From f7e4ef5b8c46a25f275b4503ff50461618ced8be Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Mon, 13 Jul 2026 19:58:36 +0800
Subject: [PATCH 01/36] fix: preserve parser and rule configuration contracts

---
 packages/core/package.json                    |   1 +
 packages/core/src/config/defaults.ts          |   2 +-
 packages/core/src/core-contracts.test.ts      |   8 +-
 packages/core/src/generator/chain.test.ts     |  22 -
 packages/core/src/generator/chain.ts          |  50 ---
 packages/core/src/generator/dns.ts            |   3 +-
 packages/core/src/generator/yaml.test.ts      |  20 +
 packages/core/src/generator/yaml.ts           |  15 +-
 .../core/src/migrations/legacy-config.test.ts | 179 ++++++++
 packages/core/src/migrations/legacy-config.ts | 396 ++++++++++++++++++
 packages/core/src/parser/clash-yaml.test.ts   |  19 +
 packages/core/src/parser/clash-yaml.ts        |  96 +++--
 .../src/parser/config-line-parser.test.ts     |   5 +
 .../core/src/parser/config-line-tokenizer.ts  |   5 +-
 .../parse-platform-proxy-line.test.ts         |  14 +
 .../core/src/parser/platform/peggy/surge.js   |   4 +-
 .../src/parser/protocols/simple-proxy.test.ts |   5 +
 .../core/src/parser/protocols/simple-proxy.ts |   6 +-
 .../src/parser/protocols/ssr-snell.test.ts    |  13 +
 packages/core/src/parser/protocols/ssr.ts     |   7 +-
 packages/core/src/proxy-group-targets.test.ts |   3 +
 packages/core/src/proxy-group-targets.ts      |   5 +-
 packages/core/src/rules-database.test.ts      |  77 ----
 packages/core/src/rules-database.ts           |  67 ---
 .../src/rules/custom-rule-helpers.test.ts     |  14 +-
 packages/core/src/rules/custom-rule-utils.ts  |  30 --
 packages/core/src/rules/rule-model.test.ts    |   5 +-
 packages/core/src/rules/rule-model.ts         |   3 +-
 packages/core/src/rules/rules-utils.test.ts   |  19 -
 .../core/src/subscription/config-utils.ts     |   3 +-
 .../src/subscription/import-error.test.ts     |  11 +
 .../core/src/subscription/import-error.ts     |  16 +-
 .../subscription-userinfo.test.ts             |   6 +
 .../src/subscription/subscription-userinfo.ts |  24 +-
 .../templates/config-template.fields.test.ts  |   2 +-
 .../templates/config-template.groups.test.ts  |  19 +-
 .../src/templates/config-template.test.ts     |  61 ++-
 .../core/src/templates/config-template.ts     |  54 ++-
 packages/server-core/src/cron-auth.test.ts    |   4 +
 packages/server-core/src/cron-auth.ts         |   6 +-
 .../src/crypto/encrypted-field.test.ts        |  28 ++
 .../server-core/src/crypto/encrypted-field.ts |  10 +-
 .../src/subscription/auto-update-failure.ts   |   8 +-
 packages/server-core/src/subscription/crud.ts |   3 +-
 .../src/subscription/ssrf-ip.test.ts          |   4 +
 .../server-core/src/subscription/ssrf-ip.ts   |  86 ++--
 .../sections/proxy-groups-categories.test.ts  |   6 +-
 .../sections/proxy-groups-categories.tsx      |   4 +-
 ...ups-custom-groups-panel-card-props.test.ts |   6 +-
 .../proxy-groups-custom-groups-panel.test.ts  |  42 +-
 .../proxy-groups-custom-groups-panel.tsx      |  60 ++-
 .../proxy-groups-custom-rules.test.ts         |  12 +-
 .../sections/proxy-groups-custom-rules.tsx    |  29 +-
 .../sections/proxy-groups-module-card.tsx     |   2 +-
 .../proxy-groups-module-rules-panel.test.ts   |   5 +-
 .../proxy-groups-module-rules-panel.tsx       |   4 +-
 .../proxy-groups-rules-library.test.ts        |   4 +-
 .../sections/proxy-groups-rules-library.tsx   |   8 +-
 .../sections/rules-management-section.test.ts |  25 +-
 .../sections/rules-management-section.tsx     |  27 +-
 .../converter/quick-mode/constants.test.ts    |   7 +
 .../product/converter/quick-mode/constants.ts |  18 +-
 .../home/use-editing-subscription-loader.ts   |   5 +-
 .../actions/custom-actions.test.ts            |  20 +-
 .../config-store/actions/custom-actions.ts    |  29 +-
 .../actions/proxy-group-actions.test.ts       |  52 ++-
 .../actions/proxy-group-actions.ts            |  64 ++-
 .../actions/proxy-group-rule-set-helpers.ts   |  30 +-
 .../config-store/actions/template-actions.ts  |   3 +
 .../ui/src/store/config-store/auth-handoff.ts |   7 +-
 70 files changed, 1349 insertions(+), 558 deletions(-)
 create mode 100644 packages/core/src/migrations/legacy-config.test.ts
 create mode 100644 packages/core/src/migrations/legacy-config.ts

