xs text-white/60">流量信息 User-Agent（可选）</div>
-                      <Input
-                        value={source.userinfoUserAgent ?? ""}
-                        onChange={(e) => onUpdateMeta(source.id, { userinfoUserAgent: e.target.value })}
-                        placeholder="例如 clash.meta/v1.19.16"
-                        className="text-xs"
-                      />
-                    </div>
-                  </div>
-
-                  <div className="text-[11px] text-white/40">
-                    有些订阅源不会直接返回 <span className="font-mono">subscription-userinfo</span>，但会提供独立的流量接口。
-                    设置后，SubBoost 会在导入/刷新时额外抓取该接口，用来更新这个源自己的流量与到期快照。
-                  </div>
-                </div>
-              ) : (
-                <Textarea
-                  value={source.content}
-                  onChange={(e) => onUpdateContent(source.id, e.target.value)}
-                  placeholder={sourceTypeInfo[source.type].placeholder}
-                  className="min-h-[60vh] text-xs font-mono"
-                />
-              )}
-            </div>
-          </div>
-        )}
-
-        <div className="flex justify-end gap-2">
-          <Button variant="outline" onClick={onClose}>
-            完成
-          </Button>
-        </div>
-      </DialogContent>
-    </Dialog>
-  );
-}
+export { SourceEditorDialog as InputSourceEditorDialog } from "@subboost/ui/product/converter/source-editor-dialog";
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.test.ts
index 75f4219..e84623c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.test.ts
@@ -50,7 +50,8 @@ vi.mock("lucide-react", () => ({
 vi.mock("@subboost/ui/components/ui/badge", () => ({ Badge: () => null }));
 vi.mock("@subboost/ui/components/ui/button", () => ({
   Button: (props: any) => {
-    mocks.captures.button = props;
+    mocks.captures.buttons = [...(mocks.captures.buttons || []), props];
+    if (props.children === "批量编辑") mocks.captures.button = props;
     return null;
   },
 }));
@@ -83,6 +84,12 @@ vi.mock("./node-management/bulk-edit-dialog", () => ({
     return null;
   },
 }));
+vi.mock("./node-management/auto-processing-dialog", () => ({
+  NodeManagementAutoProcessingDialog: (props: any) => {
+    mocks.captures.autoProcessingDialog = props;
+    return null;
+  },
+}));
 vi.mock("./node-management/node-list", () => ({
   NodeManagementNodeList: (props: any) => {
     mocks.captures.nodeList = props;
@@ -147,6 +154,7 @@ describe("NodeManagementSection", () => {
         },
       ],
       nodes,
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
       deletedNodeNames: [" Gone ", "Deleted", ""],
       deletedNodes: [
         { originName: "Deleted", name: "[HK] Deleted" },
@@ -163,6 +171,7 @@ describe("NodeManagementSection", () => {
       listenerPorts: { "[HK] Alpha": 7891, Beta: 7892 },
       setListenerPort: vi.fn(),
       bulkSetListenerPorts: vi.fn(),
+      setNodeNameFilter: vi.fn(),
     };
   });
 
@@ -374,6 +383,102 @@ describe("NodeManagementSection", () => {
     });
   });
 
+  it("uses effective nodes for the list, search, and bulk edit while keeping the raw snapshot for auto processing", () => {
+    mocks.store.nodeNameFilter = { enabled: true, excludeRegexes: ["beta"] };
+    const { setters } = renderSection();
+
+    expect(mocks.captures.nodeList.nodes).toEqual([nodes[0]]);
+    expect(mocks.captures.nodeList.visibleNodes).toEqual([nodes[0]]);
+    expect(mocks.captures.bulkDialog.nodes).toEqual([nodes[0]]);
+    expect(mocks.captures.autoProcessingDialog).toEqual(
+      expect.objectContaining({
+        nodes,
+        config: { enabled: true, excludeRegexes: ["beta"] },
+        hasProxyProviders: false,
+      })
+    );
+
+    const autoProcessingButton = mocks.captures.buttons.find(
+      (props: any) => Array.isArray(props.children) && props.children[0] === "自动处理"
+    );
+    expect(autoProcessingButton.disabled).not.toBe(true);
+    autoProcessingButton.onClick();
+    expect(setters[8]).toHaveBeenCalledWith(true);
+
+    mocks.captures.autoProcessingDialog.onSave({
+      enabled: true,
+      excludeRegexes: ["beta"],
+    });
+    expect(mocks.store.setNodeNameFilter).toHaveBeenCalledWith({
+      enabled: true,
+      excludeRegexes: ["beta"],
+    });
+  });
+
+  it("keeps automatic processing available before nodes are imported", () => {
+    mocks.store.nodes = [];
+    renderSection();
+
+    const autoProcessingButton = mocks.captures.buttons.find(
+      (props: any) => Array.isArray(props.children) && props.children[0] === "自动处理"
+    );
+    expect(autoProcessingButton.disabled).not.toBe(true);
+  });
+
+  it("orders only effective node slots when filtered nodes are hidden", () => {
+    const gamma = {
+      name: "Gamma",
+      type: "trojan",
+      server: "gamma.test",
+      port: 443,
+      password: "secret",
+      _originName: "Gamma",
+    };
+    mocks.store.nodes = [nodes[0], nodes[1], gamma];
+    mocks.store.nodeNameFilter = { enabled: true, excludeRegexes: ["beta"] };
+    renderSection();
+
+    mocks.captures.nodeList.moveNode(nodes[0].name, "down");
+    expect(mocks.store.setNodeOrder).toHaveBeenCalledWith(
+      nodes[0].name,
+      2,
+      [nodes[0].name, gamma.name]
+    );
+
+    mocks.captures.nodeList.setNodeOrder(gamma.name, 1);
+    expect(mocks.store.setNodeOrder).toHaveBeenCalledWith(
+      gamma.name,
+      1,
+      [nodes[0].name, gamma.name]
+    );
+  });
+
+  it("only treats a usable http(s) source as a proxy-provider output", () => {
+    for (const content of ["", "not a url", "ftp://example.com/provider"]) {
+      mocks.store.sources = [
+        {
+          id: "provider",
+          type: "url",
+          content,
+          useProxyProviders: true,
+        },
+      ];
+      renderSection();
+      expect(mocks.captures.autoProcessingDialog.hasProxyProviders).toBe(false);
+    }
+
+    mocks.store.sources = [
+      {
+        id: "provider",
+        type: "url",
+        content: " https://example.com/provider ",
+        useProxyProviders: true,
+      },
+    ];
+    renderSection();
+    expect(mocks.captures.autoProcessingDialog.hasProxyProviders).toBe(true);
+  });
+
   it("ignores empty listener-port cleanup requests and keeps unchanged cleanup state", () => {
     renderSection({ 5: { Beta: "7890" }, 6: { Beta: "bad" } });
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx
index e97cd07..ac4de22 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx
@@ -6,12 +6,17 @@ import { Badge } from "@subboost/ui/components/ui/badge";
 import { Button } from "@subboost/ui/components/ui/button";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
 import { Input } from "@subboost/ui/components/ui/input";
-import { Switch } from "@subboost/ui/components/ui/switch";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { toast } from "@subboost/ui/components/ui/toaster";
 import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
+import {
+  DEFAULT_NODE_NAME_FILTER_CONFIG,
+  resolveNodeNameFilter,
+} from "@subboost/core/subscription/node-name-filter";
 import { useConfigStore, type SubscriptionSource } from "@subboost/ui/store/config-store";
 import { useProductInteractionAdapter } from "@subboost/ui/product/interactions";
 import { SectionHeader } from "../section-header";
+import { NodeManagementAutoProcessingDialog } from "./node-management/auto-processing-dialog";
 import { NodeManagementBulkEditDialog } from "./node-management/bulk-edit-dialog";
 import { NodeManagementNodeList } from "./node-management/node-list";
 
@@ -19,6 +24,17 @@ const NODE_SOURCE_IDS_KEY = "_sourceIds";
 const ORIGIN_NAME_KEY = "_originName";
 const LISTENER_PORT_WARNING_STORAGE_KEY = "subboost.listenerPortWarningAccepted";
 
+function canGenerateProxyProvider(source: SubscriptionSource): boolean {
+  if (source.type !== "url" || source.useProxyProviders !== true) return false;
+  const content = typeof source.content === "string" ? source.content.trim() : "";
+  if (!content) return false;
+  try {
+    return ["http:", "https:"].includes(new URL(content).protocol);
+  } catch {
+    return false;
+  }
+}
+
 function hasAcceptedListenerPortWarning(): boolean {
   if (typeof window === "undefined") return false;
   try {
@@ -47,6 +63,7 @@ export function NodeManagementSection({
   const {
     sources,
     nodes,
+    nodeNameFilter,
     deletedNodeNames,
     deletedNodes,
     removeNode,
@@ -54,13 +71,24 @@ export function NodeManagementSection({
     renameNode,
     restoreNodeName,
     bulkRenameNodes,
-    moveNode,
     setNodeOrder,
     listenerPorts,
     setListenerPort,
     bulkSetListenerPorts,
+    setNodeNameFilter,
   } = useConfigStore();
 
+  const normalizedNodeNameFilter = nodeNameFilter ?? DEFAULT_NODE_NAME_FILTER_CONFIG;
+  const nodeNameFilterResult = React.useMemo(
+    () => resolveNodeNameFilter(nodes, normalizedNodeNameFilter),
+    [nodes, normalizedNodeNameFilter]
+  );
+  const effectiveNodes = nodeNameFilterResult.effectiveNodes;
+  const hasProxyProviders = React.useMemo(
+    () => sources.some(canGenerateProxyProvider),
+    [sources]
+  );
+
   const deletedMarkedNodes = React.useMemo(() => {
     const activeOrigins = new Set<string>();
     for (const node of nodes) {
@@ -96,12 +124,12 @@ export function NodeManagementSection({
   const [nameRulesOpen, setNameRulesOpen] = React.useState(false);
   const [nodeSearchKeyword, setNodeSearchKeyword] = React.useState("");
   const [listenerPortEnabled, setListenerPortEnabled] = React.useState(false);
-  const listenerPortSwitchId = React.useId();
   const interactions = useProductInteractionAdapter();
 
   const [listenerPortDrafts, setListenerPortDrafts] = React.useState<Record<string, string>>({});
   const [listenerPortErrors, setListenerPortErrors] = React.useState<Record<string, string>>({});
   const [orderDrafts, setOrderDrafts] = React.useState<Record<string, string>>({});
+  const [autoProcessingOpen, setAutoProcessingOpen] = React.useState(false);
 
   const hasConfiguredListenerPorts = React.useMemo(
     () => Object.values(listenerPorts).some((port) => Number.isInteger(port) && port >= 1 && port <= 65535),
@@ -159,15 +187,44 @@ export function NodeManagementSection({
 
   const nodeIndexByName = React.useMemo(() => {
     const map = new Map<string, number>();
-    nodes.forEach((n, i) => map.set(n.name, i));
+    effectiveNodes.forEach((n, i) => map.set(n.name, i));
     return map;
-  }, [nodes]);
+  }, [effectiveNodes]);
+  const effectiveNodeNames = React.useMemo(
+    () => effectiveNodes.map((node) => node.name),
+    [effectiveNodes]
+  );
 
   const visibleNodes = React.useMemo(() => {
     const keyword = nodeSearchKeyword.trim().toLowerCase();
-    if (!keyword) return nodes;
-    return nodes.filter((node) => node.name.toLowerCase().includes(keyword));
-  }, [nodeSearchKeyword, nodes]);
+    if (!keyword) return effectiveNodes;
+    return effectiveNodes.filter((node) => node.name.toLowerCase().includes(keyword));
+  }, [effectiveNodes, nodeSearchKeyword]);
+
+  const setEffectiveNodeOrder = React.useCallback(
+    (nodeName: string, order: number) => {
+      const currentIndex = nodeIndexByName.get(nodeName);
+      if (currentIndex === undefined || !Number.isFinite(order)) return;
+      const targetIndex = Math.max(
+        0,
+        Math.min(effectiveNodes.length - 1, Math.floor(order) - 1)
+      );
+      if (targetIndex === currentIndex) return;
+      setNodeOrder(nodeName, targetIndex + 1, effectiveNodeNames);
+    },
+    [effectiveNodeNames, effectiveNodes.length, nodeIndexByName, setNodeOrder]
+  );
+
+  const moveEffectiveNode = React.useCallback(
+    (nodeName: string, direction: "up" | "down") => {
+      const currentIndex = nodeIndexByName.get(nodeName);
+      if (currentIndex === undefined) return;
+      const nextIndex = direction === "up" ? currentIndex - 1 : currentIndex + 1;
+      if (nextIndex < 0 || nextIndex >= effectiveNodes.length) return;
+      setEffectiveNodeOrder(nodeName, nextIndex + 1);
+    },
+    [effectiveNodes.length, nodeIndexByName, setEffectiveNodeOrder]
+  );
 
   const visibleDeletedMarkedNodes = React.useMemo(() => {
     const keyword = nodeSearchKeyword.trim().toLowerCase();
@@ -411,9 +468,9 @@ export function NodeManagementSection({
         onToggle={onToggle}
         badge={
           <div className="ml-auto flex items-center gap-2">
-            {nodes.length > 0 ? (
+            {effectiveNodes.length > 0 ? (
               <Badge variant="outline" className="border-green-500/50 bg-green-500/10 text-green-300">
-                {nodes.length} 个节点
+                {effectiveNodes.length} 个节点
               </Badge>
             ) : (
               <Badge variant="secondary">无节点</Badge>
@@ -429,47 +486,60 @@ export function NodeManagementSection({
 
       {isExpanded && (
         <div className="mt-2 pl-6">
-          <div className="flex items-center gap-2 pb-2 pr-2">
-            <div className="relative flex-1 min-w-0">
+          <div className="flex flex-col gap-2 pb-2 pr-2 sm:flex-row sm:items-center">
+            <div className="relative w-full sm:min-w-0 sm:flex-1">
               <Search className="absolute left-2 top-1/2 -translate-y-1/2 h-3.5 w-3.5 text-white/30" />
               <Input
                 value={nodeSearchKeyword}
                 onChange={(e) => setNodeSearchKeyword(e.target.value)}
                 placeholder="搜索节点..."
-                disabled={nodes.length === 0 && deletedMarkedNodes.length === 0}
+                disabled={effectiveNodes.length === 0 && deletedMarkedNodes.length === 0}
                 className="pl-7 text-xs h-7 bg-white/5 border-white/10"
               />
             </div>
-            <div
-              className="flex h-7 shrink-0 items-center gap-2 rounded-md border border-white/10 bg-white/5 px-2"
-              title="为节点配置 socks5/http 协议的本地监听端口"
-            >
-              <Switch
-                id={listenerPortSwitchId}
-                checked={isListenerPortVisible}
-                onCheckedChange={handleListenerPortChange}
-                disabled={nodes.length === 0 && !hasConfiguredListenerPorts}
-                aria-label="监听端口"
-              />
-              <label htmlFor={listenerPortSwitchId} className="cursor-pointer select-none text-xs text-white/70">
-                监听端口
-              </label>
+            <div className="flex w-full flex-wrap items-center gap-2 sm:w-auto">
+              <div className="shrink-0" title="为节点配置 socks5/http 协议的本地监听端口">
+                <SwitchField
+                  label="监听端口"
+                  checked={isListenerPortVisible}
+                  onCheckedChange={handleListenerPortChange}
+                  disabled={effectiveNodes.length === 0 && !hasConfiguredListenerPorts}
+                  density="compact"
+                />
+              </div>
+              <Button
+                variant="secondary"
+                size="sm"
+                onClick={() => setNameRulesOpen(true)}
+                disabled={effectiveNodes.length === 0}
+                className="h-7 shrink-0 px-2 text-xs"
+              >
+                批量编辑
+              </Button>
+              <Button
+                variant="secondary"
+                size="sm"
+                onClick={() => setAutoProcessingOpen(true)}
+                className="h-7 shrink-0 gap-1.5 px-2 text-xs"
+              >
+                自动处理
+                {normalizedNodeNameFilter.enabled &&
+                normalizedNodeNameFilter.excludeRegexes.length > 0 ? (
+                  <Badge
+                    variant="outline"
+                    className="h-4 min-w-4 border-indigo-400/40 bg-indigo-400/10 px-1 text-[10px] leading-none text-indigo-200"
+                  >
+                    {normalizedNodeNameFilter.excludeRegexes.length}
+                  </Badge>
+                ) : null}
+              </Button>
             </div>
-            <Button
-              variant="secondary"
-              size="sm"
-              onClick={() => setNameRulesOpen(true)}
-              disabled={nodes.length === 0}
-              className="h-7 px-2 text-xs"
-            >
-              批量编辑
-            </Button>
           </div>
 
           <NodeManagementBulkEditDialog
             open={nameRulesOpen}
             onOpenChange={setNameRulesOpen}
-            nodes={nodes}
+            nodes={effectiveNodes}
             resolveNodeNameParts={resolveNodeNameParts}
             bulkRenameNodes={bulkRenameNodes}
             listenerPortEnabled={isListenerPortVisible}
@@ -478,8 +548,17 @@ export function NodeManagementSection({
             onClearListenerPortUiState={clearListenerPortUiState}
           />
 
-          <NodeManagementNodeList
+          <NodeManagementAutoProcessingDialog
+            open={autoProcessingOpen}
+            onOpenChange={setAutoProcessingOpen}
             nodes={nodes}
+            config={normalizedNodeNameFilter}
+            hasProxyProviders={hasProxyProviders}
+            onSave={setNodeNameFilter}
+          />
+
+          <NodeManagementNodeList
+            nodes={effectiveNodes}
             deletedMarkedNodes={deletedMarkedNodes}
             visibleNodes={visibleNodes}
             visibleDeletedMarkedNodes={visibleDeletedMarkedNodes}
@@ -500,8 +579,8 @@ export function NodeManagementSection({
             orderDrafts={orderDrafts}
             setOrderDrafts={setOrderDrafts}
             nodeIndexByName={nodeIndexByName}
-            setNodeOrder={setNodeOrder}
-            moveNode={moveNode}
+            setNodeOrder={setEffectiveNodeOrder}
+            moveNode={moveEffectiveNode}
             isListenerPortVisible={isListenerPortVisible}
             removeNode={removeNode}
             restoreDeletedNode={restoreDeletedNode}
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.test.ts
new file mode 100644
index 0000000..8912c76
--- /dev/null
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.test.ts
@@ -0,0 +1,202 @@
+import * as React from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { ParsedNode } from "@subboost/core/types/node";
+
+const mocks = vi.hoisted(() => ({
+  buttons: [] as Array<Record<string, any>>,
+  dialog: null as Record<string, any> | null,
+  switchField: null as Record<string, any> | null,
+  textarea: null as Record<string, any> | null,
+}));
+
+vi.mock("@subboost/ui/components/ui/button", () => ({
+  Button: (props: any) => {
+    mocks.buttons.push(props);
+    return React.createElement("button", { disabled: props.disabled }, props.children);
+  },
+}));
+vi.mock("@subboost/ui/components/ui/dialog", () => ({
+  Dialog: (props: any) => {
+    mocks.dialog = props;
+    return props.children;
+  },
+  DialogContent: (props: any) => React.createElement("section", null, props.children),
+  DialogDescription: (props: any) => React.createElement("p", null, props.children),
+  DialogFooter: (props: any) => React.createElement("footer", null, props.children),
+  DialogHeader: (props: any) => React.createElement("header", null, props.children),
+  DialogTitle: (props: any) => React.createElement("h2", null, props.children),
+}));
+vi.mock("@subboost/ui/components/ui/form-field", () => ({
+  FormField: (props: any) =>
+    React.createElement(
+      "div",
+      null,
+      React.createElement("label", null, props.label),
+      props.children,
+      props.description ? React.createElement("p", null, props.description) : null,
+      props.error ? React.createElement("p", { role: "alert" }, props.error) : null
+    ),
+}));
+vi.mock("@subboost/ui/components/ui/switch-field", () => ({
+  SwitchField: (props: any) => {
+    mocks.switchField = props;
+    return React.createElement(
+      "label",
+      null,
+      props.label,
+      React.createElement("input", {
+        checked: props.checked,
+        readOnly: true,
+        type: "checkbox",
+      })
+    );
+  },
+}));
+vi.mock("@subboost/ui/components/ui/textarea", () => ({
+  Textarea: (props: any) => {
+    mocks.textarea = props;
+    return React.createElement("textarea", {
+      placeholder: props.placeholder,
+      readOnly: true,
+      value: props.value,
+    });
+  },
+}));
+
+import { NodeManagementAutoProcessingDialog } from "./auto-processing-dialog";
+
+const nodes = [
+  {
+    name: "[HK] Alpha",
+    type: "ss",
+    server: "alpha.test",
+    port: 443,
+    cipher: "aes-128-gcm",
+    password: "secret",
+    _originName: "Alpha",
+  },
+  {
+    name: "Beta",
+    type: "vless",
+    server: "beta.test",
+    port: 8443,
+    uuid: "00000000-0000-4000-8000-000000000001",
+  },
+] as ParsedNode[];
+
+function renderDialog(
+  overrides: Partial<React.ComponentProps<typeof NodeManagementAutoProcessingDialog>> = {}
+) {
+  const props: React.ComponentProps<typeof NodeManagementAutoProcessingDialog> = {
+    open: true,
+    onOpenChange: vi.fn(),
+    nodes,
+    config: { enabled: true, excludeRegexes: ["alpha"] },
+    hasProxyProviders: false,
+    onSave: vi.fn(),
+    ...overrides,
+  };
+  const html = renderToStaticMarkup(
+    React.createElement(NodeManagementAutoProcessingDialog, props)
+  );
+  return { html, props };
+}
+
+function findButton(label: string) {
+  return mocks.buttons.find((button) => button.children === label);
+}
+
+describe("NodeManagementAutoProcessingDialog", () => {
+  beforeEach(() => {
+    mocks.buttons = [];
+    mocks.dialog = null;
+    mocks.switchField = null;
+    mocks.textarea = null;
+  });
+
+  it("renders the compact wording, counts, and matching display/origin names", () => {
+    const { html } = renderDialog();
+
+    expect(html).toContain("自动处理");
+    expect(html).toContain("启用");
+    expect(html).toContain("排除正则");
+    expect(html).toContain("每行一条，匹配导入名称。");
+    expect(html).toContain("剩余流量|套餐到期|注意事项");
+    expect(html).toContain("导入 2 · 排除 1 · 保留 1");
+    expect(html).toContain("[HK] Alpha");
+    expect(html).toContain("原名：Alpha");
+    expect(html).not.toContain("原名：Beta");
+    expect(mocks.switchField).toEqual(
+      expect.objectContaining({ checked: true, label: "启用" })
+    );
+  });
+
+  it("normalizes empty and duplicate lines before saving", () => {
+    const { props } = renderDialog({
+      config: {
+        enabled: true,
+        excludeRegexes: [" Alpha ", "", "Alpha"],
+      },
+    });
+
+    const saveButton = findButton("保存");
+    expect(saveButton).toEqual(expect.objectContaining({ disabled: false }));
+    saveButton?.onClick();
+
+    expect(props.onSave).toHaveBeenCalledWith({
+      enabled: true,
+      excludeRegexes: ["Alpha"],
+    });
+    expect(props.onOpenChange).toHaveBeenCalledWith(false);
+  });
+
+  it.each([
+    { pattern: "[", message: "第 2 行正则无效" },
+    { pattern: "(a+)+$", message: "第 2 行正则过于复杂" },
+  ])("blocks invalid rules and reports their source line", ({ pattern, message }) => {
+    const { html, props } = renderDialog({
+      config: { enabled: true, excludeRegexes: ["nomatch", pattern] },
+    });
+
+    expect(html).toContain(message);
+    const saveButton = findButton("保存");
+    expect(saveButton).toEqual(expect.objectContaining({ disabled: true }));
+    saveButton?.onClick();
+    expect(props.onSave).not.toHaveBeenCalled();
+  });
+
+  it("blocks an empty effective result unless proxy-providers keep output valid", () => {
+    let result = renderDialog({
+      config: { enabled: true, excludeRegexes: [".*"] },
+    });
+
+    expect(result.html).toContain("过滤后没有可用节点，请调整规则或关闭过滤。");
+    expect(findButton("保存")).toEqual(expect.objectContaining({ disabled: true }));
+
+    mocks.buttons = [];
+    result = renderDialog({
+      config: { enabled: true, excludeRegexes: [".*"] },
+      hasProxyProviders: true,
+    });
+    expect(result.html).toContain("proxy-providers 不参与。");
+    const providerSaveButton = findButton("保存");
+    expect(providerSaveButton).toEqual(expect.objectContaining({ disabled: false }));
+    providerSaveButton?.onClick();
+    expect(result.props.onSave).toHaveBeenCalledWith({
+      enabled: true,
+      excludeRegexes: [".*"],
+    });
+  });
+
+  it("closes through both the dialog contract and the cancel button", () => {
+    const { props } = renderDialog();
+
+    mocks.dialog?.onOpenChange(false);
+    findButton("取消")?.onClick();
+
+    expect(props.onOpenChange).toHaveBeenCalledTimes(2);
+    expect(props.onOpenChange).toHaveBeenNthCalledWith(1, false);
+    expect(props.onOpenChange).toHaveBeenNthCalledWith(2, false);
+  });
+});
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.tsx b/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.tsx
new file mode 100644
index 0000000..6842b1f
--- /dev/null
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.tsx
@@ -0,0 +1,197 @@
+"use client";
+
+import * as React from "react";
+import {
+  NodeNameFilterConfigError,
+  parseNodeNameFilterConfig,
+  resolveNodeNameFilter,
+  type NodeNameFilterConfig,
+  type NodeNameFilterValidationError,
+} from "@subboost/core/subscription/node-name-filter";
+import { getNodeOriginName } from "@subboost/core/subscription/node-source-state";
+import type { ParsedNode } from "@subboost/core/types/node";
+import { Button } from "@subboost/ui/components/ui/button";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@subboost/ui/components/ui/dialog";
+import { FormField } from "@subboost/ui/components/ui/form-field";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
+import { Textarea } from "@subboost/ui/components/ui/textarea";
+
+type NodeManagementAutoProcessingDialogProps = {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  nodes: ParsedNode[];
+  config: NodeNameFilterConfig;
+  hasProxyProviders: boolean;
+  onSave: (config: NodeNameFilterConfig) => void;
+};
+
+function formatValidationError(error: NodeNameFilterValidationError): string {
+  if (error.line && error.code === "invalid_regex") {
+    return `第 ${error.line} 行正则无效`;
+  }
+  if (error.line && error.code === "unsafe_regex") {
+    return `第 ${error.line} 行正则过于复杂`;
+  }
+  return error.line ? `第 ${error.line} 行${error.message}` : error.message;
+}
+
+export function NodeManagementAutoProcessingDialog({
+  open,
+  onOpenChange,
+  nodes,
+  config,
+  hasProxyProviders,
+  onSave,
+}: NodeManagementAutoProcessingDialogProps) {
+  const configText = config.excludeRegexes.join("\n");
+  const [enabled, setEnabled] = React.useState(config.enabled);
+  const [excludeRegexText, setExcludeRegexText] = React.useState(configText);
+
+  React.useEffect(() => {
+    if (!open) return;
+    setEnabled(config.enabled);
+    setExcludeRegexText(configText);
+  }, [config.enabled, configText, open]);
+
+  const plan = React.useMemo(() => {
+    try {
+      const parsedConfig = parseNodeNameFilterConfig({
+        enabled,
+        excludeRegexes: excludeRegexText.split("\n"),
+      });
+      return {
+        config: parsedConfig,
+        result: resolveNodeNameFilter(nodes, parsedConfig),
+        errors: [] as NodeNameFilterValidationError[],
+      };
+    } catch (error) {
+      return {
+        config: null,
+        result: null,
+        errors:
+          error instanceof NodeNameFilterConfigError
+            ? error.errors
+            : [{ code: "invalid_config" as const, message: "配置格式无效" }],
+      };
+    }
+  }, [enabled, excludeRegexText, nodes]);
+
+  const validationMessage =
+    plan.errors.length > 0 ? plan.errors.map(formatValidationError).join("；") : undefined;
+  const blocksEmptyResult = Boolean(
+    plan.config?.enabled &&
+      plan.result &&
+      plan.result.rawCount > 0 &&
+      plan.result.effectiveCount === 0 &&
+      !hasProxyProviders
+  );
+  const canSave = Boolean(plan.config && plan.result && !blocksEmptyResult);
+
+  const handleSave = () => {
+    if (!plan.config || !canSave) return;
+    onSave(plan.config);
+    onOpenChange(false);
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="w-[calc(100%_-_2rem)] max-w-xl gap-4 p-4 sm:p-6">
+        <DialogHeader>
+          <DialogTitle>自动处理</DialogTitle>
+          <DialogDescription className="sr-only">
+            设置按导入名称自动排除节点的规则
+          </DialogDescription>
+        </DialogHeader>
+
+        <SwitchField
+          label="启用"
+          checked={enabled}
+          onCheckedChange={setEnabled}
+        />
+
+        <FormField
+          label="排除正则"
+          description="每行一条，匹配导入名称。"
+          error={validationMessage}
+        >
+          <Textarea
+            value={excludeRegexText}
+            onChange={(event) => setExcludeRegexText(event.target.value)}
+            placeholder="剩余流量|套餐到期|注意事项"
+            rows={6}
+            className="min-h-32 resize-y break-words [overflow-wrap:anywhere]"
+          />
+        </FormField>
+
+        <div
+          className="space-y-2 rounded-xl border border-white/10 bg-white/[0.03] p-3"
+          aria-live="polite"
+        >
+          <p className="text-xs leading-relaxed text-white/60">
+            导入 {plan.result?.rawCount ?? nodes.length} · 排除{" "}
+            {plan.result?.excludedCount ?? "—"} · 保留{" "}
+            {plan.result?.effectiveCount ?? "—"}
+          </p>
+
+          {hasProxyProviders ? (
+            <p className="text-xs leading-relaxed text-white/40">
+              proxy-providers 不参与。
+            </p>
+          ) : null}
+
+          {blocksEmptyResult ? (
+            <p className="text-xs leading-relaxed text-red-400" role="alert">
+              过滤后没有可用节点，请调整规则或关闭过滤。
+            </p>
+          ) : null}
+
+          {plan.result ? (
+            <div className="space-y-1.5">
+              <p className="text-xs font-medium text-white/60">匹配节点</p>
+              {plan.result.excludedNodes.length > 0 ? (
+                <div className="max-h-48 space-y-1 overflow-y-auto pr-1 custom-scrollbar">
+                  {plan.result.excludedNodes.map((node, index) => {
+                    const originName = getNodeOriginName(node);
+                    return (
+                      <div
+                        key={`${node.name}:${index}`}
+                        className="rounded-lg border border-red-500/15 bg-red-500/[0.06] px-2.5 py-2"
+                      >
+                        <p className="break-words text-xs leading-relaxed text-white/75 [overflow-wrap:anywhere]">
+                          {node.name}
+                        </p>
+                        {originName !== node.name ? (
+                          <p className="mt-0.5 break-words text-[11px] leading-relaxed text-white/40 [overflow-wrap:anywhere]">
+                            原名：{originName}
+                          </p>
+                        ) : null}
+                      </div>
+                    );
+                  })}
+                </div>
+              ) : (
+                <p className="text-xs text-white/40">没有匹配节点</p>
+              )}
+            </div>
+          ) : null}
+        </div>
+
+        <DialogFooter className="gap-2 sm:space-x-0">
+          <Button variant="ghost" onClick={() => onOpenChange(false)}>
+            取消
+          </Button>
+          <Button onClick={handleSave} disabled={!canSave}>
+            保存
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management/bulk-edit-dialog.tsx b/packages/ui/src/product/converter/advanced-mode/sections/node-management/bulk-edit-dialog.tsx
index 26a86e9..7808d12 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management/bulk-edit-dialog.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management/bulk-edit-dialog.tsx
@@ -4,7 +4,7 @@ import * as React from "react";
 import { Button } from "@subboost/ui/components/ui/button";
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@subboost/ui/components/ui/dialog";
 import { Input } from "@subboost/ui/components/ui/input";
-import { Switch } from "@subboost/ui/components/ui/switch";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { toast } from "@subboost/ui/components/ui/toaster";
 import { formatNodeNameFromTemplate } from "@subboost/core/node-name-template";
 import { useProductInteractionAdapter } from "@subboost/ui/product/interactions";
@@ -228,15 +228,19 @@ export function NodeManagementBulkEditDialog({
                 <div className="text-[10px] text-white/40">支持 $1、$2… 分组引用；留空表示删除匹配内容</div>
               </div>
 
-              <div className="flex flex-wrap items-center gap-3">
-                <div className="flex items-center gap-2">
-                  <Switch checked={nameRulesTrim} onCheckedChange={setNameRulesTrim} />
-                  <span className="text-xs text-white/70">去除首尾空格</span>
-                </div>
-                <div className="flex items-center gap-2">
-                  <Switch checked={nameRulesCollapseSpaces} onCheckedChange={setNameRulesCollapseSpaces} />
-                  <span className="text-xs text-white/70">空白归一化</span>
-                </div>
+              <div className="grid gap-2 sm:grid-cols-2">
+                <SwitchField
+                  label="去除首尾空格"
+                  checked={nameRulesTrim}
+                  onCheckedChange={setNameRulesTrim}
+                  density="compact"
+                />
+                <SwitchField
+                  label="空白归一化"
+                  checked={nameRulesCollapseSpaces}
+                  onCheckedChange={setNameRulesCollapseSpaces}
+                  density="compact"
+                />
               </div>
             </div>
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.test.ts
index d55b88e..4e02d9d 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.test.ts
@@ -170,13 +170,13 @@ describe("NodeManagementNodeList", () => {
   it("handles list actions for rename, listener ports, ordering, delete, and restore", () => {
     const props = makeProps();
     const tree = renderTree(props);
-    const buttons = collectElements(tree, (element) => element.type === "button");
+    const buttons = collectElements(tree, (element) => typeof element.props.label === "string");
     const inputs = collectInputs(tree);
 
-    buttons.find((button) => button.props.title === "恢复原名: Original Alpha")?.props.onClick();
+    buttons.find((button) => button.props.label === "恢复原名: Original Alpha")?.props.onClick();
     expect(props.restoreNodeName).toHaveBeenCalledWith(alpha.name);
 
-    const renameButtons = buttons.filter((button) => button.props.title === "重命名");
+    const renameButtons = buttons.filter((button) => button.props.label === "重命名节点");
     renameButtons[0].props.onClick();
     expect(props.setEditingNodeName).toHaveBeenCalledWith(alpha.name);
     expect(props.setEditNodeValue).toHaveBeenCalledWith("Alpha");
@@ -201,22 +201,22 @@ describe("NodeManagementNodeList", () => {
     expect(props.setNodeOrder).toHaveBeenCalledWith(alpha.name, 2);
     expect(props.setOrderDrafts).toHaveBeenCalled();
 
-    buttons.find((button) => button.props.title === "上移")?.props.onClick();
-    buttons.find((button) => button.props.title === "下移")?.props.onClick();
+    buttons.find((button) => button.props.label === "上移节点")?.props.onClick();
+    buttons.find((button) => button.props.label === "下移节点")?.props.onClick();
     expect(props.moveNode).toHaveBeenCalledWith(alpha.name, "up");
     expect(props.moveNode).toHaveBeenCalledWith(alpha.name, "down");
 
-    buttons.find((button) => button.props.title === "删除")?.props.onClick();
+    buttons.find((button) => button.props.label === "删除节点")?.props.onClick();
     expect(props.removeNode).toHaveBeenCalledWith(alpha.name);
 
-    buttons.find((button) => button.props.title === "恢复")?.props.onClick();
+    buttons.find((button) => button.props.label === "恢复节点 Deleted")?.props.onClick();
     expect(props.restoreDeletedNode).toHaveBeenCalledWith("Deleted");
   });
 
   it("commits and cancels rename while editing a node", () => {
     const props = makeProps({ editingNodeName: alpha.name, editNodeValue: " Gamma " });
     const tree = renderTree(props);
-    const buttons = collectElements(tree, (element) => element.type === "button");
+    const buttons = collectElements(tree, (element) => typeof element.props.label === "string");
     const input = collectInputs(tree).find((element) => element.props.autoFocus);
     expect(input).toBeDefined();
 
@@ -230,10 +230,10 @@ describe("NodeManagementNodeList", () => {
     input!.props.onKeyDown({ key: "Escape" });
     expect(props.setEditingNodeName).toHaveBeenCalledWith(null);
 
-    buttons.find((button) => button.props.title === "保存")?.props.onClick();
+    buttons.find((button) => button.props.label === "保存节点名称")?.props.onClick();
     expect(props.renameNode).toHaveBeenCalledWith(alpha.name, "[HK] Gamma");
 
-    buttons.find((button) => button.props.title === "取消")?.props.onClick();
+    buttons.find((button) => button.props.label === "取消重命名")?.props.onClick();
     expect(props.setEditingNodeName).toHaveBeenCalledWith(null);
   });
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.tsx b/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.tsx
index 80883bf..6a6c74a 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.tsx
@@ -3,6 +3,7 @@
 import * as React from "react";
 import { Check, ChevronDown, ChevronUp, Pencil, RotateCcw, Trash2, X } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
 import { ProtocolBadge } from "@subboost/ui/components/ui/protocol-badge";
 import { toast } from "@subboost/ui/components/ui/toaster";
@@ -144,23 +145,25 @@ export function NodeManagementNodeList({
                           className="flex-1 h-6 text-xs bg-white/10"
                           autoFocus
                         />
-                        <button
+                        <IconButton
+                          label="保存节点名称"
+                          variant="ghost"
                           onClick={() => {
                             commitRename();
                             setEditingNodeName(null);
                           }}
-                          className="p-1 text-green-400 hover:text-green-300"
-                          title="保存"
+                          className="h-6 w-6 p-1 text-green-400 hover:text-green-300"
                         >
                           <Check className="h-3 w-3" />
-                        </button>
-                        <button
+                        </IconButton>
+                        <IconButton
+                          label="取消重命名"
+                          variant="ghost"
                           onClick={() => setEditingNodeName(null)}
-                          className="p-1 text-white/30 hover:text-white/50"
-                          title="取消"
+                          className="h-6 w-6 p-1 text-white/30 hover:text-white/50"
                         >
                           <X className="h-3 w-3" />
-                        </button>
+                        </IconButton>
                       </>
                     ) : (
                       <>
@@ -178,13 +181,14 @@ export function NodeManagementNodeList({
                             {parts.canEditBase ? parts.baseName : node.name}
                           </span>
                           {isRenamed && (
-                            <button
+                            <IconButton
+                              label={`恢复原名: ${originName}`}
+                              variant="ghost"
                               onClick={() => restoreNodeName(node.name)}
-                              className="p-0.5 text-white/30 hover:text-amber-400 transition-colors"
-                              title={`恢复原名: ${originName}`}
+                              className="h-5 w-5 p-0.5 text-white/30 transition-colors hover:text-amber-400"
                             >
                               <RotateCcw className="h-2.5 w-2.5" />
-                            </button>
+                            </IconButton>
                           )}
                         </span>
                         {isListenerPortVisible && (
@@ -271,25 +275,29 @@ export function NodeManagementNodeList({
                             className="h-6 w-10 text-[10px] bg-white/10 border-white/10 text-center px-1"
                           />
                           <div className="flex flex-col">
-                            <button
+                            <IconButton
+                              label="上移节点"
+                              variant="ghost"
                               onClick={() => moveNode(node.name, "up")}
                               disabled={(nodeIndexByName.get(node.name) ?? 0) <= 0}
                               className="h-3 w-4 flex items-center justify-center text-white/30 hover:text-indigo-300 disabled:opacity-30 disabled:cursor-not-allowed transition-colors"
-                              title="上移"
                             >
                               <ChevronUp className="h-2.5 w-2.5" />
-                            </button>
-                            <button
+                            </IconButton>
+                            <IconButton
+                              label="下移节点"
+                              variant="ghost"
                               onClick={() => moveNode(node.name, "down")}
                               disabled={(nodeIndexByName.get(node.name) ?? 0) >= nodes.length - 1}
                               className="h-3 w-4 flex items-center justify-center text-white/30 hover:text-indigo-300 disabled:opacity-30 disabled:cursor-not-allowed transition-colors"
-                              title="下移"
                             >
                               <ChevronDown className="h-2.5 w-2.5" />
-                            </button>
+                            </IconButton>
                           </div>
                         </div>
-                        <button
+                        <IconButton
+                          label="重命名节点"
+                          variant="ghost"
                           onClick={() => {
                             if (parts.tag && !parts.canEditBase) {
                               toast({
@@ -303,18 +311,18 @@ export function NodeManagementNodeList({
                             setEditingNodeName(node.name);
                             setEditNodeValue(parts.baseName);
                           }}
-                          className="p-1 text-white/50 hover:text-indigo-400 transition-colors"
-                          title="重命名"
+                          className="h-6 w-6 p-1 text-white/50 hover:text-indigo-400 transition-colors"
                         >
                           <Pencil className="h-3 w-3" />
-                        </button>
-                        <button
+                        </IconButton>
+                        <IconButton
+                          label="删除节点"
+                          variant="ghost"
                           onClick={() => removeNode(node.name)}
-                          className="p-1 text-white/50 hover:text-red-400 transition-colors"
-                          title="删除"
+                          className="h-6 w-6 p-1 text-white/50 hover:text-red-400 transition-colors"
                         >
                           <Trash2 className="h-3 w-3" />
-                        </button>
+                        </IconButton>
                       </>
                     )}
                   </div>
@@ -354,13 +362,14 @@ export function NodeManagementNodeList({
                         >
                           已删除
                         </Badge>
-                        <button
+                        <IconButton
+                          label={`恢复节点 ${originName}`}
+                          variant="ghost"
                           onClick={() => restoreDeletedNode(originName)}
-                          className="p-1 text-white/30 hover:text-white/60"
-                          title="恢复"
+                          className="h-6 w-6 p-1 text-white/30 hover:text-white/60"
                         >
                           <RotateCcw className="h-3 w-3" />
-                        </button>
+                        </IconButton>
                       </div>
                     ))}
                   </div>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel-interactions.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel-interactions.test.ts
index 98a8a0c..e803c43 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel-interactions.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel-interactions.test.ts
@@ -45,6 +45,15 @@ vi.mock("@subboost/ui/components/ui/button", () => ({
   Button: (props: any) => React.createElement("button", props, props.children),
 }));
 
+vi.mock("@subboost/ui/components/ui/form-field", () => ({
+  FormField: (props: any) => React.createElement("div", null, props.children),
+}));
+
+vi.mock("@subboost/ui/components/ui/choice-group", () => ({
+  ChoiceGroup: (props: any) => React.createElement("div", null, props.children),
+  ChoiceChip: ({ label, selected, ...props }: any) => React.createElement("button", { ...props, "aria-pressed": selected }, label),
+}));
+
 vi.mock("@subboost/ui/components/ui/input", () => ({
   Input: (props: any) => React.createElement("input", props),
 }));
@@ -163,7 +172,7 @@ describe("ProxyGroupAdvancedPanel interactions", () => {
     const sourceCheckboxes = elements.filter((element) => element.type === "input" && element.props.type === "checkbox");
     const textInputs = elements.filter((element) => element.type === "input" && element.props.type !== "checkbox");
     const regionButtons = elements.filter(
-      (element) => element.type === "button" && String(element.props.className || "").includes("rounded border px-2"),
+      (element) => element.type === "button" && typeof element.props["aria-pressed"] === "boolean",
     );
     const includedRows = elements.filter((element) => element.props.draggable);
     const excludeButton = elements.find((element) => element.type === "button" && element.props.title === "排除");
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.test.ts
index d2d9f5d..ac3b84b 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.test.ts
@@ -168,6 +168,26 @@ describe("ProxyGroupAdvancedPanel", () => {
     );
   });
 
+  it("omits globally filtered nodes from member candidates", () => {
+    mocks.store.nodeNameFilter = {
+      enabled: true,
+      excludeRegexes: ["japan"],
+    };
+
+    const html = renderToStaticMarkup(
+      React.createElement(ProxyGroupAdvancedPanel, {
+        target: { kind: "custom", id: "media", name: "Media" },
+        advanced: {},
+        onChange: vi.fn(),
+        rulesCount: 0,
+        rulesContent: null,
+      }),
+    );
+
+    expect(html).toContain("US Source");
+    expect(html).not.toContain("Japan Source");
+  });
+
   it("renders empty states without generated members or source matches", () => {
     mocks.store = {
       ...mocks.store,
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx
index 4d856f4..73497f7 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx
@@ -4,7 +4,9 @@ import * as React from "react";
 import { Plus, X } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
 import { Button } from "@subboost/ui/components/ui/button";
+import { ChoiceChip, ChoiceGroup } from "@subboost/ui/components/ui/choice-group";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
+import { FormField } from "@subboost/ui/components/ui/form-field";
 import { Input } from "@subboost/ui/components/ui/input";
 import { toast } from "@subboost/ui/components/ui/toaster";
 import { cn } from "@subboost/ui/lib/utils";
@@ -12,6 +14,7 @@ import { PROXY_GROUP_MODULES, generateProxyGroups } from "@subboost/core/generat
 import { resolveProxyGroupModuleName } from "@subboost/core/proxy-group-name";
 import { REGION_PRESETS } from "@subboost/core/proxy-group-advanced";
 import { getProxyGroupMemberKey } from "@subboost/core/proxy-group-targets";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import { getNodeSourceIds } from "@subboost/core/subscription/node-source-state";
 import { isSubscriptionInfoNodeName } from "@subboost/core/subscription/info-node-name";
 import type {
@@ -29,6 +32,7 @@ import {
   insertMemberAfterProtected,
   isNodeMember,
   isProxyGroupMember,
+  mergeVisibleMemberOrder,
   normalizeList,
   withMember,
   withoutMember,
@@ -134,6 +138,7 @@ export function ProxyGroupAdvancedPanel({
 }) {
   const {
     nodes,
+    nodeNameFilter,
     sources,
     enabledProxyGroups,
     customProxyGroups,
@@ -146,6 +151,32 @@ export function ProxyGroupAdvancedPanel({
     ruleProviderBaseUrl,
   } = useConfigStore();
   const [draggingKey, setDraggingKey] = React.useState<string | null>(null);
+  const effectiveNodes = React.useMemo(
+    () => resolveNodeNameFilter(nodes, nodeNameFilter).effectiveNodes,
+    [nodeNameFilter, nodes],
+  );
+  const effectiveNodeNameSet = React.useMemo(
+    () => new Set(effectiveNodes.map((node) => node.name)),
+    [effectiveNodes],
+  );
+  const filteredNodeMemberKeys = React.useMemo(
+    () =>
+      new Set(
+        nodes
+          .filter((node) => !effectiveNodeNameSet.has(node.name))
+          .map((node) => getProxyGroupMemberKey({ kind: "node", name: node.name })),
+      ),
+    [effectiveNodeNameSet, nodes],
+  );
+  const preserveFilteredMemberOrder = React.useCallback(
+    (nextVisibleOrder: readonly ProxyGroupMemberRef[]) =>
+      mergeVisibleMemberOrder(
+        advanced.memberOrder,
+        nextVisibleOrder,
+        filteredNodeMemberKeys,
+      ),
+    [advanced.memberOrder, filteredNodeMemberKeys],
+  );
   const activeCustomProxyGroups = React.useMemo(
     () => customProxyGroups.filter((group) => group.enabled !== false),
     [customProxyGroups],
@@ -162,8 +193,8 @@ export function ProxyGroupAdvancedPanel({
   }, [customProxyGroups, target.id, target.kind]);
 
   const activeNodes = React.useMemo(
-    () => nodes.filter((node) => !isSubscriptionInfoNodeName(node.name)),
-    [nodes],
+    () => effectiveNodes.filter((node) => !isSubscriptionInfoNodeName(node.name)),
+    [effectiveNodes],
   );
   const moduleNames = React.useMemo(
     () =>
@@ -178,7 +209,7 @@ export function ProxyGroupAdvancedPanel({
 
   const generatedProxyGroups = React.useMemo(() => {
     return generateProxyGroups({
-      nodes,
+      nodes: effectiveNodes,
       enabledModules: previewEnabledProxyGroups,
       ruleProviderBaseUrl,
       testUrl,
@@ -190,7 +221,7 @@ export function ProxyGroupAdvancedPanel({
       proxyGroupNameOverrides,
     });
   }, [
-    nodes,
+    effectiveNodes,
     previewEnabledProxyGroups,
     ruleProviderBaseUrl,
     testUrl,
@@ -202,9 +233,9 @@ export function ProxyGroupAdvancedPanel({
     proxyGroupNameOverrides,
   ]);
   const generatedProxyNames = React.useMemo(() => {
-    if (nodes.length === 0) return [];
+    if (effectiveNodes.length === 0) return [];
     return generatedProxyGroups.find((group) => group.name === target.name)?.proxies ?? [];
-  }, [generatedProxyGroups, nodes.length, target.name]);
+  }, [effectiveNodes.length, generatedProxyGroups, target.name]);
 
   const candidateMembers = React.useMemo(() => {
     const rawNames = [
@@ -307,9 +338,9 @@ export function ProxyGroupAdvancedPanel({
       const next = [...current];
       const [item] = next.splice(from, 1);
       next.splice(to, 0, item);
-      onChange({ memberOrder: next });
+      onChange({ memberOrder: preserveFilteredMemberOrder(next) });
     },
-    [includedMembers, onChange],
+    [includedMembers, onChange, preserveFilteredMemberOrder],
   );
 
   const sourceIds = normalizeList(advanced.sourceIds);
@@ -336,21 +367,37 @@ export function ProxyGroupAdvancedPanel({
       onChange({
         extraMembers: withMember(extraRefs, member.ref),
         excludedMembers: withoutMember(excludedRefs, member.key),
-        memberOrder: insertMemberAfterProtected(includedMembers, member.ref),
+        memberOrder: preserveFilteredMemberOrder(
+          insertMemberAfterProtected(includedMembers, member.ref),
+        ),
       });
     },
-    [excludedRefs, extraRefs, includedMembers, onChange],
+    [
+      excludedRefs,
+      extraRefs,
+      includedMembers,
+      onChange,
+      preserveFilteredMemberOrder,
+    ],
   );
 
   const addAllNodes = React.useCallback(() => {
-    onChange(
-      buildAddAllMembersPatch({
-        advanced,
-        currentMembers: includedMembers,
-        membersToAdd: excludedNodeMembers,
-      }),
-    );
-  }, [advanced, excludedNodeMembers, includedMembers, onChange]);
+    const patch = buildAddAllMembersPatch({
+      advanced,
+      currentMembers: includedMembers,
+      membersToAdd: excludedNodeMembers,
+    });
+    onChange({
+      ...patch,
+      memberOrder: preserveFilteredMemberOrder(patch.memberOrder ?? []),
+    });
+  }, [
+    advanced,
+    excludedNodeMembers,
+    includedMembers,
+    onChange,
+    preserveFilteredMemberOrder,
+  ]);
 
   const removeAllNodes = React.useCallback(() => {
     onChange(
@@ -363,13 +410,15 @@ export function ProxyGroupAdvancedPanel({
 
   const addAllProxyGroups = React.useCallback(() => {
     if (addableProxyGroupMembers.length > 0) {
-      onChange(
-        buildAddAllMembersPatch({
-          advanced,
-          currentMembers: includedMembers,
-          membersToAdd: addableProxyGroupMembers,
-        }),
-      );
+      const patch = buildAddAllMembersPatch({
+        advanced,
+        currentMembers: includedMembers,
+        membersToAdd: addableProxyGroupMembers,
+      });
+      onChange({
+        ...patch,
+        memberOrder: preserveFilteredMemberOrder(patch.memberOrder ?? []),
+      });
     }
     const skippedCount =
       excludedProxyGroupMembers.length - addableProxyGroupMembers.length;
@@ -385,6 +434,7 @@ export function ProxyGroupAdvancedPanel({
     excludedProxyGroupMembers.length,
     includedMembers,
     onChange,
+    preserveFilteredMemberOrder,
   ]);
 
   const removeAllProxyGroups = React.useCallback(() => {
@@ -434,48 +484,49 @@ export function ProxyGroupAdvancedPanel({
 