diff --git a/packages/core/package.json b/packages/core/package.json
index 85859fb..e29f699 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -13,6 +13,7 @@
     "./generator/yaml-semantics": "./src/generator/yaml-semantics.ts",
     "./json": "./src/json.ts",
     "./mihomo/*": "./src/mihomo/*.ts",
+    "./migrations/*": "./src/migrations/*.ts",
     "./node-name-template": "./src/node-name-template.ts",
     "./node-identity": "./src/node-identity.ts",
     "./parser": "./src/parser/index.ts",
diff --git a/packages/core/src/config/defaults.ts b/packages/core/src/config/defaults.ts
index fb0f8d8..24c870a 100644
--- a/packages/core/src/config/defaults.ts
+++ b/packages/core/src/config/defaults.ts
@@ -122,7 +122,7 @@ dns:
   fake-ip-range: 198.18.0.1/16
   default-nameserver: [180.76.76.76, 182.254.118.118, 8.8.8.8, 180.184.2.2]
   nameserver: [180.76.76.76, 119.29.29.29, 180.184.1.1, 223.5.5.5, 8.8.8.8, "https://223.6.6.6/dns-query#h3=true", "https://dns.alidns.com/dns-query", "https://cloudflare-dns.com/dns-query", "https://doh.pub/dns-query"]
-  fallback: ["https://000000.dns.nextdns.io/dns-query#h3=true", "https://dns.alidns.com/dns-query", "https://doh.pub/dns-query", "https://public.dns.iij.jp/dns-query", "https://101.101.101.101/dns-query", "https://208.67.220.220/dns-query", "tls://8.8.4.4", "tls://1.0.0.1:853", "https://cloudflare-dns.com/dns-query", "https://dns.google/dns-query"]
+  fallback: ["https://dns.quad9.net/dns-query", "https://dns.alidns.com/dns-query", "https://doh.pub/dns-query", "https://public.dns.iij.jp/dns-query", "https://101.101.101.101/dns-query", "https://208.67.220.220/dns-query", "tls://8.8.4.4", "tls://1.0.0.1:853", "https://cloudflare-dns.com/dns-query", "https://dns.google/dns-query"]
   fallback-filter: {geoip: true, ipcidr: [240.0.0.0/4, 0.0.0.0/32, 127.0.0.1/32], domain: ["+.google.com", "+.facebook.com", "+.twitter.com", "+.youtube.com", "+.xn--ngstr-lra8j.com", "+.google.cn", "+.googleapis.cn", "+.googleapis.com", "+.gvt1.com"]}
   fake-ip-filter: ["*.lan", "stun.*.*.*", "stun.*.*", time.windows.com, time.nist.gov, time.apple.com, time.asia.apple.com, "*.ntp.org.cn", "*.openwrt.pool.ntp.org", time1.cloud.tencent.com, time.ustc.edu.cn, pool.ntp.org, ntp.ubuntu.com, ntp.aliyun.com, ntp1.aliyun.com, ntp2.aliyun.com, ntp3.aliyun.com, ntp4.aliyun.com, ntp5.aliyun.com, ntp6.aliyun.com, ntp7.aliyun.com, time1.aliyun.com, time2.aliyun.com, time3.aliyun.com, time4.aliyun.com, time5.aliyun.com, time6.aliyun.com, time7.aliyun.com, "*.time.edu.cn", time1.apple.com, time2.apple.com, time3.apple.com, time4.apple.com, time5.apple.com, time6.apple.com, time7.apple.com, time1.google.com, time2.google.com, time3.google.com, time4.google.com, music.163.com, "*.music.163.com", "*.126.net", musicapi.taihe.com, music.taihe.com, songsearch.kugou.com, trackercdn.kugou.com, "*.kuwo.cn", api-jooxtt.sanook.com, api.joox.com, joox.com, y.qq.com, "*.y.qq.com", streamoc.music.tc.qq.com, mobileoc.music.tc.qq.com, isure.stream.qqmusic.qq.com, dl.stream.qqmusic.qq.com, aqqmusic.tc.qq.com, amobile.music.tc.qq.com, "*.xiami.com", "*.music.migu.cn", music.migu.cn, "*.msftconnecttest.com", "*.msftncsi.com", localhost.ptlogin2.qq.com, "*.*.*.srv.nintendo.net", "*.*.stun.playstation.net", "xbox.*.*.microsoft.com", "*.ipv6.microsoft.com", "*.*.xboxlive.com", speedtest.cros.wr.pvp.net]
   # nameserver-policy 示例（full）
diff --git a/packages/core/src/core-contracts.test.ts b/packages/core/src/core-contracts.test.ts
index 4279613..18ad9f5 100644
--- a/packages/core/src/core-contracts.test.ts
+++ b/packages/core/src/core-contracts.test.ts
@@ -173,14 +173,14 @@ describe("custom routing rule set contracts", () => {
     expect(parseRuleSetTargetValue("module:")).toBeNull();
     expect(parseRuleSetTargetValue("bad:value")).toBeNull();
     expect(extractRuleSetPathFromUrl("https://example.com/geo/geosite/youtube.mrs?raw=1")).toBe(
-      "geosite/youtube.mrs"
+      "https://example.com/geo/geosite/youtube.mrs?raw=1"
     );
     expect(normalizeRuleSetPathInput("/geoip/private.mrs")).toBe("geoip/private.mrs");
     expect(buildRuleSetUrlFromPath("geosite/youtube.mrs", "https://rules.example.com/geo/")).toBe(
       "https://rules.example.com/geo/geosite/youtube.mrs"
     );
     expect(buildRuleSetUrlFromPath("https://cdn.example.com/geosite/youtube.mrs", DEFAULT_RULE_PROVIDER_BASE_URL)).toBe(
-      `${DEFAULT_RULE_PROVIDER_BASE_URL}/geosite/youtube.mrs`
+      "https://cdn.example.com/geosite/youtube.mrs"
     );
   });
 
@@ -231,7 +231,7 @@ describe("custom routing rule set contracts", () => {
       id: "private",
       name: "private",
       behavior: "ipcidr",
-      path: "geoip/private.mrs",
+      path: "https://rules.example.com/geo/geoip/private.mrs",
       target: {
         kind: "module",
         id: moduleId,
@@ -246,7 +246,7 @@ describe("custom routing rule set contracts", () => {
       id: "youtube",
       name: "YouTube",
       behavior: "domain",
-      path: "geosite/youtube.mrs",
+      path: "https://rules.example.com/geo/geosite/youtube.mrs?download=1",
       target: {
         kind: "custom",
         id: "custom",
diff --git a/packages/core/src/generator/chain.test.ts b/packages/core/src/generator/chain.test.ts
index b0141fa..c0b44a5 100644
--- a/packages/core/src/generator/chain.test.ts
+++ b/packages/core/src/generator/chain.test.ts
@@ -6,7 +6,6 @@ import {
   generateDialerProxyGroups,
   getDialerRelayNodes,
   getDialerTargetNodes,
-  suggestDialerGroups,
   validateDialerConfig,
 } from "./chain";
 
@@ -184,25 +183,4 @@ describe("dialer proxy chain helpers", () => {
     });
   });
 
-  it("suggests regional relay groups from node names", () => {
-    const suggestions = suggestDialerGroups([
-      node("US Los Angeles 01"),
-      node("美国 New York 02"),
-      node("香港 HK 01"),
-      node("Unknown 01"),
-    ]);
-
-    expect(suggestions).toEqual([
-      {
-        name: "🇺🇸 美国中转",
-        relayNodes: ["US Los Angeles 01", "美国 New York 02"],
-        description: "使用美国节点作为中转",
-      },
-      {
-        name: "🇭🇰 香港中转",
-        relayNodes: ["香港 HK 01"],
-        description: "使用香港节点作为中转",
-      },
-    ]);
-  });
 });
diff --git a/packages/core/src/generator/chain.ts b/packages/core/src/generator/chain.ts
index 6ddd21f..4eb3487 100644
--- a/packages/core/src/generator/chain.ts
+++ b/packages/core/src/generator/chain.ts
@@ -151,53 +151,3 @@ export function validateDialerConfig(
     errors,
   };
 }
-
-/**
- * 从节点列表中推荐中转组合
- * 基于节点名称中的地区信息进行智能匹配
- */
-export function suggestDialerGroups(
-  nodes: ParsedNode[]
-): Array<{ name: string; relayNodes: string[]; description: string }> {
-  const suggestions: Array<{ name: string; relayNodes: string[]; description: string }> = [];
-
-  // 地区关键词
-  const regions: Record<string, { keywords: string[]; emoji: string; name: string }> = {
-    us: { keywords: ["美国", "US", "USA", "United States", "洛杉矶", "纽约", "西雅图"], emoji: "🇺🇸", name: "美国" },
-    hk: { keywords: ["香港", "HK", "Hong Kong", "港"], emoji: "🇭🇰", name: "香港" },
-    jp: { keywords: ["日本", "JP", "Japan", "东京", "大阪"], emoji: "🇯🇵", name: "日本" },
-    sg: { keywords: ["新加坡", "SG", "Singapore", "狮城"], emoji: "🇸🇬", name: "新加坡" },
-    tw: { keywords: ["台湾", "TW", "Taiwan", "台北"], emoji: "🇹🇼", name: "台湾" },
-    kr: { keywords: ["韩国", "KR", "Korea", "首尔"], emoji: "🇰🇷", name: "韩国" },
-  };
-
-  // 按地区分类节点
-  const nodesByRegion: Record<string, string[]> = {};
-
-  for (const node of nodes) {
-    const name = node.name.toLowerCase();
-    for (const [region, config] of Object.entries(regions)) {
-      if (config.keywords.some((kw) => name.includes(kw.toLowerCase()))) {
-        if (!nodesByRegion[region]) {
-          nodesByRegion[region] = [];
-        }
-        nodesByRegion[region].push(node.name);
-        break;
-      }
-    }
-  }
-
-  // 生成推荐的中转组
-  for (const [region, config] of Object.entries(regions)) {
-    const regionNodes = nodesByRegion[region] || [];
-    if (regionNodes.length > 0) {
-      suggestions.push({
-        name: `${config.emoji} ${config.name}中转`,
-        relayNodes: regionNodes.slice(0, 5), // 最多取5个节点
-        description: `使用${config.name}节点作为中转`,
-      });
-    }
-  }
-
-  return suggestions;
-}
diff --git a/packages/core/src/generator/dns.ts b/packages/core/src/generator/dns.ts
index dca1145..7917111 100644
--- a/packages/core/src/generator/dns.ts
+++ b/packages/core/src/generator/dns.ts
@@ -28,7 +28,7 @@ export const DEFAULT_DNS_CONFIG: DNSConfig = {
     "https://doh.pub/dns-query",
   ],
   fallback: [
-    "https://000000.dns.nextdns.io/dns-query#h3=true",
+    "https://dns.quad9.net/dns-query",
     "https://dns.alidns.com/dns-query",
     "https://doh.pub/dns-query",
     "https://public.dns.iij.jp/dns-query",
@@ -128,4 +128,3 @@ export const DEFAULT_DNS_CONFIG: DNSConfig = {
     "speedtest.cros.wr.pvp.net",
   ],
 };
-
diff --git a/packages/core/src/generator/yaml.test.ts b/packages/core/src/generator/yaml.test.ts
index 6bb6555..6294e21 100644
--- a/packages/core/src/generator/yaml.test.ts
+++ b/packages/core/src/generator/yaml.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import yamlParser from "js-yaml";
 import { collectDnsPolicyEntries, configToYaml } from "./yaml";
 import type { ClashConfig } from "@subboost/core/types/config";
 
@@ -73,6 +74,25 @@ describe("configToYaml", () => {
     expect(yaml).toBe(["proxies:", "", "proxy-groups:", "", "rule-providers:", "", "rules:"].join("\n"));
   });
 
+  it("quotes rule scalars that YAML would otherwise truncate or reinterpret", () => {
+    const rules = [
+      "DOMAIN-SUFFIX,example.com,Netflix #1",
+      "DOMAIN,example.net,Group: Primary",
+      "MATCH,Select",
+    ];
+    const output = configToYaml({
+      proxies: [],
+      "proxy-groups": [],
+      "rule-providers": {},
+      rules,
+    } as unknown as ClashConfig);
+
+    expect((yamlParser.load(output) as ClashConfig).rules).toEqual(rules);
+    expect(output).toContain('  - "DOMAIN-SUFFIX,example.com,Netflix #1"');
+    expect(output).toContain('  - "DOMAIN,example.net,Group: Primary"');
+    expect(output).toContain("  - MATCH,Select");
+  });
+
   it("collects DNS policy entries from clean string and array values only", () => {
     expect(collectDnsPolicyEntries(null)).toEqual([]);
     expect(collectDnsPolicyEntries([])).toEqual([]);
diff --git a/packages/core/src/generator/yaml.ts b/packages/core/src/generator/yaml.ts
index 7efb8cd..840f589 100644
--- a/packages/core/src/generator/yaml.ts
+++ b/packages/core/src/generator/yaml.ts
@@ -237,6 +237,19 @@ function toInlineYaml(value: unknown): string {
   return String(value);
 }
 