         <div className="relative p-3 before:absolute before:bottom-3 before:left-0 before:top-3 before:w-px before:bg-white/10">
           <div className={ADVANCED_PANEL_TITLE_CLASS}>地区</div>
-          <div className="flex flex-wrap gap-1.5">
+          <ChoiceGroup label="地区筛选" className="gap-1.5">
             {REGION_PRESETS.map((region) => {
               const active = regions.includes(region.id);
               return (
-                <button
+                <ChoiceChip
                   key={region.id}
-                  type="button"
+                  label={`${region.emoji} ${region.label}`}
+                  selected={active}
                   onClick={() => onChange({ regions: toggleValue(regions, region.id as NodeRegion) })}
                   className={cn(
-                    "rounded border px-2 py-1 text-[10px] transition-colors",
-                    active
-                      ? "border-indigo-400/40 bg-indigo-500/20 text-indigo-100"
-                      : "border-white/10 bg-white/5 text-white/55 hover:bg-white/10",
+                    "min-h-0 rounded px-2 py-1 text-[10px]",
+                    active && "border-indigo-400/40 bg-indigo-500/20 text-indigo-100",
                   )}
-                >
-                  {region.emoji} {region.label}
-                </button>
+                />
               );
             })}
-          </div>
+          </ChoiceGroup>
           <div className="mt-1 text-[10px] text-white/35">不选择表示匹配所有地区</div>
         </div>
 
         <div className="relative space-y-3 p-3 before:absolute before:bottom-3 before:left-0 before:top-3 before:w-px before:bg-white/10">
-          <label className="block">
-            <span className={ADVANCED_PANEL_TITLE_CLASS}>包含正则（可选）</span>
+          <FormField
+            label={<span className="text-[11px] font-medium text-white/50">包含正则（可选）</span>}
+            className="space-y-1"
+          >
             <Input
               value={advanced.includeRegex ?? ""}
               onChange={(event) => onChange({ includeRegex: event.target.value })}
               placeholder="例如: IEPL|专线|家宽"
               className="h-8 border-white/10 bg-white/5 text-xs"
             />
-          </label>
-          <label className="block">
-            <span className={ADVANCED_PANEL_TITLE_CLASS}>排除正则（可选）</span>
+          </FormField>
+          <FormField
+            label={<span className="text-[11px] font-medium text-white/50">排除正则（可选）</span>}
+            className="space-y-1"
+          >
             <Input
               value={advanced.excludeRegex ?? ""}
               onChange={(event) => onChange({ excludeRegex: event.target.value })}
               placeholder="例如: 测试|过期"
               className="h-8 border-white/10 bg-white/5 text-xs"
             />
-          </label>
+          </FormField>
         </div>
       </div>
 
@@ -498,10 +549,11 @@ export function ProxyGroupAdvancedPanel({
             暂无已启用成员
           </div>
         ) : (
-          <div className="max-h-52 space-y-1 overflow-y-auto pr-1 custom-scrollbar">
+          <div role="list" className="max-h-52 space-y-1 overflow-y-auto pr-1 custom-scrollbar">
             {includedMembers.map((member) => (
               <div
                 key={member.key}
+                role="listitem"
                 draggable
                 onDragStart={() => setDraggingKey(member.key)}
                 onDragOver={(event) => event.preventDefault()}
@@ -555,16 +607,18 @@ export function ProxyGroupAdvancedPanel({
             <div className="max-h-52 overflow-y-auto pr-1 custom-scrollbar flex flex-wrap gap-1.5">
               {excludedMembers.map((member) => {
                 return (
-                  <button
+                  <Button
                     key={member.key}
                     type="button"
-                    className="inline-flex max-w-full items-center gap-1 rounded border border-white/10 bg-white/5 px-2 py-1 text-[10px] text-white/55 transition-colors hover:border-emerald-400/30 hover:bg-emerald-500/10 hover:text-emerald-100"
+                    variant="outline"
+                    size="sm"
+                    className="h-auto max-w-full gap-1 rounded px-2 py-1 text-[10px] text-white/55 hover:border-emerald-400/30 hover:bg-emerald-500/10 hover:text-emerald-100"
                     title={memberLabel(member)}
                     onClick={() => enableMember(member)}
                   >
                     <Plus className="h-3 w-3" />
                     <span className="truncate">{memberLabel(member)}</span>
-                  </button>
+                  </Button>
                 );
               })}
             </div>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.test.ts
index f4d27ce..d901d5e 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.test.ts
@@ -6,6 +6,7 @@ import {
   findCycleCreatingProxyGroupKeys,
   isNodeMember,
   isProxyGroupMember,
+  mergeVisibleMemberOrder,
   type ResolvedMember,
 } from "./proxy-group-member-bulk";
 
@@ -90,6 +91,30 @@ describe("proxy group member bulk helpers", () => {
     });
   });
 
+  it("reorders visible members without removing filtered-node slots", () => {
+    expect(
+      mergeVisibleMemberOrder(
+        [
+          { kind: "direct" },
+          { kind: "node", name: "Visible A" },
+          { kind: "node", name: "Filtered" },
+          { kind: "node", name: "Visible B" },
+        ],
+        [
+          { kind: "direct" },
+          { kind: "node", name: "Visible B" },
+          { kind: "node", name: "Visible A" },
+        ],
+        new Set(["node:Filtered"]),
+      ),
+    ).toEqual([
+      { kind: "direct" },
+      { kind: "node", name: "Visible B" },
+      { kind: "node", name: "Filtered" },
+      { kind: "node", name: "Visible A" },
+    ]);
+  });
+
   it("distinguishes nodes and proxy groups from fixed policies", () => {
     const node = resolved({ kind: "node", name: "A" }, "A");
     const moduleMember = resolved({ kind: "module", id: "auto" }, "Auto");
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.ts
index bc42638..9755f0c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.ts
@@ -49,6 +49,41 @@ function uniqueMemberRefs(members: readonly ProxyGroupMemberRef[]): ProxyGroupMe
   });
 }
 
+export function mergeVisibleMemberOrder(
+  currentOrder: readonly ProxyGroupMemberRef[] | undefined,
+  nextVisibleOrder: readonly ProxyGroupMemberRef[],
+  preservedKeys: ReadonlySet<string>,
+): ProxyGroupMemberRef[] {
+  const visible = uniqueMemberRefs(nextVisibleOrder).filter(
+    (member) => !preservedKeys.has(getProxyGroupMemberKey(member)),
+  );
+  const merged: ProxyGroupMemberRef[] = [];
+  const used = new Set<string>();
+  let visibleIndex = 0;
+
+  const append = (member: ProxyGroupMemberRef) => {
+    const key = getProxyGroupMemberKey(member);
+    if (used.has(key)) return;
+    used.add(key);
+    merged.push(member);
+  };
+
+  for (const member of normalizeList(currentOrder)) {
+    if (preservedKeys.has(getProxyGroupMemberKey(member))) {
+      append(member);
+      continue;
+    }
+    const replacement = visible[visibleIndex];
+    visibleIndex += 1;
+    if (replacement) append(replacement);
+  }
+
+  for (; visibleIndex < visible.length; visibleIndex += 1) {
+    append(visible[visibleIndex]);
+  }
+  return merged;
+}
+
 export function insertMembersAfterProtected(
   currentMembers: readonly ResolvedMember[],
   members: readonly ProxyGroupMemberRef[],
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-row.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-row.tsx
index d61b724..cee5dba 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-row.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-row.tsx
@@ -16,16 +16,16 @@ import { cn } from "@subboost/ui/lib/utils";
 import type { CustomRule } from "@subboost/core/types/config";
 import type {
   CustomRuleListItem,
-  ProxyGroupRuleTarget,
+  ProxyGroupRuleTargetOption,
   ProxyGroupRuleTargetKind,
 } from "./proxy-group-rule-targets";
 
-export type RuleSetMoveTarget = ProxyGroupRuleTarget & { kind: "module" | "custom" };
+export type RuleSetMoveTarget = ProxyGroupRuleTargetOption & { kind: "module" | "custom" };
 export type ProxyGroupRuleRowState = "active" | "moved" | "removed";
 
 type RuleSource = "preset" | "custom" | "manual" | "experimental";
 
-export function isRuleSetMoveTarget(target: ProxyGroupRuleTarget): target is RuleSetMoveTarget {
+export function isRuleSetMoveTarget(target: ProxyGroupRuleTargetOption): target is RuleSetMoveTarget {
   return target.kind === "module" || target.kind === "custom";
 }
 
@@ -153,9 +153,9 @@ export function ProxyGroupManualRuleRow({
   onRemove,
 }: {
   item: CustomRuleListItem;
-  targets: ProxyGroupRuleTarget[];
+  targets: ProxyGroupRuleTargetOption[];
   currentTargetName: string;
-  onMove: (item: CustomRuleListItem, target: ProxyGroupRuleTarget) => void;
+  onMove: (item: CustomRuleListItem, target: ProxyGroupRuleTargetOption) => void;
   onRemove: (item: CustomRuleListItem) => void;
 }) {
   const { rule } = item;
@@ -210,10 +210,10 @@ export function ProxyGroupRuleMoveMenu({
 }: {
   title: string;
   ariaLabel: string;
-  targets: ProxyGroupRuleTarget[];
+  targets: ProxyGroupRuleTargetOption[];
   kinds: ProxyGroupRuleTargetKind[];
-  currentTarget?: Partial<ProxyGroupRuleTarget>;
-  onMove: (target: ProxyGroupRuleTarget) => void | Promise<void>;
+  currentTarget?: Partial<ProxyGroupRuleTargetOption>;
+  onMove: (target: ProxyGroupRuleTargetOption) => void | Promise<void>;
 }) {
   return (
     <DropdownMenu>
@@ -322,7 +322,10 @@ function NoResolveBadge() {
   );
 }
 
-function isCurrentTarget(target: ProxyGroupRuleTarget, currentTarget?: Partial<ProxyGroupRuleTarget>) {
+function isCurrentTarget(
+  target: ProxyGroupRuleTargetOption,
+  currentTarget?: Partial<ProxyGroupRuleTargetOption>,
+) {
   if (!currentTarget) return false;
   if (currentTarget.kind && currentTarget.id) {
     return currentTarget.kind === target.kind && currentTarget.id === target.id;
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-targets.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-targets.ts
index 0c66fac..97cd83b 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-targets.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-targets.ts
@@ -5,7 +5,7 @@ import type { CustomProxyGroup, CustomRule } from "@subboost/core/types/config";
 
 export type ProxyGroupRuleTargetKind = "module" | "custom";
 
-export type ProxyGroupRuleTarget = {
+export type ProxyGroupRuleTargetOption = {
   kind: ProxyGroupRuleTargetKind;
   id: string;
   name: string;
@@ -48,10 +48,10 @@ export function buildManualRuleTargets({
   hiddenProxyGroups?: string[];
   customProxyGroups: CustomProxyGroup[];
   proxyGroupNameOverrides?: Record<string, string>;
-}): ProxyGroupRuleTarget[] {
+}): ProxyGroupRuleTargetOption[] {
   const hidden = new Set(hiddenProxyGroups || []);
   const enabled = new Set(enabledProxyGroups);
-  const targets: ProxyGroupRuleTarget[] = [];
+  const targets: ProxyGroupRuleTargetOption[] = [];
 
   for (const proxyModule of PROXY_GROUP_MODULES) {
     if (!enabled.has(proxyModule.id) || hidden.has(proxyModule.id)) continue;
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-type-menu.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-type-menu.test.ts
index a30fab3..9d7d14a 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-type-menu.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-type-menu.test.ts
@@ -26,7 +26,8 @@ vi.mock("@subboost/ui/components/ui/dropdown-menu", () => ({
   DropdownMenu: (props: any) => React.createElement("div", null, props.children),
   DropdownMenuContent: (props: any) => {
     captures.contents.push(props);
-    return React.createElement("div", props, props.children);
+    const { children, sideOffset: _sideOffset, ...domProps } = props;
+    return React.createElement("div", domProps, children);
   },
   DropdownMenuItem: (props: any) => {
     captures.items.push(props);
@@ -35,7 +36,8 @@ vi.mock("@subboost/ui/components/ui/dropdown-menu", () => ({
   DropdownMenuSub: (props: any) => React.createElement("div", null, props.children),
   DropdownMenuSubContent: (props: any) => {
     captures.subContents.push(props);
-    return React.createElement("div", props, props.children);
+    const { children, sideOffset: _sideOffset, ...domProps } = props;
+    return React.createElement("div", domProps, children);
   },
   DropdownMenuSubTrigger: (props: any) => {
     captures.subTriggers.push(props);
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets-invalid-save.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets-invalid-save.test.ts
new file mode 100644
index 0000000..f6bac42
--- /dev/null
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets-invalid-save.test.ts
@@ -0,0 +1,202 @@
+import * as React from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  buttons: [] as any[],
+  ruleSets: [] as any[],
+  store: {} as Record<string, any>,
+  toast: vi.fn(),
+}));
+
+const stateMock = vi.hoisted(() => ({
+  callIndex: 0,
+  overrides: {} as Record<number, unknown>,
+}));
+
+vi.mock("react", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react")>();
+  return {
+    ...actual,
+    useState: (initial: unknown) => {
+      const index = stateMock.callIndex++;
+      const value = Object.prototype.hasOwnProperty.call(
+        stateMock.overrides,
+        index,
+      )
+        ? stateMock.overrides[index]
+        : initial;
+      return [value, vi.fn()];
+    },
+  };
+});
+
+vi.mock("lucide-react", () => ({
+  ArrowRight: () => null,
+  Check: () => null,
+  Pencil: () => null,
+  Trash2: () => null,
+  X: () => null,
+}));
+vi.mock("@subboost/ui/components/ui/button", () => ({
+  Button: (props: any) => {
+    mocks.buttons.push(props);
+    return null;
+  },
+}));
+vi.mock("@subboost/ui/components/ui/select", () => ({
+  Select: (props: any) => props.children,
+  SelectContent: (props: any) => props.children,
+  SelectItem: (props: any) => props.children,
+  SelectTrigger: (props: any) => props.children,
+  SelectValue: () => null,
+}));
+vi.mock("@subboost/ui/components/ui/switch", () => ({
+  Switch: () => null,
+}));
+vi.mock("@subboost/ui/components/ui/toaster", () => ({ toast: mocks.toast }));
+vi.mock("@subboost/core/generator/proxy-groups", () => ({
+  PROXY_GROUP_MODULES: [
+    { id: "auto", name: "Auto", rules: [] },
+    { id: "fallback", name: "Fallback", rules: [] },
+  ],
+}));
+vi.mock("@subboost/core/generator/module-rules", () => ({
+  getModuleRuleOrderKey: (moduleId: string, ruleId: string) =>
+    `${moduleId}:${ruleId}`,
+}));
+vi.mock("@subboost/core/proxy-group-name", () => ({
+  resolveProxyGroupModuleName: (module: { name: string }, override?: string) =>
+    override || module.name,
+}));
+vi.mock("@subboost/core/proxy-group-targets", () => ({
+  resolveProxyGroupTargetName: (target: unknown) =>
+    typeof target === "string" ? target : "",
+}));
+vi.mock("@subboost/core/rules/custom-routing-rule-sets", () => ({
+  collectCustomRoutingRuleSets: () => mocks.ruleSets,
+  getRuleSetTargetValue: (target: { kind: string; id: string }) =>
+    `${target.kind}:${target.id}`,
+  normalizeRuleSetPathInput: (path: string) => path.trim(),
+  parseRuleSetTargetValue: (value: string) => {
+    const [kind, id] = value.split(":");
+    return (kind === "module" || kind === "custom") && id
+      ? { kind, id }
+      : null;
+  },
+}));
+vi.mock("@subboost/ui/store/config-store", () => ({
+  useConfigStore: () => mocks.store,
+}));
+
+import { ProxyGroupsAddedRuleSets } from "./proxy-groups-added-rule-sets";
+
+const moduleItem = {
+  key: "custom-rule-set:rule-a",
+  id: "rule-a",
+  name: "Rule A",
+  behavior: "domain",
+  path: "geosite/rule-a.mrs",
+  noResolve: true,
+  source: { kind: "custom-rule-set", id: "rule-a" },
+  target: {
+    kind: "module",
+    id: "auto",
+    value: "module:auto",
+    name: "Auto",
+  },
+};
+
+const customItem = {
+  key: "custom-rule-set:rule-b",
+  id: "rule-b",
+  name: "Rule B",
+  behavior: "ipcidr",
+  path: "geoip/rule-b.mrs",
+  source: { kind: "custom-rule-set", id: "rule-b" },
+  target: {
+    kind: "custom",
+    id: "custom-1",
+    value: "custom:custom-1",
+    name: "Custom",
+  },
+};
+
+function renderEditing(item: typeof moduleItem | typeof customItem, draft: unknown) {
+  stateMock.callIndex = 0;
+  stateMock.overrides = { 0: item.key, 1: draft };
+  mocks.buttons = [];
+  mocks.ruleSets = [item];
+  renderToStaticMarkup(
+    React.createElement(ProxyGroupsAddedRuleSets, {
+      showSearchHint: false,
+      totalRules: null,
+    }),
+  );
+}
+
+function clickSave() {
+  mocks.buttons
+    .find((props: any) => props.title === "保存规则集")
+    .onClick();
+}
+
+describe("ProxyGroupsAddedRuleSets invalid saves", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.store = {
+      enabledProxyGroups: ["auto"],
+      hiddenProxyGroups: [],
+      customRuleSets: [],
+      builtinRuleEdits: {},
+      customProxyGroups: [{ id: "custom-1", name: "Custom" }],
+      proxyGroupNameOverrides: { auto: "Auto" },
+      toggleProxyGroup: vi.fn(),
+      updateModuleRule: vi.fn(),
+      removeModuleRule: vi.fn(),
+      moveModuleRule: vi.fn(),
+    };
+  });
+
+  it("ignores invalid saves and reports missing targets as conflicts", () => {
+    renderEditing(moduleItem, {
+      path: "geosite/rule-a.mrs",
+      targetValue: "bad",
+      noResolve: false,
+    });
+    clickSave();
+    expect(mocks.store.updateModuleRule).not.toHaveBeenCalled();
+
+    renderEditing(moduleItem, {
+      path: "geosite/rule-a.mrs",
+      targetValue: "module:missing",
+      noResolve: false,
+    });
+    clickSave();
+    expect(mocks.toast).toHaveBeenCalledWith(
+      expect.objectContaining({ title: "规则集已存在", variant: "warning" }),
+    );
+
+    renderEditing(customItem, {
+      path: "geoip/rule-b.mrs",
+      targetValue: "custom:missing",
+      noResolve: false,
+    });
+    clickSave();
+    expect(mocks.toast).toHaveBeenCalledWith(
+      expect.objectContaining({ title: "规则集已存在", variant: "warning" }),
+    );
+
+    renderEditing(moduleItem, {
+      path: "   ",
+      targetValue: "module:auto",
+      noResolve: false,
+    });
+    clickSave();
+    expect(mocks.store.updateModuleRule).not.toHaveBeenCalledWith(
+      "auto",
+      "rule-a",
+      expect.objectContaining({ path: "" }),
+    );
+  });
+});
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.test.ts
index ce2de32..9d89941 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.test.ts
@@ -673,58 +673,4 @@ describe("ProxyGroupsAddedRuleSets", () => {
     expect(stateMock.setters[1]).toHaveBeenCalledWith(null);
   });
 
-  it("ignores invalid saves and reports missing targets as conflicts", () => {
-    renderAdded({
-      0: moduleItem.key,
-      1: { path: "geosite/rule-a.mrs", targetValue: "bad", noResolve: false },
-    });
-    mocks.captures.buttons
-      .find((props: any) => props.title === "保存规则集")
-      .onClick();
-    expect(mocks.store.updateModuleRule).not.toHaveBeenCalled();
-
-    renderAdded({
-      0: moduleItem.key,
-      1: {
-        path: "geosite/rule-a.mrs",
-        targetValue: "module:missing",
-        noResolve: false,
-      },
-    });
-    mocks.captures.buttons
-      .find((props: any) => props.title === "保存规则集")
-      .onClick();
-    expect(mocks.toast).toHaveBeenCalledWith(
-      expect.objectContaining({ title: "规则集已存在", variant: "warning" }),
-    );
-
-    renderAdded({
-      0: customItem.key,
-      1: {
-        path: "geoip/rule-b.mrs",
-        targetValue: "custom:missing",
-        noResolve: false,
-      },
-    });
-    mocks.captures.buttons
-      .find((props: any) => props.title === "保存规则集")
-      .onClick();
-    expect(mocks.toast).toHaveBeenCalledWith(
-      expect.objectContaining({ title: "规则集已存在", variant: "warning" }),
-    );
-
-    renderAdded({
-      0: moduleItem.key,
-      1: { path: "   ", targetValue: "module:auto", noResolve: false },
-    });
-    mocks.captures.buttons
-      .find((props: any) => props.title === "保存规则集")
-      .onClick();
-    expect(mocks.store.updateModuleRule).not.toHaveBeenCalledWith(
-      "auto",
-      "rule-a",
-      expect.objectContaining({ path: "" }),
-    );
-
-  });
 });
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.tsx
index 726f9a3..fcde116 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.tsx
@@ -3,6 +3,7 @@
 import * as React from "react";
 import { ArrowRight, Check, Pencil, Trash2, X } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import {
   Select,
   SelectContent,
@@ -324,6 +325,7 @@ export function ProxyGroupsAddedRuleSets({
                     </Select>
                     <div className="flex h-7 shrink-0 items-center gap-1 rounded-lg border border-white/10 bg-white/5 px-2">
                       <Switch
+                        aria-label={`设置 ${item.name} no-resolve`}
                         checked={draft.noResolve}
                         onCheckedChange={(noResolve) =>
                           setDraft((prev) =>
@@ -403,22 +405,24 @@ export function ProxyGroupsAddedRuleSets({
                 {item.target.name}
               </span>
               <div className="ml-auto flex shrink-0 items-center gap-0.5">
-                <button
+                <IconButton
+                  label="编辑规则集"
+                  variant="ghost"
                   type="button"
                   onClick={() => startEditing(item)}
                   className="inline-flex h-5 w-5 items-center justify-center rounded-md text-white/35 transition-colors hover:bg-white/10 hover:text-white/80"
-                  title="编辑规则集"
                 >
                   <Pencil className="h-3 w-3" />
-                </button>
-                <button
+                </IconButton>
+                <IconButton
+                  label="删除规则集"
+                  variant="ghost"
                   type="button"
                   onClick={() => removeRuleSet(item)}
                   className="inline-flex h-5 w-5 items-center justify-center rounded-md text-white/30 transition-colors hover:bg-red-500/10 hover:text-red-300"
-                  title="删除规则集"
                 >
                   <Trash2 className="h-3 w-3" />
-                </button>
+                </IconButton>
               </div>
             </div>
           );
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
index 35b862b..9abb12c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
@@ -268,7 +268,8 @@ describe("ProxyGroupsCategories", () => {
     expect(html).toContain("grid-cols-[minmax(0,1fr)_96px]");
     expect(html).not.toContain("md:grid-cols-[minmax(0,1fr)_96px]");
     expect(html).toContain("min-w-0 space-y-1");
-    expect(html).toContain("h-9 w-full");
+    expect(html).toContain("text-xs text-amber-300");
+    expect(html).toContain('aria-label="高级模式"');
     expect(mocks.store.setRuleProviderBaseUrl).not.toHaveBeenCalled();
 
     expect(mocks.captures.moduleCards).toHaveLength(1);
@@ -318,8 +319,10 @@ describe("ProxyGroupsCategories", () => {
     expect(mocks.store.removeModuleRule).toHaveBeenCalledWith("auto", "rule-a");
     card.onMoveRule("rule-a", "top");
     expect(mocks.store.moveModuleRule).toHaveBeenCalledWith("auto", "rule-a", "top");
-    card.onMoveManualRule("manual-1", "Fallback");
-    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", { target: "Fallback" });
+    card.onMoveManualRule("manual-1", { kind: "module", id: "fallback", name: "Fallback" });
+    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", {
+      target: { kind: "module", id: "fallback" },
+    });
     card.onRestoreRule("rule-a");
     expect(mocks.store.restoreModuleRule).toHaveBeenCalledWith("auto", "rule-a");
     card.onResetRuleTarget("rule-a");
@@ -441,6 +444,40 @@ describe("ProxyGroupsCategories", () => {
     expect(mocks.store.updateProxyGroupAdvanced).toHaveBeenCalledWith("auto", { sourceIds: ["source-a"] });
   });
 
+  it("builds proxy-group previews from effective nodes", () => {
+    mocks.store.nodes = [
+      {
+        name: "TAG-Notice",
+        _originName: "套餐到期提醒",
+        type: "ss",
+        server: "notice.example.com",
+        port: 8388,
+        cipher: "aes-128-gcm",
+        password: "secret",
+      },
+      {
+        name: "US",
+        type: "ss",
+        server: "us.example.com",
+        port: 8388,
+        cipher: "aes-128-gcm",
+        password: "secret",
+      },
+    ];
+    mocks.store.nodeNameFilter = {
+      enabled: true,
+      excludeRegexes: ["套餐到期"],
+    };
+
+    renderCategories({ 0: new Set(["core"]) });
+
+    expect(vi.mocked(generateProxyGroups)).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        nodes: [expect.objectContaining({ name: "US" })],
+      }),
+    );
+  });
+
   it("renders custom category and disabled non-core module branches", async () => {
     mocks.store.hiddenProxyGroups = [];
     mocks.store.enabledProxyGroups = [];
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
index e12d52d..3642d3c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
@@ -3,6 +3,7 @@
 import * as React from "react";
 import { ChevronDown, ChevronRight, RotateCcw } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
+import { Button } from "@subboost/ui/components/ui/button";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
 import { Switch } from "@subboost/ui/components/ui/switch";
 import {
@@ -25,6 +26,7 @@ import {
 import type { HiddenPresetRuleIds } from "@subboost/core/generator/module-rules";
 import { resolveProxyGroupModuleName } from "@subboost/core/proxy-group-name";
 import { resolveProxyGroupTargetName } from "@subboost/core/proxy-group-targets";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import { useConfigStore, type RuleSetDraft } from "@subboost/ui/store/config-store";
 import {
   buildManualRuleTargets,
@@ -43,6 +45,7 @@ export function ProxyGroupsCategories() {
   const {
     ruleProviderBaseUrl,
     nodes = [],
+    nodeNameFilter,
     testUrl,
     testInterval,
     cnIpNoResolve,
@@ -81,6 +84,10 @@ export function ProxyGroupsCategories() {
     Set<string>
   >(new Set(customProxyGroups.length > 0 ? [CUSTOM_CATEGORY_ID] : []));
   const didApplyCustomCategoryDefault = React.useRef(customProxyGroups.length > 0);
+  const effectiveNodes = React.useMemo(
+    () => resolveNodeNameFilter(nodes, nodeNameFilter).effectiveNodes,
+    [nodeNameFilter, nodes],
+  );
   const [editingModuleId, setEditingModuleId] = React.useState<string | null>(
     null,
   );
@@ -158,9 +165,9 @@ export function ProxyGroupsCategories() {
     return grouped;
   }, [hiddenProxyGroups]);
   const generatedProxyGroupNodeCounts = React.useMemo(() => {
-    if (nodes.length === 0) return new Map<string, number>();
+    if (effectiveNodes.length === 0) return new Map<string, number>();
     const generated = generateProxyGroups({
-      nodes,
+      nodes: effectiveNodes,
       enabledModules: enabledProxyGroups,
       ruleProviderBaseUrl,
       testUrl,
@@ -171,7 +178,7 @@ export function ProxyGroupsCategories() {
       builtinRuleEdits,
       proxyGroupNameOverrides,
     });
-    const nodeNameSet = new Set(nodes.map((node) => node.name));
+    const nodeNameSet = new Set(effectiveNodes.map((node) => node.name));
     return new Map(
       generated.map((group) => [
         group.name,
@@ -186,7 +193,7 @@ export function ProxyGroupsCategories() {
       ]),
     );
   }, [
-    nodes,
+    effectiveNodes,
     enabledProxyGroups,
     ruleProviderBaseUrl,
     testUrl,
@@ -301,7 +308,7 @@ export function ProxyGroupsCategories() {
       <div className="grid grid-cols-[minmax(0,1fr)_96px] gap-3">
         <div className="min-w-0 space-y-1">
           <div className={PROXY_GROUP_SECTION_LABEL_ROW_CLASS}>
-            <label className={PROXY_GROUP_SECTION_LABEL_CLASS}>规则集 URL</label>
+            <p className={PROXY_GROUP_SECTION_LABEL_CLASS}>规则集 URL</p>
           </div>
           <div
             className="min-w-0 rounded-md border border-white/10 bg-white/5 px-3 py-2 font-mono text-xs text-white/65"
@@ -312,31 +319,33 @@ export function ProxyGroupsCategories() {
         </div>
         <div className="min-w-0 space-y-1">
           <div className={PROXY_GROUP_SECTION_LABEL_ROW_CLASS}>
-            <label className="text-xs text-amber-300">高级模式</label>
+            <p className="text-xs text-amber-300">高级模式</p>
           </div>
           <div className="flex h-9 w-full items-center justify-center gap-1 rounded-md border border-white/10 bg-white/5 px-2">
             <span className="text-[10px] text-white/65">
               {proxyGroupAdvancedModeEnabled ? "已开启" : "未开启"}
             </span>
-            <Switch checked={proxyGroupAdvancedModeEnabled} onCheckedChange={setProxyGroupAdvancedModeEnabled} />
+            <Switch checked={proxyGroupAdvancedModeEnabled} onCheckedChange={setProxyGroupAdvancedModeEnabled} aria-label="高级模式" />
           </div>
         </div>
       </div>
 
       <div className="space-y-1">
         <div className={PROXY_GROUP_SECTION_LABEL_ROW_CLASS}>
-          <label className={PROXY_GROUP_SECTION_LABEL_CLASS}>分流规则组</label>
+          <p className={PROXY_GROUP_SECTION_LABEL_CLASS}>分流规则组</p>
           {hiddenModules.length > 0 && (
             <DropdownMenu>
               <DropdownMenuTrigger asChild>
-                <button
+                <Button
                   type="button"
-                  className="ml-auto inline-flex h-6 items-center gap-1 rounded-md border border-white/10 bg-white/5 px-2 text-[10px] text-white/60 transition-colors hover:bg-white/10 hover:text-white/85"
+                  variant="outline"
+                  size="sm"
+                  className="ml-auto h-6 gap-1 rounded-md px-2 text-[10px] text-white/60 hover:bg-white/10 hover:text-white/85"
                   title="恢复隐藏分组"
                 >
                   <RotateCcw className="h-3 w-3" />
                   已隐藏 {hiddenModules.length}
-                </button>
+                </Button>
               </DropdownMenuTrigger>
               <DropdownMenuContent align="end" className="w-56">
                 <DropdownMenuLabel className="text-xs">恢复隐藏分组</DropdownMenuLabel>
@@ -582,8 +591,8 @@ export function ProxyGroupsCategories() {
                               onMoveRule={(ruleId, target) =>
                                 moveModuleRule(module.id, ruleId, target)
                               }
-                              onMoveManualRule={(ruleId, targetName) =>
-                                updateCustomRule(ruleId, { target: targetName })
+                              onMoveManualRule={(ruleId, target) =>
+                                updateCustomRule(ruleId, { target: { kind: target.kind, id: target.id } })
                               }
                               onRemoveManualRule={removeCustomRule}
                               onRestoreRule={(ruleId) =>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel-card-props.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel-card-props.test.ts
index 62bae9f..57b7cf9 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel-card-props.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel-card-props.test.ts
@@ -170,7 +170,7 @@ describe("ProxyGroupsCustomGroupsPanel card props", () => {
     card.onAddRuleToCustomGroup();
     card.onRemoveExtraRule();
     card.onMoveRule();
-    card.onMoveManualRule("manual-1", "Auto");
+    card.onMoveManualRule("manual-1", { kind: "module", id: "auto", name: "Auto" });
     card.onRemoveManualRule(0);
     card.onRestoreRule();
     card.onResetRuleTarget();
@@ -185,7 +185,9 @@ describe("ProxyGroupsCustomGroupsPanel card props", () => {
 
     expect(mocks.store.updateCustomProxyGroup).toHaveBeenCalledWith("custom-1", { enabled: true });
     expect(mocks.store.removeCustomProxyGroup).toHaveBeenCalledWith("custom-1");
-    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", { target: "Auto" });
+    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", {
+      target: { kind: "module", id: "auto" },
+    });
     expect(mocks.store.removeCustomRule).toHaveBeenCalledWith(0);
     expect(mocks.store.updateCustomProxyGroup).toHaveBeenCalledWith("custom-1", {
       groupType: "load-balance",
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.test.ts
index abbc63c..03f1d51 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.test.ts
@@ -66,8 +66,12 @@ vi.mock("@subboost/ui/components/ui/input", () => ({
 vi.mock("@subboost/ui/components/ui/toaster", () => ({ toast: mocks.toast }));
 vi.mock("@subboost/core/generator/proxy-groups", () => ({
   PROXY_GROUP_MODULES: [
-    { id: "auto", name: "Auto" },
-    { id: "fallback", name: "Fallback" },
+    {
+      id: "auto",
+      name: "Auto",
+      rules: [{ id: "builtin-a", name: "Builtin A", behavior: "domain", path: "geosite/builtin-a.mrs" }],
+    },
+    { id: "fallback", name: "Fallback", rules: [] },
   ],
 }));
 vi.mock("@subboost/core/proxy-group-name", () => ({
@@ -176,6 +180,7 @@ describe("ProxyGroupsCustomGroupsPanel", () => {
       customRules: [{ id: "manual-1", target: "🧩 Custom" }],
       customProxyGroups: [customGroup, targetGroup],
       customRuleSets: [sourceRule],
+      builtinRuleEdits: {},
       dialerProxyGroups: [{ name: "Dialer" }],
       addCustomProxyGroup: vi.fn(),
       removeCustomProxyGroup: vi.fn(),
@@ -290,11 +295,40 @@ describe("ProxyGroupsCustomGroupsPanel", () => {
 
   });
 
+  it("shows builtin rules moved into a custom group and wires their actions", () => {
+    mocks.store.builtinRuleEdits = {
+      "module:auto:builtin-a": { target: { kind: "custom", id: "custom-1" } },
+    };
+
+    renderPanel({ 0: new Set(["custom-1"]) });
+
+    expect(mocks.captures.ruleRows).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ name: "Builtin A", source: "preset", state: "moved" }),
+      ]),
+    );
+    const builtinMove = mocks.captures.moveMenus.find((menu: any) => menu.ariaLabel === "移动 Builtin A 规则集");
+    builtinMove.onMove({ kind: "module", id: "fallback", name: "Fallback" });
+    expect(mocks.store.moveModuleRule).toHaveBeenCalledWith("auto", "builtin-a", {
+      kind: "module",
+      id: "fallback",
+      name: "Fallback",
+    });
+
+    mocks.captures.buttons.find((button: any) => button["aria-label"] === "删除 Builtin A 规则集").onClick();
+    expect(mocks.store.removeModuleRule).toHaveBeenCalledWith("custom-1", "builtin-a");
+  });
+
   it("updates manual rules, deletes rule rows, and renders empty state", () => {
     renderPanel({ 0: new Set(["custom-1"]) });
 
-    mocks.captures.manualRows[0].onMove({ rule: { id: "manual-1" }, index: 0 }, { name: "Auto" });
-    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", { target: "Auto" });
+    mocks.captures.manualRows[0].onMove(
+      { rule: { id: "manual-1" }, index: 0 },
+      { kind: "module", id: "auto", name: "Auto" },
+    );
+    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", {
+      target: { kind: "module", id: "auto" },
+    });
     mocks.captures.manualRows[0].onRemove({ index: 0 });
     expect(mocks.store.removeCustomRule).toHaveBeenCalledWith(0);
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx
index 872909a..9d159f7 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx
@@ -14,7 +14,7 @@ import { useProductInteractionAdapter } from "@subboost/ui/product/interactions"
 import {
   buildManualRuleTargets,
   listCustomRulesForTarget,
-  type ProxyGroupRuleTarget,
+  type ProxyGroupRuleTargetOption,
 } from "./proxy-group-rule-targets";
 import {
   ProxyGroupManualRuleRow,
@@ -48,6 +48,7 @@ export function ProxyGroupsCustomGroupsPanel({
     proxyGroupNameOverrides = {},
     customRules = [],
     customRuleSets = [],
+    builtinRuleEdits = {},
     customProxyGroups = [],
     addCustomProxyGroup,
     removeCustomProxyGroup,
@@ -124,8 +125,8 @@ export function ProxyGroupsCustomGroupsPanel({
   }, [customProxyGroups, hiddenProxyGroups, proxyGroupNameOverrides]);
 
   const moveManualRule = React.useCallback(
-    (item: { rule: { id: string }; index: number }, target: ProxyGroupRuleTarget) => {
-      updateCustomRule(item.rule.id, { target: target.name });
+    (item: { rule: { id: string }; index: number }, target: ProxyGroupRuleTargetOption) => {
+      updateCustomRule(item.rule.id, { target: { kind: target.kind, id: target.id } });
     },
     [updateCustomRule],
   );
@@ -248,7 +249,20 @@ export function ProxyGroupsCustomGroupsPanel({
                   customProxyGroups,
                 }) === group.name,
             );
-            const totalRules = groupRuleSets.length + manualRules.length;
+            const movedBuiltinRules = Object.entries(builtinRuleEdits).flatMap(([key, edit]) => {
+              if (edit?.enabled === false || !edit?.target) return [];
+              const match = key.match(/^module:([^:]+):(.+)$/);
+              if (!match) return [];
+              const sourceModule = PROXY_GROUP_MODULES.find((module) => module.id === match[1]);
+              const rule = sourceModule?.rules.find((item) => item.id === match[2]);
+              if (!sourceModule || !rule) return [];
+              const targetName = resolveProxyGroupTargetName(edit.target, {
+                moduleNames,
+                customProxyGroups,
+              });
+              return targetName === group.name ? [{ sourceModule, rule }] : [];
+            });
+            const totalRules = groupRuleSets.length + movedBuiltinRules.length + manualRules.length;
             const description = group.description?.trim() || "自定义代理组";
             const nodeCount = nodeCounts?.get(group.name) ?? 0;
 
@@ -326,6 +340,44 @@ export function ProxyGroupsCustomGroupsPanel({
                       }
                     />
                   ))}
+                  {movedBuiltinRules.map(({ sourceModule, rule }) => (
+                    <ProxyGroupRuleSetRow
+                      key={`builtin:${sourceModule.id}:${rule.id}`}
+                      name={rule.name}
+                      path={rule.path}
+                      source="preset"
+                      behavior={rule.behavior}
+                      noResolve={rule.noResolve}
+                      state="moved"
+                      actions={
+                        <>
+                          <ProxyGroupRuleMoveMenu
+                            title="移动规则集"
+                            ariaLabel={`移动 ${rule.name} 规则集`}
+                            targets={ruleSetMoveTargets}
+                            kinds={["module", "custom"]}
+                            currentTarget={{ kind: "custom", id: group.id, name: group.name }}
+                            onMove={(target) => {
+                              if (isRuleSetMoveTarget(target)) {
+                                moveModuleRule(sourceModule.id, rule.id, target);
+                              }
+                            }}
+                          />
+                          <Button
+                            type="button"
+                            variant="ghost"
+                            size="sm"
+                            className="h-7 px-2 text-white/35 hover:text-red-300"
+                            onClick={() => removeModuleRule(group.id, rule.id)}
+                            title="删除规则集"
+                            aria-label={`删除 ${rule.name} 规则集`}
+                          >
+                            <Trash2 className="h-3.5 w-3.5" />
+                          </Button>
+                        </>
+                      }
+                    />
+                  ))}
                   {manualRules.map((item) => (
                     <ProxyGroupManualRuleRow
                       key={`manual:${item.rule.id}`}
@@ -391,7 +443,9 @@ export function ProxyGroupsCustomGroupsPanel({
                 onAddRuleToCustomGroup={() => undefined}
                 onRemoveExtraRule={() => undefined}
                 onMoveRule={() => undefined}
-                onMoveManualRule={(ruleId, targetName) => updateCustomRule(ruleId, { target: targetName })}
+                onMoveManualRule={(ruleId, target) =>
+                  updateCustomRule(ruleId, { target: { kind: target.kind, id: target.id } })
+                }
                 onRemoveManualRule={removeCustomRule}
                 onRestoreRule={() => undefined}
                 onResetRuleTarget={() => undefined}
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-routing-rules.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-routing-rules.tsx
index 587d4c5..50a45e4 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-routing-rules.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-routing-rules.tsx
@@ -8,7 +8,7 @@ export function ProxyGroupsCustomRoutingRules() {
   return (
     <div className="space-y-1">
       <div className="flex min-h-7 items-center gap-2">
-        <label className="text-xs text-white/50">自定义分流规则</label>
+        <p className="text-xs text-white/50">自定义分流规则</p>
       </div>
       <div className="overflow-hidden rounded-lg border border-white/10 bg-white/[0.03]">
         <div className="p-2">
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.test.ts
index e73a09b..4b082ac 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.test.ts
@@ -276,9 +276,15 @@ describe("ProxyGroupsCustomRules", () => {
           "Legacy Target",
         ],
         existingRules: [],
-        onImport: mocks.store.addCustomRules,
+        onImport: expect.any(Function),
       }),
     );
+    mocks.captures.batchDialogs[0].onImport([
+      { id: "batch-1", type: "DOMAIN", value: "batch.example", target: "Custom Group" },
+    ]);
+    expect(mocks.store.addCustomRules).toHaveBeenCalledWith([
+      expect.objectContaining({ target: { kind: "custom", id: "custom-1" } }),
+    ]);
 
     mocks.captures.buttons
       .find((props) => props.children === "批量导入")
@@ -348,7 +354,7 @@ describe("ProxyGroupsCustomRules", () => {
       id: "rule-1",
       type: "DOMAIN" as const,
       value: " edited.com ",
-      target: "Custom Group",
+      target: { kind: "custom", id: "custom-1" },
       noResolve: true,
     };
     const { html, setters } = renderRules({
@@ -412,7 +418,7 @@ describe("ProxyGroupsCustomRules", () => {
     expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("rule-1", {
       type: "DOMAIN",
       value: "edited.com",
-      target: "Custom Group",
+      target: { kind: "custom", id: "custom-1" },
       noResolve: true,
     });
     expect(setters[5]).toHaveBeenCalledWith(null);
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx
index 5525b2c..32781c3 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx
@@ -3,6 +3,7 @@
 import * as React from "react";
 import { ArrowRight, Check, Pencil, Trash2, X } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
 import {
   Select,
@@ -20,7 +21,7 @@ import {
   CUSTOM_RULE_TYPES,
 } from "@subboost/core/rules/custom-rule-utils";
 import { useConfigStore } from "@subboost/ui/store/config-store";
-import type { CustomRule } from "@subboost/core/types/config";
+import type { CustomProxyGroup, CustomRule, ProxyGroupRuleTarget } from "@subboost/core/types/config";
 import {
   useProductInteractionAdapter,
   type ProductRuleKind,
@@ -88,6 +89,20 @@ function getTargetOptions(enabledGroupNames: string[], selected?: string) {
   return Array.from(new Set(options));
 }
 
+function toStableRuleTarget(
+  targetName: string,
+  moduleNames: Record<string, string>,
+  customProxyGroups: CustomProxyGroup[],
+): ProxyGroupRuleTarget {
+  const normalized = targetName.trim();
+  for (const [id, name] of Object.entries(moduleNames)) {
+    if (name.trim() === normalized) return { kind: "module", id };
+  }
+  const customGroup = customProxyGroups.find((group) => group.name.trim() === normalized);
+  if (customGroup) return { kind: "custom", id: customGroup.id };
+  return normalized;
+}
+
 export function ProxyGroupsCustomRules() {
   const {
     customRules,
@@ -174,7 +189,7 @@ export function ProxyGroupsCustomRules() {
       id: createCustomRuleId(),
       type: addedRuleType,
       value,
-      target: newRuleTarget,
+      target: toStableRuleTarget(newRuleTarget, moduleNames, customProxyGroups),
       noResolve: newRuleNoResolve,
     });
     interactions.ruleAdded?.({
@@ -213,7 +228,7 @@ export function ProxyGroupsCustomRules() {
     updateCustomRule(editingRuleId, {
       type: editingRuleDraft.type,
       value,
-      target: editingRuleDraft.target,
+      target: toStableRuleTarget(resolveTargetName(editingRuleDraft.target), moduleNames, customProxyGroups),
       noResolve: Boolean(editingRuleDraft.noResolve),
     });
     cancelEditingRule();
@@ -245,7 +260,14 @@ export function ProxyGroupsCustomRules() {
         defaultNoResolve={newRuleNoResolve}
         targetOptions={batchTargetOptions}
         existingRules={customRules}
-        onImport={addCustomRules}
+        onImport={(rules) =>
+          addCustomRules(
+            rules.map((rule) => ({
+              ...rule,
+              target: toStableRuleTarget(resolveTargetName(rule.target), moduleNames, customProxyGroups),
+            })),
+          )
+        }
       />
 