+function toBlockSequenceScalar(value: string): string {
+  const trimmed = value.trim();
+  const ambiguous =
+    !value ||
+    trimmed !== value ||
+    /[\r\n#]/.test(value) ||
+    /:\s/.test(value) ||
+    /^[\-?:,\[\]{}&*!|>'"%@`]/.test(value) ||
+    /^(?:null|~|true|false|yes|no|on|off)$/i.test(value) ||
+    /^[+-]?(?:\d+|\d*\.\d+|\d+\.\d*)(?:[eE][+-]?\d+)?$/.test(value);
+  return ambiguous ? `"${escapeYamlDoubleQuotedString(value)}"` : value;
+}
+
 function normalizeDnsPolicyValue(value: unknown): DnsPolicyValue | null {
   if (Array.isArray(value)) {
     const servers = value
@@ -372,7 +385,7 @@ export function configToYaml(config: ClashConfig): string {
   lines.push("rules:");
   if (config.rules) {
     for (const rule of config.rules) {
-      lines.push(`  - ${rule}`);
+      lines.push(`  - ${toBlockSequenceScalar(rule)}`);
     }
   }
 
diff --git a/packages/core/src/migrations/legacy-config.test.ts b/packages/core/src/migrations/legacy-config.test.ts
new file mode 100644
index 0000000..0d24326
--- /dev/null
+++ b/packages/core/src/migrations/legacy-config.test.ts
@@ -0,0 +1,179 @@
+import { describe, expect, it } from "vitest";
+import { migrateLegacyConfig } from "./legacy-config";
+
+describe("migrateLegacyConfig", () => {
+  it("keeps current configs unchanged", () => {
+    const config = {
+      customProxyGroups: [],
+      customRuleSets: [],
+      builtinRuleEdits: {},
+    };
+
+    expect(migrateLegacyConfig(config)).toBe(config);
+  });
+
+  it("migrates filtered groups and every supported legacy rule shape", () => {
+    const result = migrateLegacyConfig({
+      filteredProxyGroups: [
+        {
+          id: "us-only",
+          name: "US Only",
+          groupType: "url-test",
+          sourceIds: ["airport", "airport"],
+          regions: ["us"],
+          excludedNodeNames: ["Old Node"],
+        },
+      ],
+      customProxyGroups: [
+        {
+          id: "custom-lab",
+          name: "Lab",
+          emoji: "🧪",
+          groupType: "select",
+          rules: [
+            {
+              id: "lab-provider",
+              name: "Lab Provider",
+              path: "geosite/lab.mrs",
+              behavior: "domain",
+            },
+          ],
+        },
+      ],
+      customRules: [
+        { id: "ordinary", type: "DOMAIN", value: "example.com", target: "US Only" },
+        {
+          id: "manual-provider",
+          type: "RULE-SET",
+          value: "geoip/manual.mrs",
+          target: "US Only",
+        },
+      ],
+      customRuleSets: [
+        {
+          id: "existing-provider",
+          name: "Existing",
+          path: "geosite/existing.mrs",
+          behavior: "domain",
+          target: "US Only",
+        },
+      ],
+      builtinRuleEdits: {
+        "module:youtube:youtube": { target: "US Only" },
+      },
+      moduleRuleExclusions: {
+        ai: ["openai", "anthropic"],
+      },
+      moduleRuleOverrides: {
+        google: [
+          {
+            id: "openai",
+            name: "OpenAI",
+            path: "geosite/openai.mrs",
+            behavior: "domain",
+          },
+          {
+            id: "new-provider",
+            name: "New Provider",
+            path: "geoip/new-provider.mrs",
+          },
+        ],
+      },
+      allRulesOrderEditingEnabled: true,
+      dialerProxyGroups: [{ id: "relay", relayNodes: ["US Only"] }],
+      proxyGroupOrder: ["filtered:us-only"],
+      ruleOrder: [
+        "module:ai:openai",
+        "module:google:new-provider",
+        "custom-group:custom-lab:lab-provider",
+        "custom-rule:manual-provider",
+      ],
+    });
+
+    expect(result).not.toHaveProperty("filteredProxyGroups");
+    expect(result).not.toHaveProperty("moduleRuleExclusions");
+    expect(result).not.toHaveProperty("moduleRuleOverrides");
+    expect(result).not.toHaveProperty("allRulesOrderEditingEnabled");
+    expect(result.proxyGroupAdvancedModeEnabled).toBe(true);
+    expect(result.customProxyGroups).toEqual([
+      {
+        id: "custom-lab",
+        name: "Lab",
+        emoji: "🧪",
+        groupType: "select",
+      },
+      expect.objectContaining({
+        id: "migrated-filtered-us-only",
+        name: "US Only",
+        memberSource: "filtered-nodes",
+        groupType: "url-test",
+        advanced: {
+          sourceIds: ["airport"],
+          regions: ["us"],
+          excludedMembers: [{ kind: "node", name: "Old Node" }],
+        },
+      }),
+    ]);
+    expect(result.customRules).toEqual([
+      {
+        id: "ordinary",
+        type: "DOMAIN",
+        value: "example.com",
+        target: { kind: "custom", id: "migrated-filtered-us-only" },
+      },
+    ]);
+    expect(result.customRuleSets).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          id: "existing-provider",
+          target: { kind: "custom", id: "migrated-filtered-us-only" },
+        }),
+        expect.objectContaining({
+          id: "manual-provider",
+          behavior: "ipcidr",
+          target: { kind: "custom", id: "migrated-filtered-us-only" },
+        }),
+        expect.objectContaining({
+          id: "lab-provider",
+          target: { kind: "custom", id: "custom-lab" },
+        }),
+        expect.objectContaining({
+          id: "new-provider",
+          behavior: "ipcidr",
+          target: { kind: "module", id: "google" },
+        }),
+      ])
+    );
+    expect(result.builtinRuleEdits).toEqual({
+      "module:youtube:youtube": {
+        target: { kind: "custom", id: "migrated-filtered-us-only" },
+      },
+      "module:ai:openai": { target: { kind: "module", id: "google" } },
+      "module:ai:anthropic": { enabled: false },
+    });
+    expect(result.dialerProxyGroups).toEqual([{ id: "relay", relayNodes: ["US Only"] }]);
+    expect(result.proxyGroupOrder).toEqual(["custom:migrated-filtered-us-only"]);
+    expect(result.ruleOrder).toEqual([
+      "module:ai:openai",
+      "custom-rule-set:new-provider",
+      "custom-rule-set:lab-provider",
+      "custom-rule-set:manual-provider",
+    ]);
+  });
+
+  it("lets current builtin edits win when old and new fields overlap", () => {
+    const result = migrateLegacyConfig({
+      moduleRuleExclusions: { ai: ["openai"] },
+      builtinRuleEdits: {
+        "module:ai:openai": { target: { kind: "module", id: "select" } },
+      },
+    });
+
+    expect(result.builtinRuleEdits).toEqual({
+      "module:ai:openai": {
+        enabled: false,
+        target: { kind: "module", id: "select" },
+      },
+    });
+  });
+});
diff --git a/packages/core/src/migrations/legacy-config.ts b/packages/core/src/migrations/legacy-config.ts
new file mode 100644
index 0000000..9513f3f
--- /dev/null
+++ b/packages/core/src/migrations/legacy-config.ts
@@ -0,0 +1,396 @@
+import { PROXY_GROUP_MODULES } from "@subboost/core/generator/proxy-group-modules";
+import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
+import { normalizeProxyGroupTargetRef } from "@subboost/core/proxy-group-targets";
+import {
+  isValidRuleSetPathOrUrl,
+  normalizeRuleSetPathInput,
+} from "@subboost/core/rules/rule-model";
+import type {
+  CustomRuleSet,
+  ProxyGroupAdvancedConfig,
+  ProxyGroupRuleTarget,
+  RuleSetBehavior,
+} from "@subboost/core/types/config";
+
+type MutableRecord = Record<string, unknown>;
+
+const LEGACY_GROUP_TYPES = new Set([
+  "select",
+  "url-test",
+  "fallback",
+  "load-balance",
+  "direct-first",
+  "reject-first",
+]);
+const BUILTIN_MODULE_IDS = new Set(PROXY_GROUP_MODULES.map((module) => module.id));
+const BUILTIN_RULE_SOURCE_BY_ID = new Map(
+  PROXY_GROUP_MODULES.flatMap((module) => module.rules.map((rule) => [rule.id, module.id] as const))
+);
+
+function isRecord(value: unknown): value is MutableRecord {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function hasOwn(value: MutableRecord, key: string): boolean {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+
+function stringValue(value: unknown): string {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function uniqueStringArray(value: unknown): string[] {
+  if (!Array.isArray(value)) return [];
+  const out: string[] = [];
+  const seen = new Set<string>();
+  for (const item of value) {
+    const text = stringValue(item);
+    if (!text || seen.has(text)) continue;
+    seen.add(text);
+    out.push(text);
+  }
+  return out;
+}
+
+function makeUniqueValue(base: string, used: Set<string>, fallback: string): string {
+  const normalized = base.trim() || fallback;
+  if (!used.has(normalized)) {
+    used.add(normalized);
+    return normalized;
+  }
+  let index = 2;
+  let candidate = `${normalized}-${index}`;
+  while (used.has(candidate)) {
+    index += 1;
+    candidate = `${normalized}-${index}`;
+  }
+  used.add(candidate);
+  return candidate;
+}
+
+function makeUniqueName(base: string, used: Set<string>): string {
+  const normalized = base.trim() || "自定义代理组";
+  if (!used.has(normalized)) {
+    used.add(normalized);
+    return normalized;
+  }
+  let index = 2;
+  let candidate = `${normalized} (${index})`;
+  while (used.has(candidate)) {
+    index += 1;
+    candidate = `${normalized} (${index})`;
+  }
+  used.add(candidate);
+  return candidate;
+}
+
+function migrateFilteredAdvanced(group: MutableRecord): ProxyGroupAdvancedConfig {
+  return normalizeProxyGroupAdvancedConfig({
+    sourceIds: uniqueStringArray(group.sourceIds),
+    regions: uniqueStringArray(group.regions),
+    includeRegex: stringValue(group.includeRegex),
+    excludeRegex: stringValue(group.excludeRegex),
+    excludedMembers: uniqueStringArray(group.excludedNodeNames).map((name) => ({
+      kind: "node" as const,
+      name,
+    })),
+  });
+}
+
+function retargetRuleTarget(
+  value: unknown,
+  nameMap: Map<string, { id: string; name: string }>,
+  idMap: Map<string, { id: string; name: string }>
+): unknown {
+  const ref = normalizeProxyGroupTargetRef(value);
+  if (ref?.kind === "custom" && idMap.has(ref.id)) {
+    return { kind: "custom" as const, id: idMap.get(ref.id)!.id };
+  }
+  const text = stringValue(value);
+  const migrated = text ? nameMap.get(text) : undefined;
+  return migrated ? { kind: "custom" as const, id: migrated.id } : value;
+}
+
+function retargetStringArray(value: unknown, nameMap: Map<string, { id: string; name: string }>): unknown {
+  if (!Array.isArray(value)) return value;
+  return value.map((item) => {
+    if (typeof item !== "string") return item;
+    return nameMap.get(item.trim())?.name ?? item;
+  });
+}
+
+function migrateFilteredProxyGroups(record: MutableRecord): MutableRecord {
+  if (!hasOwn(record, "filteredProxyGroups")) return record;
+
+  const next = { ...record };
+  const existingCustomGroups = Array.isArray(next.customProxyGroups) ? [...next.customProxyGroups] : [];
+  const validExistingGroups = existingCustomGroups.filter(isRecord);
+  const usedIds = new Set(validExistingGroups.map((group) => stringValue(group.id)).filter(Boolean));
+  const usedNames = new Set(validExistingGroups.map((group) => stringValue(group.name)).filter(Boolean));
+  const nameMap = new Map<string, { id: string; name: string }>();