       <div className={RULE_ADD_ROW_FRAME_CLASS}>
@@ -294,6 +316,7 @@ export function ProxyGroupsCustomRules() {
             </Select>
             <div className="flex h-7 shrink-0 items-center gap-1 rounded-lg border border-white/10 bg-white/5 px-2">
               <Switch
+                aria-label="新规则不解析域名"
                 checked={newRuleNoResolve}
                 onCheckedChange={setNewRuleNoResolve}
               />
@@ -408,6 +431,7 @@ export function ProxyGroupsCustomRules() {
                       </Select>
                       <div className="flex h-7 shrink-0 items-center gap-1 rounded-lg border border-white/10 bg-white/5 px-2">
                         <Switch
+                          aria-label="编辑规则时不解析域名"
                           checked={Boolean(editingRuleDraft.noResolve)}
                           onCheckedChange={(noResolve) =>
                             setEditingRuleDraft((prev) =>
@@ -492,22 +516,24 @@ export function ProxyGroupsCustomRules() {
                   {ruleTargetName}
                 </span>
                 <div className="ml-auto flex shrink-0 items-center gap-0.5">
-                  <button
+                  <IconButton
+                    label="编辑规则"
+                    variant="ghost"
                     type="button"
                     onClick={() => startEditingRule(rule)}
                     className="inline-flex h-5 w-5 items-center justify-center rounded-md text-white/35 transition-colors hover:bg-white/10 hover:text-white/80"
-                    title="编辑规则"
                   >
                     <Pencil className="h-3 w-3" />
-                  </button>
-                  <button
+                  </IconButton>
+                  <IconButton
+                    label="删除规则"
+                    variant="ghost"
                     type="button"
                     onClick={() => removeCustomRule(index)}
                     className="inline-flex h-5 w-5 items-center justify-center rounded-md text-white/30 transition-colors hover:bg-red-500/10 hover:text-red-300"
-                    title="删除规则"
                   >
                     <Trash2 className="h-3 w-3" />
-                  </button>
+                  </IconButton>
                 </div>
               </div>
             );
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts
index 0f4e0ac..6a1067c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts
@@ -14,8 +14,10 @@ const mocks = vi.hoisted(() => ({
 }));
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => React.createElement("span", null, props.children),
   Arrow: () => null,
   Content: ({ align, children, className, side }: any) => React.createElement("div", { align, className, side }, children),
+  Close: (props: any) => React.createElement("button", null, props.children),
   Portal: (props: any) => React.createElement("div", null, props.children),
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("div", null, props.children),
@@ -154,6 +156,8 @@ describe("ProxyGroupsModuleCard", () => {
     expect(html).toContain("Gemini 分流说明");
     expect(html).toContain("rules-panel");
     expect(mocks.panels[0]).toEqual(expect.objectContaining({ module: baseModule, cnIpNoResolve: true }));
+    expect(html).toContain('aria-label="收起 Gemini Display"');
+    expect(html).toContain('aria-expanded="true"');
 
     capturesClick(html);
     mocks.buttons.find((button) => button.title === "改名").onClick({ stopPropagation: vi.fn() });
@@ -264,6 +268,17 @@ describe("ProxyGroupsModuleCard", () => {
     expect(mocks.panels).toHaveLength(0);
   });
 
+  it("keeps the full module header as the disclosure control", () => {
+    const collapsedHandlers = props({ isRulesExpanded: false });
+    const collapsedHtml = renderToStaticMarkup(
+      React.createElement(ProxyGroupsModuleCard, collapsedHandlers),
+    );
+
+    expect(collapsedHtml).toContain('class="absolute inset-0');
+    expect(collapsedHtml).toContain('aria-label="展开 Gemini Display"');
+    expect(collapsedHtml).toContain('aria-expanded="false"');
+  });
+
   it("renders module summary with the requested description and rule colors", () => {
     const html = renderToStaticMarkup(
       React.createElement(
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
index cc08d63..fd493b2 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
@@ -1,10 +1,16 @@
 "use client";
 
 import * as React from "react";
-import * as Popover from "@radix-ui/react-popover";
 import { Check, ChevronDown, ChevronRight, HelpCircle, Pencil, SlidersHorizontal, Trash2, X } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
+import {
+  Popover,
+  PopoverArrow,
+  PopoverContent,
+  PopoverTrigger,
+} from "@subboost/ui/components/ui/popover";
 import { Switch } from "@subboost/ui/components/ui/switch";
 import {
   getEffectiveModuleRuleItems,
@@ -17,7 +23,7 @@ import type { CustomProxyGroup, RuleSetDraft } from "@subboost/ui/store/config-s
 import { cn } from "@subboost/ui/lib/utils";
 import type {
   CustomRuleListItem,
-  ProxyGroupRuleTarget,
+  ProxyGroupRuleTargetOption,
 } from "./proxy-group-rule-targets";
 import { ProxyGroupsModuleRulesPanel } from "./proxy-groups-module-rules-panel";
 import {
@@ -38,20 +44,18 @@ function ModuleHintPopover({ moduleId }: { moduleId: string }) {
   const label = isGemini ? "Gemini 分流说明" : "谷歌学术分流说明";
 
   return (
-    <Popover.Root>
-      <Popover.Trigger asChild>
-        <button
-          type="button"
-          className="inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-          aria-label={label}
-          title={label}
+    <Popover>
+      <PopoverTrigger asChild>
+        <IconButton
+          label={label}
+          variant="ghost"
+          className="pointer-events-auto inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
           onClick={(e) => e.stopPropagation()}
         >
           <HelpCircle className="h-3.5 w-3.5" />
-        </button>
-      </Popover.Trigger>
-      <Popover.Portal>
-        <Popover.Content
+        </IconButton>
+      </PopoverTrigger>
+        <PopoverContent
           side="bottom"
           align="start"
           sideOffset={8}
@@ -86,10 +90,9 @@ function ModuleHintPopover({ moduleId }: { moduleId: string }) {
               </ul>
             </div>
           )}
-          <Popover.Arrow className="fill-white/10" />
-        </Popover.Content>
-      </Popover.Portal>
-    </Popover.Root>
+          <PopoverArrow className="fill-white/10" />
+        </PopoverContent>
+    </Popover>
   );
 }
 
@@ -163,7 +166,7 @@ export function ProxyGroupsModuleCard({
   hiddenPresetRuleIds: HiddenPresetRuleIds;
   customProxyGroups: CustomProxyGroup[];
   manualRules: CustomRuleListItem[];
-  manualRuleTargets: ProxyGroupRuleTarget[];
+  manualRuleTargets: ProxyGroupRuleTargetOption[];
   enabledProxyGroups: string[];
   hiddenProxyGroups: string[];
   proxyGroupNameOverrides: Record<string, string>;
@@ -176,7 +179,7 @@ export function ProxyGroupsModuleCard({
   onAddRuleToCustomGroup: (groupId: string, rule: RuleSetDraft) => void;
   onRemoveExtraRule: (ruleId: string) => void;
   onMoveRule: (ruleId: string, target: { kind: "module" | "custom"; id: string }) => void;
-  onMoveManualRule: (ruleId: string, targetName: string) => void;
+  onMoveManualRule: (ruleId: string, target: ProxyGroupRuleTargetOption) => void;
   onRemoveManualRule: (index: number) => void;
   onRestoreRule: (ruleId: string) => void;
   onResetRuleTarget: (ruleId: string) => void;
@@ -249,28 +252,39 @@ export function ProxyGroupsModuleCard({
     <div className="overflow-hidden rounded border border-white/10 bg-white/5">
       <div
         className={cn(
-          "grid grid-cols-[auto_minmax(0,1fr)_auto] items-center gap-x-2 gap-y-1 px-2 py-2",
-          hasExpandedContent && "cursor-pointer transition-colors hover:bg-white/5"
+          "relative grid grid-cols-[auto_minmax(0,1fr)_auto] items-center gap-x-2 gap-y-1 px-2 py-2",
+          hasExpandedContent && !isEditing && "cursor-pointer"
         )}
-        onClick={() => {
-          if (hasExpandedContent) onToggleRulesExpanded();
-        }}
-        title={hasExpandedContent ? (isRulesExpanded ? "收起" : "展开") : undefined}
       >
+        {hasExpandedContent && !isEditing && (
+          <button
+            type="button"
+            className="absolute inset-0 z-0 cursor-pointer rounded-none transition-colors hover:bg-white/5 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-indigo-500/60"
+            aria-label={isRulesExpanded ? `收起 ${display.full}` : `展开 ${display.full}`}
+            aria-expanded={isRulesExpanded}
+            onClick={onToggleRulesExpanded}
+            title={isRulesExpanded ? "收起" : "展开"}
+          />
+        )}
         {!isEditing && (hasExpandedContent ? (
           isRulesExpanded ? (
-            <ChevronDown className="h-4 w-4 shrink-0 text-white/50" />
+            <ChevronDown className="pointer-events-none relative z-10 h-4 w-4 shrink-0 text-white/50" aria-hidden="true" />
           ) : (
-            <ChevronRight className="h-4 w-4 shrink-0 text-white/50" />
+            <ChevronRight className="pointer-events-none relative z-10 h-4 w-4 shrink-0 text-white/50" aria-hidden="true" />
           )
         ) : (
           <span className="h-4 w-4 shrink-0" />
         ))}
-        <div className={cn("min-w-0", isEditing && "col-span-3")}>
+        <div
+          className={cn(
+            "min-w-0",
+            isEditing && "col-span-3",
+            hasExpandedContent && !isEditing && "pointer-events-none relative z-10",
+          )}
+        >
           {isEditing ? (
             <div
               className="grid w-full min-w-0 grid-cols-[minmax(0,1fr)_auto_auto] items-center gap-1"
-              onClick={(e) => e.stopPropagation()}
             >
               <div
                 className={cn(
@@ -336,7 +350,7 @@ export function ProxyGroupsModuleCard({
                     <Button
                       variant="ghost"
                       size="sm"
-                      className="h-7 px-2"
+                      className="pointer-events-auto h-7 px-2"
                       onClick={(e) => {
                         e.stopPropagation();
                         onStartEditing();
@@ -359,10 +373,12 @@ export function ProxyGroupsModuleCard({
         </div>
 
         {!isEditing && (
-          <div className="flex shrink-0 items-center justify-end gap-2" onClick={(e) => e.stopPropagation()}>
+          <div className="pointer-events-none relative z-10 flex shrink-0 items-center justify-end gap-2">
             <Switch
+              aria-label={`启用 ${display.full} 分流组`}
               checked={isEnabled}
               onCheckedChange={onToggleEnabled}
+              className="pointer-events-auto"
               onClick={(e) => e.stopPropagation()}
             />
             {onChangeGroupType && (
@@ -376,7 +392,7 @@ export function ProxyGroupsModuleCard({
                     type="button"
                     variant="ghost"
                     size="sm"
-                    className="h-7 shrink-0 px-2 text-white/35 hover:text-indigo-200"
+                    className="pointer-events-auto h-7 shrink-0 px-2 text-white/35 hover:text-indigo-200"
                     title={`类型：${typeLabel}`}
                     aria-label={`修改 ${display.full} 类型`}
                   >
@@ -388,7 +404,7 @@ export function ProxyGroupsModuleCard({
             <Button
               variant="ghost"
               size="sm"
-              className="h-7 shrink-0 px-2 text-white/30 hover:text-red-400"
+              className="pointer-events-auto h-7 shrink-0 px-2 text-white/30 hover:text-red-400"
               onClick={(e) => {
                 e.stopPropagation();
                 onHide();
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts
index d7d8c63..979ac3a 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts
@@ -3,14 +3,17 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it, vi } from "vitest";
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => React.createElement("span", null, props.children),
   Arrow: () => React.createElement("span", null, "arrow"),
-  Content: (props: any) => React.createElement("div", props, props.children),
+  Content: ({ children, sideOffset: _sideOffset, ...props }: any) => React.createElement("div", props, children),
+  Close: (props: any) => React.createElement("button", null, props.children),
   Portal: (props: any) => React.createElement("div", null, props.children),
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("div", null, props.children),
 }));
 vi.mock("lucide-react", () => ({
   AlertCircle: () => React.createElement("span", null, "alert-icon"),
+  CircleHelp: () => React.createElement("span", null, "circle-help-icon"),
   HelpCircle: () => React.createElement("span", null, "help-icon"),
 }));
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.tsx
index bbca127..82e63c5 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.tsx
@@ -1,28 +1,16 @@
 "use client";
 
-import * as Popover from "@radix-ui/react-popover";
 import { AlertCircle, HelpCircle } from "lucide-react";
+import { HelpPopover } from "@subboost/ui/components/ui/popover";
 
 export function ExperimentalCnRuleHelpButton() {
   return (
-    <Popover.Root>
-      <Popover.Trigger asChild>
-        <button
-          type="button"
-          className="inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-          aria-label="国内服务实验性选项说明"
-          title="国内服务实验性选项说明"
-        >
-          <HelpCircle className="h-3.5 w-3.5" />
-        </button>
-      </Popover.Trigger>
-      <Popover.Portal>
-        <Popover.Content
-          side="bottom"
-          align="end"
-          sideOffset={8}
-          className="z-50 w-[420px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-        >
+    <HelpPopover
+      label="国内服务实验性选项说明"
+      side="bottom"
+      align="end"
+      contentClassName="w-[420px] bg-black/90 p-3"
+    >
           <div className="space-y-2 text-xs">
             <div className="flex items-center gap-2">
               <HelpCircle className="h-4 w-4 text-amber-300" />
@@ -37,33 +25,19 @@ export function ExperimentalCnRuleHelpButton() {
               预期结果：不会发生DNS泄露的同时正确分流绝大多数国内站点；但也可能导致意料之外的分流错误。
             </div>
           </div>
-          <Popover.Arrow className="fill-white/10" />
-        </Popover.Content>
-      </Popover.Portal>
-    </Popover.Root>
+    </HelpPopover>
   );
 }
 
 export function CnIpNoResolveHelpButton() {
   return (
-    <Popover.Root>
-      <Popover.Trigger asChild>
-        <button
-          type="button"
-          className="inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-          aria-label="国内服务 no-resolve 说明"
-          title="国内服务 no-resolve 说明"
-        >
-          <AlertCircle className="h-3.5 w-3.5" />
-        </button>
-      </Popover.Trigger>
-      <Popover.Portal>
-        <Popover.Content
-          side="bottom"
-          align="end"
-          sideOffset={8}
-          className="z-50 w-[360px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-        >
+    <HelpPopover
+      label="国内服务 no-resolve 说明"
+      side="bottom"
+      align="end"
+      contentClassName="w-[360px] bg-black/90 p-3"
+      className="text-amber-300/70"
+    >
           <div className="space-y-2 text-xs">
             <div className="flex items-center gap-2">
               <AlertCircle className="h-4 w-4 text-amber-300" />
@@ -80,9 +54,6 @@ export function CnIpNoResolveHelpButton() {
               该开关仅影响“国内服务”的 GeoIP（cn-ip）规则，不影响其它代理组。
             </div>
           </div>
-          <Popover.Arrow className="fill-white/10" />
-        </Popover.Content>
-      </Popover.Portal>
-    </Popover.Root>
+    </HelpPopover>
   );
 }
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
index f62bdff..dcd6914 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
@@ -48,13 +48,16 @@ vi.mock("react", async (importOriginal) => {
 });
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => React.createElement(React.Fragment, null, props.children),
+  Close: (props: any) => React.createElement(React.Fragment, null, props.children),
   Root: (props: any) => React.createElement(React.Fragment, null, props.children),
   Trigger: (props: any) => React.createElement(React.Fragment, null, props.children),
   Portal: (props: any) => React.createElement(React.Fragment, null, props.children),
-  Content: (props: any) => React.createElement("div", props, props.children),
+  Content: ({ children, sideOffset: _sideOffset, ...props }: any) => React.createElement("div", props, children),
   Arrow: () => null,
 }));
 vi.mock("lucide-react", () => ({
+  CircleHelp: () => null,
   HelpCircle: () => null,
   Plus: () => null,
   RotateCcw: () => null,
@@ -229,8 +232,9 @@ describe("ProxyGroupsModuleRulesPanel", () => {
     mocks.captures.buttons.find((button) => button["aria-label"] === "恢复默认目标 Removed 规则集").onClick();
     expect(props.onResetRuleTarget).toHaveBeenCalledWith("removed-rule");
 
-    mocks.captures.manualRows[0].onMove(mocks.captures.manualRows[0].item, { name: "自动选择" });
-    expect(props.onMoveManualRule).toHaveBeenCalledWith("manual-1", "自动选择");
+    const manualTarget = { kind: "module", id: "auto", name: "自动选择" };
+    mocks.captures.manualRows[0].onMove(mocks.captures.manualRows[0].item, manualTarget);
+    expect(props.onMoveManualRule).toHaveBeenCalledWith("manual-1", manualTarget);
     mocks.captures.manualRows[0].onRemove({ index: 0 });
     expect(props.onRemoveManualRule).toHaveBeenCalledWith(0);
   });
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
index 41e1af8..5484e98 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
@@ -1,11 +1,11 @@
 "use client";
 
 import * as React from "react";
-import * as Popover from "@radix-ui/react-popover";
 import { HelpCircle, Plus, RotateCcw, Trash2 } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
 import { Button } from "@subboost/ui/components/ui/button";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
+import { HelpPopover } from "@subboost/ui/components/ui/popover";
 import { Switch } from "@subboost/ui/components/ui/switch";
 import { PROXY_GROUP_MODULES, type ProxyGroupModule, type ProxyGroupRule } from "@subboost/core/generator/proxy-groups";
 import {
@@ -22,7 +22,7 @@ import { useProductApiAdapter } from "@subboost/ui/product/api-adapter";
 import type { CustomProxyGroup, RuleSetDraft } from "@subboost/ui/store/config-store";
 import type {
   CustomRuleListItem,
-  ProxyGroupRuleTarget,
+  ProxyGroupRuleTargetOption,
 } from "./proxy-group-rule-targets";
 import {
   ProxyGroupManualRuleRow,
@@ -46,7 +46,9 @@ type CnCandidateRule = {
   parentModuleId?: string;
 };
 
-function isModuleRuleMoveTarget(target: ProxyGroupRuleTarget): target is ProxyGroupRuleTarget & MoveTarget {
+function isModuleRuleMoveTarget(
+  target: ProxyGroupRuleTargetOption,
+): target is ProxyGroupRuleTargetOption & MoveTarget {
   return target.kind === "module" || target.kind === "custom";
 }
 
@@ -110,7 +112,7 @@ export function ProxyGroupsModuleRulesPanel({
   hiddenPresetRuleIds: HiddenPresetRuleIds;
   customProxyGroups: CustomProxyGroup[];
   manualRules: CustomRuleListItem[];
-  manualRuleTargets: ProxyGroupRuleTarget[];
+  manualRuleTargets: ProxyGroupRuleTargetOption[];
   proxyGroupNameOverrides: Record<string, string>;
   moduleRuleEditWarningAccepted: boolean;
   acceptModuleRuleEditWarning: () => void;
@@ -119,7 +121,7 @@ export function ProxyGroupsModuleRulesPanel({
   onAddRuleToCustomGroup: (groupId: string, rule: RuleSetDraft) => void;
   onRemoveRule: (ruleId: string) => void;
   onMoveRule: (ruleId: string, target: MoveTarget) => void;
-  onMoveManualRule: (ruleId: string, targetName: string) => void;
+  onMoveManualRule: (ruleId: string, target: ProxyGroupRuleTargetOption) => void;
   onRemoveManualRule: (index: number) => void;
   onRestoreRule: (ruleId: string) => void;
   onResetRuleTarget: (ruleId: string) => void;
@@ -347,7 +349,11 @@ export function ProxyGroupsModuleRulesPanel({
                       <div className="flex h-7 shrink-0 items-center gap-1">
                         <CnIpNoResolveHelpButton />
                         <span className="proxy-group-rule-no-resolve-label text-[10px] text-white/50">no-resolve</span>
-                        <Switch checked={cnIpNoResolve} onCheckedChange={onChangeCnIpNoResolve} />
+                        <Switch
+                          checked={cnIpNoResolve}
+                          onCheckedChange={onChangeCnIpNoResolve}
+                          aria-label="国内 IP 规则不解析域名"
+                        />
                       </div>
                     )}
                     <ProxyGroupRuleMoveMenu
@@ -386,7 +392,7 @@ export function ProxyGroupsModuleRulesPanel({
               item={item}
               targets={manualRuleTargets}
               currentTargetName={moduleDisplayName}
-              onMove={(nextItem, target) => onMoveManualRule(nextItem.rule.id, target.name)}
+              onMove={(nextItem, target) => onMoveManualRule(nextItem.rule.id, target)}
               onRemove={({ index }) => onRemoveManualRule(index)}
             />
           ))}
@@ -490,40 +496,23 @@ export function ProxyGroupsModuleRulesPanel({
         <div className="rounded border border-white/10 bg-white/[0.03] px-2 py-2">
           <div className="mb-2 flex items-center gap-1.5">
             <div className="text-xs font-medium text-white">中国相关子规则集</div>
-            <Popover.Root>
-              <Popover.Trigger asChild>
-                <button
-                  type="button"
-                  className="inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-                  aria-label="实验性：中国业务子规则集"
-                  title="实验性：中国业务子规则集"
-                >
-                  <HelpCircle className="h-3.5 w-3.5" />
-                </button>
-              </Popover.Trigger>
-              <Popover.Portal>
-                <Popover.Content
-                  side="bottom"
-                  align="start"
-                  sideOffset={8}
-                  className="z-50 w-[420px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-                >
-                  <div className="space-y-2 text-xs">
-                    <div className="flex items-center gap-2">
-                      <HelpCircle className="h-4 w-4 text-amber-300" />
-                      <div className="text-white font-medium">
-                        实验性：中国业务子规则集
-                      </div>
-                    </div>
-                    <div className="text-white/60 leading-relaxed">
-                      这些是已启用规则集的中国子集，通常表示对应服务有中国业务；但不代表必然适合分流至
-                      <span className="text-white/75"> 🔒 国内服务</span>，请按自身需求启用。
-                    </div>
-                  </div>
-                  <Popover.Arrow className="fill-white/10" />
-                </Popover.Content>
-              </Popover.Portal>
-            </Popover.Root>
+            <HelpPopover
+              label="实验性：中国业务子规则集"
+              side="bottom"
+              align="start"
+              contentClassName="w-[420px] bg-black/90 p-3"
+            >
+              <div className="space-y-2 text-xs">
+                <div className="flex items-center gap-2">
+                  <HelpCircle className="h-4 w-4 text-amber-300" aria-hidden="true" />
+                  <p className="font-medium text-white">实验性：中国业务子规则集</p>
+                </div>
+                <p className="leading-relaxed text-white/60">
+                  这些是已启用规则集的中国子集，通常表示对应服务有中国业务；但不代表必然适合分流至
+                  <span className="text-white/75"> 🔒 国内服务</span>，请按自身需求启用。
+                </p>
+              </div>
+            </HelpPopover>
           </div>
           <div className="space-y-1">
             {availableCnCandidateRules.map((rule) => (
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts
index 7ed964c..394cde0 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts
@@ -319,7 +319,7 @@ describe("ProxyGroupsRulesLibrary", () => {
         id: "telegram",
         name: "Telegram",
         behavior: "ipcidr",
-        path: "geoip/telegram.mrs",
+        path: "https://raw.example/geoip/telegram.mrs",
         noResolve: true,
       },
     ]);
@@ -340,7 +340,7 @@ describe("ProxyGroupsRulesLibrary", () => {
         id: "telegram",
         name: "Telegram",
         behavior: "ipcidr",
-        path: "geoip/telegram.mrs",
+        path: "https://raw.example/geoip/telegram.mrs",
         noResolve: true,
       },
     ]);
@@ -417,13 +417,13 @@ describe("ProxyGroupsRulesLibrary", () => {
     expect(stateMock.setters[1]).not.toHaveBeenCalledWith("");
 
     renderLibrary();
-    const firstRuleDiv = mocks.captures.nativeDivs.find((props) => String(props.className).includes("cursor-pointer"));
-    firstRuleDiv.onClick();
+    const firstRuleButton = mocks.captures.nativeButtons.find((props) => String(props.className).includes("w-full"));
+    firstRuleButton.onClick();
     expect(stateMock.setters[0]).toHaveBeenCalledWith([telegramRule]);
 
     renderLibrary({ 0: [telegramRule] });
-    const selectedRuleDiv = mocks.captures.nativeDivs.find((props) => String(props.className).includes("cursor-pointer"));
-    selectedRuleDiv.onClick();
+    const selectedRuleButton = mocks.captures.nativeButtons.find((props) => String(props.className).includes("w-full"));
+    selectedRuleButton.onClick();
     expect(stateMock.setters[0]).toHaveBeenCalledWith([]);
   });
 
@@ -439,7 +439,7 @@ describe("ProxyGroupsRulesLibrary", () => {
     const { html } = renderLibrary({ 0: selectedRules, 1: "custom:custom-1" });
     expect(html).toContain("+1");
 
-    mocks.captures.nativeButtons.find((props) => props.children === "清空").onClick();
+    mocks.captures.buttons.find((props) => props.children === "清空").onClick();
     expect(stateMock.setters[0]).toHaveBeenCalledWith([]);
 
     mocks.captures.badges.find((props) => typeof props.onClick === "function").onClick();
@@ -565,7 +565,7 @@ describe("ProxyGroupsRulesLibrary", () => {
     mocks.search.searchResults = [netflixRule];
     mocks.store.builtinRuleEdits = { "module:auto:netflix": { enabled: false } };
     renderLibrary();
-    expect(mocks.captures.nativeDivs.some((props) => String(props.className).includes("cursor-pointer"))).toBe(true);
+    expect(mocks.captures.nativeButtons.some((props) => String(props.className).includes("w-full"))).toBe(true);
 
     mocks.store.builtinRuleEdits = {};
     mocks.store.customRuleSets = [{ id: "netflix", name: "Netflix", behavior: "domain", path: "geosite/netflix.mrs", target: "Custom" }];
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx
index fd7d975..cce1dfb 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx
@@ -251,7 +251,8 @@ export function ProxyGroupsRulesLibrary() {
               }
 
               return (
-                <div
+                <button
+                  type="button"
                   key={rule.id}
                   onClick={() => {
                     if (isSelected) {
@@ -263,7 +264,7 @@ export function ProxyGroupsRulesLibrary() {
                     }
                   }}
                   className={cn(
-                    "flex items-center gap-1.5 px-1.5 py-1 rounded cursor-pointer transition-colors",
+                    "flex w-full items-center gap-1.5 rounded px-1.5 py-1 text-left transition-colors",
                     isSelected
                       ? "bg-indigo-500/20 text-indigo-400"
                       : "hover:bg-white/5 text-white/70",
@@ -294,7 +295,7 @@ export function ProxyGroupsRulesLibrary() {
                   >
                     {rule.behavior === "ipcidr" ? "IP" : "域名"}
                   </Badge>
-                </div>
+                </button>
               );
             })}
           </div>
@@ -347,12 +348,15 @@ export function ProxyGroupsRulesLibrary() {
                 </span>{" "}
                 条未分配的规则
               </span>
-              <button
+              <Button
+                type="button"
+                variant="ghost"
+                size="sm"
                 onClick={() => setSelectedRules([])}
-                className="text-[10px] text-white/40 hover:text-white/60"
+                className="h-auto p-0 text-[10px] text-white/40 hover:bg-transparent hover:text-white/60"
               >
                 清空
-              </button>
+              </Button>
             </div>
             <div className="flex flex-wrap gap-0.5">
               {selectedRules.slice(0, 5).map((rule) => (
@@ -562,7 +566,13 @@ export function ProxyGroupsRulesLibrary() {
                           .filter((r) => builtinRuleEdits?.[getModuleRuleOrderKey(mod.id, r.id)]?.enabled !== false)
                           .map((r) => r.id),
                         ...customRuleSets
-                          .filter((r) => r.target === resolveModuleFullName(mod))
+                          .filter(
+                            (rule) =>
+                              resolveProxyGroupTargetName(rule.target, {
+                                moduleNames,
+                                customProxyGroups,
+                              }) === resolveModuleFullName(mod),
+                          )
                           .map((r) => r.id),
                       ],
                     );
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts
index ce271c1..7ad7d62 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts
@@ -320,10 +320,10 @@ describe("RulesManagementSection", () => {
 
   it("moves editable rules by buttons, absolute order input, blur, and escape cleanup", () => {
     stateMock.value = { "custom:one": "1" };
-    const tree = renderSection();
+    const tree = renderSection({ ruleOrder: ["module:geo", "custom:one"] });
     const orderInputs = collectElements(tree, (element) => (element.props as any).title === "最终规则行号（1=最前）");
-    const upButtons = collectElements(tree, (element) => element.type === "button" && element.props.title === "上移");
-    const downButtons = collectElements(tree, (element) => element.type === "button" && element.props.title === "下移");
+    const upButtons = collectElements(tree, (element) => element.props.label === "上移规则");
+    const downButtons = collectElements(tree, (element) => element.props.label === "下移规则");
 
     orderInputs[1].props.onChange({ target: { value: "2" } });
     expect(stateMock.value["custom:one"]).toBe("2");
@@ -346,6 +346,29 @@ describe("RulesManagementSection", () => {
     expect(mocks.store.setRuleOrder).toHaveBeenCalledWith(["custom:one", "module:geo"]);
   });
 
+  it("does not turn legacy custom-only ordering into full ordering after a custom move", () => {
+    const tree = renderSection({ ruleOrder: ["custom:one"] });
+    const orderInputs = collectElements(tree, (element) => (element.props as any).title === "最终规则行号（1=最前）");
+    const upButtons = collectElements(tree, (element) => element.props.label === "上移规则");
+    const downButtons = collectElements(tree, (element) => element.props.label === "下移规则");
+
+    stateMock.value = { "custom:one": "1" };
+    orderInputs[1].props.onKeyDown({ key: "Enter" });
+    upButtons[1].props.onClick();
+    downButtons[1].props.onClick();
+
+    expect(upButtons[1].props.disabled).toBe(true);
+    expect(downButtons[1].props.disabled).toBe(true);
+    expect(mocks.store.setRuleOrder).not.toHaveBeenCalled();
+  });
+
+  it("uses full non-MATCH ordering for a new empty rule-order state", () => {
+    const tree = renderSection({ ruleOrder: [] });
+    const header = collectElements(tree, (element) => element.props.title === "规则管理")[0];
+    expect(collectText(tree)).toContain("已开启全规则排序");
+    expect(collectText(header.props.badge)).toContain("可调 2 / 全部 3");
+  });
+
   it("keeps collapsed sections lightweight", () => {
     mocks.store = {
       enabledProxyGroups: [],
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx
index c55c7b1..8223e81 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx
@@ -5,6 +5,7 @@ import { ArrowDown, ArrowUp, ListOrdered } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
 import { Input } from "@subboost/ui/components/ui/input";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Switch } from "@subboost/ui/components/ui/switch";
 import {
   buildGeneratedRuleEntries,
@@ -52,7 +53,7 @@ export function RulesManagementSection({
     setRuleOrder,
   } = useConfigStore();
   const [orderDrafts, setOrderDrafts] = React.useState<Record<string, string>>({});
-  const allRulesMode = hasFullRuleOrderKeys(ruleOrder);
+  const allRulesMode = ruleOrder.length === 0 || hasFullRuleOrderKeys(ruleOrder);
 
   const entries = React.useMemo(
     () =>
@@ -85,6 +86,7 @@ export function RulesManagementSection({
   const preMatchKeys = React.useMemo(() => preMatchEntries.map((entry) => entry.key), [preMatchEntries]);
   const editableEntries = React.useMemo(() => entries.filter((entry) => entry.editable), [entries]);
   const editableKeys = React.useMemo(() => editableEntries.map((entry) => entry.key), [editableEntries]);
+  const movableKeys = allRulesMode ? preMatchKeys : editableKeys;
 
   const applyRuleOrder = React.useCallback(
     (nextRuleOrder: string[]) => {
@@ -102,30 +104,30 @@ export function RulesManagementSection({
 
   const moveRule = React.useCallback(
     (key: string, direction: "up" | "down") => {
-      const from = preMatchKeys.indexOf(key);
+      const from = movableKeys.indexOf(key);
       if (from < 0) return;
-      const to = clamp(direction === "up" ? from - 1 : from + 1, 0, preMatchKeys.length - 1);
+      const to = clamp(direction === "up" ? from - 1 : from + 1, 0, movableKeys.length - 1);
       if (to === from) return;
-      const next = preMatchKeys.slice();
+      const next = movableKeys.slice();
       const [item] = next.splice(from, 1);
       next.splice(to, 0, item);
       applyRuleOrder(next);
     },
-    [applyRuleOrder, preMatchKeys]
+    [applyRuleOrder, movableKeys]
   );
 
   const setRuleAbsoluteOrder = React.useCallback(
     (key: string, absoluteOrder: number) => {
-      const from = preMatchKeys.indexOf(key);
+      const from = movableKeys.indexOf(key);
       if (from < 0 || !Number.isFinite(absoluteOrder)) return;
-      const to = clamp(Math.floor(absoluteOrder) - 1, 0, preMatchEntries.length - 1);
+      const to = clamp(Math.floor(absoluteOrder) - 1, 0, movableKeys.length - 1);
       if (to === from) return;
-      const next = preMatchKeys.slice();
+      const next = movableKeys.slice();
       const [item] = next.splice(from, 1);
       next.splice(to, 0, item);
       applyRuleOrder(next);
     },
-    [applyRuleOrder, preMatchEntries.length, preMatchKeys]
+    [applyRuleOrder, movableKeys]
   );
 
   const handleToggleAllRulesMode = React.useCallback(
@@ -184,6 +186,7 @@ export function RulesManagementSection({
               <div className="ml-auto flex shrink-0 items-center gap-2">
                 <span className="text-[11px] whitespace-nowrap text-white/55">调整所有规则顺序</span>
                 <Switch
+                  aria-label="调整所有规则顺序"
                   checked={allRulesMode}
                   onCheckedChange={handleToggleAllRulesMode}
                   disabled={preMatchEntries.length <= 1}
@@ -194,11 +197,11 @@ export function RulesManagementSection({
 
           <div className="max-h-[460px] overflow-y-auto overflow-x-hidden rounded-lg border border-white/10 bg-black/10 pr-1 custom-scrollbar">
             {entries.map((entry, index) => {
-              const fullIndex = preMatchKeys.indexOf(entry.key);
+              const movableIndex = movableKeys.indexOf(entry.key);
               const canEditOrder = entry.key !== "special:match" && (allRulesMode || entry.editable);
-              const canMoveUp = canEditOrder && fullIndex > 0;
-              const canMoveDown = canEditOrder && fullIndex >= 0 && fullIndex < preMatchKeys.length - 1;
-              const absoluteOrder = index + 1;
+              const canMoveUp = canEditOrder && movableIndex > 0;
+              const canMoveDown = canEditOrder && movableIndex >= 0 && movableIndex < movableKeys.length - 1;
+              const absoluteOrder = allRulesMode ? index + 1 : movableIndex + 1;
               const displayDetail = getRuleDisplayDetail(entry);
               const shouldShowSourceLabel =
                 entry.sourceLabel.trim() !== entry.target.trim() &&
@@ -288,22 +291,24 @@ export function RulesManagementSection({
                         className="h-8 w-16 shrink-0 rounded-lg border-white/10 bg-white/10 px-1 text-center text-xs disabled:cursor-not-allowed disabled:opacity-50"
                       />
                       <div className="flex flex-col">
-                        <button
+                        <IconButton
+                          label="上移规则"
+                          variant="ghost"
                           onClick={() => moveRule(entry.key, "up")}
                           disabled={!canMoveUp}
                           className="flex h-4 w-5 items-center justify-center text-white/30 transition-colors hover:text-emerald-300 disabled:cursor-not-allowed disabled:opacity-30"
-                          title="上移"
                         >
                           <ArrowUp className="h-3 w-3" />
-                        </button>
-                        <button
+                        </IconButton>
+                        <IconButton
+                          label="下移规则"
+                          variant="ghost"
                           onClick={() => moveRule(entry.key, "down")}
                           disabled={!canMoveDown}
                           className="flex h-4 w-5 items-center justify-center text-white/30 transition-colors hover:text-emerald-300 disabled:cursor-not-allowed disabled:opacity-30"
-                          title="下移"
                         >
                           <ArrowDown className="h-3 w-3" />
-                        </button>
+                        </IconButton>
                       </div>
                     </div>
                   </div>
diff --git a/packages/ui/src/product/converter/quick-mode/constants.test.ts b/packages/ui/src/product/converter/quick-mode/constants.test.ts
index 43c4dd5..76e6173 100644
--- a/packages/ui/src/product/converter/quick-mode/constants.test.ts
+++ b/packages/ui/src/product/converter/quick-mode/constants.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { sourceTypeInfo, templates } from "./constants";
+import { getTemplateList } from "@subboost/core/templates";
 
 describe("quick mode constants", () => {
   it("defines all supported source type labels and placeholders", () => {
@@ -17,5 +18,11 @@ describe("quick mode constants", () => {
     expect(templates.map((item) => item.name)).toEqual(["精简版", "标准版", "完整版"]);
     expect(templates[0].groups).toBeLessThan(templates[2].groups);
     expect(templates[0].rules).toBeLessThan(templates[2].rules);
+    const currentCounts = new Map(
+      getTemplateList().map((template) => [template.id, [template.groupCount, template.ruleCount]])
+    );
+    for (const template of templates) {
+      expect([template.groups, template.rules]).toEqual(currentCounts.get(template.id));
+    }
   });
 });
diff --git a/packages/ui/src/product/converter/quick-mode/constants.ts b/packages/ui/src/product/converter/quick-mode/constants.ts
index 7d314d0..e679fdd 100644
--- a/packages/ui/src/product/converter/quick-mode/constants.ts
+++ b/packages/ui/src/product/converter/quick-mode/constants.ts
@@ -1,52 +1,32 @@
-import type { SourceType } from "@subboost/ui/store/config-store";
 import type { TemplateType } from "@subboost/core/types/config";
-import { FileCode, Link2, Server } from "lucide-react";
+import { getTemplateList } from "@subboost/core/templates";
+export { sourceTypeInfo } from "@subboost/ui/product/converter/source-type-info";
 
-export const sourceTypeInfo: Record<
-  SourceType,
-  { label: string; icon: typeof Link2; placeholder: string; description: string }
-> = {
-  url: {
-    label: "订阅链接",
-    icon: Link2,
-    placeholder: "https://example.com/sub?token=xxx",
-    description: "输入订阅链接，系统将自动获取节点",
-  },
-  yaml: {
-    label: "YAML 配置",
-    icon: FileCode,
-    placeholder: "proxies:\n  - name: 节点名称\n    type: vmess\n    ...",
-    description: "粘贴完整的 Clash YAML 配置文件",
-  },
-  nodes: {
-    label: "节点链接",
-    icon: Server,
-    placeholder:
-      "ss://...\nssr://...\nvmess://...\nvless://...\ntrojan://...\nanytls://...\nhysteria2://... / hy2://...\ntuic://...\n(socks5://... / socks4://...)",
-    description: "每行一个节点链接，支持 ss/ssr/vmess/vless/trojan/anytls/hy2/tuic",
-  },
-};
+const templateCounts = new Map(
+  getTemplateList().map((template) => [template.id, { groups: template.groupCount, rules: template.ruleCount }])
+);
+
+function countsFor(id: TemplateType) {
+  return templateCounts.get(id) ?? { groups: 0, rules: 0 };
+}
 
 export const templates = [
   {
     id: "minimal" as TemplateType,
     name: "精简版",
     description: "基础代理组 + 国内外分流",
-    groups: 7,
-    rules: 5,
+    ...countsFor("minimal"),
   },
   {
     id: "standard" as TemplateType,
     name: "标准版",
     description: "完整代理组 + 常用规则",
-    groups: 14,
-    rules: 15,
+    ...countsFor("standard"),
   },
   {
     id: "full" as TemplateType,
     name: "完整版",
     description: "全部功能 + 扩展规则集",
-    groups: 20,
-    rules: 40,
+    ...countsFor("full"),
   },
 ];
diff --git a/packages/ui/src/product/converter/quick-mode/sources-section.test.ts b/packages/ui/src/product/converter/quick-mode/sources-section.test.ts
index 1f59b3a..38b5fd1 100644
--- a/packages/ui/src/product/converter/quick-mode/sources-section.test.ts
+++ b/packages/ui/src/product/converter/quick-mode/sources-section.test.ts
@@ -51,21 +51,28 @@ vi.mock("react", async (importOriginal) => {
 
 vi.mock("react/jsx-runtime", async (importOriginal) => {
   const actual = await importOriginal<typeof import("react/jsx-runtime")>();
-  const capture = (type: any, props: any, key?: any) => {
+  const capture = (type: any, props: any) => {
     if (type === "button") {
       mocks.captures.rawButtons ||= [];
       mocks.captures.rawButtons.push(props || {});
     }
-    return actual.jsx(type, props, key);
   };
   return {
     ...actual,
-    jsx: capture,
-    jsxs: capture,
+    jsx: (type: any, props: any, key?: any) => {
+      capture(type, props);
+      return actual.jsx(type, props, key);
+    },
+    jsxs: (type: any, props: any, key?: any) => {
+      capture(type, props);
+      return actual.jsxs(type, props, key);
+    },
   };
 });
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => props.children,
+  Close: (props: any) => props.children,
   Root: (props: any) => props.children,
   Trigger: (props: any) => props.children,
   Portal: (props: any) => props.children,
@@ -77,11 +84,15 @@ vi.mock("lucide-react", () => ({
   Check: () => null,
   ChevronDown: () => null,
   ChevronUp: () => null,
+  CircleHelp: () => null,
+  FileCode: () => null,
   HelpCircle: () => null,
   Loader2: () => null,
+  Link2: () => null,
   Maximize2: () => null,
   Menu: () => null,
   Plus: () => null,
+  Server: () => null,
   X: () => null,
 }));
 vi.mock("@subboost/ui/components/ui/button", () => ({
@@ -90,6 +101,12 @@ vi.mock("@subboost/ui/components/ui/button", () => ({
     return null;
   },
 }));
+vi.mock("@subboost/ui/components/ui/icon-button", () => ({
+  IconButton: (props: any) => {
+    mocks.captures.iconButtons.push(props);
+    return null;
+  },
+}));
 vi.mock("@subboost/ui/components/ui/textarea", () => ({
   Textarea: (props: any) => {
     mocks.captures.textareas.push(props);
@@ -152,6 +169,26 @@ vi.mock("@subboost/ui/product/subscription/source-order", () => ({ moveSubscript
 vi.mock("@subboost/ui/product/converter/source-display-label", () => ({
   buildSourceDisplayLabel: ({ typeLabel, order, total, tag }: any) => `${typeLabel} ${order}/${total}${tag ? ` ${tag}` : ""}`,
 }));
+vi.mock("@subboost/ui/product/converter/source-controls", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@subboost/ui/product/converter/source-controls")>();
+  return {
+    ...actual,
+    AddSourceMenu: (props: any) => {
+      mocks.captures.addSourceMenus.push(props);
+      return null;
+    },
+    SourceTypeChoices: (props: any) => {
+      mocks.captures.sourceTypeChoices.push(props);
+      return null;
+    },
+  };
+});
+vi.mock("@subboost/ui/product/converter/source-editor-dialog", () => ({
+  SourceEditorDialog: (props: any) => {
+    mocks.captures.editor = props;
+    return null;
+  },
+}));
 vi.mock("@subboost/ui/product/interactions", () => ({ useProductInteractionAdapter: () => mocks.interactions }));
 vi.mock("./constants", () => ({
   sourceTypeInfo: {
@@ -204,6 +241,9 @@ function renderSection(overrides: Record<number, unknown> = {}) {
   mocks.captures.inputs = [];
   mocks.captures.textareas = [];
   mocks.captures.switches = [];
+  mocks.captures.iconButtons = [];
+  mocks.captures.addSourceMenus = [];
+  mocks.captures.sourceTypeChoices = [];
   mocks.captures.rawButtons = [];
   try {
     const html = renderToStaticMarkup(React.createElement(SourcesSection));
@@ -216,7 +256,16 @@ function renderSection(overrides: Record<number, unknown> = {}) {
 describe("quick mode SourcesSection", () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    mocks.captures = { buttons: [], inputs: [], textareas: [], switches: [], rawButtons: [] };
+    mocks.captures = {
+      addSourceMenus: [],
+      buttons: [],
+      iconButtons: [],
+      inputs: [],
+      rawButtons: [],
+      sourceTypeChoices: [],
+      switches: [],
+      textareas: [],
+    };
     mocks.getSubscriptionUserInfoDisplay.mockReturnValue({ traffic: "1 GB", expire: "2026-01-01" });
     mocks.markSourceAsPendingImport.mockImplementation((source) => ({ ...source, pendingImport: true }));
     mocks.moveSubscriptionSource.mockImplementation((sources) => sources.slice().reverse());
@@ -237,43 +286,34 @@ describe("quick mode SourcesSection", () => {
     renderSection({ 0: true, 1: "s1" });
 
     expect(mocks.captures.errorBadge).toEqual(expect.objectContaining({ errorMessage: "parse failed" }));
-    expect(mocks.captures.dialog).toEqual(expect.objectContaining({ open: true }));
-    expect(mocks.captures.inputs.some((props: any) => props.value === "https://example.com/sub")).toBe(true);
-    expect(mocks.captures.inputs.some((props: any) => props.value === "HK")).toBe(true);
-    expect(mocks.captures.inputs.some((props: any) => props.readOnly)).toBe(true);
-    expect(mocks.captures.textareas.some((props: any) => props.value === "ss://node")).toBe(true);
-    expect(mocks.captures.switches).toEqual([expect.objectContaining({ checked: false })]);
+    expect(mocks.captures.editor).toEqual(expect.objectContaining({ source: urlSource }));
+    expect(mocks.captures.addSourceMenus[0]).toEqual(expect.objectContaining({ open: true }));
+    expect(mocks.captures.sourceTypeChoices).toHaveLength(2);
   });
 
-  it("updates source content and metadata through captured inputs", () => {
+  it("updates source content and metadata through the shared editor contract", () => {
     renderSection({ 1: "s1" });
 
-    const mainUrlInput = mocks.captures.inputs.find((props: any) => props.placeholder === "https://example.com/sub" && props.value === urlSource.content);
-    mainUrlInput.onChange({ target: { value: "https://new.example/sub" } });
+    mocks.captures.editor.onUpdateContent("s1", "https://new.example/sub");
     expect(mocks.store.setSources).toHaveBeenCalledWith(expect.any(Array));
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ content: "https://new.example/sub" }));
 
-    const textArea = mocks.captures.textareas.find((props: any) => props.value === "ss://node");
-    textArea.onChange({ target: { value: "trojan://node" } });
+    mocks.captures.editor.onUpdateContent("s2", "trojan://node");
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ content: "trojan://node" }));
 
-    const tagInput = mocks.captures.inputs.find((props: any) => props.value === "HK");
-    tagInput.onChange({ target: { value: "JP" } });
+    mocks.captures.editor.onUpdateMeta("s1", { tag: "JP" });
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ tag: "JP" }));
 
-    const templateInput = mocks.captures.inputs.find((props: any) => props.value === "[{tag}] {name}");
-    templateInput.onChange({ target: { value: "{tag}-{name}" } });
+    mocks.captures.editor.onUpdateMeta("s1", { nameTemplate: "{tag}-{name}" });
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ nameTemplate: "{tag}-{name}" }));
 
-    mocks.captures.switches[0].onCheckedChange(true);
+    mocks.captures.editor.onUpdateMeta("s1", { useProxyProviders: true });
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ useProxyProviders: true }));
 
-    const userinfoUrlInput = mocks.captures.inputs.find((props: any) => props.value === "https://example.com/userinfo");
-    userinfoUrlInput.onChange({ target: { value: "https://new.example/userinfo" } });
+    mocks.captures.editor.onUpdateMeta("s1", { userinfoUrl: "https://new.example/userinfo" });
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ userinfoUrl: "https://new.example/userinfo" }));
 
-    const userinfoUaInput = mocks.captures.inputs.find((props: any) => props.value === "clash");
-    userinfoUaInput.onChange({ target: { value: "clash.meta/v1.19.16" } });
+    mocks.captures.editor.onUpdateMeta("s1", { userinfoUserAgent: "clash.meta/v1.19.16" });
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ userinfoUserAgent: "clash.meta/v1.19.16" }));
   });
 
@@ -291,7 +331,7 @@ describe("quick mode SourcesSection", () => {
       },
     });
 
-    mocks.captures.dialog.onOpenChange(false);
+    mocks.captures.editor.onClose();
     expect(mocks.store.parseSingleSource).toHaveBeenCalledWith("s1");
     expect(stateMock.setters[1]).toHaveBeenCalledWith(null);
 
@@ -308,7 +348,7 @@ describe("quick mode SourcesSection", () => {
         userinfoUserAgent: "clash",
       },
     });
-    mocks.captures.buttons.at(-1).onClick();
+    mocks.captures.editor.onClose();
     expect(mocks.store.parseSingleSource).not.toHaveBeenCalled();
   });
 
@@ -318,7 +358,7 @@ describe("quick mode SourcesSection", () => {
     mocks.store.parseErrors = [];
     mocks.store.sources = [{ ...urlSource, content: "", parsed: false, nodeCount: undefined }];
     renderSection();
-    expect(mocks.captures.dialog).toEqual(expect.objectContaining({ open: false }));
+    expect(mocks.captures.editor).toEqual(expect.objectContaining({ source: null }));
 
     mocks.store.setSources.mockClear();
     const emptyInput = mocks.captures.inputs.find((props: any) => props.placeholder === "https://example.com/sub");
@@ -329,7 +369,7 @@ describe("quick mode SourcesSection", () => {
   it("imports sources and reports success, runtime, and validation outcomes", async () => {
     renderSection();
 
-    mocks.captures.rawButtons.find((props: any) => props.title === "重新导入").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "重新导入").onClick();
     await Promise.resolve();
     await Promise.resolve();
 
@@ -344,7 +384,7 @@ describe("quick mode SourcesSection", () => {
     });
 
     mocks.interactions.sourceImported.mockClear();
-    mocks.captures.rawButtons.find((props: any) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     await Promise.resolve();
 
@@ -356,7 +396,7 @@ describe("quick mode SourcesSection", () => {
     mocks.interactions.sourceImported.mockClear();
     mocks.store.sources = [{ ...textSource, error: undefined, errorInfo: undefined, parsed: false }];
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     await Promise.resolve();
 
@@ -369,10 +409,7 @@ describe("quick mode SourcesSection", () => {
     vi.spyOn(Date, "now").mockReturnValue(1700000000000);
 
     renderSection({ 0: true });
-    const addMenuButtons = mocks.captures.rawButtons.filter((props: any) =>
-      String(props.className).includes("w-full flex items-center gap-3")
-    );
-    addMenuButtons[0].onClick();
+    mocks.captures.addSourceMenus[0].onAdd("url");
 
     expect(mocks.store.setSources).toHaveBeenCalledWith([
       urlSource,
@@ -386,16 +423,16 @@ describe("quick mode SourcesSection", () => {
     });
 
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "下移" && !props.disabled).onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "下移" && !props.disabled).onClick();
     expect(mocks.moveSubscriptionSource).toHaveBeenCalledWith(mocks.store.sources, "s1", "down");
     expect(mocks.store.setSources).toHaveBeenCalledWith([...mocks.store.sources].reverse());
 
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "删除").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "删除导入源").onClick();
     expect(mocks.store.setSources).toHaveBeenCalledWith([textSource]);
 
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "Text").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("text");
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(
       expect.objectContaining({
         id: "s1",
@@ -412,17 +449,14 @@ describe("quick mode SourcesSection", () => {
     mocks.userStore = { user: { isAdmin: false, quota: { maxImportSourcesPerType: 1 } } };
 
     renderSection({ 0: true });
-    const addMenuButtons = mocks.captures.rawButtons.filter((props: any) =>
-      String(props.className).includes("w-full flex items-center gap-3")
-    );
-    addMenuButtons[0].onClick();
+    mocks.captures.addSourceMenus[0].onAdd("url");
     expect(mocks.toast).toHaveBeenCalledWith({
       title: "每种导入方式最多 1 个",
       variant: "warning",
     });
 
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "Text").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("text");
     expect(mocks.toast).toHaveBeenCalledWith({
       title: "每种导入方式最多 1 个",
       variant: "warning",
@@ -435,10 +469,7 @@ describe("quick mode SourcesSection", () => {
       textSource,
     ];
     renderSection({ 0: true });
-    const anonymousAddMenuButtons = mocks.captures.rawButtons.filter((props: any) =>
-      String(props.className).includes("w-full flex items-center gap-3")
-    );
-    anonymousAddMenuButtons[0].onClick();
+    mocks.captures.addSourceMenus[0].onAdd("url");
     expect(mocks.toast).toHaveBeenCalledWith({
       title: "未登录用户每种导入方式最多 2 个（登录后可提升）",
       variant: "warning",
@@ -448,12 +479,8 @@ describe("quick mode SourcesSection", () => {
   it("renders and edits non-url expanded sources", () => {
     renderSection({ 1: "s2" });
 
-    const expandedTextarea = mocks.captures.textareas.find((props: any) =>
-      String(props.className).includes("min-h-[60vh]")
-    );
-    expect(expandedTextarea).toMatchObject({ value: "ss://node" });
-
-    expandedTextarea.onChange({ target: { value: "vmess://node" } });
+    expect(mocks.captures.editor.source).toEqual(textSource);
+    mocks.captures.editor.onUpdateContent("s2", "vmess://node");
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ content: "vmess://node" }));
   });
 
@@ -467,10 +494,7 @@ describe("quick mode SourcesSection", () => {
     ];
 
     renderSection({ 0: true });
-    const addMenuButtons = mocks.captures.rawButtons.filter((props: any) =>
-      String(props.className).includes("w-full flex items-center gap-3")
-    );
-    addMenuButtons[0].onClick();
+    mocks.captures.addSourceMenus[0].onAdd("url");
 
     expect(mocks.toast).not.toHaveBeenCalled();
     expect(mocks.store.setSources).toHaveBeenCalledWith([
@@ -481,7 +505,7 @@ describe("quick mode SourcesSection", () => {
     mocks.store.setSources.mockClear();
     mocks.store.sources = [textSource];
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "URL").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "text").onChange("url");
 
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -498,30 +522,29 @@ describe("quick mode SourcesSection", () => {
   it("keeps no-op source actions from writing back", async () => {
     mocks.store.setSources.mockClear();
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "URL").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("url");
     expect(mocks.store.setSources).not.toHaveBeenCalled();
 
     mocks.moveSubscriptionSource.mockReturnValueOnce(mocks.store.sources);
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "下移" && !props.disabled).onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "下移" && !props.disabled).onClick();
     expect(mocks.store.setSources).not.toHaveBeenCalled();
 
     renderSection({ 1: "s1" });
     mocks.markSourceAsPendingImport.mockClear();
-    const tagInput = mocks.captures.inputs.find((props: any) => props.value === "HK");
-    tagInput.onChange({ target: { value: "HK" } });
+    mocks.captures.editor.onUpdateMeta("s1", { tag: "HK" });
     expect(mocks.markSourceAsPendingImport).not.toHaveBeenCalled();
 
     mocks.store.parseSingleSource.mockClear();
     mocks.store.sources = [{ ...urlSource, content: "", parsed: false, nodeCount: undefined }];
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     expect(mocks.store.parseSingleSource).not.toHaveBeenCalled();
 
     mocks.store.sources = [{ ...urlSource, parsing: true }];
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "导入中...").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入中").onClick();
     await Promise.resolve();
     expect(mocks.store.parseSingleSource).not.toHaveBeenCalled();
   });
@@ -555,7 +578,7 @@ describe("quick mode SourcesSection", () => {
       },
     });
 
-    mocks.captures.dialog.onOpenChange(false);
+    mocks.captures.editor.onClose();
     expect(mocks.store.parseSingleSource).not.toHaveBeenCalled();
     expect(stateMock.setters[1]).toHaveBeenCalledWith(null);
   });
diff --git a/packages/ui/src/product/converter/quick-mode/sources-section.tsx b/packages/ui/src/product/converter/quick-mode/sources-section.tsx
index 260c219..ed953f0 100644
--- a/packages/ui/src/product/converter/quick-mode/sources-section.tsx
+++ b/packages/ui/src/product/converter/quick-mode/sources-section.tsx
@@ -1,17 +1,14 @@
-import * as Popover from "@radix-ui/react-popover";
-import { Plus, X, AlertCircle, Check, Loader2, Maximize2, HelpCircle, Menu, ChevronUp, ChevronDown } from "lucide-react";
+import { X, AlertCircle, Check, Loader2, Maximize2, ChevronUp, ChevronDown } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Textarea } from "@subboost/ui/components/ui/textarea";
 import { Input } from "@subboost/ui/components/ui/input";
 import { Badge } from "@subboost/ui/components/ui/badge";
-import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@subboost/ui/components/ui/dialog";
-import { Switch } from "@subboost/ui/components/ui/switch";
 import { cn } from "@subboost/ui/lib/utils";
-import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
-import type { SourceType } from "@subboost/ui/store/config-store";
 import { SubscriptionImportErrorBadge } from "@subboost/ui/product/converter/subscription-import-error";
-import { getSubscriptionUserInfoDisplay } from "@subboost/ui/product/subscription/subscription-userinfo-display";
 import { buildSourceDisplayLabel } from "@subboost/ui/product/converter/source-display-label";
+import { AddSourceMenu, SourceStatusPopover, SourceTypeChoices } from "@subboost/ui/product/converter/source-controls";
+import { SourceEditorDialog } from "@subboost/ui/product/converter/source-editor-dialog";
 import { useSubscriptionSourcesController } from "@subboost/ui/product/converter/use-subscription-sources-controller";
 import { sourceTypeInfo } from "./constants";
 
@@ -49,115 +46,56 @@ export function SourcesSection() {
             total: sources.length,
           });
           const sourceNodes = nodesBySourceId.get(source.id) ?? [];
-          const userInfoDisplay = getSubscriptionUserInfoDisplay(source.subscriptionUserInfo, sourceNodes);
-          const hasUserInfoDisplay = Boolean(userInfoDisplay && (userInfoDisplay.traffic || userInfoDisplay.expire));
-
           return (
             <div key={source.id} className="flex flex-col gap-1.5 flex-shrink-0">
               {/* Source Header */}
               <div className="flex items-center justify-between">
                 <div className="flex items-center gap-2">
-                  <div className="flex gap-1">
-                    {(Object.keys(sourceTypeInfo) as SourceType[]).map((type) => {
-                      const info = sourceTypeInfo[type];
-                      const Icon = info.icon;
-                      return (
-                        <button
-                          key={type}
-                          onClick={() => updateSourceType(source.id, type)}
-                          className={cn(
-                            "p-1 rounded transition-colors",
-                            source.type === type
-                              ? "bg-indigo-500/20 text-indigo-400"
-                              : "text-white/30 hover:text-white/50 hover:bg-white/5"
-                          )}
-                          title={info.label}
-                        >
-                          <Icon className="h-3.5 w-3.5" />
-                        </button>
-                      );
-                    })}
-                  </div>
+                  <SourceTypeChoices value={source.type} onChange={(type) => updateSourceType(source.id, type)} />
                   <span className="text-xs text-white/50">
                     {sourceDisplayLabel}
                   </span>
-                  {source.parsed && source.nodeCount !== undefined && (
-                    <Popover.Root>
-                      <Popover.Trigger asChild>
-                        <button
-                          type="button"
-                          className="inline-flex items-center gap-1 rounded-full border border-green-500/50 bg-green-500/5 px-2 py-0.5 text-xs font-semibold text-green-300 transition-colors hover:bg-green-500/10 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black whitespace-nowrap"
-                          title="查看流量/到期"
-                          aria-label="查看流量/到期"
-                        >
-                          ✓ {source.nodeCount} 节点
-                          <Menu className="h-3 w-3 text-green-300/70" aria-hidden="true" />
-                        </button>
-                      </Popover.Trigger>
-                      <Popover.Portal>
-                        <Popover.Content
-                          side="bottom"
-                          align="start"
-                          sideOffset={8}
-                          className="z-50 w-[260px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-                        >
-                          <div className="space-y-2 text-xs">
-                            <div className="flex items-center gap-2">
-                              <HelpCircle className="h-4 w-4 text-green-300" />
-                              <div className="text-white font-medium">订阅信息</div>
-                            </div>
-                            {hasUserInfoDisplay && userInfoDisplay ? (
-                              <div className="space-y-1 text-white/60">
-                                {userInfoDisplay.traffic ? <div>已用流量：{userInfoDisplay.traffic}</div> : null}
-                                {userInfoDisplay.expire ? <div>到期时间：{userInfoDisplay.expire}</div> : null}
-                              </div>
-                            ) : (
-                              <div className="text-white/60 leading-relaxed">暂无已用流量/到期时间信息</div>
-                            )}
-                          </div>
-                          <Popover.Arrow className="fill-white/10" />
-                        </Popover.Content>
-                      </Popover.Portal>
-                    </Popover.Root>
-                  )}
+                  <SourceStatusPopover source={source} nodes={sourceNodes} />
                   {(source.errorInfo || source.error) && (
                     <SubscriptionImportErrorBadge errorInfo={source.errorInfo} errorMessage={source.error} />
                   )}
                 </div>
                 <div className="flex items-center gap-1">
                   <div className="flex flex-col">
-                    <button
+                    <IconButton
+                      label="上移"
+                      variant="ghost"
                       onClick={() => moveSource(source.id, "up")}
                       disabled={index <= 0}
                       className="flex h-3.5 w-4 items-center justify-center text-white/30 transition-colors hover:text-indigo-300 disabled:cursor-not-allowed disabled:opacity-30"
-                      title="上移"
-                      aria-label="上移"
                     >
-                      <ChevronUp className="h-2.5 w-2.5" />
-                    </button>
-                    <button
+                      <ChevronUp className="h-2.5 w-2.5" aria-hidden="true" />
+                    </IconButton>
+                    <IconButton
+                      label="下移"
+                      variant="ghost"
                       onClick={() => moveSource(source.id, "down")}
                       disabled={index >= sources.length - 1}
                       className="flex h-3.5 w-4 items-center justify-center text-white/30 transition-colors hover:text-indigo-300 disabled:cursor-not-allowed disabled:opacity-30"
-                      title="下移"
-                      aria-label="下移"
                     >
-                      <ChevronDown className="h-2.5 w-2.5" />
-                    </button>
+                      <ChevronDown className="h-2.5 w-2.5" aria-hidden="true" />
+                    </IconButton>
                   </div>
-                  <button
+                  <IconButton
+                    label="高级编辑"
+                    variant="ghost"
                     onClick={() => setExpandedSourceId(source.id)}
-                    className="p-1 rounded transition-colors text-white/30 hover:text-white/60 hover:bg-white/5"
-                    title="高级编辑"
+                    className="h-6 w-6 rounded p-1 text-white/30 hover:bg-white/5 hover:text-white/60"
                   >
-                    <Maximize2 className="h-3.5 w-3.5" />
-                  </button>
-                  {/* 导入按钮 */}
-                  <button
+                    <Maximize2 className="h-3.5 w-3.5" aria-hidden="true" />
+                  </IconButton>
+                  <IconButton
+                    label={source.parsing ? "导入中" : source.parsed ? "重新导入" : "导入此源"}
+                    variant="ghost"
                     onClick={() => void handleImportSource(source.id)}
                     disabled={!source.content.trim() || source.parsing}
                     className={cn(
-                      "p-1 rounded transition-colors disabled:opacity-100",
+                      "h-6 w-6 rounded p-1 transition-colors disabled:opacity-100",
                       source.parsing
                         ? "text-indigo-400"
                         : source.parsed
@@ -169,20 +107,20 @@ export function SourcesSection() {
                     title={source.parsing ? "导入中..." : source.parsed ? "重新导入" : "导入此源"}
                   >
                     {source.parsing ? (
-                      <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                      <Loader2 className="h-3.5 w-3.5 animate-spin" aria-hidden="true" />
                     ) : (
-                      <Check className="h-3.5 w-3.5" />
+                      <Check className="h-3.5 w-3.5" aria-hidden="true" />
                     )}
-                  </button>
-                  {/* 删除按钮 */}
+                  </IconButton>
                   {sources.length > 1 && (
-                    <button
+                    <IconButton
+                      label="删除导入源"
+                      variant="ghost"
                       onClick={() => removeSource(source.id)}
-                      className="p-1 text-white/50 hover:text-red-400 transition-colors"
-                      title="删除"
+                      className="h-6 w-6 rounded p-1 text-white/50 transition-colors hover:text-red-400"
                     >
-                      <X className="h-3.5 w-3.5" />
-                    </button>
+                      <X className="h-3.5 w-3.5" aria-hidden="true" />
+                    </IconButton>
                   )}
                 </div>
               </div>
@@ -210,39 +148,8 @@ export function SourcesSection() {
           );
         })}
 
-        {/* Add Source Button */}
-        <div className="relative flex-shrink-0">
-          <Button
-            variant="outline"
-            size="sm"
-            className="w-full h-8 text-xs border-dashed border-white/20 text-white/50 hover:text-white/70 hover:border-white/30"
-            onClick={() => setShowAddMenu(!showAddMenu)}
-          >
-            <Plus className="h-3.5 w-3.5 mr-1.5" />
-            添加订阅/节点源
-          </Button>
-
-          {showAddMenu && (
-            <div className="absolute top-full left-0 right-0 mt-1 bg-[#1a1a1a] border border-white/10 rounded-lg shadow-xl z-10 overflow-hidden">
-              {(Object.keys(sourceTypeInfo) as SourceType[]).map((type) => {
-                const info = sourceTypeInfo[type];
-                const Icon = info.icon;
-                return (
-                  <button
-                    key={type}
-                    onClick={() => addSource(type)}
-                    className="w-full flex items-center gap-3 px-3 py-2.5 text-left hover:bg-white/5 transition-colors"
-                  >
-                    <Icon className="h-4 w-4 text-indigo-400" />
-                    <div>
-                      <div className="text-xs font-medium text-white">{info.label}</div>
-                      <div className="text-[10px] text-white/40">{info.description}</div>
-                    </div>
-                  </button>
-                );
-              })}
-            </div>
-          )}
+        <div className="flex-shrink-0">
+          <AddSourceMenu open={showAddMenu} onOpenChange={setShowAddMenu} onAdd={addSource} />
         </div>
 
         {/* Status */}
@@ -259,161 +166,13 @@ export function SourcesSection() {
         )}
       </div>
 
-      <Dialog
-        open={Boolean(expandedSource)}
-        onOpenChange={(open) => {
-          if (!open) closeExpandedSourceEditor();
-        }}
-      >
-        <DialogContent className="w-[calc(100vw-2rem)] sm:max-w-4xl">
-          <DialogHeader>
-            <DialogTitle>{expandedSource ? `高级编辑：${sourceTypeInfo[expandedSource.type].label}` : "高级编辑"}</DialogTitle>
-          </DialogHeader>
-
-          {expandedSource && (
-            <div className="space-y-3">
-              <div className="grid gap-3 sm:grid-cols-3">
-                <div className="space-y-1">
-                  <div className="text-xs text-white/60">标签（tag）</div>
-                  <Input
-                    value={expandedSource.tag ?? ""}
-                    onChange={(e) => updateSourceMeta(expandedSource.id, { tag: e.target.value })}
-                    placeholder="例如：A / 订阅1 / 自建1"
-                    className="text-xs"
-                  />
-                </div>
-                <div className="space-y-1">
-                  <div className="text-xs text-white/60">节点命名模板</div>
-                  <Input
-                    value={expandedSource.nameTemplate ?? DEFAULT_NODE_NAME_TEMPLATE}
-                    onChange={(e) => updateSourceMeta(expandedSource.id, { nameTemplate: e.target.value })}
-                    className="text-xs font-mono"
-                  />
-                </div>
-                <div className="space-y-1">
-                  <div className="text-xs text-white/60">预览</div>
-                  <Input value={expandedSourcePreviewName} readOnly className="text-xs font-mono" />
-                </div>
-              </div>
-
-              <div className="text-[11px] text-white/40">
-                可用占位符：{"{tag}"}、{"{name}"}；留空则默认：{DEFAULT_NODE_NAME_TEMPLATE}
-              </div>
-
-              <div className="space-y-1">
-                <div className="text-xs text-white/60">{sourceTypeInfo[expandedSource.type].label}</div>
-                {expandedSource.type === "url" ? (
-                  <div className="space-y-3">
-                    <div className="flex items-center gap-3">
-                      <Input
-                        value={expandedSource.content}
-                        onChange={(e) => updateSource(expandedSource.id, e.target.value)}
-                        placeholder={sourceTypeInfo[expandedSource.type].placeholder}
-                        className="text-xs min-w-0 flex-1"
-                      />
-
-                      <div className="flex h-10 flex-none items-center gap-2 rounded-xl border border-white/10 bg-white/5 px-3">
-                        <div className="text-xs text-white/70 whitespace-nowrap">proxy-providers模式</div>
-                        <Popover.Root>
-                          <Popover.Trigger asChild>
-                            <button
-                              type="button"
-                              className="inline-flex h-6 w-6 flex-none items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-                              aria-label="proxy-providers 模式说明"
-                              title="proxy-providers 模式说明"
-                            >
-                              <HelpCircle className="h-3.5 w-3.5" />
-                            </button>
-                          </Popover.Trigger>
-                          <Popover.Portal>
-                            <Popover.Content
-                              side="bottom"
-                              align="end"
-                              sideOffset={8}
-                              className="z-50 w-[360px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-                            >
-                              <div className="space-y-2 text-xs">
-                                <div className="flex items-center gap-2">
-                                  <HelpCircle className="h-4 w-4 text-amber-300" />
-                                  <div className="text-white font-medium">proxy-providers 模式</div>
-                                </div>
-                                <div className="text-white/60 leading-relaxed">
-                                  部分订阅限制 CN IP 导入，url 无法在 SubBoost 内拉取解析。开启后 SubBoost
-                                  不再拉取/解析该 url，而是在最终配置中写入{" "}
-                                  <span className="font-mono">proxy-providers</span>，交由客户端自行拉取节点。
-                                </div>
-                                <div className="pt-2 border-t border-white/10 text-white/60 space-y-1">
-                                  <div className="font-medium text-white/80">注意开启后：</div>
-                                  <ul className="ml-4 list-disc space-y-1">
-                                    <li>无法在预览中查看/管理该 url 的节点</li>
-                                    <li>无法将这些节点用于中转代理组、分流组高级模式等高级功能</li>
-                                    <li>节点命名模板与 tag 在该模式下不生效</li>
-                                  </ul>
-                                </div>
-                                <div className="pt-2 border-t border-white/10 text-[10px] text-white/40">
-                                  若导入 url 报“未解析到有效节点/获取失败”等，可尝试开启此模式。
-                                </div>
-                              </div>
-                              <Popover.Arrow className="fill-white/10" />
-                            </Popover.Content>
-                          </Popover.Portal>
-                        </Popover.Root>
-                        <Switch
-                          checked={Boolean(expandedSource.useProxyProviders)}
-                          onCheckedChange={(checked) =>
-                            updateSourceMeta(expandedSource.id, { useProxyProviders: Boolean(checked) })
-                          }
-                        />
-                      </div>
-                    </div>
-
-                    <div className="grid gap-3 sm:grid-cols-2">
-                      <div className="space-y-1">
-                        <div className="text-xs text-white/60">流量/到期信息 URL（可选）</div>
-                        <Input
-                          value={expandedSource.userinfoUrl ?? ""}
-                          onChange={(e) => updateSourceMeta(expandedSource.id, { userinfoUrl: e.target.value })}
-                          placeholder="留空则默认使用当前订阅源 URL"
-                          className="text-xs"
-                        />
-                      </div>
-                      <div className="space-y-1">
-                        <div className="text-xs text-white/60">流量信息 User-Agent（可选）</div>
-                        <Input
-                          value={expandedSource.userinfoUserAgent ?? ""}
-                          onChange={(e) =>
-                            updateSourceMeta(expandedSource.id, { userinfoUserAgent: e.target.value })
-                          }
-                          placeholder="例如 clash.meta/v1.19.16"
-                          className="text-xs"
-                        />
-                      </div>
-                    </div>
-
-                    <div className="text-[11px] text-white/40">
-                      有些订阅源不会直接返回 <span className="font-mono">subscription-userinfo</span>，但会提供独立的流量接口。
-                      设置后，SubBoost 会在导入/刷新时额外抓取该接口，用来更新这个源自己的流量与到期快照。
-                    </div>
-                  </div>
-                ) : (
-                  <Textarea
-                    value={expandedSource.content}
-                    onChange={(e) => updateSource(expandedSource.id, e.target.value)}
-                    placeholder={sourceTypeInfo[expandedSource.type].placeholder}
-                    className="min-h-[60vh] text-xs font-mono"
-                  />
-                )}
-              </div>
-            </div>
-          )}
-
-          <div className="flex justify-end gap-2">
-            <Button variant="outline" onClick={closeExpandedSourceEditor}>
-              完成
-            </Button>
-          </div>
-        </DialogContent>
-      </Dialog>
+      <SourceEditorDialog
+        source={expandedSource}
+        previewName={expandedSourcePreviewName}
+        onClose={closeExpandedSourceEditor}
+        onUpdateContent={updateSource}
+        onUpdateMeta={updateSourceMeta}
+      />
     </>
   );
 }
diff --git a/packages/ui/src/product/converter/quick-mode/templates-section.test.ts b/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
index 44bbdf4..7f3ae5d 100644
--- a/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
+++ b/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
@@ -1,6 +1,6 @@
 import * as React from "react";
 import { renderToStaticMarkup } from "react-dom/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
   captures: {} as Record<string, any>,
@@ -59,17 +59,22 @@ vi.mock("react", async (importOriginal) => {
 
 vi.mock("react/jsx-runtime", async (importOriginal) => {
   const actual = await importOriginal<typeof import("react/jsx-runtime")>();
-  const capture = (type: any, props: any, key?: any) => {
+  const capture = (type: any, props: any) => {
     if (type === "button") {
       mocks.captures.rawButtons ||= [];
       mocks.captures.rawButtons.push(props || {});
     }
-    return actual.jsx(type, props, key);
   };
   return {
     ...actual,
-    jsx: capture,
-    jsxs: capture,
+    jsx: (type: any, props: any, key?: any) => {
+      capture(type, props);
+      return actual.jsx(type, props, key);
+    },
+    jsxs: (type: any, props: any, key?: any) => {
+      capture(type, props);
+      return actual.jsxs(type, props, key);
+    },
   };
 });
 
@@ -149,6 +154,10 @@ function flushPromises() {
   return new Promise((resolve) => setTimeout(resolve, 0));
 }
 
+function catalogApplyButtons() {
+  return mocks.captures.buttons.filter((props: any) => props.className === "flex-shrink-0");
+}
+
 function renderSection(overrides: Record<number, unknown> = {}) {
   stateMock.enabled = true;
   stateMock.callIndex = 0;
@@ -195,17 +204,21 @@ describe("quick mode TemplatesSection", () => {
     };
   });
 
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
   it("selects built-in templates and opens the catalog", () => {
     const { setters } = renderSection();
 
-    mocks.captures.cards[1].onClick();
+    mocks.captures.rawButtons.find((props: any) => props["aria-label"] === "选择 Standard 模板").onClick();
     expect(mocks.store.setTemplate).toHaveBeenCalledWith("standard");
     expect(mocks.interactions.templateSelected).toHaveBeenCalledWith({
       source: "builtin",
       templateType: "standard",
     });
 
-    mocks.captures.cards.at(-1).onClick();
+    mocks.captures.rawButtons.find((props: any) => props["aria-label"] === "打开Catalog").onClick();
     expect(setters[0]).toHaveBeenCalledWith(true);
     expect(mocks.interactions.templateCatalogOpened).toHaveBeenCalledWith({ mode: "quick" });
   });
@@ -231,7 +244,7 @@ describe("quick mode TemplatesSection", () => {
     });
 
     const { setters } = renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
 
     expect(setters[4]).toHaveBeenCalledWith("tpl-config");
@@ -251,7 +264,7 @@ describe("quick mode TemplatesSection", () => {
   it("rejects unsupported catalog templates and missing details", async () => {
     mocks.productApi.templates.loadTemplateDetail.mockResolvedValue({ kind: "yaml", name: "Raw YAML" });
     renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[1].onClick();
+    catalogApplyButtons()[1].onClick();
     await flushPromises();
     expect(mocks.interactions.templateApplied).toHaveBeenCalledWith({
       source: "catalog",
@@ -262,7 +275,7 @@ describe("quick mode TemplatesSection", () => {
 
     mocks.productApi.templates.loadTemplateDetail.mockResolvedValue(null);
     renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
     expect(mocks.interactions.templateApplied).toHaveBeenCalledWith({
       source: "catalog",
@@ -273,11 +286,13 @@ describe("quick mode TemplatesSection", () => {
   });
 
   it("reports runtime failures and hides optional catalog features when disabled", async () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     mocks.productApi.templates.loadTemplateDetail.mockRejectedValue(new Error("network"));
     renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
     expect(mocks.toast).toHaveBeenCalledWith(expect.objectContaining({ title: "应用模板失败，请稍后重试", variant: "destructive" }));
+    expect(errorSpy).toHaveBeenCalledWith(expect.objectContaining({ message: "network" }));
 
     mocks.productApi.templates.catalogEnabled = false;
     mocks.productApi.templates.builtinEngagementEnabled = false;
@@ -320,11 +335,9 @@ describe("quick mode TemplatesSection", () => {
       full: { id: "builtin-full", engagementCount: 0, isEngaged: false },
     });
 
-    const stopPropagation = vi.fn();
-    mocks.captures.rawButtons.find((props: any) => props.title === "Like").onClick({ stopPropagation });
+    mocks.captures.rawButtons.find((props: any) => props.title === "Like").onClick();
     await flushPromises();
 
-    expect(stopPropagation).toHaveBeenCalled();
     expect(mocks.productApi.templates.toggleTemplateEngagement).toHaveBeenCalledWith("builtin-minimal");
     expect(mocks.interactions.templateEngagementToggled).toHaveBeenCalledWith({ source: "builtin", engaged: true });
     expect(setters[5]).toHaveBeenCalledWith(expect.any(Function));
@@ -402,14 +415,14 @@ describe("quick mode TemplatesSection", () => {
       config: { template: "minimal" },
     });
     const unnamed = renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
     expect(mocks.toast).toHaveBeenCalledWith(expect.objectContaining({ title: "已应用模板：未命名模板" }));
     expect(unnamed.setters[4]).toHaveBeenCalledWith(null);
 
     mocks.productApi.templates.loadTemplateDetail.mockResolvedValue({ kind: "markdown", name: "Doc" });
     renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
     expect(mocks.interactions.templateApplied).toHaveBeenCalledWith({
       source: "catalog",
@@ -419,7 +432,7 @@ describe("quick mode TemplatesSection", () => {
 
     mocks.productApi.templates.loadTemplateDetail = undefined;
     const noLoader = renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
     expect(noLoader.setters[4]).not.toHaveBeenCalled();
   });
diff --git a/packages/ui/src/product/converter/quick-mode/templates-section.tsx b/packages/ui/src/product/converter/quick-mode/templates-section.tsx
index aa5489b..48fb744 100644
--- a/packages/ui/src/product/converter/quick-mode/templates-section.tsx
+++ b/packages/ui/src/product/converter/quick-mode/templates-section.tsx
@@ -193,25 +193,31 @@ export function TemplatesSection() {
     <>
       {/* Template Selection */}
       <div className="space-y-1.5">
-        <label className="text-xs text-white/50">选择模板</label>
+        <p className="text-xs text-white/50">选择模板</p>
         <div className="grid gap-1.5">
           {templates.map((template) => (
             <Card
               key={template.id}
               className={cn(
-                "p-2.5 cursor-pointer transition-all border-2",
+                "p-2.5 transition-all border-2",
                 selectedTemplate === template.id ? "border-indigo-500 bg-indigo-500/10" : "border-transparent hover:border-white/20"
               )}
-              onClick={() => {
-                setTemplate(template.id);
-                interactions.templateSelected?.({
-                  source: "builtin",
-                  templateType: template.id,
-                });
-              }}
             >
-              <div className="flex items-center justify-between">
-                <div className="flex items-center gap-3">
+              <div className="flex items-center gap-3">
+                <button
+                  type="button"
+                  aria-pressed={selectedTemplate === template.id}
+                  aria-label={`选择 ${template.name} 模板`}
+                  className="flex min-w-0 flex-1 items-center justify-between gap-3 text-left"
+                  onClick={() => {
+                    setTemplate(template.id);
+                    interactions.templateSelected?.({
+                      source: "builtin",
+                      templateType: template.id,
+                    });
+                  }}
+                >
+                  <div className="flex min-w-0 items-center gap-3">
                   <div
                     className={cn(
                       "w-4 h-4 rounded-full border-2 flex items-center justify-center",
@@ -223,45 +229,50 @@ export function TemplatesSection() {
                   <div>
                     <div className="flex items-center gap-2">
                       <span className="text-sm font-medium text-white">{template.name}</span>
-                      {builtinEngagementEnabled && (
-                        <button
-                          onClick={(e) => {
-                            e.stopPropagation();
-                            void toggleBuiltinEngagement(template.id);
-                          }}
-                          disabled={!user}
-                          className={cn(
-                            "inline-flex items-center gap-0.5 text-xs transition-colors",
-                            builtinEngagement[template.id]?.isEngaged ? "text-red-400" : "text-white/40 hover:text-red-400",
-                            !user && "cursor-not-allowed opacity-50"
-                          )}
-                          title={user ? engagementAction : engagementLoginRequired}
-                        >
-                          <Heart className={cn("h-3 w-3", builtinEngagement[template.id]?.isEngaged && "fill-current")} />
-                          <span>{builtinEngagement[template.id]?.engagementCount ?? 0}</span>
-                        </button>
-                      )}
                     </div>
                     <p className="text-xs text-white/40 mt-0.5">{template.description}</p>
                   </div>
-                </div>
-                <div className="text-right text-xs text-white/40 space-y-0.5">
-                  <div>{template.groups} 代理组</div>
-                  <div>{template.rules} 规则集</div>
-                </div>
+                  </div>
+                  <div className="space-y-0.5 text-right text-xs text-white/40">
+                    <div>{template.groups} 代理组</div>
+                    <div>{template.rules} 规则集</div>
+                  </div>
+                </button>
+                {builtinEngagementEnabled && (
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="sm"
+                    onClick={() => void toggleBuiltinEngagement(template.id)}
+                    disabled={!user}
+                    className={cn(
+                      "h-auto gap-0.5 p-0 text-xs transition-colors hover:bg-transparent",
+                      builtinEngagement[template.id]?.isEngaged ? "text-red-400" : "text-white/40 hover:text-red-400",
+                      !user && "cursor-not-allowed opacity-50"
+                    )}
+                    title={user ? engagementAction : engagementLoginRequired}
+                  >
+                    <Heart className={cn("h-3 w-3", builtinEngagement[template.id]?.isEngaged && "fill-current")} />
+                    <span>{builtinEngagement[template.id]?.engagementCount ?? 0}</span>
+                  </Button>
+                )}
               </div>
             </Card>
           ))}
 