+  const idMap = new Map<string, { id: string; name: string }>();
+  const migratedGroups: MutableRecord[] = [];
+
+  if (Array.isArray(record.filteredProxyGroups)) {
+    for (const rawGroup of record.filteredProxyGroups) {
+      if (!isRecord(rawGroup) || rawGroup.enabled === false) continue;
+      const oldId = stringValue(rawGroup.id);
+      const oldName = stringValue(rawGroup.name);
+      if (!oldId || !oldName) continue;
+
+      const id = makeUniqueValue(`migrated-filtered-${oldId}`, usedIds, "migrated-filtered-group");
+      const name = makeUniqueName(oldName, usedNames);
+      const mapped = { id, name };
+      idMap.set(oldId, mapped);
+      nameMap.set(oldName, mapped);
+
+      const rawGroupType = stringValue(rawGroup.groupType) || "select";
+      const groupType = LEGACY_GROUP_TYPES.has(rawGroupType) ? rawGroupType : "select";
+      migratedGroups.push({
+        id,
+        name,
+        emoji: stringValue(rawGroup.emoji),
+        description: "自定义代理组",
+        memberSource: "filtered-nodes",
+        groupType,
+        ...(groupType === "load-balance" && stringValue(rawGroup.strategy)
+          ? { strategy: stringValue(rawGroup.strategy) }
+          : {}),
+        advanced: migrateFilteredAdvanced(rawGroup),
+      });
+    }
+  }
+
+  next.customProxyGroups = [...existingCustomGroups, ...migratedGroups];
+  if (migratedGroups.length > 0) next.proxyGroupAdvancedModeEnabled = true;
+  delete next.filteredProxyGroups;
+
+  if (Array.isArray(next.customRules)) {
+    next.customRules = next.customRules.map((rule) =>
+      isRecord(rule) && hasOwn(rule, "target")
+        ? { ...rule, target: retargetRuleTarget(rule.target, nameMap, idMap) }
+        : rule
+    );
+  }
+  if (Array.isArray(next.customRuleSets)) {
+    next.customRuleSets = next.customRuleSets.map((ruleSet) =>
+      isRecord(ruleSet) && hasOwn(ruleSet, "target")
+        ? { ...ruleSet, target: retargetRuleTarget(ruleSet.target, nameMap, idMap) }
+        : ruleSet
+    );
+  }
+  if (isRecord(next.builtinRuleEdits)) {
+    next.builtinRuleEdits = Object.fromEntries(
+      Object.entries(next.builtinRuleEdits).map(([key, edit]) => [
+        key,
+        isRecord(edit) && hasOwn(edit, "target")
+          ? { ...edit, target: retargetRuleTarget(edit.target, nameMap, idMap) }
+          : edit,
+      ])
+    );
+  }
+  if (Array.isArray(next.dialerProxyGroups)) {
+    next.dialerProxyGroups = next.dialerProxyGroups.map((group) =>
+      isRecord(group) && hasOwn(group, "relayNodes")
+        ? { ...group, relayNodes: retargetStringArray(group.relayNodes, nameMap) }
+        : group
+    );
+  }
+  if (Array.isArray(next.proxyGroupOrder)) {
+    next.proxyGroupOrder = next.proxyGroupOrder.map((key) => {
+      const text = stringValue(key);
+      if (!text.startsWith("filtered:")) return key;
+      const mapped = idMap.get(text.slice("filtered:".length));
+      return mapped ? `custom:${mapped.id}` : key;
+    });
+  }
+
+  return next;
+}
+
+type LegacyRuleProvider = Omit<CustomRuleSet, "target"> & { legacyIndex: number };
+
+function normalizeBehavior(value: unknown, path: string): RuleSetBehavior | null {
+  if (value === "domain" || value === "ipcidr") return value;
+  if (path.toLowerCase().startsWith("geoip/")) return "ipcidr";
+  if (path.toLowerCase().startsWith("geosite/")) return "domain";
+  return null;
+}
+
+function parseLegacyRuleProvider(
+  value: unknown,
+  legacyIndex: number,
+  pathFields: string[] = ["path"]
+): LegacyRuleProvider | null {
+  if (!isRecord(value)) return null;
+  const id = stringValue(value.id);
+  let rawPath = "";
+  for (const field of pathFields) {
+    rawPath = stringValue(value[field]);
+    if (rawPath) break;
+  }
+  const path = normalizeRuleSetPathInput(rawPath);
+  const behavior = normalizeBehavior(value.behavior, path);
+  if (!id || !behavior || !path || !isValidRuleSetPathOrUrl(path)) return null;
+  const noResolve = typeof value.noResolve === "boolean" ? value.noResolve : behavior === "ipcidr";
+  return {
+    id,
+    name: stringValue(value.name) || id,
+    behavior,
+    path,
+    ...(noResolve ? { noResolve: true } : {}),
+    legacyIndex,
+  };
+}
+
+function parseLegacyOverrides(value: unknown): Record<string, LegacyRuleProvider[]> {
+  if (!isRecord(value)) return {};
+  const out: Record<string, LegacyRuleProvider[]> = {};
+  for (const [rawModuleId, rawRules] of Object.entries(value)) {
+    const moduleId = rawModuleId.trim();
+    if (!moduleId || !Array.isArray(rawRules)) continue;
+    const rules = rawRules
+      .map((rule, index) => parseLegacyRuleProvider(rule, index))
+      .filter((rule): rule is LegacyRuleProvider => Boolean(rule));
+    if (rules.length > 0) out[moduleId] = rules;
+  }
+  return out;
+}
+
+function moduleRuleKey(moduleId: string, ruleId: string): string {
+  return `module:${moduleId}:${ruleId}`;
+}
+
+function targetForModule(moduleId: string, config: MutableRecord): ProxyGroupRuleTarget {
+  if (BUILTIN_MODULE_IDS.has(moduleId)) return { kind: "module", id: moduleId };
+  const overrides = isRecord(config.proxyGroupNameOverrides) ? config.proxyGroupNameOverrides : {};
+  return stringValue(overrides[moduleId]) || moduleId;
+}
+
+function addUniqueRuleSet(ruleSets: unknown[], ruleSet: CustomRuleSet): string {
+  const existing = new Set(
+    ruleSets.filter(isRecord).map((item) => stringValue(item.id)).filter(Boolean)
+  );
+  const id = makeUniqueValue(ruleSet.id, existing, "migrated-rule-set");
+  ruleSets.push(id === ruleSet.id ? ruleSet : { ...ruleSet, id });
+  return id;
+}
+
+function migrateLegacyRuleFields(record: MutableRecord): MutableRecord {
+  const groupsHaveLegacyRules = Array.isArray(record.customProxyGroups)
+    && record.customProxyGroups.some((group) => isRecord(group) && hasOwn(group, "rules"));
+  const customRulesHaveRuleSet = Array.isArray(record.customRules)
+    && record.customRules.some((rule) => isRecord(rule) && rule.type === "RULE-SET");
+  const hasLegacyFields = hasOwn(record, "moduleRuleOverrides")
+    || hasOwn(record, "moduleRuleExclusions")
+    || hasOwn(record, "allRulesOrderEditingEnabled")
+    || groupsHaveLegacyRules
+    || customRulesHaveRuleSet;
+  if (!hasLegacyFields) return record;
+
+  const next = { ...record };
+  const ruleSets = Array.isArray(record.customRuleSets) ? [...record.customRuleSets] : [];
+  const edits: MutableRecord = isRecord(record.builtinRuleEdits) ? { ...record.builtinRuleEdits } : {};
+  const orderMoves = new Map<string, string | null>();
+
+  if (Array.isArray(record.customRules)) {
+    const rules: unknown[] = [];
+    record.customRules.forEach((rule, index) => {
+      if (!isRecord(rule) || rule.type !== "RULE-SET") {
+        rules.push(rule);
+        return;
+      }
+      const parsed = parseLegacyRuleProvider(rule, index, ["value", "path"]);
+      const target = normalizeProxyGroupTargetRef(rule.target) ?? stringValue(rule.target);
+      if (!parsed || !target) {
+        rules.push(rule);
+        return;
+      }
+      const { legacyIndex: _legacyIndex, ...provider } = parsed;
+      const id = addUniqueRuleSet(ruleSets, { ...provider, target });
+      orderMoves.set(`custom-rule:${parsed.id}`, `custom-rule-set:${id}`);
+    });
+    next.customRules = rules;
+  }
+
+  if (Array.isArray(record.customProxyGroups)) {
+    next.customProxyGroups = record.customProxyGroups.map((group) => {
+      if (!isRecord(group) || !hasOwn(group, "rules")) return group;
+      const { rules, ...rest } = group;
+      const target = stringValue(group.id)
+        ? { kind: "custom" as const, id: stringValue(group.id) }
+        : stringValue(group.name);
+      if (Array.isArray(rules) && target) {
+        rules.forEach((rule, index) => {
+          const parsed = parseLegacyRuleProvider(rule, index, ["path", "url"]);
+          if (!parsed) return;
+          const { legacyIndex: _legacyIndex, ...provider } = parsed;
+          const id = addUniqueRuleSet(ruleSets, { ...provider, target });
+          orderMoves.set(`custom-group:${stringValue(group.id)}:${parsed.id}`, `custom-rule-set:${id}`);
+        });
+      }
+      return rest;
+    });
+  }
+
+  const overrides = parseLegacyOverrides(record.moduleRuleOverrides);
+  const consumedOverrides = new Set<string>();
+  if (isRecord(record.moduleRuleExclusions)) {
+    for (const [rawSourceId, rawRuleIds] of Object.entries(record.moduleRuleExclusions)) {
+      const sourceId = rawSourceId.trim();
+      if (!sourceId || !Array.isArray(rawRuleIds)) continue;
+      for (const ruleId of uniqueStringArray(rawRuleIds)) {
+        const canonicalSourceId = BUILTIN_RULE_SOURCE_BY_ID.get(ruleId) ?? sourceId;
+        const key = moduleRuleKey(canonicalSourceId, ruleId);
+        let legacyEdit: MutableRecord = { enabled: false };
+        for (const [targetModuleId, rules] of Object.entries(overrides)) {
+          const moved = rules.find((rule) => rule.id === ruleId);
+          if (!moved) continue;
+          legacyEdit = { target: targetForModule(targetModuleId, record) };
+          consumedOverrides.add(`${targetModuleId}:${moved.legacyIndex}`);
+          break;
+        }
+        edits[key] = isRecord(edits[key]) ? { ...legacyEdit, ...edits[key] } : legacyEdit;
+      }
+    }
+  }
+
+  for (const [targetModuleId, rules] of Object.entries(overrides)) {
+    const target = targetForModule(targetModuleId, record);
+    for (const rule of rules) {
+      if (consumedOverrides.has(`${targetModuleId}:${rule.legacyIndex}`)) continue;
+      const sourceId = BUILTIN_RULE_SOURCE_BY_ID.get(rule.id);
+      if (sourceId === targetModuleId) continue;
+      const { legacyIndex: _legacyIndex, ...provider } = rule;
+      const id = addUniqueRuleSet(ruleSets, { ...provider, target });
+      orderMoves.set(moduleRuleKey(targetModuleId, rule.id), `custom-rule-set:${id}`);
+    }
+  }
+
+  if (Array.isArray(record.ruleOrder)) {
+    next.ruleOrder = record.ruleOrder.flatMap((item) => {
+      if (typeof item !== "string") return [];
+      if (orderMoves.has(item)) {
+        const moved = orderMoves.get(item);
+        return moved ? [moved] : [];
+      }
+      return item.startsWith("custom-group:") ? [] : [item];
+    });
+  }
+
+  delete next.moduleRuleOverrides;
+  delete next.moduleRuleExclusions;
+  delete next.allRulesOrderEditingEnabled;
+  next.customRuleSets = ruleSets;
+  next.builtinRuleEdits = edits;
+  return next;
+}
+
+/**
+ * Converts accepted pre-v3 configuration fields at trust-boundary entry points.
+ * Runtime state and newly persisted data must only use the current rule model.
+ */
+export function migrateLegacyConfig<T>(config: T): T {
+  if (!isRecord(config)) return config;
+  return migrateLegacyRuleFields(migrateFilteredProxyGroups(config)) as T;
+}
diff --git a/packages/core/src/parser/clash-yaml.test.ts b/packages/core/src/parser/clash-yaml.test.ts
index 102aef5..d36ad65 100644
--- a/packages/core/src/parser/clash-yaml.test.ts
+++ b/packages/core/src/parser/clash-yaml.test.ts
@@ -208,6 +208,25 @@ proxies:
     expect(mixed.errors[0]).toContain('节点 "Bad" 解析失败');
   });
 