           {catalogEnabled && (
             <Card
-              className="p-2.5 cursor-pointer transition-all border-2 border-dashed border-white/15 hover:border-white/25 bg-white/5"
-              onClick={() => {
-                setCatalogOpen(true);
-                interactions.templateCatalogOpened?.({ mode: "quick" });
-              }}
+              className="p-2.5 transition-all border-2 border-dashed border-white/15 hover:border-white/25 bg-white/5"
             >
-              <div className="flex items-center justify-between">
+              <button
+                type="button"
+                aria-label={`打开${catalogName}`}
+                className="flex w-full items-center justify-between text-left"
+                onClick={() => {
+                  setCatalogOpen(true);
+                  interactions.templateCatalogOpened?.({ mode: "quick" });
+                }}
+              >
                 <div className="flex items-center gap-3 min-w-0">
                   <div className="w-4 h-4 rounded-full border-2 border-white/30 flex items-center justify-center flex-shrink-0">
                     <Globe className="h-3 w-3 text-indigo-400" />
@@ -274,7 +285,7 @@ export function TemplatesSection() {
                 <div className="text-right text-xs text-white/40 flex-shrink-0">
                   <div>{catalogSelectAction}</div>
                 </div>
-              </div>
+              </button>
             </Card>
           )}
         </div>
diff --git a/packages/ui/src/product/converter/sections/basic-sections.test.ts b/packages/ui/src/product/converter/sections/basic-sections.test.ts
deleted file mode 100644
index 3815636..0000000
--- a/packages/ui/src/product/converter/sections/basic-sections.test.ts
+++ /dev/null
@@ -1,168 +0,0 @@
-import * as React from "react";
-import { renderToStaticMarkup } from "react-dom/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const captures = vi.hoisted(() => ({
-  inputs: [] as any[],
-  textareas: [] as any[],
-}));
-
-vi.mock("lucide-react", () => ({
-  ChevronDown: () => React.createElement("span", null, "down-icon"),
-  ChevronRight: () => React.createElement("span", null, "right-icon"),
-  Filter: () => React.createElement("span", null, "filter-icon"),
-  Globe: () => React.createElement("span", null, "globe-icon"),
-}));
-
-vi.mock("@subboost/ui/components/ui/badge", () => ({
-  Badge: (props: any) => React.createElement("span", props, props.children),
-}));
-
-vi.mock("@subboost/ui/components/ui/input", () => ({
-  Input: (props: any) => {
-    captures.inputs.push(props);
-    return React.createElement("input", props);
-  },
-}));
-
-vi.mock("@subboost/ui/components/ui/textarea", () => ({
-  Textarea: (props: any) => {
-    captures.textareas.push(props);
-    return React.createElement("textarea", props);
-  },
-}));
-
-vi.mock("@subboost/ui/lib/utils", () => ({
-  cn: (...parts: Array<string | false | null | undefined>) => parts.filter(Boolean).join(" "),
-}));
-
-import { DNSConfigSection } from "./dns-config-section";
-import { NodeFilterSection } from "./node-filter-section";
-import { SectionHeader } from "./section-header";
-
-function TestIcon() {
-  return React.createElement("span", null, "test-icon");
-}
-
-describe("converter shared sections", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    captures.inputs = [];
-    captures.textareas = [];
-  });
-
-  it("renders section headers and forwards the toggle callback", () => {
-    const onToggle = vi.fn();
-    const expanded = renderToStaticMarkup(
-      React.createElement(SectionHeader, {
-        expanded: true,
-        onToggle,
-        icon: TestIcon,
-        title: "标题",
-        badge: React.createElement("span", null, "badge"),
-      })
-    );
-    const collapsed = renderToStaticMarkup(
-      React.createElement(SectionHeader, {
-        expanded: false,
-        onToggle,
-        icon: TestIcon,
-        title: "折叠",
-      })
-    );
-
-    expect(expanded).toContain("down-icon");
-    expect(expanded).toContain("test-icon");
-    expect(expanded).toContain("badge");
-    expect(collapsed).toContain("right-icon");
-
-    const element = SectionHeader({
-      expanded: true,
-      onToggle,
-      icon: TestIcon,
-      title: "标题",
-    }) as React.ReactElement<{ onClick: () => void }>;
-    element.props.onClick();
-    expect(onToggle).toHaveBeenCalled();
-  });
-
-  it("renders and updates DNS config when expanded", () => {
-    const onDnsYamlChange = vi.fn();
-    const html = renderToStaticMarkup(
-      React.createElement(DNSConfigSection, {
-        expanded: true,
-        onToggle: vi.fn(),
-        dnsYaml: "dns: {}",
-        onDnsYamlChange,
-      })
-    );
-
-    expect(html).toContain("基础和 DNS 配置");
-    expect(html).toContain("直接编辑 YAML 格式的基础配置");
-    expect(captures.textareas[0]).toMatchObject({ value: "dns: {}" });
-
-    captures.textareas[0].onChange({ target: { value: "mixed-port: 7890" } });
-    expect(onDnsYamlChange).toHaveBeenCalledWith("mixed-port: 7890");
-  });
-
-  it("hides DNS config body when collapsed", () => {
-    const html = renderToStaticMarkup(
-      React.createElement(DNSConfigSection, {
-        expanded: false,
-        onToggle: vi.fn(),
-        dnsYaml: "dns: {}",
-        onDnsYamlChange: vi.fn(),
-      })
-    );
-
-    expect(html).toContain("基础和 DNS 配置");
-    expect(html).not.toContain("直接编辑 YAML 格式的基础配置");
-    expect(captures.textareas).toHaveLength(0);
-  });
-
-  it("renders node filter controls and dispatches include/exclude changes", () => {
-    const onFilterChange = vi.fn();
-    const onFilterModeChange = vi.fn();
-    const html = renderToStaticMarkup(
-      React.createElement(NodeFilterSection, {
-        expanded: true,
-        onToggle: vi.fn(),
-        filterKeyword: "香港",
-        onFilterChange,
-        filterMode: "include",
-        onFilterModeChange,
-        totalNodes: 10,
-        filteredCount: 3,
-      })
-    );
-
-    expect(html).toContain("节点筛选");
-    expect(html).toContain("3/10");
-    expect(html).toContain("包含");
-    expect(html).toContain("排除");
-    expect(captures.inputs[0]).toMatchObject({ value: "香港" });
-
-    captures.inputs[0].onChange({ target: { value: "日本" } });
-    expect(onFilterChange).toHaveBeenCalledWith("日本");
-    expect(html).toContain("bg-green-500/20");
-  });
-
-  it("omits filter body and badge when collapsed or empty", () => {
-    const html = renderToStaticMarkup(
-      React.createElement(NodeFilterSection, {
-        expanded: false,
-        onToggle: vi.fn(),
-        filterKeyword: "   ",
-        onFilterChange: vi.fn(),
-        filterMode: "exclude",
-        onFilterModeChange: vi.fn(),
-        totalNodes: 0,
-        filteredCount: 0,
-      })
-    );
-
-    expect(html).toContain("节点筛选");
-    expect(html).not.toContain("0/0");
-    expect(html).not.toContain("输入关键词过滤节点");
-  });
-});
diff --git a/packages/ui/src/product/converter/sections/dns-config-section.tsx b/packages/ui/src/product/converter/sections/dns-config-section.tsx
deleted file mode 100644
index 6cc8928..0000000
--- a/packages/ui/src/product/converter/sections/dns-config-section.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-"use client";
-
-import { Globe } from "lucide-react";
-import { DEFAULT_SUBBOOST_CONFIG } from "@subboost/core/config/defaults";
-import { Textarea } from "@subboost/ui/components/ui/textarea";
-import { SectionHeader } from "./section-header";
-
-interface DNSConfigSectionProps {
-  expanded: boolean;
-  onToggle: () => void;
-  dnsYaml: string;
-  onDnsYamlChange: (value: string) => void;
-}
-
-export function DNSConfigSection({
-  expanded,
-  onToggle,
-  dnsYaml,
-  onDnsYamlChange,
-}: DNSConfigSectionProps) {
-  return (
-    <div>
-      <SectionHeader
-        expanded={expanded}
-        onToggle={onToggle}
-        icon={Globe}
-        title="基础和 DNS 配置"
-      />
-      {expanded && (
-        <div className="mt-2 space-y-2 pl-6">
-          <p className="text-[10px] text-white/40 mb-1">
-            直接编辑 YAML 格式的基础配置（包括 mixed-port、allow-lan、dns、profile、sniffer 等）
-          </p>
-          <Textarea
-            value={dnsYaml}
-            onChange={(e) => onDnsYamlChange(e.target.value)}
-            placeholder={`# 基础配置示例
-mixed-port: ${DEFAULT_SUBBOOST_CONFIG.mixedPort}
-allow-lan: ${DEFAULT_SUBBOOST_CONFIG.allowLan}
-
-dns:
-  enable: true
-  listen: 0.0.0.0:5335
-  ...`}
-            className="min-h-[200px] max-h-[400px] text-xs font-mono resize-y"
-          />
-        </div>
-      )}
-    </div>
-  );
-}
-
diff --git a/packages/ui/src/product/converter/sections/index.ts b/packages/ui/src/product/converter/sections/index.ts
deleted file mode 100644
index 0631424..0000000
--- a/packages/ui/src/product/converter/sections/index.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-export { SectionHeader } from "./section-header";
-export type { SectionHeaderProps } from "./section-header";
-
-export { NodeInputSection } from "./node-input-section";
-export { NodeFilterSection } from "./node-filter-section";
-
diff --git a/packages/ui/src/product/converter/sections/node-filter-section.tsx b/packages/ui/src/product/converter/sections/node-filter-section.tsx
deleted file mode 100644
index afdfdf2..0000000
--- a/packages/ui/src/product/converter/sections/node-filter-section.tsx
+++ /dev/null
@@ -1,91 +0,0 @@
-"use client";
-
-import * as React from "react";
-import { Filter } from "lucide-react";
-import { Input } from "@subboost/ui/components/ui/input";
-import { Badge } from "@subboost/ui/components/ui/badge";
-import { cn } from "@subboost/ui/lib/utils";
-import { SectionHeader } from "./section-header";
-
-interface NodeFilterSectionProps {
-  expanded: boolean;
-  onToggle: () => void;
-  filterKeyword: string;
-  onFilterChange: (value: string) => void;
-  filterMode: "include" | "exclude";
-  onFilterModeChange: (mode: "include" | "exclude") => void;
-  totalNodes: number;
-  filteredCount: number;
-}
-
-export function NodeFilterSection({
-  expanded,
-  onToggle,
-  filterKeyword,
-  onFilterChange,
-  filterMode,
-  onFilterModeChange,
-  totalNodes,
-  filteredCount,
-}: NodeFilterSectionProps) {
-  const hasFilter = filterKeyword.trim().length > 0;
-  const filtered = hasFilter ? filteredCount : totalNodes;
-
-  return (
-    <div>
-      <SectionHeader
-        expanded={expanded}
-        onToggle={onToggle}
-        icon={Filter}
-        title="节点筛选"
-        badge={
-          hasFilter && totalNodes > 0 && (
-            <Badge variant="outline" className="ml-auto text-xs">
-              {filtered}/{totalNodes}
-            </Badge>
-          )
-        }
-      />
-      {expanded && (
-        <div className="mt-2 space-y-2 pl-6">
-          <div className="space-y-1.5">
-            <div className="flex gap-1 text-xs">
-              <button
-                onClick={() => onFilterModeChange("include")}
-                className={cn(
-                  "px-2 py-0.5 rounded transition-colors",
-                  filterMode === "include"
-                    ? "bg-green-500/20 text-green-400"
-                    : "text-white/40 hover:text-white/60"
-                )}
-              >
-                包含
-              </button>
-              <button
-                onClick={() => onFilterModeChange("exclude")}
-                className={cn(
-                  "px-2 py-0.5 rounded transition-colors",
-                  filterMode === "exclude"
-                    ? "bg-red-500/20 text-red-400"
-                    : "text-white/40 hover:text-white/60"
-                )}
-              >
-                排除
-              </button>
-            </div>
-            <Input
-              value={filterKeyword}
-              onChange={(e) => onFilterChange(e.target.value)}
-              placeholder="输入关键词过滤节点..."
-              className="h-7 text-xs"
-            />
-            <p className="text-[10px] text-white/30">
-              支持多个关键词，用 | 分隔，例如: 香港|日本|新加坡
-            </p>
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}
-
diff --git a/packages/ui/src/product/converter/sections/node-input-section.test.ts b/packages/ui/src/product/converter/sections/node-input-section.test.ts
deleted file mode 100644
index 04d6f83..0000000
--- a/packages/ui/src/product/converter/sections/node-input-section.test.ts
+++ /dev/null
@@ -1,297 +0,0 @@
-import * as React from "react";
-import { renderToStaticMarkup } from "react-dom/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import type { ParsedNode } from "@subboost/core/types/node";
-import type { SubscriptionSource } from "@subboost/ui/store/config-store";
-
-const mocks = vi.hoisted(() => ({
-  buttons: [] as any[],
-  inputs: [] as any[],
-  intrinsics: [] as any[],
-  textareas: [] as any[],
-  sectionHeaders: [] as any[],
-}));
-
-const stateMock = vi.hoisted(() => ({
-  enabled: false,
-  callIndex: 0,
-  overrides: {} as Record<number, unknown>,
-  setters: [] as Array<ReturnType<typeof vi.fn>>,
-}));
-
-vi.mock("react", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("react")>();
-  return {
-    ...actual,
-    useMemo: (factory: () => unknown) => factory(),
-    useState: (initial: unknown) => {
-      if (!stateMock.enabled) return actual.useState(initial);
-      const index = stateMock.callIndex++;
-      const value = Object.prototype.hasOwnProperty.call(stateMock.overrides, index)
-        ? stateMock.overrides[index]
-        : initial;
-      const setter = vi.fn((next: unknown) => {
-        const resolved = typeof next === "function" ? (next as (prev: unknown) => unknown)(value) : next;
-        (setter as any).lastValue = resolved;
-        return resolved;
-      });
-      stateMock.setters[index] = setter;
-      return [value, setter];
-    },
-  };
-});
-
-vi.mock("react/jsx-runtime", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("react/jsx-runtime")>();
-  const capture = (type: unknown, props: Record<string, unknown> | null, key?: unknown) => {
-    if (typeof type === "string") {
-      mocks.intrinsics.push({ type, props: props ?? {}, key });
-    }
-  };
-  return {
-    ...actual,
-    jsx: (type: unknown, props: Record<string, unknown> | null, key?: unknown) => {
-      capture(type, props, key);
-      return actual.jsx(type as any, props, key as any);
-    },
-    jsxs: (type: unknown, props: Record<string, unknown> | null, key?: unknown) => {
-      capture(type, props, key);
-      return actual.jsxs(type as any, props, key as any);
-    },
-  };
-});
-
-vi.mock("lucide-react", () => ({
-  Plus: () => React.createElement("span", null, "plus"),
-  Trash2: () => React.createElement("span", null, "trash"),
-  Link2: () => React.createElement("span", null, "link"),
-  FileCode: () => React.createElement("span", null, "file"),
-  Server: () => React.createElement("span", null, "server"),
-  Check: () => React.createElement("span", null, "check"),
-  Loader2: () => React.createElement("span", null, "loading"),
-  Pencil: () => React.createElement("span", null, "pencil"),
-  X: () => React.createElement("span", null, "x"),
-  Search: () => React.createElement("span", null, "search"),
-}));
-
-vi.mock("@subboost/ui/components/ui/button", () => ({
-  Button: (props: any) => {
-    mocks.buttons.push(props);
-    return React.createElement("button", props, props.children);
-  },
-}));
-
-vi.mock("@subboost/ui/components/ui/input", () => ({
-  Input: (props: any) => {
-    mocks.inputs.push(props);
-    return React.createElement("input", props);
-  },
-}));
-
-vi.mock("@subboost/ui/components/ui/textarea", () => ({
-  Textarea: (props: any) => {
-    mocks.textareas.push(props);
-    return React.createElement("textarea", props);
-  },
-}));
-
-vi.mock("@subboost/ui/components/ui/badge", () => ({
-  Badge: (props: any) => React.createElement("span", { className: props.className }, props.children),
-}));
-
-vi.mock("@subboost/ui/lib/utils", () => ({
-  cn: (...parts: Array<string | false | null | undefined>) => parts.filter(Boolean).join(" "),
-}));
-
-vi.mock("./section-header", () => ({
-  SectionHeader: (props: any) => {
-    mocks.sectionHeaders.push(props);
-    return React.createElement("header", null, props.title, props.badge);
-  },
-}));
-
-vi.mock("@subboost/ui/product/converter/subscription-import-error", () => ({
-  SubscriptionImportErrorBadge: () => React.createElement("span", null, "import-error"),
-}));
-
-import { NodeInputSection } from "./node-input-section";
-
-function source(overrides: Partial<SubscriptionSource> = {}): SubscriptionSource {
-  return {
-    id: "source-1",
-    type: "url",
-    content: "https://example.test/sub",
-    parsed: false,
-    parsing: false,
-    ...overrides,
-  } as SubscriptionSource;
-}
-
-function node(name: string): ParsedNode {
-  return { name, type: "direct" } as ParsedNode;
-}
-
-function renderSection(
-  props: Partial<React.ComponentProps<typeof NodeInputSection>> = {},
-  stateOverrides: Record<number, unknown> = {}
-) {
-  const callbacks = {
-    onToggle: vi.fn(),
-    onAddSource: vi.fn(),
-    onRemoveSource: vi.fn(),
-    onUpdateSourceType: vi.fn(),
-    onUpdateSourceContent: vi.fn(),
-    onParseSource: vi.fn(),
-    onRemoveNode: vi.fn(),
-    onRenameNode: vi.fn(),
-  };
-  const fullProps: React.ComponentProps<typeof NodeInputSection> = {
-    expanded: true,
-    sources: [source()],
-    nodes: [],
-    ...callbacks,
-    ...props,
-  };
-
-  stateMock.enabled = true;
-  stateMock.callIndex = 0;
-  stateMock.overrides = stateOverrides;
-  stateMock.setters = [];
-  mocks.buttons = [];
-  mocks.inputs = [];
-  mocks.intrinsics = [];
-  mocks.textareas = [];
-  mocks.sectionHeaders = [];
-  try {
-    const html = renderToStaticMarkup(React.createElement(NodeInputSection, fullProps));
-    return {
-      html,
-      callbacks,
-      setters: stateMock.setters,
-      buttons: mocks.buttons,
-      inputs: mocks.inputs,
-      intrinsics: mocks.intrinsics,
-      textareas: mocks.textareas,
-    };
-  } finally {
-    stateMock.enabled = false;
-  }
-}
-
-function textOf(children: unknown): string {
-  if (typeof children === "string" || typeof children === "number") return String(children);
-  if (Array.isArray(children)) return children.map(textOf).join("");
-  if (React.isValidElement(children)) return textOf((children.props as { children?: unknown }).children);
-  return "";
-}
-
-function findIntrinsic(type: string, predicate: (props: any) => boolean) {
-  const found = mocks.intrinsics.find((item: any) => item.type === type && predicate(item.props));
-  expect(found).toBeTruthy();
-  return found.props;
-}
-
-describe("NodeInputSection", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it("renders only the section header when collapsed", () => {
-    const { html } = renderSection({ expanded: false, sources: [source(), source({ id: "source-2", type: "yaml" })] });
-
-    expect(html).toContain("节点导入");
-    expect(html).toContain("2 个导入源");
-    expect(html).not.toContain("添加订阅源");
-  });
-
-  it("renders subscription sources and dispatches source actions", () => {
-    const { html, callbacks, buttons, textareas } = renderSection({
-      sources: [
-        source({ id: "url", type: "url", parsed: true, nodeCount: 3 }),
-        source({ id: "yaml", type: "yaml", content: "proxies: []", error: "bad yaml" }),
-      ],
-    });
-
-    expect(html).toContain("订阅链接 #1");
-    expect(html).toContain("YAML 配置 #2");
-    expect(html).toContain("✓ 3");
-    expect(html).toContain("import-error");
-
-    textareas[0].onChange({ target: { value: "https://new.example/sub" } });
-    expect(callbacks.onUpdateSourceContent).toHaveBeenCalledWith("url", "https://new.example/sub");
-
-    buttons[0].onClick();
-    expect(callbacks.onAddSource).toHaveBeenCalled();
-
-    findIntrinsic("button", (props) => props.title === "YAML 配置").onClick();
-    expect(callbacks.onUpdateSourceType).toHaveBeenCalledWith("url", "yaml");
-
-    findIntrinsic("button", (props) => props.title === "节点链接").onClick();
-    expect(callbacks.onUpdateSourceType).toHaveBeenCalledWith("url", "nodes");
-
-    findIntrinsic("button", (props) => props.title === "解析导入").onClick();
-    expect(callbacks.onParseSource).toHaveBeenCalledWith("url");
-
-    findIntrinsic("button", (props) => props.title === "删除").onClick();
-    expect(callbacks.onRemoveSource).toHaveBeenCalledWith("url");
-  });
-
-  it("limits very large node lists and toggles show-all state", () => {
-    const nodes = Array.from({ length: 201 }, (_, index) => node(`node-${index}`));
-    const { html, buttons, setters } = renderSection({ nodes });
-
-    expect(html).toContain("已导入节点");
-    expect(html).toContain("仅显示前 200 个节点");
-    expect(html).toContain("显示全部 (201)");
-
-    const showAllButton = buttons.find((button) => String(button.children).includes("显示全部"));
-    showAllButton.onClick();
-    expect(setters[3]).toHaveBeenCalled();
-    expect((setters[3] as any).lastValue).toBe(true);
-  });
-
-  it("renders search empty state without list limiting", () => {
-    const { html, inputs, setters } = renderSection({ nodes: [node("Alpha"), node("Beta")] }, { 2: "missing" });
-
-    expect(inputs[0]).toMatchObject({ value: "missing", placeholder: "搜索节点..." });
-    inputs[0].onChange({ target: { value: "Alpha" } });
-    expect(setters[2]).toHaveBeenCalledWith("Alpha");
-    expect(html).toContain("未找到匹配节点");
-    expect(html).not.toContain("仅显示前 200 个节点");
-  });
-
-  it("renders node edit mode and saves with Enter", () => {
-    const { callbacks, html, setters } = renderSection({ nodes: [node("Old")] }, { 0: "Old", 1: "New" });
-
-    expect(html).toContain('value="New"');
-    expect(html).toContain("check");
-    expect(html).toContain("x");
-
-    const editInput = findIntrinsic("input", (props) => props.type === "text" && props.value === "New");
-    editInput.onChange({ target: { value: "Next" } });
-    expect(setters[1]).toHaveBeenCalledWith("Next");
-    editInput.onKeyDown({ key: "Enter" });
-    expect(callbacks.onRenameNode).toHaveBeenCalledWith("Old", "New");
-    expect(setters[0]).toHaveBeenCalledWith(null);
-    expect(setters[1]).toHaveBeenCalledWith("");
-
-    const sameName = renderSection({ nodes: [node("Old")] }, { 0: "Old", 1: "Old" });
-    findIntrinsic("button", (props) => typeof props.className === "string" && props.className.includes("text-green-400")).onClick();
-    expect(sameName.callbacks.onRenameNode).not.toHaveBeenCalledWith("Old", "Old");
-
-    const cancel = renderSection({ nodes: [node("Old")] }, { 0: "Old", 1: "New" });
-    findIntrinsic("button", (props) => typeof props.className === "string" && props.className.includes("text-red-400")).onClick();
-    expect(cancel.setters[0]).toHaveBeenCalledWith(null);
-  });
-
-  it("starts node editing and removes nodes from action buttons", () => {
-    const { callbacks, setters } = renderSection({ nodes: [node("Alpha")] });
-
-    findIntrinsic("button", (props) => props.title === "重命名").onClick();
-    expect(setters[0]).toHaveBeenCalledWith("Alpha");
-    expect(setters[1]).toHaveBeenCalledWith("Alpha");
-
-    findIntrinsic("button", (props) => props.title === "删除").onClick();
-    expect(callbacks.onRemoveNode).toHaveBeenCalledWith("Alpha");
-  });
-});
diff --git a/packages/ui/src/product/converter/sections/node-input-section.tsx b/packages/ui/src/product/converter/sections/node-input-section.tsx
deleted file mode 100644
index 32029e4..0000000
--- a/packages/ui/src/product/converter/sections/node-input-section.tsx
+++ /dev/null
@@ -1,327 +0,0 @@
-"use client";
-
-import * as React from "react";
-import {
-  Plus,
-  Trash2,
-  Link2,
-  FileCode,
-  Server,
-  Check,
-  Loader2,
-  Pencil,
-  X,
-  Search,
-} from "lucide-react";
-import { Button } from "@subboost/ui/components/ui/button";
-import { Input } from "@subboost/ui/components/ui/input";
-import { Textarea } from "@subboost/ui/components/ui/textarea";
-import { Badge } from "@subboost/ui/components/ui/badge";
-import { cn } from "@subboost/ui/lib/utils";
-import { SectionHeader } from "./section-header";
-import type { SubscriptionSource, SourceType } from "@subboost/ui/store/config-store";
-import type { ParsedNode } from "@subboost/core/types/node";
-import { SubscriptionImportErrorBadge } from "@subboost/ui/product/converter/subscription-import-error";
-
-const sourceTypeInfo: Record<
-  SourceType,
-  { label: string; icon: typeof Link2; placeholder: string }
-> = {
-  url: {
-    label: "订阅链接",
-    icon: Link2,
-    placeholder: "https://example.com/sub?token=xxx",
-  },
-  yaml: {
-    label: "YAML 配置",
-    icon: FileCode,
-    placeholder: "proxies:\n  - name: 节点名称\n    type: vmess\n    ...",
-  },
-  nodes: {
-    label: "节点链接",
-    icon: Server,
-    placeholder:
-      "ss://...\nssr://...\nvmess://...\nvless://...\ntrojan://...\nanytls://...\nhysteria2://... / hy2://...\ntuic://...\n(socks5://... / socks4://...)",
-  },
-};
-
-interface NodeInputSectionProps {
-  expanded: boolean;
-  onToggle: () => void;
-  sources: SubscriptionSource[];
-  nodes: ParsedNode[];
-  onAddSource: () => void;
-  onRemoveSource: (id: string) => void;
-  onUpdateSourceType: (id: string, type: SourceType) => void;
-  onUpdateSourceContent: (id: string, content: string) => void;
-  onParseSource: (id: string) => void;
-  onRemoveNode: (name: string) => void;
-  onRenameNode: (oldName: string, newName: string) => void;
-}
-
-export function NodeInputSection({
-  expanded,
-  onToggle,
-  sources,
-  nodes,
-  onAddSource,
-  onRemoveSource,
-  onUpdateSourceType,
-  onUpdateSourceContent,
-  onParseSource,
-  onRemoveNode,
-  onRenameNode,
-}: NodeInputSectionProps) {
-  const [editingNodeName, setEditingNodeName] = React.useState<string | null>(null);
-  const [editNodeValue, setEditNodeValue] = React.useState("");
-  const [nodeSearch, setNodeSearch] = React.useState("");
-  const [showAllNodes, setShowAllNodes] = React.useState(false);
-
-  const NODE_RENDER_LIMIT = 200;
-  const normalizedSearch = nodeSearch.trim().toLowerCase();
-
-  const filteredNodes = React.useMemo(() => {
-    if (!normalizedSearch) return nodes;
-    return nodes.filter((n) => n.name.toLowerCase().includes(normalizedSearch));
-  }, [nodes, normalizedSearch]);
-
-  const shouldLimit = !showAllNodes && !normalizedSearch && filteredNodes.length > NODE_RENDER_LIMIT;
-  const displayedNodes = shouldLimit ? filteredNodes.slice(0, NODE_RENDER_LIMIT) : filteredNodes;
-
-  const handleStartEdit = (name: string) => {
-    setEditingNodeName(name);
-    setEditNodeValue(name);
-  };
-
-  const handleSaveEdit = (oldName: string) => {
-    if (editNodeValue.trim() && editNodeValue !== oldName) {
-      onRenameNode(oldName, editNodeValue.trim());
-    }
-    setEditingNodeName(null);
-    setEditNodeValue("");
-  };
-
-  const handleCancelEdit = () => {
-    setEditingNodeName(null);
-    setEditNodeValue("");
-  };
-
-  const sourceCount = sources.length;
-
-  return (
-    <div>
-      <SectionHeader
-        expanded={expanded}
-        onToggle={onToggle}
-        icon={Server}
-        title="节点导入"
-        badge={
-          sourceCount > 0 && (
-            <Badge variant="outline" className="ml-auto border-blue-500/50 bg-blue-500/10 text-blue-300">
-              {sourceCount} 个导入源
-            </Badge>
-          )
-        }
-      />
-      {expanded && (
-        <div className="mt-2 space-y-2 pl-6">
-          {sources.map((source, index) => {
-            const typeInfo = sourceTypeInfo[source.type];
-            return (
-              <div key={source.id} className="space-y-1">
-                <div className="flex items-center justify-between">
-                  <div className="flex items-center gap-2">
-                    <div className="flex gap-0.5">
-                      {(Object.keys(sourceTypeInfo) as SourceType[]).map(
-                        (type) => {
-                          const info = sourceTypeInfo[type];
-                          const Icon = info.icon;
-                          return (
-                            <button
-                              key={type}
-                              onClick={() => onUpdateSourceType(source.id, type)}
-                              className={cn(
-                                "p-1 rounded transition-colors",
-                                source.type === type
-                                  ? "bg-indigo-500/20 text-indigo-400"
-                                  : "text-white/30 hover:text-white/50 hover:bg-white/5"
-                              )}
-                              title={info.label}
-                            >
-                              <Icon className="h-3.5 w-3.5" />
-                            </button>
-                          );
-                        }
-                      )}
-                    </div>
-                    <span className="text-xs text-white/50">
-                      {typeInfo.label} {sources.length > 1 && `#${index + 1}`}
-                    </span>
-                    {source.parsed && source.nodeCount !== undefined && (
-                      <span className="text-xs text-green-400">
-                        ✓ {source.nodeCount}
-                      </span>
-                    )}
-                    {(source.errorInfo || source.error) && (
-                      <SubscriptionImportErrorBadge errorInfo={source.errorInfo} errorMessage={source.error} />
-                    )}
-                  </div>
-                  <div className="flex items-center gap-0.5">
-                    <button
-                      onClick={() => onParseSource(source.id)}
-                      disabled={!source.content.trim() || source.parsing}
-                      className={cn(
-                        "p-1 rounded transition-colors",
-                        source.parsing
-                          ? "text-indigo-400"
-                          : source.parsed
-                          ? "text-green-400 hover:text-green-300"
-                          : source.content.trim()
-                          ? "text-white/30 hover:text-indigo-400 hover:bg-indigo-500/10"
-                          : "text-white/10 cursor-not-allowed"
-                      )}
-                      title="解析导入"
-                    >
-                      {source.parsing ? (
-                        <Loader2 className="h-3.5 w-3.5 animate-spin" />
-                      ) : source.parsed ? (
-                        <Check className="h-3.5 w-3.5" />
-                      ) : (
-                        <Check className="h-3.5 w-3.5" />
-                      )}
-                    </button>
-                    {sources.length > 1 && (
-                      <button
-                        onClick={() => onRemoveSource(source.id)}
-                        className="p-1 rounded text-white/30 hover:text-red-400 hover:bg-red-500/10 transition-colors"
-                        title="删除"
-                      >
-                        <Trash2 className="h-3.5 w-3.5" />
-                      </button>
-                    )}
-                  </div>
-                </div>
-                <Textarea
-                  value={source.content}
-                  onChange={(e) =>
-                    onUpdateSourceContent(source.id, e.target.value)
-                  }
-                  placeholder={typeInfo.placeholder}
-                  className={cn(
-                    "min-h-[60px] max-h-[120px] text-xs font-mono resize-y",
-                    source.type === "url" && "min-h-[36px] max-h-[36px]"
-                  )}
-                />
-              </div>
-            );
-          })}
-
-          <Button
-            variant="outline"
-            size="sm"
-            onClick={onAddSource}
-            className="w-full text-xs h-7"
-          >
-            <Plus className="h-3 w-3 mr-1" />
-            添加订阅源
-          </Button>
-
-          {/* 已导入节点列表 */}
-          {nodes.length > 0 && (
-            <div className="pt-2 border-t border-white/10">
-              <div className="text-xs text-white/40 mb-1.5">已导入节点</div>
-              <div className="flex items-center gap-2 mb-2">
-                <div className="relative flex-1">
-                  <Search className="absolute left-2 top-1/2 -translate-y-1/2 h-3.5 w-3.5 text-white/30" />
-                  <Input
-                    value={nodeSearch}
-                    onChange={(e) => setNodeSearch(e.target.value)}
-                    placeholder="搜索节点..."
-                    className="h-8 pl-7 text-xs"
-                  />
-                </div>
-                {nodes.length > NODE_RENDER_LIMIT && !normalizedSearch && (
-                  <Button
-                    variant="ghost"
-                    size="sm"
-                    className="h-8 px-2 text-xs text-white/60 hover:text-white"
-                    onClick={() => setShowAllNodes((v) => !v)}
-                    title={showAllNodes ? "仅显示部分节点" : "显示全部节点"}
-                  >
-                    {showAllNodes ? "收起" : `显示全部 (${nodes.length})`}
-                  </Button>
-                )}
-              </div>
-
-              {!normalizedSearch && shouldLimit && (
-                <div className="text-[10px] text-white/40 mb-1">
-                  为避免卡顿，仅显示前 {NODE_RENDER_LIMIT} 个节点；可用搜索查看其它节点
-                </div>
-              )}
-
-              <div className="flex flex-wrap gap-1 max-h-[150px] overflow-y-auto">
-                {displayedNodes.map((node) => (
-                  <div
-                    key={node.name}
-                    className="group flex items-center gap-0.5 px-1.5 py-0.5 rounded bg-white/5 text-xs"
-                  >
-                    {editingNodeName === node.name ? (
-                      <div className="flex items-center gap-1">
-                        <input
-                          type="text"
-                          value={editNodeValue}
-                          onChange={(e) => setEditNodeValue(e.target.value)}
-                          className="w-20 px-1 py-0.5 bg-white/5 border border-indigo-500/50 rounded text-xs"
-                          autoFocus
-                          onKeyDown={(e) => {
-                            if (e.key === "Enter") handleSaveEdit(node.name);
-                            if (e.key === "Escape") handleCancelEdit();
-                          }}
-                        />
-                        <button
-                          onClick={() => handleSaveEdit(node.name)}
-                          className="p-0.5 text-green-400 hover:bg-green-500/20 rounded"
-                        >
-                          <Check className="h-3 w-3" />
-                        </button>
-                        <button
-                          onClick={handleCancelEdit}
-                          className="p-0.5 text-red-400 hover:bg-red-500/20 rounded"
-                        >
-                          <X className="h-3 w-3" />
-                        </button>
-                      </div>
-                    ) : (
-                      <>
-                        <span className="text-white/70 truncate max-w-[100px]">
-                          {node.name}
-                        </span>
-                        <button
-                          onClick={() => handleStartEdit(node.name)}
-                          className="p-0.5 opacity-0 group-hover:opacity-100 text-white/30 hover:text-indigo-400 transition-opacity"
-                          title="重命名"
-                        >
-                          <Pencil className="h-2.5 w-2.5" />
-                        </button>
-                        <button
-                          onClick={() => onRemoveNode(node.name)}
-                          className="p-0.5 opacity-0 group-hover:opacity-100 text-white/30 hover:text-red-400 transition-opacity"
-                          title="删除"
-                        >
-                          <X className="h-2.5 w-2.5" />
-                        </button>
-                      </>
-                    )}
-                  </div>
-                ))}
-                {displayedNodes.length === 0 && (
-                  <div className="text-[10px] text-white/40 py-1">未找到匹配节点</div>
-                )}
-              </div>
-            </div>
-          )}
-        </div>
-      )}
-    </div>
-  );
-}
diff --git a/packages/ui/src/product/converter/sections/section-header.tsx b/packages/ui/src/product/converter/sections/section-header.tsx
deleted file mode 100644
index 4d3212e..0000000
--- a/packages/ui/src/product/converter/sections/section-header.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-"use client";
-
-import * as React from "react";
-import { ChevronDown, ChevronRight } from "lucide-react";
-
-export interface SectionHeaderProps {
-  expanded: boolean;
-  onToggle: () => void;
-  icon: React.ComponentType<{ className?: string }>;
-  title: string;
-  badge?: React.ReactNode;
-}
-
-export function SectionHeader({
-  expanded,
-  onToggle,
-  icon: Icon,
-  title,
-  badge,
-}: SectionHeaderProps) {
-  return (
-    <button
-      onClick={onToggle}
-      className="w-full flex items-center gap-2 py-1.5 px-2 rounded-lg hover:bg-white/5 transition-colors"
-    >
-      {expanded ? (
-        <ChevronDown className="h-4 w-4 text-white/50" />
-      ) : (
-        <ChevronRight className="h-4 w-4 text-white/50" />
-      )}
-      <Icon className="h-4 w-4 text-indigo-400" />
-      <span className="text-sm font-medium text-white">{title}</span>
-      {badge}
-    </button>
-  );
-}
-
diff --git a/packages/ui/src/product/converter/source-controls.tsx b/packages/ui/src/product/converter/source-controls.tsx
new file mode 100644
index 0000000..36e242d
--- /dev/null
+++ b/packages/ui/src/product/converter/source-controls.tsx
@@ -0,0 +1,160 @@
+"use client";
+
+import { HelpCircle, Menu, Plus } from "lucide-react";
+import type { ParsedNode } from "@subboost/core/types/node";
+import { Button } from "@subboost/ui/components/ui/button";
+import { ChoiceChip, ChoiceGroup } from "@subboost/ui/components/ui/choice-group";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@subboost/ui/components/ui/dropdown-menu";
+import {
+  Popover,
+  PopoverArrow,
+  PopoverContent,
+  PopoverTrigger,
+} from "@subboost/ui/components/ui/popover";
+import { cn } from "@subboost/ui/lib/utils";
+import { getSubscriptionUserInfoDisplay } from "@subboost/ui/product/subscription/subscription-userinfo-display";
+import type { SourceType, SubscriptionSource } from "@subboost/ui/store/config-store";
+import { sourceTypeInfo } from "./source-type-info";
+
+const sourceTypes = Object.keys(sourceTypeInfo) as SourceType[];
+
+export function SourceTypeChoices({
+  value,
+  onChange,
+  compact = false,
+}: {
+  value: SourceType;
+  onChange: (type: SourceType) => void;
+  compact?: boolean;
+}) {
+  return (
+    <ChoiceGroup label="导入源类型" className={compact ? "gap-0.5" : "gap-1"}>
+      {sourceTypes.map((type) => {
+        const info = sourceTypeInfo[type];
+        const Icon = info.icon;
+        return (
+          <ChoiceChip
+            key={type}
+            selected={value === type}
+            onClick={() => onChange(type)}
+            title={info.label}
+            label={
+              <>
+                <Icon className="h-3.5 w-3.5" aria-hidden="true" />
+                <span className="sr-only">{info.label}</span>
+              </>
+            }
+            className={cn(
+              "min-h-0 rounded border-0 p-1",
+              value === type
+                ? "bg-indigo-500/20 text-indigo-400"
+                : "bg-transparent text-white/30 hover:bg-white/5 hover:text-white/50"
+            )}
+          />
+        );
+      })}
+    </ChoiceGroup>
+  );
+}
+
+export function SourceStatusPopover({
+  source,
+  nodes,
+}: {
+  source: SubscriptionSource;
+  nodes: ParsedNode[];
+}) {
+  if (!source.parsed || source.nodeCount === undefined) return null;
+
+  const userInfo = getSubscriptionUserInfoDisplay(source.subscriptionUserInfo, nodes);
+  const hasUserInfo = Boolean(userInfo && (userInfo.traffic || userInfo.expire));
+
+  return (
+    <Popover>
+      <PopoverTrigger asChild>
+        <Button
+          type="button"
+          variant="ghost"
+          size="sm"
+          className="h-auto gap-1 whitespace-nowrap rounded-full border border-green-500/50 bg-green-500/5 px-2 py-0.5 text-xs font-semibold text-green-300 hover:bg-green-500/10"
+          title="查看流量/到期"
+          aria-label="查看流量/到期"
+        >
+          ✓ {source.nodeCount} 节点
+          <Menu className="h-3 w-3 text-green-300/70" aria-hidden="true" />
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent side="bottom" align="start" className="w-[260px] bg-black/90 p-3">
+        <div className="space-y-2 text-xs">
+          <div className="flex items-center gap-2">
+            <HelpCircle className="h-4 w-4 text-green-300" aria-hidden="true" />
+            <p className="font-medium text-white">订阅信息</p>
+          </div>
+          {hasUserInfo && userInfo ? (
+            <div className="space-y-1 text-white/60">
+              {userInfo.traffic ? <p>已用流量：{userInfo.traffic}</p> : null}
+              {userInfo.expire ? <p>到期时间：{userInfo.expire}</p> : null}
+            </div>
+          ) : (
+            <p className="leading-relaxed text-white/60">暂无已用流量/到期时间信息</p>
+          )}
+        </div>
+        <PopoverArrow className="fill-black/90" />
+      </PopoverContent>
+    </Popover>
+  );
+}
+
+export function AddSourceMenu({
+  open,
+  onOpenChange,
+  onAdd,
+  compact = false,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onAdd: (type: SourceType) => void;
+  compact?: boolean;
+}) {
+  return (
+    <DropdownMenu open={open} onOpenChange={onOpenChange}>
+      <DropdownMenuTrigger asChild>
+        <Button
+          variant="outline"
+          size="sm"
+          className={cn(
+            "w-full border-dashed border-white/20 text-xs text-white/50 hover:border-white/30 hover:text-white/70",
+            compact ? "h-7" : "h-8"
+          )}
+        >
+          <Plus className="h-3.5 w-3.5" aria-hidden="true" />
+          添加订阅/节点源
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="w-[var(--radix-dropdown-menu-trigger-width)] border-white/10 bg-[#1a1a1a] text-white">
+        {sourceTypes.map((type) => {
+          const info = sourceTypeInfo[type];
+          const Icon = info.icon;
+          return (
+            <DropdownMenuItem
+              key={type}
+              onSelect={() => onAdd(type)}
+              className={cn("gap-3 focus:bg-white/5 focus:text-white", compact ? "py-2" : "py-2.5")}
+            >
+              <Icon className="h-4 w-4 text-indigo-400" aria-hidden="true" />
+              <span>
+                <span className="block text-xs font-medium text-white">{info.label}</span>
+                {!compact ? <span className="block text-[10px] text-white/40">{info.description}</span> : null}
+              </span>
+            </DropdownMenuItem>
+          );
+        })}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+}
diff --git a/packages/ui/src/product/converter/source-editor-dialog.tsx b/packages/ui/src/product/converter/source-editor-dialog.tsx
new file mode 100644
index 0000000..07fcb77
--- /dev/null
+++ b/packages/ui/src/product/converter/source-editor-dialog.tsx
@@ -0,0 +1,155 @@
+"use client";
+
+import { HelpCircle } from "lucide-react";
+import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
+import { Button } from "@subboost/ui/components/ui/button";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@subboost/ui/components/ui/dialog";
+import { FormField } from "@subboost/ui/components/ui/form-field";
+import { HelpPopover } from "@subboost/ui/components/ui/popover";
+import { Input } from "@subboost/ui/components/ui/input";
+import { Switch } from "@subboost/ui/components/ui/switch";
+import { Textarea } from "@subboost/ui/components/ui/textarea";
+import type { SubscriptionSource } from "@subboost/ui/store/config-store";
+import { sourceTypeInfo } from "./source-type-info";
+
+export type SourceEditorDialogProps = {
+  source: SubscriptionSource | null;
+  previewName: string;
+  onClose: () => void;
+  onUpdateContent: (id: string, content: string) => void;
+  onUpdateMeta: (id: string, patch: Partial<SubscriptionSource>) => void;
+};
+
+export function SourceEditorDialog({
+  source,
+  previewName,
+  onClose,
+  onUpdateContent,
+  onUpdateMeta,
+}: SourceEditorDialogProps) {
+  return (
+    <Dialog open={Boolean(source)} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent className="w-[calc(100vw-2rem)] sm:max-w-4xl">
+        <DialogHeader>
+          <DialogTitle>{source ? `高级编辑：${sourceTypeInfo[source.type].label}` : "高级编辑"}</DialogTitle>
+        </DialogHeader>
+
+        {source ? (
+          <div className="space-y-3">
+            <div className="grid gap-3 sm:grid-cols-3">
+              <FormField label="标签（tag）">
+                <Input
+                  value={source.tag ?? ""}
+                  onChange={(event) => onUpdateMeta(source.id, { tag: event.target.value })}
+                  placeholder="例如：A / 订阅1 / 自建1"
+                  className="text-xs"
+                />
+              </FormField>
+              <FormField label="节点命名模板">
+                <Input
+                  value={source.nameTemplate ?? DEFAULT_NODE_NAME_TEMPLATE}
+                  onChange={(event) => onUpdateMeta(source.id, { nameTemplate: event.target.value })}
+                  className="text-xs font-mono"
+                />
+              </FormField>
+              <FormField label="预览">
+                <Input value={previewName} readOnly className="text-xs font-mono" />
+              </FormField>
+            </div>
+
+            <p className="text-[11px] text-white/40">
+              可用占位符：{"{tag}"}、{"{name}"}；留空则默认：{DEFAULT_NODE_NAME_TEMPLATE}
+            </p>
+
+            <div className="space-y-1">
+              <p className="text-xs text-white/60">{sourceTypeInfo[source.type].label}</p>
+              {source.type === "url" ? (
+                <div className="space-y-3">
+                  <div className="flex items-center gap-3">
+                    <Input
+                      value={source.content}
+                      onChange={(event) => onUpdateContent(source.id, event.target.value)}
+                      placeholder={sourceTypeInfo[source.type].placeholder}
+                      className="min-w-0 flex-1 text-xs"
+                    />
+                    <div className="flex h-10 flex-none items-center gap-2 rounded-xl border border-white/10 bg-white/5 px-3">
+                      <span className="whitespace-nowrap text-xs text-white/70">proxy-providers模式</span>
+                      <HelpPopover
+                        label="proxy-providers 模式说明"
+                        side="bottom"
+                        align="end"
+                        contentClassName="w-[360px] bg-black/90 p-3"
+                      >
+                        <div className="space-y-2 text-xs">
+                          <div className="flex items-center gap-2">
+                            <HelpCircle className="h-4 w-4 text-amber-300" aria-hidden="true" />
+                            <p className="font-medium text-white">proxy-providers 模式</p>
+                          </div>
+                          <p className="leading-relaxed text-white/60">
+                            部分订阅限制 CN IP 导入，url 无法在 SubBoost 内拉取解析。开启后 SubBoost
+                            不再拉取/解析该 url，而是在最终配置中写入{" "}
+                            <span className="font-mono">proxy-providers</span>，交由客户端自行拉取节点。
+                          </p>
+                          <div className="space-y-1 border-t border-white/10 pt-2 text-white/60">
+                            <p className="font-medium text-white/80">注意开启后：</p>
+                            <ul className="ml-4 list-disc space-y-1">
+                              <li>无法在预览中查看/管理该 url 的节点</li>
+                              <li>无法将这些节点用于中转代理组、分流组高级模式等高级功能</li>
+                              <li>节点命名模板与 tag 在该模式下不生效</li>
+                            </ul>
+                          </div>
+                          <p className="border-t border-white/10 pt-2 text-[10px] text-white/40">
+                            若导入 url 报“未解析到有效节点/获取失败”等，可尝试开启此模式。
+                          </p>
+                        </div>
+                      </HelpPopover>
+                      <Switch
+                        checked={Boolean(source.useProxyProviders)}
+                        onCheckedChange={(checked) => onUpdateMeta(source.id, { useProxyProviders: checked })}
+                        aria-label="使用 proxy-providers 模式"
+                      />
+                    </div>
+                  </div>
+
+                  <div className="grid gap-3 sm:grid-cols-2">
+                    <FormField label="流量/到期信息 URL（可选）">
+                      <Input
+                        value={source.userinfoUrl ?? ""}
+                        onChange={(event) => onUpdateMeta(source.id, { userinfoUrl: event.target.value })}
+                        placeholder="留空则默认使用当前订阅源 URL"
+                        className="text-xs"
+                      />
+                    </FormField>
+                    <FormField label="流量信息 User-Agent（可选）">
+                      <Input
+                        value={source.userinfoUserAgent ?? ""}
+                        onChange={(event) => onUpdateMeta(source.id, { userinfoUserAgent: event.target.value })}
+                        placeholder="例如 clash.meta/v1.19.16"
+                        className="text-xs"
+                      />
+                    </FormField>
+                  </div>
+                  <p className="text-[11px] text-white/40">
+                    有些订阅源不会直接返回 <span className="font-mono">subscription-userinfo</span>，但会提供独立的流量接口。
+                    设置后，SubBoost 会在导入/刷新时额外抓取该接口，用来更新这个源自己的流量与到期快照。
+                  </p>
+                </div>
+              ) : (
+                <Textarea
+                  value={source.content}
+                  onChange={(event) => onUpdateContent(source.id, event.target.value)}
+                  placeholder={sourceTypeInfo[source.type].placeholder}
+                  className="min-h-[60vh] text-xs font-mono"
+                />
+              )}
+            </div>
+          </div>
+        ) : null}
+
+        <div className="flex justify-end gap-2">
+          <Button variant="outline" onClick={onClose}>完成</Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/packages/ui/src/product/converter/source-type-info.ts b/packages/ui/src/product/converter/source-type-info.ts
new file mode 100644
index 0000000..ca3b655
--- /dev/null
+++ b/packages/ui/src/product/converter/source-type-info.ts
@@ -0,0 +1,31 @@
+import { FileCode, Link2, Server } from "lucide-react";
+import type { SourceType } from "@subboost/ui/store/config-store";
+
+export type SourceTypeInfo = {
+  label: string;
+  icon: typeof Link2;
+  placeholder: string;
+  description: string;
+};
+
+export const sourceTypeInfo: Record<SourceType, SourceTypeInfo> = {
+  url: {
+    label: "订阅链接",
+    icon: Link2,
+    placeholder: "https://example.com/sub?token=xxx",
+    description: "输入订阅链接，系统将自动获取节点",
+  },
+  yaml: {
+    label: "YAML 配置",
+    icon: FileCode,
+    placeholder: "proxies:\n  - name: 节点名称\n    type: vmess\n    ...",
+    description: "粘贴完整的 Clash YAML 配置文件",
+  },
+  nodes: {
+    label: "节点链接",
+    icon: Server,
+    placeholder:
+      "ss://...\nssr://...\nvmess://...\nvless://...\ntrojan://...\nanytls://...\nhysteria2://... / hy2://...\ntuic://...\n(socks5://... / socks4://...)",
+    description: "每行一个节点链接，支持 ss/ssr/vmess/vless/trojan/anytls/hy2/tuic",
+  },
+};
diff --git a/packages/ui/src/product/converter/subscription-import-error.test.ts b/packages/ui/src/product/converter/subscription-import-error.test.ts
index 609b7f5..489f769 100644
--- a/packages/ui/src/product/converter/subscription-import-error.test.ts
+++ b/packages/ui/src/product/converter/subscription-import-error.test.ts
@@ -46,6 +46,13 @@ vi.mock("@subboost/ui/lib/utils", () => ({
   cn: (...parts: Array<string | false | null | undefined>) => parts.filter(Boolean).join(" "),
 }));
 
+vi.mock("@subboost/ui/components/ui/button", () => ({
+  Button: (props: any) => {
+    if (typeof props.onClick === "function") mocks.buttons.push(props);
+    return React.createElement("button", props, props.children);
+  },
+}));
+
 vi.mock("@subboost/ui/components/ui/toaster", () => ({
   toast: mocks.toast,
 }));
diff --git a/packages/ui/src/product/converter/subscription-import-error.tsx b/packages/ui/src/product/converter/subscription-import-error.tsx
index 736f7c8..c516dac 100644
--- a/packages/ui/src/product/converter/subscription-import-error.tsx
+++ b/packages/ui/src/product/converter/subscription-import-error.tsx
@@ -9,6 +9,7 @@ import {
   DialogTitle,
   DialogTrigger,
 } from "@subboost/ui/components/ui/dialog";
+import { Button } from "@subboost/ui/components/ui/button";
 import { cn } from "@subboost/ui/lib/utils";
 import { toast } from "@subboost/ui/components/ui/toaster";
 import { formatInBeijing } from "@subboost/core/time/beijing";
@@ -77,14 +78,16 @@ function ErrorDetailDialog({ error, children }: ErrorDetailDialogProps) {
           <div className="space-y-2">
             <div className="flex items-center justify-between">
               <span className="text-white/50 text-xs">{error.isUserFacingReason ? "提示内容" : "错误信息"}</span>
-              <button
+              <Button
                 type="button"
+                variant="ghost"
+                size="sm"
                 onClick={() => copyText(message)}
-                className="text-xs text-white/40 hover:text-white flex items-center gap-1 transition-colors"
+                className="h-auto gap-1 p-0 text-xs text-white/40 hover:bg-transparent hover:text-white"
               >
                 <Copy className="h-3 w-3" />
                 复制
-              </button>
+              </Button>
             </div>
             <div
               className={cn(
@@ -102,14 +105,16 @@ function ErrorDetailDialog({ error, children }: ErrorDetailDialogProps) {
             <div className="space-y-2">
               <div className="flex items-center justify-between">
                 <span className="text-white/50 text-xs">技术细节</span>
-                <button
+                <Button
                   type="button"
+                  variant="ghost"
+                  size="sm"
                   onClick={() => copyText(technicalDetail!, "已复制技术细节")}
-                  className="text-xs text-white/40 hover:text-white flex items-center gap-1 transition-colors"
+                  className="h-auto gap-1 p-0 text-xs text-white/40 hover:bg-transparent hover:text-white"
                 >
                   <Copy className="h-3 w-3" />
                   复制
-                </button>
+                </Button>
               </div>
               <div className="bg-black/30 border border-white/5 rounded-lg p-3 text-white/80 text-xs font-mono whitespace-pre-wrap break-all max-h-32 overflow-y-auto custom-scrollbar">
                 {technicalDetail}
@@ -163,10 +168,12 @@ export function SubscriptionImportErrorBadge({
 
   return (
     <ErrorDetailDialog error={normalized}>
-      <button
+      <Button
         type="button"
+        variant="ghost"
+        size="sm"
         className={cn(
-          "inline-flex items-center justify-center rounded-full px-1.5 py-0.5 text-[10px] font-medium leading-none",
+          "h-auto rounded-full px-1.5 py-0.5 text-[10px] font-medium leading-none",
           "bg-red-500/15 text-red-300 border border-red-500/20",
           "hover:bg-red-500/25 hover:text-red-200 transition-colors cursor-pointer",
           "focus:outline-none focus:ring-2 focus:ring-red-500/40",
@@ -176,7 +183,7 @@ export function SubscriptionImportErrorBadge({
       >
         <span>{badgeText}</span>
         <Menu className="ml-1 h-3 w-3 text-red-200/70" aria-hidden="true" />
-      </button>
+      </Button>
     </ErrorDetailDialog>
   );
 }
diff --git a/packages/ui/src/product/home/home-layout.tsx b/packages/ui/src/product/home/home-layout.tsx
index 0ec4bdf..c9939f3 100644
--- a/packages/ui/src/product/home/home-layout.tsx
+++ b/packages/ui/src/product/home/home-layout.tsx
@@ -223,19 +223,20 @@ export function HomeLayout({
                   )}
                 </Button>
                 {user && templateUploadHref && (
-                  <Link href={templateUploadHref}>
-                    <Button
+                  <Button
+                    asChild
                       variant="outline"
                       className="h-10 gap-2"
                       onClick={() => {
                         onTemplateUploadOpen?.();
                         interactions.templateUploadOpened?.({ entry: "home" });
                       }}
-                    >
+                  >
+                    <Link href={templateUploadHref}>
                       <Upload className="h-4 w-4" />
                       上传模板
-                    </Button>
-                  </Link>
+                    </Link>
+                  </Button>
                 )}
               </CardFooter>
             </Card>
diff --git a/packages/ui/src/product/home/subscription-link-dialog.test.ts b/packages/ui/src/product/home/subscription-link-dialog.test.ts
index 2e1ac64..aadeb6c 100644
--- a/packages/ui/src/product/home/subscription-link-dialog.test.ts
+++ b/packages/ui/src/product/home/subscription-link-dialog.test.ts
@@ -140,6 +140,8 @@ describe("SubscriptionLinkDialog", () => {
     expect(html).toContain("启用自动更新");
     expect(html).toContain("自动更新间隔");
     expect(html).toContain("注意事项");
+    expect(html).toContain("订阅链接相当于访问凭证，请勿公开分享");
+    expect(html).toContain("客户端高频拉取订阅会被封禁，请合理配置");
     expect(captures.inputs[0]).toMatchObject({ value: "我的配置", maxLength: 100 });
     expect(captures.inputs[1]).toMatchObject({ type: "number", min: 12, step: 1, value: 8 });
     expect(captures.switches).toHaveLength(2);
diff --git a/packages/ui/src/product/home/subscription-link-dialog.tsx b/packages/ui/src/product/home/subscription-link-dialog.tsx
index 007cb0e..baaa5e3 100644
--- a/packages/ui/src/product/home/subscription-link-dialog.tsx
+++ b/packages/ui/src/product/home/subscription-link-dialog.tsx
@@ -3,9 +3,11 @@
 import type * as React from "react";
 import { Check, Copy, Link as LinkIcon, Loader2 } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { FormField } from "@subboost/ui/components/ui/form-field";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
-import { Label } from "@subboost/ui/components/ui/label";
 import { Switch } from "@subboost/ui/components/ui/switch";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { SmartNodeMatchingHelp } from "@subboost/ui/components/subscription/smart-node-matching-help";
 import {
   Dialog,
@@ -83,15 +85,14 @@ export function SubscriptionLinkDialog({
 
         {!subscriptionUrl ? (
           <div className="space-y-4 py-4">
-            <div className="space-y-2">
-              <Label>订阅名称</Label>
+            <FormField label="订阅名称">
               <Input
                 placeholder="例如：我的配置"
                 value={subscriptionName}
                 onChange={(e) => setSubscriptionName(e.target.value)}
                 maxLength={100}
               />
-            </div>
+            </FormField>
 
             <div className="rounded-lg border border-white/10 bg-white/5 p-3">
               <div className="flex items-center justify-between gap-4">
@@ -101,22 +102,28 @@ export function SubscriptionLinkDialog({
                     <SmartNodeMatchingHelp enabled={smartNodeMatchingEnabled} />
                   </div>
                 </div>
-                <Switch checked={smartNodeMatchingEnabled} onCheckedChange={setSmartNodeMatchingEnabled} />
+                <Switch
+                  checked={smartNodeMatchingEnabled}
+                  onCheckedChange={setSmartNodeMatchingEnabled}
+                  aria-label="更新时智能匹配节点"
+                />
               </div>
 
               <div className="my-3 border-t border-white/10" />
 
-              <div className="flex items-center justify-between gap-4">
-                <div className="min-w-0">
-                  <p className="text-sm text-white/80">启用自动更新</p>
-                  <p className="mt-1 text-xs text-white/45">开启后服务器会按设定间隔刷新缓存</p>
-                </div>
-                <Switch checked={autoUpdateEnabled} onCheckedChange={setAutoUpdateEnabled} />
-              </div>
+              <SwitchField
+                label="启用自动更新"
+                description="开启后服务器会按设定间隔刷新缓存"
+                checked={autoUpdateEnabled}
+                onCheckedChange={setAutoUpdateEnabled}
+              />
 
               {autoUpdateEnabled && (
-                <div className="mt-4 space-y-2">
-                  <Label>自动更新间隔（小时）</Label>
+                <FormField
+                  label="自动更新间隔（小时）"
+                  description={`最小 ${minAutoUpdateLabel}，按创建时间计时`}
+                  className="mt-4"
+                >
                   <Input
                     type="number"
                     min={autoUpdatePolicy.minHours}
@@ -124,8 +131,7 @@ export function SubscriptionLinkDialog({
                     value={autoUpdateHours}
                     onChange={(e) => setAutoUpdateHours(Number(e.target.value))}
                   />
-                  <p className="text-xs text-white/45">最小 {minAutoUpdateLabel}，按创建时间计时</p>
-                </div>
+                </FormField>
               )}
             </div>
 
@@ -149,12 +155,12 @@ export function SubscriptionLinkDialog({
         ) : (
           <div className="space-y-4 py-4">
             <div className="space-y-2">
-              <label className="text-sm font-medium">订阅链接</label>
+              <p className="text-sm font-medium">订阅链接</p>
               <div className="flex gap-2">
                 <Input value={subscriptionUrl} readOnly className="font-mono text-xs" />
-                <Button
+                <IconButton
+                  label={copied ? "已复制订阅链接" : "复制订阅链接"}
                   variant="outline"
-                  size="icon"
                   onClick={handleCopyUrl}
                   className="flex-shrink-0"
                 >
@@ -163,7 +169,7 @@ export function SubscriptionLinkDialog({
                   ) : (
                     <Copy className="h-4 w-4" />
                   )}
-                </Button>
+                </IconButton>
               </div>
             </div>
 
@@ -204,4 +210,3 @@ export function SubscriptionLinkDialog({
     </Dialog>
   );
 }
-
diff --git a/packages/ui/src/product/home/unsaved-prompt.test.ts b/packages/ui/src/product/home/unsaved-prompt.test.ts
index 0e4c350..9eeea39 100644
--- a/packages/ui/src/product/home/unsaved-prompt.test.ts
+++ b/packages/ui/src/product/home/unsaved-prompt.test.ts
@@ -3,110 +3,38 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
-  buttons: [] as any[],
-  routerPush: vi.fn(),
   storeState: { nodes: [] as any[], sources: [] as any[] },
   isSourcePendingImport: vi.fn(),
   listeners: new Map<string, EventListener>(),
 }));
 
-const stateMock = vi.hoisted(() => ({
-  enabled: false,
-  callIndex: 0,
-  overrides: {} as Record<number, unknown>,
-  setters: [] as Array<ReturnType<typeof vi.fn>>,
-}));
-
 vi.mock("react", async (importOriginal) => {
   const actual = await importOriginal<typeof import("react")>();
   return {
     ...actual,
     useMemo: (factory: () => unknown) => factory(),
-    useEffect: (effect: () => void | (() => void)) => {
-      effect();
-    },
-    useState: (initial: unknown) => {
-      if (!stateMock.enabled) return actual.useState(initial);
-      const index = stateMock.callIndex++;
-      const value = Object.prototype.hasOwnProperty.call(stateMock.overrides, index)
-        ? stateMock.overrides[index]
-        : initial;
-      const setter = vi.fn((next: unknown) => {
-        const resolved = typeof next === "function" ? (next as (prev: unknown) => unknown)(value) : next;
-        (setter as any).lastValue = resolved;
-        return resolved;
-      });
-      stateMock.setters[index] = setter;
-      return [value, setter];
-    },
+    useEffect: (effect: () => void | (() => void)) => effect(),
   };
 });
-
-vi.mock("next/navigation", () => ({
-  useRouter: () => ({ push: mocks.routerPush }),
-}));
-
-vi.mock("lucide-react", () => ({
-  AlertTriangle: () => React.createElement("span", null, "alert"),
-}));
-
-vi.mock("zustand/react/shallow", () => ({
-  useShallow: (selector: unknown) => selector,
-}));
-
-vi.mock("@subboost/ui/components/ui/dialog", () => ({
-  Dialog: (props: any) => React.createElement("div", { "data-open": props.open }, props.children),
-  DialogContent: (props: any) => React.createElement("section", null, props.children),
-  DialogDescription: (props: any) => React.createElement("p", null, props.children),
-  DialogFooter: (props: any) => React.createElement("footer", null, props.children),
-  DialogHeader: (props: any) => React.createElement("header", null, props.children),
-  DialogTitle: (props: any) => React.createElement("h2", null, props.children),
-}));
-
-vi.mock("@subboost/ui/components/ui/button", () => ({
-  Button: (props: any) => {
-    mocks.buttons.push(props);
-    return React.createElement("button", props, props.children);
-  },
-}));
-
+vi.mock("zustand/react/shallow", () => ({ useShallow: (selector: unknown) => selector }));
 vi.mock("@subboost/ui/product/subscription/source-import-state", () => ({
   isSourcePendingImport: mocks.isSourcePendingImport,
 }));
-
 vi.mock("@subboost/ui/store/config-store", () => ({
   useConfigStore: (selector: (state: typeof mocks.storeState) => unknown) => selector(mocks.storeState),
 }));
 
-import { UnsavedPrompt, useUnsavedChanges } from "./unsaved-prompt";
+import { UnsavedPrompt } from "./unsaved-prompt";
 
 function stubBrowser(webdriver = false) {
   mocks.listeners.clear();
   vi.stubGlobal("navigator", { webdriver });
   vi.stubGlobal("window", {
-    addEventListener: vi.fn((type: string, listener: EventListener) => {
-      mocks.listeners.set(type, listener);
-    }),
-    removeEventListener: vi.fn((type: string) => {
-      mocks.listeners.delete(type);
-    }),
+    addEventListener: vi.fn((type: string, listener: EventListener) => mocks.listeners.set(type, listener)),
+    removeEventListener: vi.fn((type: string) => mocks.listeners.delete(type)),
   });
 }
 
-function renderPrompt(overrides: Record<number, unknown> = {}) {
-  stateMock.enabled = true;
-  stateMock.callIndex = 0;
-  stateMock.overrides = overrides;
-  stateMock.setters = [];
-  mocks.buttons = [];
-  try {
-    const html = renderToStaticMarkup(React.createElement(UnsavedPrompt));
-    return { html, setters: stateMock.setters, buttons: mocks.buttons };
-  } finally {
-    stateMock.enabled = false;
-  }
-}
-
 describe("UnsavedPrompt", () => {
   beforeEach(() => {
     vi.clearAllMocks();
@@ -116,46 +44,25 @@ describe("UnsavedPrompt", () => {
     stubBrowser(false);
   });
 
-  it("registers beforeunload and exposes the global unsaved-check function", () => {
+  it("registers beforeunload and warns when imported work exists", () => {
     mocks.storeState = { nodes: [{ name: "node-1" }], sources: [] };
-    renderPrompt();
+    expect(renderToStaticMarkup(React.createElement(UnsavedPrompt))).toBe("");
 
-    expect((window as any).__checkUnsavedChanges()).toBe(true);
     const event = { preventDefault: vi.fn(), returnValue: "" } as any;
     mocks.listeners.get("beforeunload")?.(event);
     expect(event.preventDefault).toHaveBeenCalled();
     expect(event.returnValue).toBe("您有未保存的配置更改，确定要离开吗？");
   });
 
-  it("skips beforeunload in webdriver environments", () => {
+  it("does not warn without pending work and skips automation environments", () => {
+    renderToStaticMarkup(React.createElement(UnsavedPrompt));
+    const event = { preventDefault: vi.fn(), returnValue: "" } as any;
+    mocks.listeners.get("beforeunload")?.(event);
+    expect(event.preventDefault).not.toHaveBeenCalled();
+
     stubBrowser(true);
     mocks.storeState = { nodes: [{ name: "node-1" }], sources: [] };
-    renderPrompt();
-
+    renderToStaticMarkup(React.createElement(UnsavedPrompt));
     expect(mocks.listeners.has("beforeunload")).toBe(false);
   });
-
-  it("renders the dialog and handles cancel/confirm callbacks", () => {
-    const { html, buttons, setters } = renderPrompt({ 0: true, 1: "/next" });
-
-    expect(html).toContain("未保存的更改");
-    buttons.find((button) => button.variant === "outline").onClick();
-    expect(setters[0]).toHaveBeenCalledWith(false);
-    expect(setters[1]).toHaveBeenCalledWith(null);
-
-    buttons.find((button) => button.variant === "destructive").onClick();
-    expect(mocks.routerPush).toHaveBeenCalledWith("/next");
-    expect(setters[1]).toHaveBeenLastCalledWith(null);
-  });
-
-  it("computes unsaved state from nodes and pending sources", () => {
-    mocks.storeState = { nodes: [], sources: [] };
-    expect(useUnsavedChanges()).toBe(false);
-
-    mocks.storeState = { nodes: [], sources: [{ pending: true }] };
-    expect(useUnsavedChanges()).toBe(true);
-
-    mocks.storeState = { nodes: [{ name: "node-1" }], sources: [] };
-    expect(useUnsavedChanges()).toBe(true);
-  });
 });
diff --git a/packages/ui/src/product/home/unsaved-prompt.tsx b/packages/ui/src/product/home/unsaved-prompt.tsx
index 84420ce..bc8ac0e 100644
--- a/packages/ui/src/product/home/unsaved-prompt.tsx
+++ b/packages/ui/src/product/home/unsaved-prompt.tsx
@@ -1,124 +1,35 @@
 "use client";
 
 import * as React from "react";
-import { useRouter } from "next/navigation";
-import { AlertTriangle } from "lucide-react";
 import { useShallow } from "zustand/react/shallow";
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from "@subboost/ui/components/ui/dialog";
-import { Button } from "@subboost/ui/components/ui/button";
 import { isSourcePendingImport } from "@subboost/ui/product/subscription/source-import-state";
 import { useConfigStore } from "@subboost/ui/store/config-store";
 
-/**
- * 未保存提醒组件
- * 监听页面离开事件，如果有未保存的更改则提示用户
- */
+/** Warns before a browser refresh or close would discard imported work. */
 export function UnsavedPrompt() {
   const { nodes, sources } = useConfigStore(
     useShallow((state) => ({ nodes: state.nodes, sources: state.sources }))
   );
-  const [showDialog, setShowDialog] = React.useState(false);
-  const [pendingNavigation, setPendingNavigation] = React.useState<string | null>(null);
-  const router = useRouter();
-
-  // 检测是否有未保存的更改
-  const hasUnsavedChanges = React.useMemo(() => {
-    // 有节点但没有生成配置，或者有有效的订阅源但没有解析
-    const hasNodes = nodes.length > 0;
-    const hasUnparsedSources = sources.some(isSourcePendingImport);
-    
-    // 如果有节点或未解析的源，但没有下载过配置（这里简化处理）
-    return hasNodes || hasUnparsedSources;
-  }, [nodes, sources]);
+  const hasUnsavedChanges = React.useMemo(
+    () => nodes.length > 0 || sources.some(isSourcePendingImport),
+    [nodes, sources]
+  );
 
-  // 监听 beforeunload 事件（浏览器关闭/刷新）
   React.useEffect(() => {
-    // 自动化/测试环境（如 Playwright）下禁用 beforeunload，避免阻塞自动化回归与开发调试
-    if (typeof navigator !== "undefined" && (navigator as unknown as { webdriver?: boolean }).webdriver) {
+    if (typeof navigator !== "undefined" && (navigator as { webdriver?: boolean }).webdriver) {
       return;
     }
 
-    const handleBeforeUnload = (e: BeforeUnloadEvent) => {
-      if (hasUnsavedChanges) {
-        e.preventDefault();
-        e.returnValue = "您有未保存的配置更改，确定要离开吗？";
-        return e.returnValue;
-      }
+    const handleBeforeUnload = (event: BeforeUnloadEvent) => {
+      if (!hasUnsavedChanges) return;
+      event.preventDefault();
+      event.returnValue = "您有未保存的配置更改，确定要离开吗？";
+      return event.returnValue;
     };
 
     window.addEventListener("beforeunload", handleBeforeUnload);
     return () => window.removeEventListener("beforeunload", handleBeforeUnload);
   }, [hasUnsavedChanges]);
 
-  // 处理确认离开
-  const handleConfirmLeave = () => {
-    setShowDialog(false);
-    if (pendingNavigation) {
-      router.push(pendingNavigation);
-      setPendingNavigation(null);
-    }
-  };
-
-  // 处理取消离开
-  const handleCancelLeave = () => {
-    setShowDialog(false);
-    setPendingNavigation(null);
-  };
-
-  // 暴露方法供外部调用（如导航拦截）
-  React.useEffect(() => {
-    // 在全局对象上挂载检查函数
-    (window as unknown as { __checkUnsavedChanges?: () => boolean }).__checkUnsavedChanges = () => hasUnsavedChanges;
-    
-    return () => {
-      delete (window as unknown as { __checkUnsavedChanges?: () => boolean }).__checkUnsavedChanges;
-    };
-  }, [hasUnsavedChanges]);
-
-  return (
-    <Dialog open={showDialog} onOpenChange={setShowDialog}>
-      <DialogContent className="sm:max-w-md">
-        <DialogHeader>
-          <DialogTitle className="flex items-center gap-2">
-            <AlertTriangle className="h-5 w-5 text-yellow-500" />
-            未保存的更改
-          </DialogTitle>
-          <DialogDescription>
-            您有未保存的配置更改。如果现在离开，这些更改将会丢失。
-          </DialogDescription>
-        </DialogHeader>
-        <DialogFooter className="gap-2 sm:gap-0">
-          <Button variant="outline" onClick={handleCancelLeave}>
-            继续编辑
-          </Button>
-          <Button variant="destructive" onClick={handleConfirmLeave}>
-            放弃更改
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  );
-}
-
-/**
- * Hook: 检查是否有未保存的更改
- */
-export function useUnsavedChanges() {
-  const { nodes, sources } = useConfigStore(
-    useShallow((state) => ({ nodes: state.nodes, sources: state.sources }))
-  );
-  
-  return React.useMemo(() => {
-    const hasNodes = nodes.length > 0;
-    const hasUnparsedSources = sources.some(isSourcePendingImport);
-    return hasNodes || hasUnparsedSources;
-  }, [nodes, sources]);
+  return null;
 }
-
diff --git a/packages/ui/src/product/home/use-editing-subscription-loader.test.ts b/packages/ui/src/product/home/use-editing-subscription-loader.test.ts
index 87d54d3..2e8a7f7 100644
--- a/packages/ui/src/product/home/use-editing-subscription-loader.test.ts
+++ b/packages/ui/src/product/home/use-editing-subscription-loader.test.ts
@@ -116,6 +116,7 @@ function resetStoreState(overrides: Record<string, unknown> = {}) {
     proxyGroupAdvanced: {},
     proxyGroupOrder: [],
     ruleOrder: [],
+    nodeNameFilter: { enabled: false, excludeRegexes: [] },
     ...overrides,
   };
   return { reset, generateConfig };
@@ -235,6 +236,10 @@ describe("useEditingSubscriptionLoader", () => {
               cnIpNoResolve: false,
               experimentalCnUseCnRuleSet: true,
               smartNodeMatchingEnabled: false,
+              nodeNameFilter: {
+                enabled: true,
+                excludeRegexes: ["^Remote$"],
+              },
             },
           },
         })
@@ -285,6 +290,10 @@ describe("useEditingSubscriptionLoader", () => {
       proxyGroupOrder: ["module:ai"],
       listenerPorts: { Remote: 41000 },
       appliedTemplateId: "template-1",
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["^Remote$"],
+      },
       dnsYaml: "dns: {}",
       ruleProviderBaseUrl: "https://rules.example.com",
       testUrl: "https://test.example.com",
@@ -340,6 +349,10 @@ describe("useEditingSubscriptionLoader", () => {
         smartNodeMatchingEnabled: true,
       })
     );
+    expect(mocks.bag.storeState.nodeNameFilter).toEqual({
+      enabled: false,
+      excludeRegexes: [],
+    });
   });
 
   it("hydrates single URL sources from the saved subscription info snapshot", async () => {
diff --git a/packages/ui/src/product/home/use-editing-subscription-loader.ts b/packages/ui/src/product/home/use-editing-subscription-loader.ts
index 5a615c7..a9363a0 100644
--- a/packages/ui/src/product/home/use-editing-subscription-loader.ts
+++ b/packages/ui/src/product/home/use-editing-subscription-loader.ts
@@ -15,6 +15,10 @@ import {
   normalizeSubscriptionUserInfo,
   type SubscriptionUserInfo,
 } from "@subboost/core/subscription/subscription-userinfo";
+import {
+  normalizeNodeNameFilterConfig,
+  type NodeNameFilterConfig,
+} from "@subboost/core/subscription/node-name-filter";
 import { useConfigStore } from "@subboost/ui/store/config-store";
 import { captureAuthConfigHandoff } from "@subboost/ui/store/config-store/auth-handoff";
 import { toast } from "@subboost/ui/components/ui/toaster";
@@ -486,6 +490,8 @@ export function useEditingSubscriptionLoader({
           typeof cfg.appliedTemplateId === "string" && cfg.appliedTemplateId.trim()
             ? (cfg.appliedTemplateId as string)
             : null;
+        const nodeNameFilterFromCfg: NodeNameFilterConfig =
+          normalizeNodeNameFilterConfig(cfg.nodeNameFilter);
         const proxyGroupAdvancedModeEnabledFromCfg = resolveProxyGroupAdvancedModeEnabled({
           proxyGroupAdvancedModeEnabled: (cfg as any).proxyGroupAdvancedModeEnabled,
           customProxyGroups: customProxyGroupsFromCfg,
@@ -535,6 +541,7 @@ export function useEditingSubscriptionLoader({
           ruleOrder: ruleOrderFromCfg.length > 0 ? ruleOrderFromCfg : state.ruleOrder,
           listenerPorts: listenerPortsFromCfg,
           appliedTemplateId: appliedTemplateIdFromCfg ?? state.appliedTemplateId,
+          nodeNameFilter: nodeNameFilterFromCfg,
           dnsYaml: typeof cfg.dnsYaml === "string" ? (cfg.dnsYaml as string) : state.dnsYaml,
           ruleProviderBaseUrl:
             typeof cfg.ruleProviderBaseUrl === "string" ? (cfg.ruleProviderBaseUrl as string) : state.ruleProviderBaseUrl,
diff --git a/packages/ui/src/product/home/use-subscription-link.test.ts b/packages/ui/src/product/home/use-subscription-link.test.ts
index e91fb21..e09b0c4 100644
--- a/packages/ui/src/product/home/use-subscription-link.test.ts
+++ b/packages/ui/src/product/home/use-subscription-link.test.ts
@@ -106,6 +106,7 @@ describe("useSubscriptionLink", () => {
       proxyGroupAdvanced: { auto: { includeRegex: "Fast" } },
       proxyGroupAdvancedModeEnabled: true,
       proxyGroupOrder: ["select", "auto"],
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
     };
     originalWindow = globalThis.window;
     originalNavigator = globalThis.navigator;
@@ -260,6 +261,7 @@ describe("useSubscriptionLink", () => {
             proxyGroupAdvancedModeEnabled: true,
             listenerPorts: { "Node A": 41000 },
             proxyGroupOrder: ["select", "auto"],
+            nodeNameFilter: { enabled: false, excludeRegexes: [] },
           }),
         }),
       })
@@ -362,6 +364,10 @@ describe("useSubscriptionLink", () => {
 
   it("persists resolved per-source subscription info for one source among multiple imports", async () => {
     const adapter = makeAdapter();
+    mocks.bag.storeState.nodeNameFilter = {
+      enabled: true,
+      excludeRegexes: ["^剩余流量", "^套餐流量", "^套餐到期"],
+    };
     const storeSources = [
       {
         id: "source-1",
@@ -417,6 +423,11 @@ describe("useSubscriptionLink", () => {
       total: 10 * 1024 ** 3,
       expire: 1893499200,
     });
+    expect(payload.nodes).toEqual(nodes);
+    expect(payload.config.nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["^剩余流量", "^套餐流量", "^套餐到期"],
+    });
     expect(payload.config.sources).toEqual([
       expect.objectContaining({
         id: "source-1",
diff --git a/packages/ui/src/product/home/use-subscription-link.tsx b/packages/ui/src/product/home/use-subscription-link.tsx
index 8d0822e..5907a75 100644
--- a/packages/ui/src/product/home/use-subscription-link.tsx
+++ b/packages/ui/src/product/home/use-subscription-link.tsx
@@ -27,6 +27,7 @@ import {
   type AutoUpdateIntervalPolicy,
   type AutoUpdateIntervalPolicyOverride,
 } from "@subboost/core/subscription/auto-update-interval";
+import type { NodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import { tryNormalizeSubscriptionUrlInput } from "@subboost/core/subscription/url-input";
 import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
 import { formatDateInBeijing } from "@subboost/core/time/beijing";
@@ -296,6 +297,7 @@ export function useSubscriptionLink({
     setIsCreatingSubscription(true);
 
     try {
+      const nodeNameFilter: NodeNameFilterConfig = useConfigStore.getState().nodeNameFilter;
       const subscriptionInfo: SubscriptionUserInfo = {};
       const sourceSubscriptionInfoById = new Map<string, SubscriptionUserInfo>();
       for (const source of storeSources) {
@@ -324,6 +326,7 @@ export function useSubscriptionLink({
             template,
             appliedTemplateId,
             smartNodeMatchingEnabled,
+            nodeNameFilter,
             // 用于“我的订阅 → 编辑”恢复输入源（保留 YAML/节点链接/多个 URL 的顺序）
             sources: storeSources
             .filter((s) => typeof s?.content === "string" && s.content.trim())
diff --git a/packages/ui/src/product/preview/diff-highlight.test.ts b/packages/ui/src/product/preview/diff-highlight.test.ts
index ba8a024..a8b0861 100644
--- a/packages/ui/src/product/preview/diff-highlight.test.ts
+++ b/packages/ui/src/product/preview/diff-highlight.test.ts
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { DiffHighlight, YamlHighlight } from "./diff-highlight";
+import { YamlHighlight } from "./diff-highlight";
 
 const reactMocks = vi.hoisted(() => ({
   useMemo: vi.fn((factory: () => unknown) => factory()),
@@ -7,7 +7,8 @@ const reactMocks = vi.hoisted(() => ({
   useState: vi.fn((initial: unknown) => [initial, vi.fn()]),
 }));
 
-vi.mock("react", () => ({
+vi.mock("react", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("react")>()),
   useMemo: reactMocks.useMemo,
   useEffect: reactMocks.useEffect,
   useState: reactMocks.useState,
@@ -51,33 +52,6 @@ function collectHtml(value: unknown): string[] {
   return html;
 }
 
-describe("DiffHighlight", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it("returns null for empty input", () => {
-    expect(DiffHighlight({ oldText: "", newText: "" })).toBeNull();
-  });
-
-  it("renders line-level additions and removals", () => {
-    const rendered = DiffHighlight({
-      oldText: "a\nb\nc",
-      newText: "a\nx\nc\nd",
-      className: "custom",
-    });
-
-    const text = collectText(rendered);
-    expect(text).toContain("变更统计:");
-    expect(text).toContain("+2 行");
-    expect(text).toContain("-1 行");
-    expect(text).toContain("a");
-    expect(text).toContain("b");
-    expect(text).toContain("x");
-    expect(text).toContain("d");
-  });
-});
-
 describe("YamlHighlight", () => {
   beforeEach(() => {
     vi.clearAllMocks();
diff --git a/packages/ui/src/product/preview/diff-highlight.tsx b/packages/ui/src/product/preview/diff-highlight.tsx
index 5ca81d0..727e364 100644
--- a/packages/ui/src/product/preview/diff-highlight.tsx
+++ b/packages/ui/src/product/preview/diff-highlight.tsx
@@ -1,213 +1,9 @@
 "use client";
 
 import * as React from "react";
+import { Button } from "@subboost/ui/components/ui/button";
 import { cn } from "@subboost/ui/lib/utils";
 
-interface DiffLine {
-  type: "add" | "remove" | "unchanged";
-  content: string;
-  lineNumber: number;
-}
-
-interface DiffHighlightProps {
-  oldText: string;
-  newText: string;
-  className?: string;
-}
-
-/**
- * 变更高亮组件
- * 对比两个文本并高亮显示差异
- */
-export function DiffHighlight({ oldText, newText, className }: DiffHighlightProps) {
-  const diffLines = React.useMemo(() => {
-    return computeDiff(oldText, newText);
-  }, [oldText, newText]);
-
-  const stats = React.useMemo(() => {
-    const added = diffLines.filter(l => l.type === "add").length;
-    const removed = diffLines.filter(l => l.type === "remove").length;
-    return { added, removed };
-  }, [diffLines]);
-
-  if (!oldText && !newText) {
-    return null;
-  }
-
-  return (
-    <div className={cn("rounded-lg overflow-hidden", className)}>
-      {/* 统计信息 */}
-      {(stats.added > 0 || stats.removed > 0) && (
-        <div className="flex items-center gap-3 px-3 py-2 bg-white/5 border-b border-white/10 text-xs">
-          <span className="text-white/60">变更统计:</span>
-          {stats.added > 0 && (
-            <span className="text-green-400">+{stats.added} 行</span>
-          )}
-          {stats.removed > 0 && (
-            <span className="text-red-400">-{stats.removed} 行</span>
-          )}
-        </div>
-      )}
-
-      {/* 差异内容 */}
-      <div className="overflow-auto max-h-[500px]">
-        <pre className="text-xs font-mono">
-          {diffLines.map((line, idx) => (
-            <div
-              key={idx}
-              className={cn(
-                "flex",
-                line.type === "add" && "bg-green-500/10",
-                line.type === "remove" && "bg-red-500/10"
-              )}
-            >
-              {/* 行号 */}
-              <span className="w-10 px-2 py-0.5 text-right text-white/50 select-none border-r border-white/10 flex-shrink-0">
-                {line.lineNumber}
-              </span>
-              
-              {/* 差异标记 */}
-              <span className={cn(
-                "w-6 px-1.5 py-0.5 text-center select-none flex-shrink-0",
-                line.type === "add" && "text-green-400",
-                line.type === "remove" && "text-red-400",
-                line.type === "unchanged" && "text-white/50"
-              )}>
-                {line.type === "add" ? "+" : line.type === "remove" ? "-" : " "}
-              </span>
-              
-              {/* 内容 */}
-              <span className={cn(
-                "flex-1 px-2 py-0.5 whitespace-pre",
-                line.type === "add" && "text-green-300",
-                line.type === "remove" && "text-red-300",
-                line.type === "unchanged" && "text-dark-300"
-              )}>
-                {line.content || " "}
-              </span>
-            </div>
-          ))}
-        </pre>
-      </div>
-    </div>
-  );
-}
-
-/**
- * 简单的行级差异算法
- */
-function computeDiff(oldText: string, newText: string): DiffLine[] {
-  const oldLines = oldText.split("\n");
-  const newLines = newText.split("\n");
-  const result: DiffLine[] = [];
-  
-  // 使用 LCS (最长公共子序列) 简化版本
-  const lcs = computeLCS(oldLines, newLines);
-  
-  let oldIdx = 0;
-  let newIdx = 0;
-  let lineNumber = 1;
-  
-  for (const match of lcs) {
-    // 添加删除的行
-    while (oldIdx < match.oldIndex) {
-      result.push({
-        type: "remove",
-        content: oldLines[oldIdx],
-        lineNumber: lineNumber++,
-      });
-      oldIdx++;
-    }
-    
-    // 添加新增的行
-    while (newIdx < match.newIndex) {
-      result.push({
-        type: "add",
-        content: newLines[newIdx],
-        lineNumber: lineNumber++,
-      });
-      newIdx++;
-    }
-    
-    // 添加未变更的行
-    result.push({
-      type: "unchanged",
-      content: newLines[newIdx],
-      lineNumber: lineNumber++,
-    });
-    
-    oldIdx++;
-    newIdx++;
-  }
-  
-  // 添加剩余的删除行
-  while (oldIdx < oldLines.length) {
-    result.push({
-      type: "remove",
-      content: oldLines[oldIdx],
-      lineNumber: lineNumber++,
-    });
-    oldIdx++;
-  }
-  
-  // 添加剩余的新增行
-  while (newIdx < newLines.length) {
-    result.push({
-      type: "add",
-      content: newLines[newIdx],
-      lineNumber: lineNumber++,
-    });
-    newIdx++;
-  }
-  
-  return result;
-}
-
-interface LCSMatch {
-  oldIndex: number;
-  newIndex: number;
-}
-
-/**
- * 计算最长公共子序列
- */
-function computeLCS(oldLines: string[], newLines: string[]): LCSMatch[] {
-  const m = oldLines.length;
-  const n = newLines.length;
-  
-  // 构建 LCS 表
-  const dp: number[][] = Array(m + 1).fill(null).map(() => Array(n + 1).fill(0));
-  
-  for (let i = 1; i <= m; i++) {
-    for (let j = 1; j <= n; j++) {
-      if (oldLines[i - 1] === newLines[j - 1]) {
-        dp[i][j] = dp[i - 1][j - 1] + 1;
-      } else {
-        dp[i][j] = Math.max(dp[i - 1][j], dp[i][j - 1]);
-      }
-    }
-  }
-  
-  // 回溯找出匹配
-  const matches: LCSMatch[] = [];
-  let i = m;
-  let j = n;
-  
-  while (i > 0 && j > 0) {
-    if (oldLines[i - 1] === newLines[j - 1]) {
-      matches.unshift({ oldIndex: i - 1, newIndex: j - 1 });
-      i--;
-      j--;
-    } else if (dp[i - 1][j] > dp[i][j - 1]) {
-      i--;
-    } else {
-      j--;
-    }
-  }
-  
-  return matches;
-}
-
 /**
  * YAML 语法高亮（简单版本）
  */
@@ -293,21 +89,25 @@ export function YamlHighlight({ content, className }: { content: string; classNa
                 `（${renderStats.lineCount} 行 / ${renderStats.charCount} 字符）`}
             </span>
             {forceHighlight ? (
-              <button
+              <Button
                 type="button"
+                variant="outline"
+                size="sm"
                 onClick={() => setForceHighlight(false)}
-                className="rounded border border-amber-300/40 px-2 py-0.5 text-[10px] text-amber-100 transition-colors hover:bg-amber-300/10"
+                className="h-auto rounded border-amber-300/40 px-2 py-0.5 text-[10px] text-amber-100 hover:bg-amber-300/10"
               >
                 恢复纯文本
-              </button>
+              </Button>
             ) : (
-              <button
+              <Button
                 type="button"
+                variant="outline"
+                size="sm"
                 onClick={() => setForceHighlight(true)}
-                className="rounded border border-amber-300/40 px-2 py-0.5 text-[10px] text-amber-100 transition-colors hover:bg-amber-300/10"
+                className="h-auto rounded border-amber-300/40 px-2 py-0.5 text-[10px] text-amber-100 hover:bg-amber-300/10"
               >
                 强制语法高亮
-              </button>
+              </Button>
             )}
           </div>
         </div>
diff --git a/packages/ui/src/product/preview/visual-graph.test.ts b/packages/ui/src/product/preview/visual-graph.test.ts
index da37c11..9ea9914 100644
--- a/packages/ui/src/product/preview/visual-graph.test.ts
+++ b/packages/ui/src/product/preview/visual-graph.test.ts
@@ -182,6 +182,32 @@ describe("VisualGraph", () => {
     expect(mocks.captures.proxyGroupsPreview).toBeUndefined();
   });
 
+  it("renders counts and node previews from effective nodes", () => {
+    mocks.store.nodes = [
+      { name: "TAG-Notice", _originName: "套餐到期提醒", type: "ss" },
+      { name: "US", type: "vless" },
+    ];
+    mocks.store.nodeNameFilter = {
+      enabled: true,
+      excludeRegexes: ["套餐到期"],
+    };
+
+    const { html } = renderGraph();
+
+    expect(html).toContain("US");
+    expect(html).not.toContain("TAG-Notice");
+    expect(mocks.captures.protocolBadges.map((props: any) => props.type)).toEqual(["vless"]);
+    expect(
+      mocks.captures.proxyGroupsPreview.displayGroups.find(
+        (group: any) => group.id === "dialer:d1",
+      ).dialer,
+    ).toEqual({
+      relayNodes: ["Relay"],
+      targetNodes: [],
+      type: "select",
+    });
+  });
+
   it("builds display groups, node previews, custom rules, and drag callbacks", () => {
     const { html, setters } = renderGraph({ 0: new Set(["module:auto"]), 1: null, 2: null, 3: 360 });
 
diff --git a/packages/ui/src/product/preview/visual-graph.tsx b/packages/ui/src/product/preview/visual-graph.tsx
index 029796d..96a5769 100644
--- a/packages/ui/src/product/preview/visual-graph.tsx
+++ b/packages/ui/src/product/preview/visual-graph.tsx
@@ -13,6 +13,7 @@ import {
 import { getModuleRuleOrderKey } from "@subboost/core/generator/module-rules";
 import { resolveProxyGroupModuleName } from "@subboost/core/proxy-group-name";
 import { resolveProxyGroupTargetName } from "@subboost/core/proxy-group-targets";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import { collectCustomRoutingRuleSets } from "@subboost/core/rules/custom-routing-rule-sets";
 import { CustomRulesPreview } from "./visual-graph/custom-rules-preview";
 import { getDialerEmojiFromName } from "./visual-graph/emoji";
@@ -28,6 +29,7 @@ import {
 export function VisualGraph() {
   const {
     nodes,
+    nodeNameFilter,
     enabledProxyGroups,
     dialerProxyGroups,
     customRules,
@@ -44,6 +46,7 @@ export function VisualGraph() {
   } = useConfigStore(
     useShallow((state) => ({
       nodes: state.nodes,
+      nodeNameFilter: state.nodeNameFilter,
       enabledProxyGroups: state.enabledProxyGroups,
       dialerProxyGroups: state.dialerProxyGroups ?? [],
       customRules: state.customRules ?? [],
@@ -59,6 +62,18 @@ export function VisualGraph() {
       setProxyGroupOrder: state.setProxyGroupOrder,
     })),
   );
+  const effectiveNodes = React.useMemo(
+    () => resolveNodeNameFilter(nodes, nodeNameFilter).effectiveNodes,
+    [nodeNameFilter, nodes],
+  );
+  const rawNodeNameSet = React.useMemo(
+    () => new Set(nodes.map((node) => node.name)),
+    [nodes],
+  );
+  const effectiveNodeNameSet = React.useMemo(
+    () => new Set(effectiveNodes.map((node) => node.name)),
+    [effectiveNodes],
+  );
 
   const enabledDialerProxyGroups = React.useMemo(
     () => dialerProxyGroups.filter((g) => g && g.enabled !== false),
@@ -114,9 +129,9 @@ export function VisualGraph() {
   // 节点名称列表
   // 生成当前配置下的代理组（用于显示“默认选中项”）
   const generatedProxyGroups = React.useMemo(() => {
-    if (nodes.length === 0) return [];
+    if (effectiveNodes.length === 0) return [];
     return generateProxyGroups({
-      nodes,
+      nodes: effectiveNodes,
       enabledModules: enabledProxyGroups,
       ruleProviderBaseUrl,
       testUrl,
@@ -128,7 +143,7 @@ export function VisualGraph() {
       proxyGroupNameOverrides,
     });
   }, [
-    nodes,
+    effectiveNodes,
     enabledProxyGroups,
     ruleProviderBaseUrl,
     testUrl,
@@ -259,8 +274,15 @@ export function VisualGraph() {
             category: "dialer",
             rules: [],
             dialer: {
-              relayNodes: Array.isArray(g.relayNodes) ? g.relayNodes : [],
-              targetNodes: Array.isArray(g.targetNodes) ? g.targetNodes : [],
+              relayNodes: Array.isArray(g.relayNodes)
+                ? g.relayNodes.filter(
+                    (name) =>
+                      !rawNodeNameSet.has(name) || effectiveNodeNameSet.has(name),
+                  )
+                : [],
+              targetNodes: Array.isArray(g.targetNodes)
+                ? g.targetNodes.filter((name) => effectiveNodeNameSet.has(name))
+                : [],
               type: g.type,
             },
           }));
@@ -314,6 +336,8 @@ export function VisualGraph() {
   }, [
     activeCustomProxyGroups,
     enabledDialerProxyGroups,
+    effectiveNodeNameSet,
+    rawNodeNameSet,
     generatedProxyGroups,
     customRuleSets,
     builtinRuleEdits,
@@ -382,7 +406,7 @@ export function VisualGraph() {
       .sort((a, b) => a.order - b.order);
   }, [enabledDialerProxyGroups.length, displayGroups]);
 
-  if (nodes.length === 0) {
+  if (effectiveNodes.length === 0) {
     return (
       <div className="flex flex-col items-center justify-center h-full text-white/50">
         <Network className="h-12 w-12 mb-3 opacity-50" />
@@ -410,7 +434,7 @@ export function VisualGraph() {
       <div className="grid grid-cols-3 gap-2 text-center">
         <div className="rounded-lg bg-white/5 p-2">
           <div className="text-lg font-bold text-primary-500">
-            {nodes.length}
+            {effectiveNodes.length}
           </div>
           <div className="text-[10px] text-white/50">节点</div>
         </div>
@@ -449,12 +473,12 @@ export function VisualGraph() {
             节点列表
           </span>
           <span className="text-[10px] text-white/50">
-            共 {nodes.length} 个
+            共 {effectiveNodes.length} 个
           </span>
         </div>
 
         <div className="max-h-48 overflow-y-auto space-y-1 rounded-lg bg-white/5 p-2">
-          {nodes.slice(0, 50).map((node, idx) => (
+          {effectiveNodes.slice(0, 50).map((node, idx) => (
             <div
               key={node.name + idx}
               className="flex items-center gap-2 rounded-md px-2 py-1 text-[10px] hover:bg-white/5"
@@ -486,9 +510,9 @@ export function VisualGraph() {
               <ProtocolBadge type={node.type} className="flex-shrink-0" />
             </div>
           ))}
-          {nodes.length > 50 && (
+          {effectiveNodes.length > 50 && (
             <div className="text-center text-[10px] text-white/50 py-1">
-              ... 还有 {nodes.length - 50} 个节点
+              ... 还有 {effectiveNodes.length - 50} 个节点
             </div>
           )}
         </div>
diff --git a/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.test.ts b/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.test.ts
index 3f77bbc..f813183 100644
--- a/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.test.ts
+++ b/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.test.ts
@@ -202,24 +202,25 @@ describe("ProxyGroupsPreview", () => {
     vi.useFakeTimers();
     const props = makeProps({ dragOverGroup: null });
     const tree = renderTree(props);
-    const buttons = collectElements(tree, (element) => element.type === "button");
+    const groupRows = collectElements(tree, (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
+    const disclosureButtons = collectElements(tree, (element) => element.type === "button" && "aria-expanded" in element.props);
 
-    buttons[0].props.onClick();
+    disclosureButtons[0].props.onClick();
     expect(props.onToggleExpand).toHaveBeenCalledWith("module:select");
 
-    const rejectButton = buttons[3];
+    const rejectRow = groupRows[3];
     const dragEvent = {
       clientY: 25,
       currentTarget: { getBoundingClientRect: () => ({ top: 10, height: 20 }) },
       dataTransfer: { getData: vi.fn(() => "module:auto"), dropEffect: "" },
       preventDefault: vi.fn(),
     };
-    rejectButton.props.onDragOver(dragEvent);
+    rejectRow.props.onDragOver(dragEvent);
     expect(dragEvent.preventDefault).toHaveBeenCalled();
     expect(dragEvent.dataTransfer.dropEffect).toBe("move");
     expect(props.onSetDragOverGroup).toHaveBeenCalledWith({ id: "custom:reject", position: "after" });
 
-    rejectButton.props.onDrop(dragEvent);
+    rejectRow.props.onDrop(dragEvent);
     expect(props.onSetProxyGroupOrder).toHaveBeenCalledWith([
       "module:select",
       "dialer:relay",
@@ -232,8 +233,8 @@ describe("ProxyGroupsPreview", () => {
     expect(props.onSetDraggingGroupId).toHaveBeenLastCalledWith(null);
 
     const dragLeaveProps = makeProps({ dragOverGroup: { id: "custom:reject", position: "before" } });
-    const dragLeaveButtons = collectElements(renderTree(dragLeaveProps), (element) => element.type === "button");
-    dragLeaveButtons[3].props.onDragLeave();
+    const dragLeaveRows = collectElements(renderTree(dragLeaveProps), (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
+    dragLeaveRows[3].props.onDragLeave();
     expect(dragLeaveProps.onSetDragOverGroup).toHaveBeenCalledWith(null);
 
     const remove = vi.fn();
@@ -243,7 +244,7 @@ describe("ProxyGroupsPreview", () => {
       getBoundingClientRect: () => ({ width: 320 }),
     };
     vi.stubGlobal("document", { body: { appendChild: vi.fn() } });
-    const handles = collectElements(tree, (element) => element.type === "span" && element.props.title === "拖动排序");
+    const handles = collectElements(tree, (element) => element.type === "button" && element.props.title === "拖动排序（也可用方向键）");
     const stopPropagation = vi.fn();
     handles[0].props.onDragStart({
       currentTarget: { closest: vi.fn(() => card) },
@@ -261,8 +262,7 @@ describe("ProxyGroupsPreview", () => {
     vi.runAllTimers();
     expect(remove).toHaveBeenCalled();
 
-    handles[0].props.onPointerDown({ stopPropagation });
-    handles[0].props.onClick({ stopPropagation });
+    handles[0].props.onKeyDown({ key: "ArrowDown", preventDefault: vi.fn() });
     handles[0].props.onDragEnd();
     expect(props.onSetDragOverGroup).toHaveBeenLastCalledWith(null);
     expect(props.onSetDraggingGroupId).toHaveBeenLastCalledWith(null);
@@ -274,7 +274,7 @@ describe("ProxyGroupsPreview", () => {
       draggingGroupId: null,
       dragOverGroup: null,
     });
-    const buttons = collectElements(renderTree(props), (element) => element.type === "button");
+    const groupRows = collectElements(renderTree(props), (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
     const event = {
       clientY: 0,
       currentTarget: { getBoundingClientRect: () => ({ top: 0, height: 20 }) },
@@ -282,22 +282,22 @@ describe("ProxyGroupsPreview", () => {
       preventDefault: vi.fn(),
     };
 
-    buttons[0].props.onDragOver(event);
-    buttons[0].props.onDrop(event);
+    groupRows[0].props.onDragOver(event);
+    groupRows[0].props.onDrop(event);
 
     expect(event.preventDefault).not.toHaveBeenCalled();
     expect(props.onSetProxyGroupOrder).not.toHaveBeenCalled();
     expect(props.onSetDragOverGroup).not.toHaveBeenCalled();
 
     const sameActiveProps = makeProps({ draggingGroupId: "module:select", dragOverGroup: { id: "module:select", position: "before" } });
-    const sameActiveButtons = collectElements(renderTree(sameActiveProps), (element) => element.type === "button");
-    sameActiveButtons[0].props.onDragOver({
+    const sameActiveRows = collectElements(renderTree(sameActiveProps), (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
+    sameActiveRows[0].props.onDragOver({
       clientY: 0,
       currentTarget: { getBoundingClientRect: () => ({ top: 0, height: 20 }) },
       dataTransfer: { getData: vi.fn(() => "module:select"), dropEffect: "" },
       preventDefault: vi.fn(),
     });
-    sameActiveButtons[0].props.onDrop({
+    sameActiveRows[0].props.onDrop({
       clientY: 0,
       currentTarget: { getBoundingClientRect: () => ({ top: 0, height: 20 }) },
       dataTransfer: { getData: vi.fn(() => "module:select"), dropEffect: "" },
@@ -309,8 +309,8 @@ describe("ProxyGroupsPreview", () => {
       draggingGroupId: "module:auto",
       dragOverGroup: { id: "custom:reject", position: "after" },
     });
-    const unchangedButtons = collectElements(renderTree(unchangedDragOverProps), (element) => element.type === "button");
-    unchangedButtons[3].props.onDragOver({
+    const unchangedRows = collectElements(renderTree(unchangedDragOverProps), (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
+    unchangedRows[3].props.onDragOver({
       clientY: 25,
       currentTarget: { getBoundingClientRect: () => ({ top: 10, height: 20 }) },
       dataTransfer: { getData: vi.fn(() => "module:auto"), dropEffect: "" },
@@ -321,7 +321,7 @@ describe("ProxyGroupsPreview", () => {
     vi.useFakeTimers();
     const dragStartProps = makeProps();
     const dragStartTree = renderTree(dragStartProps);
-    const handles = collectElements(dragStartTree, (element) => element.type === "span" && element.props.title === "拖动排序");
+    const handles = collectElements(dragStartTree, (element) => element.type === "button" && element.props.title === "拖动排序（也可用方向键）");
     handles[0].props.onDragStart({
       currentTarget: { closest: vi.fn(() => null) },
       dataTransfer: {
@@ -359,7 +359,7 @@ describe("ProxyGroupsPreview", () => {
       draggingGroupId: null,
       dragOverGroup: null,
     });
-    const buttons = collectElements(renderTree(props), (element) => element.type === "button");
+    const groupRows = collectElements(renderTree(props), (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
     const beforeEvent = {
       clientY: 5,
       currentTarget: { getBoundingClientRect: () => ({ top: 0, height: 20 }) },
@@ -367,11 +367,11 @@ describe("ProxyGroupsPreview", () => {
       preventDefault: vi.fn(),
     };
 
-    buttons[3].props.onDragOver(beforeEvent);
+    groupRows[3].props.onDragOver(beforeEvent);
     expect(beforeEvent.preventDefault).toHaveBeenCalled();
     expect(props.onSetDragOverGroup).toHaveBeenCalledWith({ id: "custom:reject", position: "before" });
 
-    buttons[3].props.onDrop(beforeEvent);
+    groupRows[3].props.onDrop(beforeEvent);
     expect(props.onSetProxyGroupOrder).toHaveBeenCalledWith([
       "module:select",
       "dialer:relay",
@@ -381,7 +381,7 @@ describe("ProxyGroupsPreview", () => {
       "custom:fallback",
     ]);
 
-    buttons[0].props.onDragLeave();
+    groupRows[0].props.onDragLeave();
     expect(props.onSetDragOverGroup).not.toHaveBeenCalledWith({ id: "module:select", position: expect.any(String) });
 
     const singleProps = makeProps({
@@ -389,7 +389,7 @@ describe("ProxyGroupsPreview", () => {
       draggingGroupId: null,
       dragOverGroup: null,
     });
-    const singleHandles = collectElements(renderTree(singleProps), (element) => element.type === "span" && element.props.title === "拖动排序");
+    const singleHandles = collectElements(renderTree(singleProps), (element) => element.type === "button" && element.props.title === "拖动排序（也可用方向键）");
     singleHandles[0].props.onDragStart({
       currentTarget: { closest: vi.fn() },
       dataTransfer: {
diff --git a/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.tsx b/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.tsx
index 3e44fff..42895e3 100644
--- a/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.tsx
+++ b/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.tsx
@@ -185,8 +185,9 @@ export function ProxyGroupsPreview({
                 )}
               />
             )}
-            <button
-              onClick={() => hasRules && onToggleExpand(group.id)}
+            <div
+              role="group"
+              aria-label={`${getDisplayName(group.name)} 代理组`}
               onDragOver={(e) => {
                 if (!canReorderGroups) return;
                 const activeId = (
@@ -243,11 +244,12 @@ export function ProxyGroupsPreview({
               }}
               className={cn(
                 "w-full flex items-center gap-2 p-2 text-left",
-                hasRules && "cursor-pointer hover:bg-white/5",
               )}
             >
-              <span
+              <button
+                type="button"
                 draggable={canReorderGroups}
+                disabled={!canReorderGroups}
                 onDragStart={(e) => {
                   if (!canReorderGroups) return;
                   e.stopPropagation();
@@ -287,16 +289,24 @@ export function ProxyGroupsPreview({
                   onSetDraggingGroupId(null);
                   onSetDragOverGroup(null);
                 }}
-                onPointerDown={(e) => e.stopPropagation()}
-                onClick={(e) => e.stopPropagation()}
+                onKeyDown={(event) => {
+                  if (!canReorderGroups || (event.key !== "ArrowUp" && event.key !== "ArrowDown")) return;
+                  event.preventDefault();
+                  const currentIndex = displayGroups.findIndex((item) => item.id === group.id);
+                  const targetIndex = event.key === "ArrowUp" ? currentIndex - 1 : currentIndex + 1;
+                  if (currentIndex < 0 || targetIndex < 0 || targetIndex >= displayGroups.length) return;
+                  const nextOrder = displayGroups.map((item) => item.id);
+                  [nextOrder[currentIndex], nextOrder[targetIndex]] = [nextOrder[targetIndex], nextOrder[currentIndex]];
+                  onSetProxyGroupOrder(nextOrder);
+                }}
                 className={cn(
-                  "flex h-4 w-4 items-center justify-center text-white/40 hover:text-white/70",
+                  "ml-2 flex h-6 w-6 flex-none items-center justify-center text-white/40 hover:text-white/70 disabled:opacity-30",
                   canReorderGroups
                     ? "cursor-grab active:cursor-grabbing"
                     : "cursor-default opacity-30",
                 )}
-                title="拖动排序"
-                aria-label="拖动排序"
+                title="拖动排序（也可用方向键）"
+                aria-label="调整代理组顺序"
               >
                 <span className="grid grid-cols-2 gap-0.5">
                   {Array.from({ length: 6 }).map((_, i) => (
@@ -306,7 +316,15 @@ export function ProxyGroupsPreview({
                     />
                   ))}
                 </span>
-              </span>
+              </button>
+
+              <button
+                type="button"
+                onClick={() => onToggleExpand(group.id)}
+                disabled={!hasRules}
+                aria-expanded={hasRules ? isExpanded : undefined}
+                className="flex min-w-0 flex-1 items-center gap-2 py-2 pr-2 text-left disabled:cursor-default"
+              >
 
               {hasRules ? (
                 isExpanded ? (
@@ -345,7 +363,8 @@ export function ProxyGroupsPreview({
                   </span>
                 )}
               </div>
-            </button>
+              </button>
+            </div>
 
             {isDialerGroup && (
               <div className="border-t border-white/10 p-2">
diff --git a/packages/ui/src/store/config-store/actions/custom-actions.test.ts b/packages/ui/src/store/config-store/actions/custom-actions.test.ts
index 0404386..75c0cc9 100644
--- a/packages/ui/src/store/config-store/actions/custom-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/custom-actions.test.ts
@@ -76,9 +76,19 @@ describe("custom config-store actions", () => {
 
   it("adds, removes, and renames custom proxy groups while updating matching rules", () => {
     const { actions, getState } = createHarness({
-      customRules: [rule({ id: "r1", target: "Old Group" }), rule({ id: "r2", target: "DIRECT" })],
-      customRuleSets: [{ id: "cg-rule-1", name: "CG Rule", behavior: "domain", path: "geosite/example.mrs", target: "Old Group" }],
-      builtinRuleEdits: { "module:ai:openai": { target: "Old Group" } },
+      customRules: [
+        rule({ id: "r1", target: "Old Group" }),
+        rule({ id: "r2", target: "DIRECT" }),
+        rule({ id: "r3", target: { kind: "custom", id: "custom-group-1767225600000" } }),
+      ],
+      customRuleSets: [
+        { id: "cg-rule-1", name: "CG Rule", behavior: "domain", path: "geosite/example.mrs", target: "Old Group" },
+        { id: "cg-rule-2", name: "CG Rule 2", behavior: "domain", path: "geosite/example-2.mrs", target: { kind: "custom", id: "custom-group-1767225600000" } },
+      ],
+      builtinRuleEdits: {
+        "module:ai:openai": { target: "Old Group" },
+        "module:ai:anthropic": { target: { kind: "custom", id: "custom-group-1767225600000" }, enabled: false },
+      },
     });
 
     actions.addCustomProxyGroup({ name: "Old Group", emoji: "🧩", groupType: "select" });
@@ -100,10 +110,14 @@ describe("custom config-store actions", () => {
     expect(getState().customRules[1].target).toBe("DIRECT");
     expect(getState().customRuleSets[0].target).toBe("New Group");
     expect(getState().builtinRuleEdits["module:ai:openai"].target).toBe("New Group");
+    expect(getState().customRules[2].target).toEqual({ kind: "custom", id: groupId });
 
     actions.removeCustomProxyGroup(groupId);
     expect(getState().customProxyGroups).toEqual([]);
     expect(getState().customRuleSets).toEqual([]);
+    expect(getState().customRules).toEqual([expect.objectContaining({ id: "r2", target: "DIRECT" })]);
+    expect(getState().builtinRuleEdits["module:ai:openai"]).toBeUndefined();
+    expect(getState().builtinRuleEdits["module:ai:anthropic"]).toEqual({ enabled: false });
   });
 
   it("normalizes advanced custom proxy group fields and keeps blank-name removals narrow", () => {
diff --git a/packages/ui/src/store/config-store/actions/custom-actions.ts b/packages/ui/src/store/config-store/actions/custom-actions.ts
index fa125a0..d7d5de7 100644
--- a/packages/ui/src/store/config-store/actions/custom-actions.ts
+++ b/packages/ui/src/store/config-store/actions/custom-actions.ts
@@ -7,6 +7,10 @@ import { normalizePersistedRuleOrder } from "@subboost/core/generator/rules";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
 import type { ConfigActions } from "../definitions";
 import type { GetState, SetAndGenerateConfig, SetState } from "../store-types";
+import {
+  compactBuiltinRuleEdits,
+  ruleTargetMatchesContainer,
+} from "./proxy-group-rule-set-helpers";
 
 type CustomActions = Pick<
   ConfigActions,
@@ -160,19 +164,38 @@ export function createCustomActions(
     removeCustomProxyGroup: (id: string) => {
       setAndGenerateConfig((state) => {
         const removedGroup = state.customProxyGroups.find((g) => g.id === id);
+        if (!removedGroup) return state;
         const nextCustomProxyGroups = state.customProxyGroups.filter(
           (g) => g.id !== id,
         );
         const removedGroupName = removedGroup?.name?.trim() || "";
-        const nextCustomRuleSets = removedGroupName
-          ? state.customRuleSets.filter((ruleSet) => ruleSet.target !== removedGroupName)
-          : state.customRuleSets;
+        const removedTarget = { kind: "custom" as const, id };
+        const nextCustomRules = state.customRules.filter(
+          (rule) => !ruleTargetMatchesContainer(rule.target, removedTarget, removedGroupName),
+        );
+        const nextCustomRuleSets = state.customRuleSets.filter(
+          (ruleSet) => !ruleTargetMatchesContainer(ruleSet.target, removedTarget, removedGroupName),
+        );
+        const nextBuiltinRuleEdits = compactBuiltinRuleEdits(
+          Object.fromEntries(
+            Object.entries(state.builtinRuleEdits || {}).map(([key, edit]) => {
+              if (!ruleTargetMatchesContainer(edit?.target, removedTarget, removedGroupName)) return [key, edit];
+              const { target: _removedTarget, ...rest } = edit;
+              return [key, rest];
+            }),
+          ),
+        );
         return {
           customProxyGroups: nextCustomProxyGroups,
+          customRules: nextCustomRules,
           customRuleSets: nextCustomRuleSets,
+          builtinRuleEdits: nextBuiltinRuleEdits,
           ruleOrder: normalizeRuleOrderForState({
             ...state,
+            customProxyGroups: nextCustomProxyGroups,
+            customRules: nextCustomRules,
             customRuleSets: nextCustomRuleSets,
+            builtinRuleEdits: nextBuiltinRuleEdits,
           }),
         };
       });
diff --git a/packages/ui/src/store/config-store/actions/history-actions.test.ts b/packages/ui/src/store/config-store/actions/history-actions.test.ts
index 1da671f..da44ad5 100644
--- a/packages/ui/src/store/config-store/actions/history-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/history-actions.test.ts
@@ -41,27 +41,90 @@ describe("config store history actions", () => {
     const store = createStore({
       generatedYaml: "current",
       generatedYamlError: "bad",
+      nodeNameFilter: { enabled: true, excludeRegexes: ["expire"] },
       history,
       historyIndex: history.length - 1,
     });
     const actions = createHistoryActions(store.set as any, store.get as any);
 
     actions.pushHistory();
-    expect((store.state().history as string[])).toHaveLength(50);
+    expect((store.state().history as unknown[])).toHaveLength(50);
     expect(store.state().historyIndex).toBe(49);
-    expect((store.state().history as string[]).at(-1)).toBe("current");
+    expect((store.state().history as unknown[]).at(-1)).toEqual({
+      yaml: "current",
+      nodeNameFilter: { enabled: true, excludeRegexes: ["expire"] },
+    });
 
     actions.undo();
-    expect(store.state()).toMatchObject({ historyIndex: 48, generatedYaml: "yaml-54", generatedYamlError: null });
+    expect(store.state()).toMatchObject({
+      historyIndex: 48,
+      generatedYaml: "yaml-54",
+      generatedYamlError: null,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["expire"] },
+    });
 
     actions.redo();
-    expect(store.state()).toMatchObject({ historyIndex: 49, generatedYaml: "current", generatedYamlError: null });
+    expect(store.state()).toMatchObject({
+      historyIndex: 49,
+      generatedYaml: "current",
+      generatedYamlError: null,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["expire"] },
+    });
 
     const emptyStore = createStore({ generatedYaml: "", history: [], historyIndex: -1 });
     createHistoryActions(emptyStore.set as any, emptyStore.get as any).pushHistory();
     expect(emptyStore.set).not.toHaveBeenCalled();
   });
 