+  it("repairs large malformed proxy lists without quadratic scanning", () => {
+    const count = 2_000;
+    const rows = ["proxies:"];
+    for (let index = 0; index < count; index += 1) {
+      rows.push(`  - name: Node ${index}`);
+      rows.push("      type: ss");
+      rows.push(`      server: node-${index}.example.com`);
+      rows.push("      port: 8388");
+    }
+
+    const startedAt = performance.now();
+    const result = parseClashYaml(rows.join("\n"));
+    const elapsedMs = performance.now() - startedAt;
+
+    expect(result.errors).toEqual([]);
+    expect(result.nodes).toHaveLength(count);
+    expect(elapsedMs).toBeLessThan(1_500);
+  }, 10_000);
+
   it("parses consistently indented root flow proxy lists", () => {
     for (const spaces of [0, 1, 2, 4]) {
       const indent = " ".repeat(spaces);
diff --git a/packages/core/src/parser/clash-yaml.ts b/packages/core/src/parser/clash-yaml.ts
index 26381e6..3d5245b 100644
--- a/packages/core/src/parser/clash-yaml.ts
+++ b/packages/core/src/parser/clash-yaml.ts
@@ -106,6 +106,53 @@ function repairRootFlowProxyListIndent(input: string): string {
   return lines.join("\n");
 }
 
+function repairInlineListIndent(input: string): string {
+  // 修复常见的“列表项首行内联 key（- name: xxx）但后续 key 又多缩进”的不合法 YAML。
+  // 逐个列表项消费其后续块，确保每一行最多检查一次，避免大型订阅退化为 O(n²)。
+  const lines = input.split(/\r?\n/);
+  const out: string[] = [];
+
+  for (let index = 0; index < lines.length; ) {
+    const line = lines[index];
+    const match = line.match(/^(\s*)-\s*(name\s*:\s*.+)$/);
+    if (!match) {
+      out.push(line);
+      index += 1;
+      continue;
+    }
+
+    const dashIndent = match[1].length;
+    const keyIndent = dashIndent + 2;
+    let minIndent = Number.POSITIVE_INFINITY;
+    let blockEnd = index + 1;
+
+    while (blockEnd < lines.length) {
+      const nextLine = lines[blockEnd];
+      const trimmed = nextLine.trim();
+      if (!trimmed || trimmed.startsWith("#")) {
+        blockEnd += 1;
+        continue;
+      }
+
+      const indent = countLeadingSpaces(nextLine);
+      if (indent <= dashIndent) break;
+      minIndent = Math.min(minIndent, indent);
+      blockEnd += 1;
+    }
+
+    if (minIndent !== Number.POSITIVE_INFINITY && minIndent > keyIndent) {
+      out.push(`${" ".repeat(dashIndent)}-`);
+      out.push(`${" ".repeat(minIndent)}${match[2]}`);
+    } else {
+      out.push(line);
+    }
+    out.push(...lines.slice(index + 1, blockEnd));
+    index = blockEnd;
+  }
+
+  return out.join("\n");
+}
+
 /**
  * 解析 Clash YAML 配置
  */
@@ -116,55 +163,6 @@ export function parseClashYaml(content: string): ParseResult {
   try {
     const normalizeTabs = (s: string) => s.replace(/\t/g, "  ");
 