+  it("restores node-name filters from new snapshots and supports legacy string entries", () => {
+    const store = createStore({
+      generatedYaml: "filtered",
+      generatedYamlError: null,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["test"] },
+      history: [
+        "legacy yaml",
+        {
+          yaml: "unfiltered",
+          nodeNameFilter: { enabled: false, excludeRegexes: [] },
+        },
+        {
+          yaml: "filtered",
+          nodeNameFilter: { enabled: true, excludeRegexes: ["test"] },
+        },
+      ],
+      historyIndex: 2,
+    });
+    const actions = createHistoryActions(store.set as any, store.get as any);
+
+    actions.undo();
+    expect(store.state()).toMatchObject({
+      historyIndex: 1,
+      generatedYaml: "unfiltered",
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
+    });
+
+    actions.undo();
+    expect(store.state()).toMatchObject({
+      historyIndex: 0,
+      generatedYaml: "legacy yaml",
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
+    });
+
+    actions.redo();
+    expect(store.state()).toMatchObject({
+      historyIndex: 1,
+      generatedYaml: "unfiltered",
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
+    });
+
+    actions.redo();
+    expect(store.state()).toMatchObject({
+      historyIndex: 2,
+      generatedYaml: "filtered",
+      nodeNameFilter: { enabled: true, excludeRegexes: ["test"] },
+    });
+  });
+
   it("returns current state at undo/redo boundaries and resets to initial state", () => {
     const store = createStore({ generatedYaml: "only", history: ["only"], historyIndex: 0 });
     const actions = createHistoryActions(store.set as any, store.get as any);
@@ -73,5 +136,8 @@ describe("config store history actions", () => {
 
     actions.reset();
     expect(store.state()).toEqual(expect.objectContaining(initialState));
+    expect(store.state()).toMatchObject({
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
+    });
   });
 });
diff --git a/packages/ui/src/store/config-store/actions/history-actions.ts b/packages/ui/src/store/config-store/actions/history-actions.ts
index 7cb7ef1..5800eb2 100644
--- a/packages/ui/src/store/config-store/actions/history-actions.ts
+++ b/packages/ui/src/store/config-store/actions/history-actions.ts
@@ -1,6 +1,7 @@
 import type { ConfigActions } from "../definitions";
 import { initialState } from "../definitions";
 import { computeGeneratedYamlResult } from "../generated-yaml";
+import { normalizeNodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import type { GetState, SetState } from "../store-types";
 
 type HistoryActions = Pick<
@@ -8,6 +9,23 @@ type HistoryActions = Pick<
   "generateConfig" | "setGeneratedYaml" | "pushHistory" | "undo" | "redo" | "reset"
 >;
 
+function restoreHistoryEntry(
+  entry: ReturnType<GetState>["history"][number]
+): Partial<ReturnType<GetState>> {
+  if (typeof entry === "string") {
+    return {
+      generatedYaml: entry,
+      generatedYamlError: null,
+    };
+  }
+
+  return {
+    generatedYaml: entry.yaml,
+    generatedYamlError: null,
+    nodeNameFilter: normalizeNodeNameFilterConfig(entry.nodeNameFilter),
+  };
+}
+
 export function createHistoryActions(set: SetState, get: GetState): HistoryActions {
   return {
     generateConfig: () => {
@@ -31,7 +49,13 @@ export function createHistoryActions(set: SetState, get: GetState): HistoryActio
       if (!currentYaml) return;
 
       set((state) => {
-        const newHistory = [...state.history.slice(0, state.historyIndex + 1), currentYaml].slice(-50); // 最多保留 50 条历史
+        const newHistory = [
+          ...state.history.slice(0, state.historyIndex + 1),
+          {
+            yaml: currentYaml,
+            nodeNameFilter: normalizeNodeNameFilterConfig(state.nodeNameFilter),
+          },
+        ].slice(-50); // 最多保留 50 条历史
 
         return {
           history: newHistory,
@@ -43,10 +67,10 @@ export function createHistoryActions(set: SetState, get: GetState): HistoryActio
     undo: () => {
       set((state) => {
         if (state.historyIndex > 0) {
+          const historyIndex = state.historyIndex - 1;
           return {
-            historyIndex: state.historyIndex - 1,
-            generatedYaml: state.history[state.historyIndex - 1],
-            generatedYamlError: null,
+            historyIndex,
+            ...restoreHistoryEntry(state.history[historyIndex]),
           };
         }
         return state;
@@ -56,10 +80,10 @@ export function createHistoryActions(set: SetState, get: GetState): HistoryActio
     redo: () => {
       set((state) => {
         if (state.historyIndex < state.history.length - 1) {
+          const historyIndex = state.historyIndex + 1;
           return {
-            historyIndex: state.historyIndex + 1,
-            generatedYaml: state.history[state.historyIndex + 1],
-            generatedYamlError: null,
+            historyIndex,
+            ...restoreHistoryEntry(state.history[historyIndex]),
           };
         }
         return state;
diff --git a/packages/ui/src/store/config-store/actions/node-actions.test.ts b/packages/ui/src/store/config-store/actions/node-actions.test.ts
index 622ef57..9262304 100644
--- a/packages/ui/src/store/config-store/actions/node-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/node-actions.test.ts
@@ -304,6 +304,47 @@ describe("createNodeActions", () => {
     expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual(["C", "B", "A"]);
   });
 
+  it("reorders only scoped node slots while preserving hidden node positions", () => {
+    const { actions, getState } = createHarness({
+      nodes: [
+        node("A"),
+        node("Hidden 1"),
+        node("B"),
+        node("Hidden 2"),
+        node("C"),
+      ],
+    });
+    const effectiveNodeNames = ["A", "B", "C"];
+
+    actions.setNodeOrder("C", 1, effectiveNodeNames);
+    expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual([
+      "C",
+      "Hidden 1",
+      "A",
+      "Hidden 2",
+      "B",
+    ]);
+
+    actions.setNodeOrder("C", 3, effectiveNodeNames);
+    expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual([
+      "A",
+      "Hidden 1",
+      "B",
+      "Hidden 2",
+      "C",
+    ]);
+
+    actions.setNodeOrder("Hidden 1", 2, effectiveNodeNames);
+    actions.setNodeOrder("A", 2, []);
+    expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual([
+      "A",
+      "Hidden 1",
+      "B",
+      "Hidden 2",
+      "C",
+    ]);
+  });
+
   it("bulk renames nodes and listener ports without duplicate names", () => {
     const { actions, getState } = createHarness({
       nodes: [node("A"), node("B"), node("C"), node("X")],
diff --git a/packages/ui/src/store/config-store/actions/node-actions.ts b/packages/ui/src/store/config-store/actions/node-actions.ts
index af80914..a6436b6 100644
--- a/packages/ui/src/store/config-store/actions/node-actions.ts
+++ b/packages/ui/src/store/config-store/actions/node-actions.ts
@@ -257,11 +257,44 @@ export function createNodeActions(
       });
     },
 
-    setNodeOrder: (nodeName: string, order: number) => {
+    setNodeOrder: (nodeName: string, order: number, scopeNodeNames?: string[]) => {
       setAndGenerateConfig((state) => {
+        if (!Number.isFinite(order)) return state;
+
+        if (Array.isArray(scopeNodeNames)) {
+          const scope = new Set(
+            scopeNodeNames.filter(
+              (name): name is string => typeof name === "string" && name.trim() !== ""
+            )
+          );
+          if (!scope.has(nodeName)) return state;
+
+          const scopedNodes = state.nodes.filter((node) => scope.has(node.name));
+          const from = scopedNodes.findIndex((node) => node.name === nodeName);
+          if (from < 0) return state;
+          const to = Math.max(
+            0,
+            Math.min(scopedNodes.length - 1, Math.floor(order) - 1)
+          );
+          if (to === from) return state;
+
+          const reorderedScopedNodes = scopedNodes.slice();
+          const [item] = reorderedScopedNodes.splice(from, 1);
+          reorderedScopedNodes.splice(to, 0, item);
+
+          let scopedIndex = 0;
+          return {
+            nodes: state.nodes.map((node) => {
+              if (!scope.has(node.name)) return node;
+              const replacement = reorderedScopedNodes[scopedIndex];
+              scopedIndex += 1;
+              return replacement ?? node;
+            }),
+          };
+        }
+
         const from = state.nodes.findIndex((n) => n.name === nodeName);
         if (from < 0) return state;
-        if (!Number.isFinite(order)) return state;
         const to = Math.max(0, Math.min(state.nodes.length - 1, Math.floor(order) - 1));
         if (to === from) return state;
         const next = state.nodes.slice();
diff --git a/packages/ui/src/store/config-store/actions/proxy-group-actions.test.ts b/packages/ui/src/store/config-store/actions/proxy-group-actions.test.ts
index 6cfe8e3..894f6aa 100644
--- a/packages/ui/src/store/config-store/actions/proxy-group-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/proxy-group-actions.test.ts
@@ -187,7 +187,7 @@ describe("createProxyGroupActions", () => {
 
     expect(getState().builtinRuleEdits).toEqual({});
     expect(getState().customRuleSets).toEqual([
-      { id: "custom-ai", name: "Custom AI", behavior: "domain", path: "geosite/custom-ai.mrs", target: "🤖 AI 服务" },
+      { id: "custom-ai", name: "Custom AI", behavior: "domain", path: "geosite/custom-ai.mrs", target: { kind: "module", id: "ai" } },
     ]);
 
     const beforeDuplicateAdd = getState();
@@ -207,7 +207,7 @@ describe("createProxyGroupActions", () => {
       name: "Custom AI IP",
       behavior: "ipcidr",
       path: "geoip/custom-ai.mrs",
-      target: "🤖 AI 服务",
+      target: { kind: "module", id: "ai" },
       noResolve: true,
     });
 
@@ -249,6 +249,12 @@ describe("createProxyGroupActions", () => {
     expect(getState().builtinRuleEdits).toEqual({
       "module:ai:openai": { target: "Custom", enabled: false },
     });
+
+    actions.restoreModuleRule("ai", "openai");
+
+    expect(getState().builtinRuleEdits).toEqual({
+      "module:ai:openai": { target: "Custom" },
+    });
   });
 
   it("keeps missing rule-set targets as no-ops and retargets moved builtin edits", () => {
@@ -279,7 +285,7 @@ describe("createProxyGroupActions", () => {
     actions.moveModuleRule("ai", "openai", { kind: "module", id: "youtube" });
     expect(getState().enabledProxyGroups).toContain("youtube");
     expect(getState().builtinRuleEdits).toEqual({
-      "module:ai:openai": { target: "📹 油管视频" },
+      "module:ai:openai": { target: { kind: "module", id: "youtube" } },
     });
   });
 
@@ -339,7 +345,7 @@ describe("createProxyGroupActions", () => {
 
     actions.moveModuleRule("streaming-west", "apple-tvplus", { kind: "module", id: "google" });
     expect(getState().ruleOrder).toContain(appleTvPlusKey);
-    expect(getState().builtinRuleEdits[appleTvPlusKey]).toEqual({ target: "🔍 谷歌服务" });
+    expect(getState().builtinRuleEdits[appleTvPlusKey]).toEqual({ target: { kind: "module", id: "google" } });
     expect(getAppliedOrder().indexOf(appleTvPlusKey)).toBe(appleTvPlusIndex);
     actions.resetModuleRuleTarget("streaming-west", "apple-tvplus");
     expect(getState().builtinRuleEdits).toEqual({});
@@ -366,7 +372,7 @@ describe("createProxyGroupActions", () => {
     ]);
 
     expect(getState().customRuleSets).toEqual([
-      { id: "custom", name: "custom", behavior: "ipcidr", path: "geoip/custom.mrs", target: "Custom Module", noResolve: true },
+      { id: "custom", name: "custom", behavior: "ipcidr", path: "geoip/custom.mrs", target: { kind: "custom", id: "custom-module" }, noResolve: true },
     ]);
 
     const beforePresetNoop = getState();
@@ -421,7 +427,7 @@ describe("createProxyGroupActions", () => {
         name: "Telegram",
         behavior: "ipcidr",
         path: "geoip/telegram.mrs",
-        target: "Custom",
+        target: { kind: "custom", id: "custom-1" },
         noResolve: true,
       },
     ]);
@@ -433,11 +439,11 @@ describe("createProxyGroupActions", () => {
     expect(getState().customRuleSets[0]).toMatchObject({
       id: "telegram",
       name: "Telegram Custom",
-      target: "Custom",
+      target: { kind: "custom", id: "custom-1" },
     });
 
     actions.moveModuleRule("custom-1", "telegram", { kind: "custom", id: "custom-2" });
-    expect(getState().customRuleSets[0].target).toBe("Target");
+    expect(getState().customRuleSets[0].target).toEqual({ kind: "custom", id: "custom-2" });
 
     actions.removeModuleRule("custom-2", "telegram");
     expect(getState().customRuleSets).toEqual([]);
@@ -447,7 +453,7 @@ describe("createProxyGroupActions", () => {
     const { actions, getState } = createHarness({
       builtinRuleEdits: {
         "module:ai:openai": { enabled: false },
-        "module:ai:anthropic": { enabled: false },
+        "module:ai:anthropic": { target: "Custom", enabled: false },
         "module:youtube:youtube": { enabled: false },
       },
       moduleRuleEditWarningAccepted: false,
@@ -455,11 +461,17 @@ describe("createProxyGroupActions", () => {
 
     actions.restoreModuleDefaultRules("ai");
     actions.restoreModuleDefaultRules("missing");
-    expect(getState().builtinRuleEdits).toEqual({ "module:youtube:youtube": { enabled: false } });
+    expect(getState().builtinRuleEdits).toEqual({
+      "module:ai:anthropic": { target: "Custom" },
+      "module:youtube:youtube": { enabled: false },
+    });
 
     actions.restoreModuleDefaultRules("");
     actions.restoreModuleDefaultRules("ai");
-    expect(getState().builtinRuleEdits).toEqual({ "module:youtube:youtube": { enabled: false } });
+    expect(getState().builtinRuleEdits).toEqual({
+      "module:ai:anthropic": { target: "Custom" },
+      "module:youtube:youtube": { enabled: false },
+    });
 
     actions.acceptModuleRuleEditWarning();
     expect(getState().moduleRuleEditWarningAccepted).toBe(true);
@@ -505,20 +517,22 @@ describe("createProxyGroupActions", () => {
     actions.moveModuleRule("ai", "openai", { kind: "module", id: "youtube" });
 
     expect(getState().enabledProxyGroups).toContain("youtube");
-    expect(getState().builtinRuleEdits).toEqual({ "module:ai:openai": { target: "📹 油管视频" } });
+    expect(getState().builtinRuleEdits).toEqual({
+      "module:ai:openai": { target: { kind: "module", id: "youtube" } },
+    });
 
     actions.moveModuleRule("ai", "anthropic", { kind: "custom", id: "custom-1" });
 
     expect(getState().customRuleSets).toEqual([]);
     expect(getState().builtinRuleEdits).toEqual({
-      "module:ai:openai": { target: "📹 油管视频" },
-      "module:ai:anthropic": { target: "Custom" },
+      "module:ai:openai": { target: { kind: "module", id: "youtube" } },
+      "module:ai:anthropic": { target: { kind: "custom", id: "custom-1" } },
     });
 
     actions.moveModuleRule("ai", "anthropic", { kind: "custom", id: "custom-1" });
     expect(getState().builtinRuleEdits).toEqual({
-      "module:ai:openai": { target: "📹 油管视频" },
-      "module:ai:anthropic": { target: "Custom" },
+      "module:ai:openai": { target: { kind: "module", id: "youtube" } },
+      "module:ai:anthropic": { target: { kind: "custom", id: "custom-1" } },
     });
 
     const beforeIgnoredMoves = getState();
@@ -546,7 +560,7 @@ describe("createProxyGroupActions", () => {
 
     expect(getState().enabledProxyGroups).toEqual(["select", "auto", "youtube"]);
     expect(getState().customRuleSets).toEqual([
-      { id: "custom-ai", name: "Custom AI", behavior: "domain", path: "geosite/custom-ai.mrs", target: "📹 油管视频" },
+      { id: "custom-ai", name: "Custom AI", behavior: "domain", path: "geosite/custom-ai.mrs", target: { kind: "module", id: "youtube" } },
     ]);
   });
 
@@ -594,7 +608,9 @@ describe("createProxyGroupActions", () => {
     actions.moveModuleRule("private", "private-ip", { kind: "custom", id: "custom-1" });
 
     expect(getState().customRuleSets).toEqual([]);
-    expect(getState().builtinRuleEdits).toEqual({ "module:private:private-ip": { target: "Custom" } });
+    expect(getState().builtinRuleEdits).toEqual({
+      "module:private:private-ip": { target: { kind: "custom", id: "custom-1" } },
+    });
   });
 
   it("renames non-core module groups and rewrites custom rule targets", () => {
diff --git a/packages/ui/src/store/config-store/actions/proxy-group-actions.ts b/packages/ui/src/store/config-store/actions/proxy-group-actions.ts
index ae03821..3d85e1a 100644
--- a/packages/ui/src/store/config-store/actions/proxy-group-actions.ts
+++ b/packages/ui/src/store/config-store/actions/proxy-group-actions.ts
@@ -1,5 +1,7 @@
 import {
+  type CustomProxyGroup,
   type CustomRuleSet,
+  type ProxyGroupTargetRef,
 } from "@subboost/core/types/config";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
 import { PROXY_GROUP_MODULES } from "@subboost/core/generator/proxy-groups";
@@ -15,6 +17,7 @@ import {
   resolveMoveTargetName,
   resolveRuleSetContainerTargetName,
   retargetBuiltinRuleEdits,
+  ruleTargetMatchesContainer,
   updateBuiltinRuleEdit,
 } from "./proxy-group-rule-set-helpers";
 
@@ -63,6 +66,14 @@ function isSupportedProxyGroupOrderKey(key: string): boolean {
   );
 }
 
+function resolveRuleSetContainerTargetRef(
+  id: string,
+  customProxyGroups: CustomProxyGroup[],
+): ProxyGroupTargetRef | null {
+  if (isBuiltinProxyGroup(id)) return { kind: "module", id };
+  return customProxyGroups.some((group) => group.id === id) ? { kind: "custom", id } : null;
+}
+
 export function createProxyGroupActions(
   _set: SetState,
   _get: GetState,
@@ -172,7 +183,8 @@ export function createProxyGroupActions(
           state.customProxyGroups,
           state.proxyGroupNameOverrides,
         );
-        if (!target) return state;
+        const targetRef = resolveRuleSetContainerTargetRef(id, state.customProxyGroups);
+        if (!target || !targetRef) return state;
         const proxyModule = PROXY_GROUP_MODULES.find((item) => item.id === id);
         let nextBuiltinRuleEdits = state.builtinRuleEdits;
         const customDrafts: RuleSetDraft[] = [];
@@ -189,7 +201,7 @@ export function createProxyGroupActions(
           }
           customDrafts.push(normalized);
         }
-        const nextCustomRuleSets = appendUniqueCustomRuleSets(state.customRuleSets, customDrafts, target);
+        const nextCustomRuleSets = appendUniqueCustomRuleSets(state.customRuleSets, customDrafts, targetRef);
         if (
           nextCustomRuleSets.length === state.customRuleSets.length &&
           nextBuiltinRuleEdits === state.builtinRuleEdits
@@ -222,8 +234,11 @@ export function createProxyGroupActions(
           state.customProxyGroups,
           state.proxyGroupNameOverrides,
         );
-        if (!target) return state;
-        const index = state.customRuleSets.findIndex((item) => item.id === rid && item.target === target);
+        const targetRef = resolveRuleSetContainerTargetRef(id, state.customProxyGroups);
+        if (!target || !targetRef) return state;
+        const index = state.customRuleSets.findIndex(
+          (item) => item.id === rid && ruleTargetMatchesContainer(item.target, targetRef, target),
+        );
         if (index < 0) return state;
 
         const normalized = normalizeRuleSetDraft({
@@ -234,7 +249,7 @@ export function createProxyGroupActions(
         if (!normalized) return state;
 
         const nextCustomRuleSets = state.customRuleSets.map((item, itemIndex) =>
-          itemIndex === index ? { ...normalized, target } : item
+          itemIndex === index ? { ...normalized, target: targetRef } : item
         );
 
         return {
@@ -271,8 +286,9 @@ export function createProxyGroupActions(
           state.customProxyGroups,
           state.proxyGroupNameOverrides,
         );
-        if (!target) return state;
-        const movedBuiltinKey = findBuiltinRuleEditKeyByTarget(state.builtinRuleEdits, target, rid);
+        const targetRef = resolveRuleSetContainerTargetRef(id, state.customProxyGroups);
+        if (!target || !targetRef) return state;
+        const movedBuiltinKey = findBuiltinRuleEditKeyByTarget(state.builtinRuleEdits, targetRef, target, rid);
         if (movedBuiltinKey) {
           const nextBuiltinRuleEdits = updateBuiltinRuleEdit(state.builtinRuleEdits, movedBuiltinKey, { enabled: false });
           return {
@@ -284,7 +300,7 @@ export function createProxyGroupActions(
           };
         }
         const nextCustomRuleSets = state.customRuleSets.filter(
-          (ruleSet) => !(ruleSet.id === rid && ruleSet.target === target)
+          (ruleSet) => !(ruleSet.id === rid && ruleTargetMatchesContainer(ruleSet.target, targetRef, target))
         );
         if (nextCustomRuleSets.length === state.customRuleSets.length) return state;
         return {
@@ -317,7 +333,8 @@ export function createProxyGroupActions(
           state.customProxyGroups,
           state.proxyGroupNameOverrides,
         );
-        if (!sourceTarget) return state;
+        const sourceTargetRef = resolveRuleSetContainerTargetRef(sourceId, state.customProxyGroups);
+        if (!sourceTarget || !sourceTargetRef) return state;
         if (sourceTarget === targetName) return state;
         if (target.kind === "module" && targetId === sourceId) return state;
 
@@ -330,7 +347,8 @@ export function createProxyGroupActions(
         }
 
         const customRuleSetIndex = state.customRuleSets.findIndex(
-          (ruleSet) => ruleSet.id === rid && ruleSet.target === sourceTarget
+          (ruleSet) =>
+            ruleSet.id === rid && ruleTargetMatchesContainer(ruleSet.target, sourceTargetRef, sourceTarget)
         );
         if (customRuleSetIndex >= 0) {
           const targetModule = target.kind === "module"
@@ -350,13 +368,13 @@ export function createProxyGroupActions(
               (ruleSet, index) =>
                 index !== customRuleSetIndex &&
                 ruleSet.id === rid &&
-                ruleSet.target === targetName
+                ruleTargetMatchesContainer(ruleSet.target, target, targetName)
             )
           ) {
             nextCustomRuleSets = state.customRuleSets.filter((_, index) => index !== customRuleSetIndex);
           } else {
             nextCustomRuleSets = state.customRuleSets.map((ruleSet, index) =>
-              index === customRuleSetIndex ? { ...ruleSet, target: targetName } : ruleSet
+              index === customRuleSetIndex ? { ...ruleSet, target } : ruleSet
             );
           }
           return {
@@ -372,10 +390,15 @@ export function createProxyGroupActions(
           };
         }
 
-        const movedBuiltinKey = findBuiltinRuleEditKeyByTarget(state.builtinRuleEdits, sourceTarget, rid);
+        const movedBuiltinKey = findBuiltinRuleEditKeyByTarget(
+          state.builtinRuleEdits,
+          sourceTargetRef,
+          sourceTarget,
+          rid,
+        );
         if (movedBuiltinKey) {
           const nextBuiltinRuleEdits = updateBuiltinRuleEdit(state.builtinRuleEdits, movedBuiltinKey, {
-            target: targetName,
+            target,
             enabled: true,
           });
           return {
@@ -392,7 +415,7 @@ export function createProxyGroupActions(
         if (!sourceModule || !isPresetModuleRule(sourceModule, rid)) return state;
         const key = getModuleRuleOrderKey(sourceId, rid);
         const nextBuiltinRuleEdits = updateBuiltinRuleEdit(state.builtinRuleEdits, key, {
-          target: targetName,
+          target,
           enabled: true,
         });
         return {
@@ -417,8 +440,11 @@ export function createProxyGroupActions(
         if (!mod || !isPresetModuleRule(mod, rid)) return state;
 
         const key = getModuleRuleOrderKey(id, rid);
-        if (state.builtinRuleEdits?.[key]?.enabled !== false) return state;
-        const nextBuiltinRuleEdits = updateBuiltinRuleEdit(state.builtinRuleEdits, key, { enabled: true });
+        const currentEdit = state.builtinRuleEdits?.[key];
+        if (currentEdit?.enabled !== false) return state;
+        const nextBuiltinRuleEdits = updateBuiltinRuleEdit(state.builtinRuleEdits, key, {
+          enabled: true,
+        });
         return {
           builtinRuleEdits: nextBuiltinRuleEdits,
           ruleOrder: normalizeRuleOrderForState({
@@ -459,7 +485,9 @@ export function createProxyGroupActions(
         for (const rule of proxyModule.rules) {
           const key = getModuleRuleOrderKey(id, rule.id);
           if (nextBuiltinRuleEdits?.[key]?.enabled === false) {
-            nextBuiltinRuleEdits = updateBuiltinRuleEdit(nextBuiltinRuleEdits, key, { enabled: true });
+            nextBuiltinRuleEdits = updateBuiltinRuleEdit(nextBuiltinRuleEdits, key, {
+              enabled: true,
+            });
           }
         }
         if (nextBuiltinRuleEdits === state.builtinRuleEdits) return state;
diff --git a/packages/ui/src/store/config-store/actions/proxy-group-rule-set-helpers.ts b/packages/ui/src/store/config-store/actions/proxy-group-rule-set-helpers.ts
index 08f9442..2286d37 100644
--- a/packages/ui/src/store/config-store/actions/proxy-group-rule-set-helpers.ts
+++ b/packages/ui/src/store/config-store/actions/proxy-group-rule-set-helpers.ts
@@ -1,11 +1,14 @@
 import { PROXY_GROUP_MODULES } from "@subboost/core/generator/proxy-groups";
 import { normalizePersistedRuleOrder } from "@subboost/core/generator/rules";
 import { resolveProxyGroupModuleName } from "@subboost/core/proxy-group-name";
+import { normalizeProxyGroupTargetRef } from "@subboost/core/proxy-group-targets";
 import { isValidRuleSetPathOrUrl, normalizeRuleSetPathInput } from "@subboost/core/rules/rule-model";
 import type {
   BuiltinRuleEdits,
   CustomProxyGroup,
   CustomRuleSet,
+  ProxyGroupRuleTarget,
+  ProxyGroupTargetRef,
   RuleSetBehavior,
 } from "@subboost/core/types/config";
 import type { RuleSetDraft } from "../definitions";
@@ -82,7 +85,8 @@ export function resolveRuleSetContainerTargetName(
 export function compactBuiltinRuleEdits(edits: BuiltinRuleEdits): BuiltinRuleEdits {
   const next: BuiltinRuleEdits = {};
   for (const [key, edit] of Object.entries(edits || {})) {
-    const target = typeof edit?.target === "string" ? edit.target.trim() : "";
+    const target = normalizeProxyGroupTargetRef(edit?.target) ??
+      (typeof edit?.target === "string" ? edit.target.trim() : "");
     const enabled = edit?.enabled === false ? false : undefined;
     if (!target && enabled !== false) continue;
     next[key] = {
@@ -96,12 +100,13 @@ export function compactBuiltinRuleEdits(edits: BuiltinRuleEdits): BuiltinRuleEdi
 export function updateBuiltinRuleEdit(
   edits: BuiltinRuleEdits,
   key: string,
-  patch: { target?: string | null; enabled?: false | true | null }
+  patch: { target?: ProxyGroupRuleTarget | null; enabled?: false | true | null }
 ): BuiltinRuleEdits {
   const prev = edits?.[key] || {};
   const next = { ...prev };
   if ("target" in patch) {
-    const target = typeof patch.target === "string" ? patch.target.trim() : "";
+    const target = normalizeProxyGroupTargetRef(patch.target) ??
+      (typeof patch.target === "string" ? patch.target.trim() : "");
     if (target) next.target = target;
     else delete next.target;
   }
@@ -129,12 +134,13 @@ export function retargetBuiltinRuleEdits(edits: BuiltinRuleEdits, from: string,
 
 export function findBuiltinRuleEditKeyByTarget(
   edits: BuiltinRuleEdits,
-  target: string,
+  target: ProxyGroupTargetRef,
+  legacyTargetName: string,
   ruleId: string
 ): string | null {
-  if (!target || !ruleId) return null;
+  if (!target.id || !legacyTargetName || !ruleId) return null;
   for (const [key, edit] of Object.entries(edits || {})) {
-    if (edit?.target !== target) continue;
+    if (!ruleTargetMatchesContainer(edit?.target, target, legacyTargetName)) continue;
     const parts = key.split(":");
     if (parts.length !== 3 || parts[0] !== "module") continue;
     if (parts[2] === ruleId) return key;
@@ -145,7 +151,7 @@ export function findBuiltinRuleEditKeyByTarget(
 export function appendUniqueCustomRuleSets(
   existing: CustomRuleSet[],
   drafts: RuleSetDraft[],
-  target: string
+  target: ProxyGroupRuleTarget
 ): CustomRuleSet[] {
   const seen = new Set(existing.map((item) => item.id));
   const next = [...existing];
@@ -157,3 +163,13 @@ export function appendUniqueCustomRuleSets(
   }
   return next;
 }
+
+export function ruleTargetMatchesContainer(
+  target: ProxyGroupRuleTarget | undefined,
+  container: ProxyGroupTargetRef,
+  legacyTargetName: string
+): boolean {
+  const ref = normalizeProxyGroupTargetRef(target);
+  if (ref) return ref.kind === container.kind && ref.id === container.id;
+  return typeof target === "string" && target.trim() === legacyTargetName.trim();
+}
diff --git a/packages/ui/src/store/config-store/actions/settings-actions.test.ts b/packages/ui/src/store/config-store/actions/settings-actions.test.ts
index f17b2e0..f93a2bb 100644
--- a/packages/ui/src/store/config-store/actions/settings-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/settings-actions.test.ts
@@ -25,6 +25,10 @@ describe("config store settings actions", () => {
     actions.setTestUrl("https://cp.cloudflare.com/generate_204");
     actions.setTestInterval(600);
     actions.setRuleProviderBaseUrl("https://rules.example.com");
+    actions.setNodeNameFilter({
+      enabled: true,
+      excludeRegexes: ["  expire  ", "expire", ""],
+    });
     actions.setCnIpNoResolve(true);
     actions.setExperimentalCnUseCnRuleSet(1 as unknown as boolean);
 
@@ -35,10 +39,31 @@ describe("config store settings actions", () => {
       testUrl: "https://cp.cloudflare.com/generate_204",
       testInterval: 600,
       ruleProviderBaseUrl: "https://rules.example.com",
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["expire"],
+      },
       cnIpNoResolve: true,
       experimentalCnUseCnRuleSet: true,
     });
-    expect(store.setAndGenerateConfig).toHaveBeenCalledTimes(8);
+    expect(store.setAndGenerateConfig).toHaveBeenCalledTimes(9);
     expect(store.set).not.toHaveBeenCalled();
   });
+
+  it("rejects invalid node-name filters before updating generated config", () => {
+    const store = createStore();
+    const actions = createSettingsActions(
+      store.set as any,
+      store.get as any,
+      store.setAndGenerateConfig as any
+    );
+
+    expect(() =>
+      actions.setNodeNameFilter({
+        enabled: true,
+        excludeRegexes: ["("],
+      })
+    ).toThrow("第 1 行");
+    expect(store.state()).toEqual({});
+  });
 });
diff --git a/packages/ui/src/store/config-store/actions/settings-actions.ts b/packages/ui/src/store/config-store/actions/settings-actions.ts
index c1508f2..c1445f1 100644
--- a/packages/ui/src/store/config-store/actions/settings-actions.ts
+++ b/packages/ui/src/store/config-store/actions/settings-actions.ts
@@ -1,4 +1,5 @@
 import type { ConfigActions } from "../definitions";
+import { parseNodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import type { GetState, SetAndGenerateConfig, SetState } from "../store-types";
 
 type SettingsActions = Pick<
@@ -9,6 +10,7 @@ type SettingsActions = Pick<
   | "setTestUrl"
   | "setTestInterval"
   | "setRuleProviderBaseUrl"
+  | "setNodeNameFilter"
   | "setProxyGroupAdvancedModeEnabled"
   | "setCnIpNoResolve"
   | "setExperimentalCnUseCnRuleSet"
@@ -44,6 +46,12 @@ export function createSettingsActions(
       setAndGenerateConfig(() => ({ ruleProviderBaseUrl: url }));
     },
 
+    setNodeNameFilter: (config) => {
+      setAndGenerateConfig(() => ({
+        nodeNameFilter: parseNodeNameFilterConfig(config),
+      }));
+    },
+
     setProxyGroupAdvancedModeEnabled: (value: boolean) => {
       setAndGenerateConfig(() => ({ proxyGroupAdvancedModeEnabled: Boolean(value) }));
     },
diff --git a/packages/ui/src/store/config-store/actions/template-actions.test.ts b/packages/ui/src/store/config-store/actions/template-actions.test.ts
index 62fae65..b624f95 100644
--- a/packages/ui/src/store/config-store/actions/template-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/template-actions.test.ts
@@ -38,6 +38,7 @@ describe("createTemplateActions", () => {
       builtinRuleEdits: { "module:ai:anthropic": { enabled: false } },
       ruleOrder: ["module:ai:openai"],
       moduleRuleEditWarningAccepted: true,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["套餐到期"] },
     });
 
     actions.setTemplate("standard");
@@ -52,6 +53,7 @@ describe("createTemplateActions", () => {
       builtinRuleEdits: {},
       ruleOrder: [],
       moduleRuleEditWarningAccepted: false,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["套餐到期"] },
     });
 
     actions.setAppliedTemplateId(null);
diff --git a/packages/ui/src/store/config-store/actions/template-actions.ts b/packages/ui/src/store/config-store/actions/template-actions.ts
index 206bdcd..f01aab6 100644
--- a/packages/ui/src/store/config-store/actions/template-actions.ts
+++ b/packages/ui/src/store/config-store/actions/template-actions.ts
@@ -79,7 +79,6 @@ export function createTemplateActions(
     // 应用模板配置（从模板库应用）
     applyTemplateConfig: (config: SubBoostTemplateConfig) => {
       if (!config || typeof config !== "object") return;
-
       setAndGenerateConfig((state) => {
         const ruleModel = normalizeRuleModelFromConfig(config);
         const hasCustomProxyGroups = Array.isArray(config.customProxyGroups);
diff --git a/packages/ui/src/store/config-store/auth-handoff.test.ts b/packages/ui/src/store/config-store/auth-handoff.test.ts
index 9e805fb..7f47558 100644
--- a/packages/ui/src/store/config-store/auth-handoff.test.ts
+++ b/packages/ui/src/store/config-store/auth-handoff.test.ts
@@ -51,6 +51,7 @@ function meaningfulState(overrides: Record<string, unknown> = {}) {
       },
     ],
     nodes: [{ name: "Node A" }],
+    nodeNameFilter: { enabled: true, excludeRegexes: ["expire", "test"] },
     deletedNodeNames: ["Gone"],
     deletedNodes: [{ originName: "Gone", name: "Gone" }],
     customRules: [{ id: "rule-1", type: "DOMAIN", value: "example.com", target: "Proxy" }],
@@ -142,6 +143,7 @@ describe("auth config handoff", () => {
         }),
       ],
       nodes: [{ name: "Node A" }],
+      nodeNameFilter: { enabled: true, excludeRegexes: ["expire", "test"] },
       deletedNodeNames: ["Gone"],
       deletedNodes: [{ originName: "Gone", name: "Gone" }],
       template: "full",
@@ -243,6 +245,10 @@ describe("auth config handoff", () => {
         state: {
           sources: [{ id: "bad", type: "bad", content: "x" }],
           nodes: [{ name: "Node" }, "bad"],
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["  expire  ", "expire", "", 42],
+          },
           deletedNodeNames: ["Gone", 1],
           deletedNodes: [{ originName: "Gone" }],
           template: "bad",
@@ -284,6 +290,7 @@ describe("auth config handoff", () => {
     const consumed = consumeAuthConfigHandoff();
 
     expect(consumed).toEqual({
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
       deletedNodeNames: ["Gone"],
       deletedNodes: [{ originName: "Gone" }],
       enabledProxyGroups: ["select"],
@@ -341,6 +348,7 @@ describe("auth config handoff", () => {
 
     expect(consumed).toEqual({
       sources: [{ id: "source-1", type: "url", content: "https://example.com/sub" }],
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
     });
   });
 });
diff --git a/packages/ui/src/store/config-store/auth-handoff.ts b/packages/ui/src/store/config-store/auth-handoff.ts
index 79cee51..922cedf 100644
--- a/packages/ui/src/store/config-store/auth-handoff.ts
+++ b/packages/ui/src/store/config-store/auth-handoff.ts
@@ -1,6 +1,7 @@
 import type { ConfigState, SourceType, SubscriptionSource } from "./definitions";
 import { initialState } from "./definitions";
 import { safeParseJsonObject } from "@subboost/core/json";
+import { normalizeNodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
 
@@ -109,6 +110,8 @@ function hasMeaningfulConfig(state: ConfigState): boolean {
   return (
     state.sources.some((source) => source.content.trim()) ||
     state.nodes.length > 0 ||
+    state.nodeNameFilter.enabled ||
+    state.nodeNameFilter.excludeRegexes.length > 0 ||
     state.deletedNodeNames.length > 0 ||
     state.deletedNodes.length > 0 ||
     state.customRules.length > 0 ||
@@ -142,6 +145,7 @@ function buildHandoffState(state: ConfigState): Partial<ConfigState> {
   return {
     sources: sourceArray(state.sources) ?? [],
     nodes: state.nodes,
+    nodeNameFilter: normalizeNodeNameFilterConfig(state.nodeNameFilter),
     deletedNodeNames: state.deletedNodeNames,
     deletedNodes: state.deletedNodes,
     template: state.template,
@@ -179,6 +183,7 @@ function normalizeHandoffState(raw: unknown): Partial<ConfigState> | null {
   if (sources) out.sources = sources;
   const nodes = objectArray<ConfigState["nodes"][number]>(raw.nodes);
   if (nodes) out.nodes = nodes;
+  out.nodeNameFilter = normalizeNodeNameFilterConfig(raw.nodeNameFilter);
   const deletedNodeNames = stringArray(raw.deletedNodeNames);
   if (deletedNodeNames) out.deletedNodeNames = deletedNodeNames;
   const deletedNodes = objectArray<ConfigState["deletedNodes"][number]>(raw.deletedNodes);
diff --git a/packages/ui/src/store/config-store/definitions.test.ts b/packages/ui/src/store/config-store/definitions.test.ts
index b00e86e..8787f2e 100644
--- a/packages/ui/src/store/config-store/definitions.test.ts
+++ b/packages/ui/src/store/config-store/definitions.test.ts
@@ -1,6 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { TEMPLATES } from "@subboost/core/templates";
 import { DEFAULT_SUBBOOST_CONFIG } from "@subboost/core/config/defaults";
+import { DEFAULT_NODE_NAME_FILTER_CONFIG } from "@subboost/core/subscription/node-name-filter";
 
 const mocks = vi.hoisted(() => ({
   importSource: vi.fn(),
@@ -43,6 +44,8 @@ describe("config store definitions", () => {
     expect(initialState.testUrl).toBe(DEFAULT_SUBBOOST_CONFIG.testUrl);
     expect(initialState.testInterval).toBe(DEFAULT_SUBBOOST_CONFIG.testInterval);
     expect(initialState.ruleProviderBaseUrl).toBe(DEFAULT_SUBBOOST_CONFIG.ruleProviderBaseUrl);
+    expect(initialState.nodeNameFilter).toEqual(DEFAULT_NODE_NAME_FILTER_CONFIG);
+    expect(initialState.nodeNameFilter).not.toBe(DEFAULT_NODE_NAME_FILTER_CONFIG);
     expect(initialState.generatedYaml).toBe("");
     expect(initialState.historyIndex).toBe(-1);
   });
diff --git a/packages/ui/src/store/config-store/definitions.ts b/packages/ui/src/store/config-store/definitions.ts
index 91e2dc0..6d94831 100644
--- a/packages/ui/src/store/config-store/definitions.ts
+++ b/packages/ui/src/store/config-store/definitions.ts
@@ -17,6 +17,10 @@ import {
 } from "@subboost/core/subscription/import-error";
 import type { SubscriptionUserInfo } from "@subboost/core/subscription/subscription-userinfo";
 import { tryNormalizeSubscriptionUrlInput } from "@subboost/core/subscription/url-input";
+import {
+  DEFAULT_NODE_NAME_FILTER_CONFIG,
+  type NodeNameFilterConfig,
+} from "@subboost/core/subscription/node-name-filter";
 import { getActiveProductApiAdapter } from "@subboost/ui/product/api-adapter";
 import {
   getNodeSourceIds,
@@ -32,6 +36,14 @@ export { DEFAULT_BASE_CONFIG_YAML };
 export type RuleSetDraft = Omit<CustomRuleSet, "target">;
 export type { BuiltinRuleEdits, CustomRuleSet, ProxyGroupAdvancedConfig };
 export type { DialerProxyGroup, SubBoostTemplateConfig } from "@subboost/core/types/template-config";
+export type { NodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
+
+export type ConfigHistoryEntry =
+  | string
+  | {
+      yaml: string;
+      nodeNameFilter: NodeNameFilterConfig;
+    };
 
 // 预设的中转组名称
 export const PRESET_RELAY_NAMES = [
@@ -164,6 +176,7 @@ export interface ConfigState {
   }>;
   parseErrors: string[];
   isLoading: boolean;
+  nodeNameFilter: NodeNameFilterConfig;
 
   // 订阅源
   sources: SubscriptionSource[];
@@ -217,7 +230,7 @@ export interface ConfigState {
   generatedYamlError: string | null;
 
   // 历史记录（用于撤销）
-  history: string[];
+  history: ConfigHistoryEntry[];
   historyIndex: number;
 }
 
@@ -236,7 +249,8 @@ export interface ConfigActions {
   restoreNodeName: (nodeName: string) => void;
   restoreDeletedNode: (originName: string) => void;
   moveNode: (nodeName: string, direction: "up" | "down") => void;
-  setNodeOrder: (nodeName: string, order: number) => void;
+  setNodeOrder: (nodeName: string, order: number, scopeNodeNames?: string[]) => void;
+  setNodeNameFilter: (config: NodeNameFilterConfig) => void;
 
   // 模板和配置
   setTemplate: (template: TemplateType) => void;
@@ -330,6 +344,10 @@ export const initialState: ConfigState = {
   deletedNodes: [],
   parseErrors: [],
   isLoading: false,
+  nodeNameFilter: {
+    enabled: DEFAULT_NODE_NAME_FILTER_CONFIG.enabled,
+    excludeRegexes: [...DEFAULT_NODE_NAME_FILTER_CONFIG.excludeRegexes],
+  },
   sources: [
     { id: "1", type: "url", content: "" },
     { id: "2", type: "yaml", content: "" },
diff --git a/packages/ui/src/store/config-store/generated-yaml.test.ts b/packages/ui/src/store/config-store/generated-yaml.test.ts
index dc4c0e8..7f77555 100644
--- a/packages/ui/src/store/config-store/generated-yaml.test.ts
+++ b/packages/ui/src/store/config-store/generated-yaml.test.ts
@@ -5,6 +5,7 @@ import { computeGeneratedYaml, computeGeneratedYamlResult } from "./generated-ya
 const mocks = vi.hoisted(() => ({
   generateClashYaml: vi.fn(),
   stripImportedNodeControlFieldsFromList: vi.fn(),
+  resolveNodeNameFilter: vi.fn(),
 }));
 
 vi.mock("@subboost/core/generator", () => ({
@@ -15,6 +16,11 @@ vi.mock("@subboost/core/subscription/imported-node-controls", () => ({
   stripImportedNodeControlFieldsFromList: mocks.stripImportedNodeControlFieldsFromList,
 }));
 
+vi.mock("@subboost/core/subscription/node-name-filter", () => ({
+  DEFAULT_NODE_NAME_FILTER_CONFIG: { enabled: false, excludeRegexes: [] },
+  resolveNodeNameFilter: mocks.resolveNodeNameFilter,
+}));
+
 function createState(overrides: Record<string, unknown> = {}) {
   return {
     ...structuredClone(initialState),
@@ -27,6 +33,14 @@ describe("computeGeneratedYamlResult", () => {
     vi.clearAllMocks();
     mocks.generateClashYaml.mockReturnValue("generated yaml");
     mocks.stripImportedNodeControlFieldsFromList.mockImplementation((nodes) => nodes);
+    mocks.resolveNodeNameFilter.mockImplementation((nodes) => ({
+      rawNodes: nodes,
+      effectiveNodes: nodes,
+      excludedNodes: [],
+      rawCount: nodes.length,
+      excludedCount: 0,
+      effectiveCount: nodes.length,
+    }));
   });
 
   it("passes sanitized nodes and valid proxy providers to the core generator", () => {
@@ -62,6 +76,10 @@ describe("computeGeneratedYamlResult", () => {
     );
 
     expect(result).toEqual({ yaml: "generated yaml", error: null });
+    expect(mocks.resolveNodeNameFilter).toHaveBeenCalledWith(
+      nodes,
+      expect.objectContaining({ enabled: false, excludeRegexes: [] })
+    );
     expect(mocks.stripImportedNodeControlFieldsFromList).toHaveBeenCalledWith(nodes);
     expect(mocks.generateClashYaml).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -89,6 +107,58 @@ describe("computeGeneratedYamlResult", () => {
     );
   });
 
+  it("generates from effective nodes while preserving the complete state snapshot", () => {
+    const rawNodes = [
+      { name: "Keep", type: "ss" },
+      { name: "Drop", type: "ss" },
+    ];
+    const effectiveNodes = [rawNodes[0]];
+    mocks.resolveNodeNameFilter.mockReturnValueOnce({
+      rawNodes,
+      effectiveNodes,
+      excludedNodes: [rawNodes[1]],
+      rawCount: 2,
+      excludedCount: 1,
+      effectiveCount: 1,
+    });
+    const state = createState({
+      nodes: rawNodes,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["drop"] },
+    });
+
+    expect(computeGeneratedYaml(state)).toBe("generated yaml");
+
+    expect(mocks.stripImportedNodeControlFieldsFromList).toHaveBeenCalledWith(effectiveNodes);
+    expect(mocks.generateClashYaml).toHaveBeenCalledWith(
+      expect.objectContaining({ nodes: effectiveNodes })
+    );
+    expect(state.nodes).toBe(rawNodes);
+  });
+
+  it("hides generated preview when filtering removes every node", () => {
+    const rawNodes = [{ name: "Drop", type: "ss" }];
+    mocks.resolveNodeNameFilter.mockReturnValueOnce({
+      rawNodes,
+      effectiveNodes: [],
+      excludedNodes: rawNodes,
+      rawCount: 1,
+      excludedCount: 1,
+      effectiveCount: 0,
+    });
+
+    const result = computeGeneratedYamlResult(
+      createState({
+        nodes: rawNodes,
+        nodeNameFilter: { enabled: true, excludeRegexes: ["drop"] },
+      })
+    );
+
+    expect(result).toEqual({ yaml: "", error: null });
+    expect(mocks.generateClashYaml).toHaveBeenCalledWith(
+      expect.objectContaining({ nodes: [] })
+    );
+  });
+
   it("hides generated preview output when there are no nodes or providers", () => {
     const result = computeGeneratedYamlResult(createState());
 
@@ -113,6 +183,41 @@ describe("computeGeneratedYamlResult", () => {
     expect(yaml).toBe("generated yaml");
   });
 
+  it("keeps provider output visible when every ordinary node is excluded", () => {
+    const rawNodes = [{ name: "Drop", type: "ss" }];
+    mocks.resolveNodeNameFilter.mockReturnValueOnce({
+      rawNodes,
+      effectiveNodes: [],
+      excludedNodes: rawNodes,
+      rawCount: 1,
+      excludedCount: 1,
+      effectiveCount: 0,
+    });
+
+    const yaml = computeGeneratedYaml(
+      createState({
+        nodes: rawNodes,
+        nodeNameFilter: { enabled: true, excludeRegexes: ["drop"] },
+        sources: [
+          {
+            id: "remote",
+            type: "url",
+            content: "https://example.com/sub.yaml",
+            useProxyProviders: true,
+          },
+        ],
+      })
+    );
+
+    expect(yaml).toBe("generated yaml");
+    expect(mocks.generateClashYaml).toHaveBeenCalledWith(
+      expect.objectContaining({
+        nodes: [],
+        proxyProviders: expect.objectContaining({ url_remote: expect.any(Object) }),
+      })
+    );
+  });
+
   it("formats generator failures for UI display", () => {
     mocks.generateClashYaml.mockImplementationOnce(() => {
       throw new Error("dns yaml failed");
@@ -130,4 +235,16 @@ describe("computeGeneratedYamlResult", () => {
       error: "生成配置失败",
     });
   });
+
+  it("formats node-filter failures for UI display", () => {
+    mocks.resolveNodeNameFilter.mockImplementationOnce(() => {
+      throw new Error("第 1 行：正则表达式无效");
+    });
+
+    expect(computeGeneratedYamlResult(createState({ nodes: [{ name: "Node A" }] }))).toEqual({
+      yaml: "",
+      error: "第 1 行：正则表达式无效",
+    });
+    expect(mocks.generateClashYaml).not.toHaveBeenCalled();
+  });
 });
diff --git a/packages/ui/src/store/config-store/generated-yaml.ts b/packages/ui/src/store/config-store/generated-yaml.ts
index b202822..514f703 100644
--- a/packages/ui/src/store/config-store/generated-yaml.ts
+++ b/packages/ui/src/store/config-store/generated-yaml.ts
@@ -1,5 +1,7 @@
 import { generateClashYaml } from "@subboost/core/generator";
 import { stripImportedNodeControlFieldsFromList } from "@subboost/core/subscription/imported-node-controls";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
+import type { ParsedNode } from "@subboost/core/types/node";
 import type { ConfigState } from "./definitions";
 
 function buildProxyProvidersFromSources(
@@ -50,10 +52,11 @@ function formatGeneratedYamlError(error: unknown): string {
 
 function buildGenerateClashYamlOptions(
   state: ConfigState,
-  proxyProviders: Record<string, unknown> | undefined
+  proxyProviders: Record<string, unknown> | undefined,
+  effectiveNodes: ParsedNode[]
 ): GenerateClashYamlOptions {
   return {
-    nodes: stripImportedNodeControlFieldsFromList(state.nodes),
+    nodes: stripImportedNodeControlFieldsFromList(effectiveNodes),
     proxyProviders,
     template: state.template,
     userConfig: {
@@ -84,10 +87,13 @@ function buildGenerateClashYamlOptions(
 
 export function computeGeneratedYamlResult(state: ConfigState): GeneratedYamlResult {
   const proxyProviders = buildProxyProvidersFromSources(state);
-  const hasPreviewContent = state.nodes.length > 0 || Boolean(proxyProviders);
 
   try {
-    const yaml = generateClashYaml(buildGenerateClashYamlOptions(state, proxyProviders));
+    const { effectiveNodes } = resolveNodeNameFilter(state.nodes, state.nodeNameFilter);
+    const hasPreviewContent = effectiveNodes.length > 0 || Boolean(proxyProviders);
+    const yaml = generateClashYaml(
+      buildGenerateClashYamlOptions(state, proxyProviders, effectiveNodes)
+    );
     return { yaml: hasPreviewContent ? yaml : "", error: null };
   } catch (error) {
     return { yaml: "", error: formatGeneratedYamlError(error) };
diff --git a/packages/ui/src/store/config-store/persistence.test.ts b/packages/ui/src/store/config-store/persistence.test.ts
new file mode 100644
index 0000000..cdf737c
--- /dev/null
+++ b/packages/ui/src/store/config-store/persistence.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, it } from "vitest";
+import { DEFAULT_NODE_NAME_FILTER_CONFIG } from "@subboost/core/subscription/node-name-filter";
+import { initialState } from "./definitions";
+import {
+  CONFIG_DRAFT_STORAGE_VERSION,
+  normalizePersistedConfigState,
+  partializeConfigState,
+  prepareConfigDraftScope,
+} from "./persistence";
+
+describe("config store persistence", () => {
+  it("round-trips the normalized node-name filter without persisting node snapshots", () => {
+    const state = {
+      ...structuredClone(initialState),
+      nodes: [{ name: "完整节点快照" }],
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["  expire  ", "expire", "", "test"],
+      },
+    } as typeof initialState;
+
+    const persisted = partializeConfigState(state);
+
+    expect(persisted).toMatchObject({
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["expire", "test"],
+      },
+    });
+    expect(persisted).not.toHaveProperty("nodes");
+    expect(normalizePersistedConfigState(persisted).nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["expire", "test"],
+    });
+  });
+
+  it("defaults missing or malformed node-name filter data without a storage-version bump", () => {
+    expect(CONFIG_DRAFT_STORAGE_VERSION).toBe(10);
+    expect(normalizePersistedConfigState({}).nodeNameFilter).toEqual(
+      DEFAULT_NODE_NAME_FILTER_CONFIG
+    );
+    expect(
+      normalizePersistedConfigState({
+        nodeNameFilter: {
+          enabled: "yes",
+          excludeRegexes: "expire",
+        },
+      }).nodeNameFilter
+    ).toEqual(DEFAULT_NODE_NAME_FILTER_CONFIG);
+  });
+
+  it("restores the filter only from the current draft envelope", () => {
+    const storageName = "subboost-config:user:user-1";
+    const storage = {
+      getItem: (key: string) =>
+        key === storageName
+          ? JSON.stringify({
+              version: CONFIG_DRAFT_STORAGE_VERSION,
+              state: {
+                nodeNameFilter: {
+                  enabled: true,
+                  excludeRegexes: ["test"],
+                },
+              },
+            })
+          : null,
+      setItem: () => undefined,
+    };
+
+    expect(prepareConfigDraftScope(storage, "user-1").state.nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["test"],
+    });
+  });
+});
diff --git a/packages/ui/src/store/config-store/persistence.ts b/packages/ui/src/store/config-store/persistence.ts
index 8f359f3..b640224 100644
--- a/packages/ui/src/store/config-store/persistence.ts
+++ b/packages/ui/src/store/config-store/persistence.ts
@@ -1,5 +1,6 @@
 import type { ConfigState } from "./definitions";
 import { safeParseJsonObject } from "@subboost/core/json";
+import { normalizeNodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import { getConfigDraftStorageNameForUser } from "./draft-storage";
 
 export {
@@ -58,6 +59,7 @@ export function normalizePersistedConfigState(
     ...(typeof state.proxyGroupAdvancedModeEnabled === "boolean"
       ? { proxyGroupAdvancedModeEnabled: state.proxyGroupAdvancedModeEnabled }
       : {}),
+    nodeNameFilter: normalizeNodeNameFilterConfig(state.nodeNameFilter),
     cnIpNoResolve: typeof state.cnIpNoResolve === "boolean" ? state.cnIpNoResolve : true,
     experimentalCnUseCnRuleSet:
       typeof state.experimentalCnUseCnRuleSet === "boolean" ? state.experimentalCnUseCnRuleSet : true,
@@ -76,6 +78,7 @@ export function partializeConfigState(state: ConfigState): Partial<ConfigState>
     testInterval: state.testInterval,
     ruleProviderBaseUrl: state.ruleProviderBaseUrl,
     proxyGroupAdvancedModeEnabled: state.proxyGroupAdvancedModeEnabled,
+    nodeNameFilter: normalizeNodeNameFilterConfig(state.nodeNameFilter),
     cnIpNoResolve: state.cnIpNoResolve,
     experimentalCnUseCnRuleSet: state.experimentalCnUseCnRuleSet,
   };
diff --git a/packages/ui/src/store/config-store/source-actions-multiple.test.ts b/packages/ui/src/store/config-store/source-actions-multiple.test.ts
index 53c4c0c..1ed8504 100644
--- a/packages/ui/src/store/config-store/source-actions-multiple.test.ts
+++ b/packages/ui/src/store/config-store/source-actions-multiple.test.ts
@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it } from "vitest";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import type { ParsedNode } from "@subboost/core/types/node";
 import type { SubscriptionSource } from "./definitions";
 import {
@@ -13,6 +14,20 @@ import {
 
 const mocks = getSourceActionMocks();
 
+type DeferredFetchResult = {
+  content: string;
+  headers: Record<string, string>;
+  parseResult: ReturnType<typeof parseResult>;
+};
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((done) => {
+    resolve = done;
+  });
+  return { promise, resolve };
+}
+
 describe("createSourceActions parseMultipleSources", () => {
   beforeEach(resetSourceActionMocks);
 
@@ -33,12 +48,23 @@ describe("createSourceActions parseMultipleSources", () => {
       source({ id: "yaml", type: "yaml", content: "proxies: []", tag: "Y" }),
       source({ id: "empty", type: "nodes", content: "   " }),
     ];
-    const { actions, getState } = createHarness({ sources });
+    const { actions, getState } = createHarness({
+      sources,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["remote|yaml"] },
+    });
 
     await actions.parseMultipleSources(sources);
 
     expect(getState().isLoading).toBe(false);
     expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual(["[U]Remote", "[Y]Yaml"]);
+    expect(
+      resolveNodeNameFilter(getState().nodes, getState().nodeNameFilter)
+        .effectiveNodes
+    ).toEqual([]);
+    expect(getState().nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["remote|yaml"],
+    });
     expect(getState().parseErrors).toEqual([
       "源 #3 获取失败: fetch failed",
       "源 #4: yaml warning",
@@ -358,4 +384,35 @@ describe("createSourceActions parseMultipleSources", () => {
       nodeCount: 3,
     });
   });
+
+  it("discards the entire batch when any source fingerprint changes before completion", async () => {
+    const first = deferred<DeferredFetchResult>();
+    const second = deferred<DeferredFetchResult>();
+    mocks.fetchUrlContentInBrowser.mockReturnValueOnce(first.promise).mockReturnValueOnce(second.promise);
+    const sources = [
+      source({ id: "s1", type: "url", content: "https://example.com/one" }),
+      source({ id: "s2", type: "url", content: "https://example.com/two" }),
+    ];
+    const { actions, getState } = createHarness({ sources, nodes: [node("Keep")] });
+
+    const running = actions.parseMultipleSources(sources);
+    actions.setSources(
+      getState().sources.map((item: SubscriptionSource) =>
+        item.id === "s2" ? { ...item, nameTemplate: "{name}-changed" } : item
+      )
+    );
+    first.resolve({ content: "one", headers: {}, parseResult: parseResult([node("One")]) });
+    await Promise.resolve();
+    second.resolve({ content: "two", headers: {}, parseResult: parseResult([node("Two")]) });
+    await running;
+
+    expect(getState().isLoading).toBe(false);
+    expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual(["Keep"]);
+    expect(getState().sources).toEqual([
+      expect.objectContaining({ id: "s1" }),
+      expect.objectContaining({ id: "s2", nameTemplate: "{name}-changed" }),
+    ]);
+    expect(getState().sources[0]).not.toHaveProperty("parsed");
+    expect(getState().sources[1]).not.toHaveProperty("parsed");
+  });
 });
diff --git a/packages/ui/src/store/config-store/source-actions.test.ts b/packages/ui/src/store/config-store/source-actions.test.ts
index c3baf95..3470057 100644
--- a/packages/ui/src/store/config-store/source-actions.test.ts
+++ b/packages/ui/src/store/config-store/source-actions.test.ts
@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it } from "vitest";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import type { ParsedNode } from "@subboost/core/types/node";
 import type { SubscriptionSource } from "./definitions";
 import {
@@ -13,6 +14,20 @@ import {
 
 const mocks = getSourceActionMocks();
 
+type DeferredFetchResult = {
+  content: string;
+  headers: Record<string, string>;
+  parseResult: ReturnType<typeof parseResult>;
+};
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((done) => {
+    resolve = done;
+  });
+  return { promise, resolve };
+}
+
 describe("createSourceActions", () => {
   beforeEach(resetSourceActionMocks);
 
@@ -86,6 +101,7 @@ describe("createSourceActions", () => {
     const { actions, getState } = createHarness({
       nodes: [node("Existing", { server: "same.example.com" })],
       deletedNodeNames: ["Gone"],
+      nodeNameFilter: { enabled: true, excludeRegexes: ["fresh"] },
     });
 
     actions.parseContent("ss://content");
@@ -95,6 +111,14 @@ describe("createSourceActions", () => {
     expect(getState().nodes[0]).toMatchObject({ _originName: "Existing" });
     expect(getState().nodes[1]).toMatchObject({ _originName: "Fresh" });
     expect(getState().parseErrors).toEqual(["minor warning"]);
+    expect(getState().nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["fresh"],
+    });
+    expect(
+      resolveNodeNameFilter(getState().nodes, getState().nodeNameFilter)
+        .effectiveNodes.map((item) => item.name)
+    ).toEqual(["Existing"]);
   });
 
   it("marks invalid parse content errors without changing nodes", () => {
@@ -231,6 +255,7 @@ describe("createSourceActions", () => {
           nameTemplate: "{tag}-{name}",
         }),
       ],
+      nodeNameFilter: { enabled: true, excludeRegexes: ["^remote node$"] },
     });
 
     await actions.parseSingleSource("s1");
@@ -240,6 +265,14 @@ describe("createSourceActions", () => {
       _originName: "Remote Node",
       _sourceIds: ["s1"],
     });
+    expect(
+      resolveNodeNameFilter(getState().nodes, getState().nodeNameFilter)
+        .effectiveNodes
+    ).toEqual([]);
+    expect(getState().nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["^remote node$"],
+    });
     expect(getState().parseErrors).toEqual(["remote warning"]);
     expect(getState().sources[0]).toMatchObject({
       parsing: false,
@@ -539,4 +572,61 @@ describe("createSourceActions", () => {
     ]);
   });
 
+  it("discards a pending single-source result after its input fingerprint changes", async () => {
+    const pending = deferred<DeferredFetchResult>();
+    mocks.fetchUrlContentInBrowser.mockReturnValueOnce(pending.promise);
+    const original = source({ id: "s1", type: "url", content: "https://example.com/old" });
+    const { actions, getState } = createHarness({ sources: [original] });
+
+    const running = actions.parseSingleSource("s1");
+    actions.setSources([
+      { ...getState().sources[0], content: "https://example.com/new", userinfoUserAgent: "new-agent" },
+    ]);
+    pending.resolve({ content: "old", headers: {}, parseResult: parseResult([node("Old")]) });
+    await running;
+
+    expect(getState().nodes).toEqual([]);
+    expect(getState().sources[0]).toMatchObject({
+      content: "https://example.com/new",
+      userinfoUserAgent: "new-agent",
+      parsing: false,
+    });
+    expect(getState().sources[0].parsed).not.toBe(true);
+  });
+
+  it("discards a pending single-source result after the source is deleted", async () => {
+    const pending = deferred<DeferredFetchResult>();
+    mocks.fetchUrlContentInBrowser.mockReturnValueOnce(pending.promise);
+    const { actions, getState } = createHarness({
+      sources: [source({ id: "s1", type: "url", content: "https://example.com/sub" })],
+    });
+
+    const running = actions.parseSingleSource("s1");
+    actions.setSources([]);
+    pending.resolve({ content: "old", headers: {}, parseResult: parseResult([node("Deleted")]) });
+    await running;
+
+    expect(getState().sources).toEqual([]);
+    expect(getState().nodes).toEqual([]);
+  });
+
+  it("keeps the newest result when two single-source imports finish in reverse order", async () => {
+    const first = deferred<DeferredFetchResult>();
+    const second = deferred<DeferredFetchResult>();
+    mocks.fetchUrlContentInBrowser.mockReturnValueOnce(first.promise).mockReturnValueOnce(second.promise);
+    const { actions, getState } = createHarness({
+      sources: [source({ id: "s1", type: "url", content: "https://example.com/sub" })],
+    });
+
+    const olderRun = actions.parseSingleSource("s1");
+    const newerRun = actions.parseSingleSource("s1");
+    second.resolve({ content: "new", headers: {}, parseResult: parseResult([node("New")]) });
+    await newerRun;
+    first.resolve({ content: "old", headers: {}, parseResult: parseResult([node("Old")]) });
+    await olderRun;
+
+    expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual(["New"]);
+    expect(getState().sources[0]).toMatchObject({ parsed: true, parsing: false, nodeCount: 1 });
+  });
+
 });
diff --git a/packages/ui/src/store/config-store/source-actions.ts b/packages/ui/src/store/config-store/source-actions.ts
index f58464b..4ecd5b9 100644
--- a/packages/ui/src/store/config-store/source-actions.ts
+++ b/packages/ui/src/store/config-store/source-actions.ts
@@ -33,6 +33,7 @@ import {
   withUniqueNodeNames,
 } from "./definitions";
 import type { GetState, SetAndGenerateConfig, SetState, StoreState } from "./store-types";
+import { SourceImportOperationGuard, type SingleSourceImportOperation } from "./source-import-operation";
 
 type SourceActions = Pick<
   ConfigActions,
@@ -75,6 +76,18 @@ function filterDialerProxyGroupsByAvailableNames(
 }
 
 export function createSourceActions(set: SetState, get: GetState, setAndGenerateConfig: SetAndGenerateConfig): SourceActions {
+  const importOperations = new SourceImportOperationGuard();
+  const discardStaleSingle = (operation: SingleSourceImportOperation): boolean => {
+    if (importOperations.isSingleCurrent(get().sources, operation)) return false;
+    if (importOperations.ownsSingle(operation)) {
+      set((state) => ({
+        sources: state.sources.map((source) => source.id === operation.sourceId ? { ...source, parsing: false } : source),
+      }));
+    }
+    importOperations.finishSingle(operation);
+    return true;
+  };
+
   return {
     // 设置订阅源
     setSources: (sources: SubscriptionSource[]) => {
@@ -116,7 +129,11 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
 
     // 解析订阅内容
     parseContent: (content: string) => {
-      set({ isLoading: true });
+      importOperations.cancelAll();
+      set((state) => ({
+        isLoading: true,
+        sources: state.sources.map((source) => (source.parsing ? { ...source, parsing: false } : source)),
+      }));
 
       try {
         const result: ParseResult = parseSubscription(content);
@@ -165,6 +182,7 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
       const { sources } = get();
       const source = sources.find((s) => s.id === sourceId);
       if (!source || !source.content.trim()) return;
+      const operation = importOperations.startSingle(source);
 
       const currentSourceContent =
         source.type === "url"
@@ -181,11 +199,12 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
       const lastNameTemplate = typeof source.lastParsedNameTemplate === "string" ? source.lastParsedNameTemplate.trim() : "";
 
       // 标记为解析中
-      set({
-        sources: sources.map((s) =>
+      set((state) => ({
+        isLoading: false,
+        sources: state.sources.map((s) =>
           s.id === sourceId ? { ...s, parsing: true, error: undefined, errorInfo: undefined } : s
         ),
-      });
+      }));
 
       try {
         let contentToParse = source.content;
@@ -204,6 +223,8 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
             throw new Error("只支持 HTTP/HTTPS url");
           }
 
+          if (discardStaleSingle(operation)) return;
+
           setAndGenerateConfig((state) => {
             const baseNodes = detachSourceNodesFromState(state.nodes, sourceId).nodes;
 
@@ -240,6 +261,7 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
               parseErrors: [],
             };
           });
+          importOperations.finishSingle(operation);
           return;
         }
 
@@ -279,6 +301,8 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
           currentNameTemplate,
         });
 
+        if (discardStaleSingle(operation)) return;
+
         // 刷新此订阅源解析出的节点：尽量保留用户顺序/手动改名，仅更新节点内容与来源归属。
         setAndGenerateConfig((state) => {
           const merged = mergeParsedSourceNodes(state.nodes, parsedNodes, state.deletedNodeNames, {
@@ -354,7 +378,9 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
             parseErrors: result.errors.map(sanitizePublicErrorText).filter((e) => e !== ""),
           };
         });
+        importOperations.finishSingle(operation);
       } catch (error) {
+        if (discardStaleSingle(operation)) return;
         const baseInfo = toSubscriptionImportErrorInfo(error);
         const shouldHintProxyProviders =
           source.type === "url" &&
@@ -383,12 +409,18 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
               : s
           ),
         }));
+        importOperations.finishSingle(operation);
       }
     },
 
     // 解析多个订阅源
     parseMultipleSources: async (sources: SubscriptionSource[]) => {
-      set({ isLoading: true, parseErrors: [] });
+      const operation = importOperations.startBatch(sources);
+      set((state) => ({
+        isLoading: true,
+        parseErrors: [],
+        sources: state.sources.map((source) => (source.parsing ? { ...source, parsing: false } : source)),
+      }));
 
       const allNodes: ParsedNode[] = [];
       const allErrors: string[] = [];
@@ -574,6 +606,12 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
       // 确保 name 全局唯一（Clash 要求 proxies.name 唯一）
       const uniqueNamedNodes = withUniqueNodeNames(uniqueNodes, new Set<string>());
 
+      if (!importOperations.isBatchCurrent(get().sources, operation)) {
+        if (importOperations.ownsBatch(operation)) set({ isLoading: false });
+        importOperations.finishBatch(operation);
+        return;
+      }
+
       setAndGenerateConfig((state) => {
         const deleted = new Set(state.deletedNodeNames);
         const normalizedCandidates = uniqueNamedNodes.map((node) => {
@@ -652,6 +690,7 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
           }),
         };
       });
+      importOperations.finishBatch(operation);
     },
   };
 }
diff --git a/packages/ui/src/store/config-store/source-import-operation.ts b/packages/ui/src/store/config-store/source-import-operation.ts
new file mode 100644
index 0000000..d5c40f0
--- /dev/null
+++ b/packages/ui/src/store/config-store/source-import-operation.ts
@@ -0,0 +1,90 @@
+import type { SubscriptionSource } from "./definitions";
+
+export type SingleSourceImportOperation = {
+  id: number;
+  sourceId: string;
+  fingerprint: string;
+};
+
+export type BatchSourceImportOperation = {
+  id: number;
+  sources: Array<{ sourceId: string; fingerprint: string }>;
+};
+
+export function buildSourceImportFingerprint(source: SubscriptionSource): string {
+  return JSON.stringify([
+    source.type,
+    source.content,
+    typeof source.tag === "string" ? source.tag : null,
+    typeof source.nameTemplate === "string" ? source.nameTemplate : null,
+    source.useProxyProviders === true,
+    typeof source.userinfoUrl === "string" ? source.userinfoUrl : null,
+    typeof source.userinfoUserAgent === "string" ? source.userinfoUserAgent : null,
+  ]);
+}
+
+export class SourceImportOperationGuard {
+  private sequence = 0;
+  private readonly singleOperations = new Map<string, number>();
+  private activeBatchId: number | null = null;
+
+  startSingle(source: SubscriptionSource): SingleSourceImportOperation {
+    this.activeBatchId = null;
+    const operation = {
+      id: ++this.sequence,
+      sourceId: source.id,
+      fingerprint: buildSourceImportFingerprint(source),
+    };
+    this.singleOperations.set(source.id, operation.id);
+    return operation;
+  }
+
+  startBatch(sources: readonly SubscriptionSource[]): BatchSourceImportOperation {
+    const operation = {
+      id: ++this.sequence,
+      sources: sources.map((source) => ({
+        sourceId: source.id,
+        fingerprint: buildSourceImportFingerprint(source),
+      })),
+    };
+    this.singleOperations.clear();
+    this.activeBatchId = operation.id;
+    return operation;
+  }
+
+  cancelAll(): void {
+    this.singleOperations.clear();
+    this.activeBatchId = null;
+  }
+
+  ownsSingle(operation: SingleSourceImportOperation): boolean {
+    return this.singleOperations.get(operation.sourceId) === operation.id;
+  }
+
+  isSingleCurrent(sources: readonly SubscriptionSource[], operation: SingleSourceImportOperation): boolean {
+    if (!this.ownsSingle(operation)) return false;
+    const current = sources.find((source) => source.id === operation.sourceId);
+    return Boolean(current && buildSourceImportFingerprint(current) === operation.fingerprint);
+  }
+
+  finishSingle(operation: SingleSourceImportOperation): void {
+    if (this.ownsSingle(operation)) this.singleOperations.delete(operation.sourceId);
+  }
+
+  ownsBatch(operation: BatchSourceImportOperation): boolean {
+    return this.activeBatchId === operation.id;
+  }
+
+  isBatchCurrent(sources: readonly SubscriptionSource[], operation: BatchSourceImportOperation): boolean {
+    if (!this.ownsBatch(operation)) return false;
+    const currentById = new Map(sources.map((source) => [source.id, source]));
+    return operation.sources.every(({ sourceId, fingerprint }) => {
+      const current = currentById.get(sourceId);
+      return Boolean(current && buildSourceImportFingerprint(current) === fingerprint);
+    });
+  }
+
+  finishBatch(operation: BatchSourceImportOperation): void {
+    if (this.ownsBatch(operation)) this.activeBatchId = null;
+  }
+}
diff --git a/packages/ui/src/templates/template-card.test.ts b/packages/ui/src/templates/template-card.test.ts
index a868f5b..a917343 100644
--- a/packages/ui/src/templates/template-card.test.ts
+++ b/packages/ui/src/templates/template-card.test.ts
@@ -108,12 +108,12 @@ describe("TemplateCard", () => {
     expect(html).toContain("公开");
     expect(html).toContain("使用");
 
-    mocks.captures.buttons.find((button) => button.title === "删除").onClick();
+    mocks.captures.buttons.find((button) => button.title === "删除模板").onClick();
     expect(props.onDelete).toHaveBeenCalled();
     mocks.captures.buttons.find((button) => button.children?.includes?.("使用")).onClick();
     expect(props.onApply).toHaveBeenCalled();
 
-    const engageButton = mocks.captures.nativeButtons.find((button) => button.title === "取消收藏");
+    const engageButton = mocks.captures.buttons.find((button) => button.title === "取消收藏");
     expect(engageButton.disabled).toBe(false);
     expect(engageButton.className).toContain("text-red-400");
     engageButton.onClick();
@@ -140,10 +140,10 @@ describe("TemplateCard", () => {
     expect(html).toContain("私有");
     expect(html).toContain("应用中");
     expect(html).toContain("loader-icon");
-    expect(mocks.captures.buttons.some((button) => button.title === "删除")).toBe(false);
+    expect(mocks.captures.buttons.some((button) => button.title === "删除模板")).toBe(false);
     expect(mocks.captures.buttons.find((button) => button.children?.includes?.("应用中")).disabled).toBe(true);
 
-    const engageButton = mocks.captures.nativeButtons.find((button) => button.title === "登录后可收藏");
+    const engageButton = mocks.captures.buttons.find((button) => button.title === "登录后可收藏");
     expect(engageButton.disabled).toBe(true);
     expect(engageButton.className).toContain("cursor-not-allowed");
   });
@@ -157,7 +157,7 @@ describe("TemplateCard", () => {
 
     expect(html).not.toContain("公开");
     expect(html).not.toContain("私有");
-    expect(mocks.captures.buttons.some((button) => button.title === "删除")).toBe(false);
-    expect(mocks.captures.nativeButtons).toEqual([]);
+    expect(mocks.captures.buttons.some((button) => button.title === "删除模板")).toBe(false);
+    expect(mocks.captures.buttons.some((button) => button.title === "登录后可收藏")).toBe(false);
   });
 });
diff --git a/packages/ui/src/templates/template-card.tsx b/packages/ui/src/templates/template-card.tsx
index bfc6d6d..3ca19ad 100644
--- a/packages/ui/src/templates/template-card.tsx
+++ b/packages/ui/src/templates/template-card.tsx
@@ -13,6 +13,7 @@ import {
   Trash2,
 } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Card, CardContent } from "@subboost/ui/components/ui/card";
 import { cn } from "@subboost/ui/lib/utils";
 import type { Template } from "./types";
@@ -58,15 +59,14 @@ export function TemplateCard({
           </div>
           <div className="flex items-center gap-2 flex-shrink-0">
             {showDelete && onDelete && (
-              <Button
+              <IconButton
+                label="删除模板"
                 variant="outline"
-                size="icon"
                 onClick={onDelete}
-                title="删除"
                 className="h-8 w-8 border-white/10 hover:border-red-500/40 hover:text-red-400"
               >
                 <Trash2 className="h-4 w-4" />
-              </Button>
+              </IconButton>
             )}
             <Button size="sm" onClick={onApply} disabled={isApplying} className="gap-1">
               {isApplying ? <Loader2 className="h-4 w-4 animate-spin" /> : <CheckCircle className="h-4 w-4" />}
@@ -91,11 +91,14 @@ export function TemplateCard({
           </span>
 
           {showEngagement && (
-            <button
+            <Button
+              type="button"
+              variant="ghost"
+              size="sm"
               onClick={onEngage}
               disabled={!isLoggedIn}
               className={cn(
-                "inline-flex items-center gap-1 transition-colors",
+                "h-auto gap-1 p-0 transition-colors hover:bg-transparent",
                 template.isEngaged ? "text-red-400" : "hover:text-red-400",
                 !isLoggedIn && "cursor-not-allowed opacity-50"
               )}
@@ -103,7 +106,7 @@ export function TemplateCard({
             >
               <Heart className={cn("h-3.5 w-3.5", template.isEngaged && "fill-current")} />
               {formatNumber(template.engagementCount)}
-            </button>
+            </Button>
           )}
 
           <span className="inline-flex items-center gap-1">
diff --git a/packages/ui/src/templates/template-upload-dialog.test.ts b/packages/ui/src/templates/template-upload-dialog.test.ts
index 6ec7666..be687c1 100644
--- a/packages/ui/src/templates/template-upload-dialog.test.ts
+++ b/packages/ui/src/templates/template-upload-dialog.test.ts
@@ -4,9 +4,11 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
   buttons: [] as any[],
+  choiceChips: [] as any[],
   dialogs: [] as any[],
   inputs: [] as any[],
   rawButtons: [] as any[],
+  switchFields: [] as any[],
   textareas: [] as any[],
 }));
 
@@ -40,6 +42,19 @@ vi.mock("@subboost/ui/components/ui/button", () => ({
     return React.createElement("button", props, props.children);
   },
 }));
+vi.mock("@subboost/ui/components/ui/choice-group", () => ({
+  ChoiceGroup: (props: any) => React.createElement("div", null, props.children),
+  ChoiceChip: (props: any) => {
+    mocks.choiceChips.push(props);
+    return React.createElement("button", { onClick: props.onClick, disabled: props.disabled }, props.label);
+  },
+}));
+vi.mock("@subboost/ui/components/ui/switch-field", () => ({
+  SwitchField: (props: any) => {
+    mocks.switchFields.push(props);
+    return React.createElement("div", null, props.label, props.description);
+  },
+}));
 vi.mock("@subboost/ui/components/ui/dialog", () => ({
   Dialog: (props: any) => {
     mocks.dialogs.push(props);
@@ -69,9 +84,11 @@ import { TemplateUploadDialog } from "./template-upload-dialog";
 
 function renderDialog(overrides: Partial<React.ComponentProps<typeof TemplateUploadDialog>> = {}) {
   mocks.buttons = [];
+  mocks.choiceChips = [];
   mocks.dialogs = [];
   mocks.inputs = [];
   mocks.rawButtons = [];
+  mocks.switchFields = [];
   mocks.textareas = [];
   const props = {
     open: true,
@@ -113,10 +130,10 @@ describe("TemplateUploadDialog", () => {
 
     mocks.inputs[0].onChange({ target: { value: "New template" } });
     mocks.textareas[0].onChange({ target: { value: "New description" } });
-    mocks.buttons.find((button) => button.children === "配置模板").onClick();
-    mocks.buttons.find((button) => button.children === "YAML（开发中）").onClick();
-    mocks.rawButtons[0].onClick();
-    mocks.rawButtons[1].onClick();
+    mocks.choiceChips.find((chip) => chip.label === "配置模板").onClick();
+    mocks.choiceChips.find((chip) => chip.label === "YAML（开发中）").onClick();
+    mocks.switchFields[0].onCheckedChange(true);
+    mocks.switchFields[1].onCheckedChange(true);
     mocks.buttons.at(-2).onClick();
     mocks.buttons.at(-1).onClick();
 
@@ -167,8 +184,8 @@ describe("TemplateUploadDialog", () => {
     expect(html).toContain("公开模板");
     expect(html).toContain("其他用户可以搜索和使用此模板");
     expect(html).toContain("globe-icon");
-    expect(mocks.rawButtons).toHaveLength(1);
-    mocks.rawButtons[0].onClick();
+    expect(mocks.switchFields).toHaveLength(1);
+    mocks.switchFields[0].onCheckedChange(false);
     expect(props.onPublicChange).toHaveBeenCalledWith(false);
   });
 
@@ -180,7 +197,7 @@ describe("TemplateUploadDialog", () => {
 
     expect(html).toContain("默认模板");
     expect(html).toContain("将展示在默认模板中");
-    mocks.rawButtons[1].onClick();
+    expect(mocks.switchFields[1]).toEqual(expect.objectContaining({ disabled: true }));
     expect(props.onPublicChange).not.toHaveBeenCalled();
   });
 });
diff --git a/packages/ui/src/templates/template-upload-dialog.tsx b/packages/ui/src/templates/template-upload-dialog.tsx
index 6c8092c..b7a6d32 100644
--- a/packages/ui/src/templates/template-upload-dialog.tsx
+++ b/packages/ui/src/templates/template-upload-dialog.tsx
@@ -2,6 +2,7 @@
 
 import { Globe, Loader2, Lock, Upload } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { ChoiceChip, ChoiceGroup } from "@subboost/ui/components/ui/choice-group";
 import {
   Dialog,
   DialogContent,
@@ -11,7 +12,9 @@ import {
   DialogTitle,
 } from "@subboost/ui/components/ui/dialog";
 import { Input } from "@subboost/ui/components/ui/input";
+import { FormField } from "@subboost/ui/components/ui/form-field";
 import { Textarea } from "@subboost/ui/components/ui/textarea";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { cn } from "@subboost/ui/lib/utils";
 
 type UploadMode = "config" | "yaml";
@@ -78,18 +81,16 @@ export function TemplateUploadDialog({
         </DialogHeader>
 
         <div className="space-y-4 py-4">
-          <div className="space-y-2">
-            <label className="text-sm font-medium">模板名称 *</label>
+          <FormField label="模板名称" required>
             <Input
               placeholder="例如：流媒体优化配置"
               value={name}
               onChange={(event) => onNameChange(event.target.value)}
               maxLength={100}
             />
-          </div>
+          </FormField>
 
-          <div className="space-y-2">
-            <label className="text-sm font-medium">描述（可选）</label>
+          <FormField label="描述（可选）">
             <Textarea
               placeholder="简要描述模板的特点和适用场景..."
               value={description}
@@ -97,29 +98,23 @@ export function TemplateUploadDialog({
               className="min-h-[80px]"
               maxLength={500}
             />
-          </div>
+          </FormField>
 
           <div className="space-y-2">
-            <label className="text-sm font-medium">模板类型</label>
-            <div className="flex items-center gap-2">
-              <Button
-                type="button"
-                variant={mode === "config" ? "default" : "outline"}
-                size="sm"
+            <p className="text-sm font-medium">模板类型</p>
+            <ChoiceGroup label="模板类型">
+              <ChoiceChip
+                selected={mode === "config"}
+                label="配置模板"
                 onClick={() => onModeChange("config")}
-              >
-                配置模板
-              </Button>
-              <Button
-                type="button"
-                variant={mode === "yaml" ? "default" : "outline"}
-                size="sm"
+              />
+              <ChoiceChip
+                selected={mode === "yaml"}
+                label="YAML（开发中）"
                 onClick={() => onModeChange("yaml")}
-                disabled={true}
-              >
-                YAML（开发中）
-              </Button>
-            </div>
+                disabled
+              />
+            </ChoiceGroup>
             {mode === "config" ? (
               <p className="text-xs text-white/50">
                 将保存你当前的配置器设置（模板/分组/规则/DNS/自定义分流/中转等），不包含节点，可直接“使用”应用到配置器。
@@ -130,16 +125,11 @@ export function TemplateUploadDialog({
           </div>
 
           {userIsAdmin && (
-            <div className="flex items-center justify-between p-3 rounded-lg bg-white/5 border border-white/10">
-              <div className="min-w-0">
-                <div className="text-sm font-medium">作为默认模板</div>
-                <div className="text-xs text-white/50">
-                  开启后将发布到“默认模板”（公开）
-                </div>
-              </div>
-              <button
-                type="button"
-                onClick={() => {
+            <SwitchField
+              label="作为默认模板"
+              description="开启后将发布到“默认模板”（公开）"
+              checked={asDefault}
+              onCheckedChange={() => {
                   const next = !asDefault;
                   onDefaultChange(next);
                   if (next) {
@@ -148,71 +138,41 @@ export function TemplateUploadDialog({
                     onYamlContentChange("");
                   }
                 }}
-                className={cn(
-                  "relative w-10 h-5 rounded-full transition-colors flex-shrink-0",
-                  asDefault ? "bg-primary-500" : "bg-white/20"
-                )}
-              >
-                <span
-                  className={cn(
-                    "absolute top-0.5 left-0.5 w-4 h-4 rounded-full bg-white shadow transition-all duration-200",
-                    asDefault && "translate-x-5"
-                  )}
-                />
-              </button>
-            </div>
+            />
           )}
 
           {mode === "yaml" && (
-            <div className="space-y-2">
-              <label className="text-sm font-medium">配置内容（YAML）*</label>
+            <FormField
+              label="配置内容（YAML）"
+              description="注意：系统会自动移除实际节点信息，只保留配置结构"
+              required
+            >
               <Textarea
                 placeholder="粘贴您的 YAML 配置内容..."
                 value={yamlContent}
                 onChange={(event) => onYamlContentChange(event.target.value)}
                 className="min-h-[150px] font-mono text-xs"
               />
-              <p className="text-xs text-white/50">
-                注意：系统会自动移除实际节点信息，只保留配置结构
-              </p>
-            </div>
+            </FormField>
           )}
 
           {showVisibilityControls && (
-            <div className="flex items-center justify-between p-3 rounded-lg bg-white/5 border border-white/10">
-              <div className="flex items-center gap-2">
+            <SwitchField
+              label={
+                <span className="flex items-center gap-2">
                 {asDefault || isPublic ? (
                   <Globe className="h-4 w-4 text-green-400" />
                 ) : (
                   <Lock className="h-4 w-4 text-white/50" />
                 )}
-                <div>
-                  <div className="text-sm font-medium">{visibilityLabel}</div>
-                  <div className="text-xs text-white/50">{visibilityDescription}</div>
-                </div>
-              </div>
-              <button
-                onClick={() => {
-                  if (asDefault) return;
-                  onPublicChange(!isPublic);
-                }}
-                className={cn(
-                  "relative w-10 h-5 rounded-full transition-colors flex-shrink-0",
-                  asDefault
-                    ? "bg-green-500 opacity-60 cursor-not-allowed"
-                    : isPublic
-                      ? "bg-green-500"
-                      : "bg-white/20"
-                )}
-              >
-                <span
-                  className={cn(
-                    "absolute top-0.5 left-0.5 w-4 h-4 rounded-full bg-white shadow transition-all duration-200",
-                    (asDefault || isPublic) && "translate-x-5"
-                  )}
-                />
-              </button>
-            </div>
+                  {visibilityLabel}
+                </span>
+              }
+              description={visibilityDescription}
+              checked={asDefault || isPublic}
+              disabled={asDefault}
+              onCheckedChange={(checked) => onPublicChange(checked)}
+            />
           )}
         </div>
 
diff --git a/scripts/check-ui-consistency.cjs b/scripts/check-ui-consistency.cjs
new file mode 100644
index 0000000..39caecd
--- /dev/null
+++ b/scripts/check-ui-consistency.cjs
@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+
+const fs = require("node:fs");
+const path = require("node:path");
+const ts = require("typescript");
+
+const workspaceRoot = process.cwd();
+const requestedRoots = process.argv.slice(2);
+const roots = (requestedRoots.length > 0 ? requestedRoots : ["packages", "local"])
+  .map((entry) => path.resolve(workspaceRoot, entry))
+  .filter((entry) => fs.existsSync(entry));
+
+const ignoredDirectoryNames = new Set([".next", "dist", "generated", "node_modules"]);
+const findings = [];
+
+function normalizePath(filePath) {
+  return filePath.replaceAll("\\", "/");
+}
+
+function isIgnoredFile(filePath) {
+  const normalized = normalizePath(filePath);
+  return (
+    /\.(test|spec)\.[jt]sx?$/.test(normalized) ||
+    normalized.includes("/__tests__/") ||
+    normalized.includes("/components/ui/radix-")
+  );
+}
+
+function collectFiles(entry, output) {
+  const stat = fs.statSync(entry);
+  if (stat.isFile()) {
+    if (/\.[jt]sx?$/.test(entry) && !isIgnoredFile(entry)) output.push(entry);
+    return;
+  }
+
+  for (const item of fs.readdirSync(entry, { withFileTypes: true })) {
+    if (item.isDirectory() && ignoredDirectoryNames.has(item.name)) continue;
+    collectFiles(path.join(entry, item.name), output);
+  }
+}
+
+function tagName(node) {
+  return node.tagName?.getText() ?? "";
+}
+
+function attributesOf(node) {
+  return node.attributes?.properties ?? [];
+}
+
+function findAttribute(node, name) {
+  return attributesOf(node).find(
+    (attribute) => ts.isJsxAttribute(attribute) && attribute.name.getText() === name
+  );
+}
+
+function hasDescendantTag(node, prohibitedNames) {
+  let found = false;
+  function visit(child) {
+    if (found) return;
+    if ((ts.isJsxElement(child) || ts.isJsxSelfClosingElement(child)) && prohibitedNames.has(tagName(child.openingElement ?? child))) {
+      found = true;
+      return;
+    }
+    ts.forEachChild(child, visit);
+  }
+  for (const child of node.children ?? []) visit(child);
+  return found;
+}
+
+function report(sourceFile, node, message) {
+  const position = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+  findings.push({
+    file: path.relative(workspaceRoot, sourceFile.fileName),
+    line: position.line + 1,
+    column: position.character + 1,
+    message,
+  });
+}
+
+function checkFile(filePath) {
+  const sourceText = fs.readFileSync(filePath, "utf8");
+  const sourceFile = ts.createSourceFile(filePath, sourceText, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+  const normalized = normalizePath(filePath);
+  const isUiWrapper = normalized.includes("/components/ui/");
+  const isIconButtonWrapper = normalized.endsWith("/components/ui/icon-button.tsx");
+  const isSwitchFieldWrapper = normalized.endsWith("/components/ui/switch-field.tsx");
+
+  function visit(node) {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      const moduleName = node.moduleSpecifier.text;
+      if (moduleName.startsWith("@radix-ui/react-") && !isUiWrapper) {
+        report(sourceFile, node, `业务代码不得直接导入 ${moduleName}，请使用共享 UI 包装组件`);
+      }
+    }
+
+    if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node)) {
+      const opening = ts.isJsxElement(node) ? node.openingElement : node;
+      const name = tagName(opening);
+
+      if ((name === "Link" || name === "a") && ts.isJsxElement(node) && hasDescendantTag(node, new Set(["Button", "button"]))) {
+        report(sourceFile, opening, `${name} 内不得嵌套 Button/button；请使用 Button 或 IconButton 的 asChild`);
+      }
+
+      if (name === "Button" && !isIconButtonWrapper) {
+        const size = findAttribute(opening, "size");
+        if (size?.initializer && ts.isStringLiteral(size.initializer) && size.initializer.text === "icon") {
+          report(sourceFile, opening, '业务代码不得直接使用 Button size="icon"；请使用 IconButton');
+        }
+      }
+
+      if (name === "IconButton" && !findAttribute(opening, "label")) {
+        report(sourceFile, opening, "IconButton 必须提供 label");
+      }
+
+      if (name === "Switch" && !isSwitchFieldWrapper) {
+        const hasAccessibleName = Boolean(
+          findAttribute(opening, "aria-label") || findAttribute(opening, "aria-labelledby")
+        );
+        if (!hasAccessibleName) {
+          report(sourceFile, opening, "裸 Switch 必须提供 aria-label 或 aria-labelledby");
+        }
+      }
+    }
+
+    ts.forEachChild(node, visit);
+  }
+
+  visit(sourceFile);
+}
+
+const files = [];
+for (const root of roots) collectFiles(root, files);
+for (const file of files) checkFile(file);
+
+if (findings.length > 0) {
+  for (const finding of findings) {
+    console.error(`${finding.file}:${finding.line}:${finding.column} ${finding.message}`);
+  }
+  console.error(`\nUI consistency check failed with ${findings.length} finding(s).`);
+  process.exit(1);
+}
+
+console.log(`UI consistency check passed (${files.length} source files scanned).`);
diff --git a/test/setup-runtime.ts b/test/setup-runtime.ts
new file mode 100644
index 0000000..598ad4d
--- /dev/null
+++ b/test/setup-runtime.ts
@@ -0,0 +1,20 @@
+import { existsSync } from "node:fs";
+import { delimiter, join } from "node:path";
+
+function findGitBashBin(): string | null {
+  const candidates = [
+    process.env.ProgramFiles && join(process.env.ProgramFiles, "Git", "bin"),
+    process.env["ProgramFiles(x86)"] && join(process.env["ProgramFiles(x86)"], "Git", "bin"),
+    process.env.LOCALAPPDATA && join(process.env.LOCALAPPDATA, "Programs", "Git", "bin"),
+    process.env.USERPROFILE && join(process.env.USERPROFILE, "scoop", "apps", "git", "current", "bin"),
+  ].filter((value): value is string => Boolean(value));
+  return candidates.find((directory) => existsSync(join(directory, "bash.exe"))) || null;
+}
+
+if (process.platform === "win32") {
+  const gitBashBin = findGitBashBin();
+  if (!gitBashBin) {
+    throw new Error("Git for Windows Bash is required to run SubBoost shell-script tests on Windows.");
+  }
+  process.env.PATH = `${gitBashBin}${delimiter}${process.env.PATH || ""}`;
+}
diff --git a/vitest.config.ts b/vitest.config.ts
index fd7b986..c785aea 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -25,6 +25,7 @@ export default defineConfig({
   plugins: [tsxTransformPlugin()],
   test: {
     environment: "node",
+    setupFiles: ["./test/setup-runtime.ts"],
     include: [
       "packages/core/src/**/*.test.ts",
       "packages/server-core/src/**/*.test.ts",