-    const repairInlineListIndent = (input: string): string => {
-      // 修复常见的“列表项首行内联 key（- name: xxx）但后续 key 又多缩进”的不合法 YAML
-      // 例如（不合法）：
-      //  - name: ss-A
-      //     type: ss
-      // 修复为（合法）：
-      //  -
-      //     name: ss-A
-      //     type: ss
-      const lines = input.split(/\r?\n/);
-      const out: string[] = [];
-
-      for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-        const m = line.match(/^(\s*)-\s*(name\s*:\s*.+)$/);
-        if (!m) {
-          out.push(line);
-          continue;
-        }
-
-        const dashIndent = m[1].length;
-        const namePair = m[2];
-        const keyIndent = dashIndent + 2;
-
-        // 计算该列表项后续块内最小缩进（用于对齐 name/type/server 等）
-        let minIndent = Number.POSITIVE_INFINITY;
-        for (let j = i + 1; j < lines.length; j++) {
-          const l = lines[j];
-          if (!l.trim() || l.trim().startsWith("#")) continue;
-
-          const indent = (l.match(/^(\s*)/)?.[1].length ?? 0);
-          // 缩进回退到当前列表项的 '-' 缩进（或更浅）时，说明已经离开该列表项
-          if (indent <= dashIndent) break;
-          minIndent = Math.min(minIndent, indent);
-        }
-
-        // 仅当后续 key 明显比内联 key 更深时才修复，避免误改合法 YAML
-        if (minIndent !== Number.POSITIVE_INFINITY && minIndent > keyIndent) {
-          out.push(`${" ".repeat(dashIndent)}-`);
-          out.push(`${" ".repeat(minIndent)}${namePair}`);
-          continue;
-        }
-
-        out.push(line);
-      }
-
-      return out.join("\n");
-    };
-
     const tryLoad = (raw: string): unknown => yaml.load(raw) as unknown;
     const normalizedContent = normalizeClashYamlScalarText(normalizeTabs(content));
 
diff --git a/packages/core/src/parser/config-line-parser.test.ts b/packages/core/src/parser/config-line-parser.test.ts
index c21ae05..b1cbded 100644
--- a/packages/core/src/parser/config-line-parser.test.ts
+++ b/packages/core/src/parser/config-line-parser.test.ts
@@ -36,6 +36,11 @@ describe("config line tokenizer helpers", () => {
     });
     expect(() => tokenizeConfigLine("broken")).toThrow("无效的配置行格式");
     expect(() => tokenizeConfigLine("Bad = ss, example.com, 70000")).toThrow("配置行中的地址或端口无效");
+    for (const invalidPort of ["1.5", "0x50", "8e3", "+80", "-1"]) {
+      expect(() => tokenizeConfigLine(`Bad = ss, example.com, ${invalidPort}`), invalidPort).toThrow(
+        "配置行中的地址或端口无效"
+      );
+    }
     expect(tokenizeConfigLine("Ignored = ss, ignored.example.com, 8388, =empty, flag")).toMatchObject({
       params: {},
       extras: ["flag"],
diff --git a/packages/core/src/parser/config-line-tokenizer.ts b/packages/core/src/parser/config-line-tokenizer.ts
index 4c95cc1..f177746 100644
--- a/packages/core/src/parser/config-line-tokenizer.ts
+++ b/packages/core/src/parser/config-line-tokenizer.ts
@@ -39,8 +39,9 @@ export function tokenizeConfigLine(line: string): {
 
   const type = tokens[0].toLowerCase();
   const host = stripQuotes(tokens[1]);
-  const port = Number(tokens[2]);
-  if (!host || !Number.isFinite(port) || port < 1 || port > 65535) {
+  const portText = stripQuotes(tokens[2]);
+  const port = Number(portText);
+  if (!host || !/^\d+$/.test(portText) || !Number.isInteger(port) || port < 1 || port > 65535) {
     throw new Error("配置行中的地址或端口无效");
   }
 
diff --git a/packages/core/src/parser/platform/parse-platform-proxy-line.test.ts b/packages/core/src/parser/platform/parse-platform-proxy-line.test.ts
index 59f1228..e6708a4 100644
--- a/packages/core/src/parser/platform/parse-platform-proxy-line.test.ts
+++ b/packages/core/src/parser/platform/parse-platform-proxy-line.test.ts
@@ -34,6 +34,20 @@ describe("parsePlatformProxyLine", () => {
     });
   });
 
+  it("keeps ws=false disabled and accepts IP or single-label SNI values", () => {
+    const disabledWs = parsePlatformProxyLine(
+      "No WS = vmess, vmess.example.com, 443, username=11111111-1111-4111-8111-111111111111, ws=false, ws-path=/ignored, tls=true, sni=127.0.0.1"
+    );
+    const localSni = parsePlatformProxyLine(
+      "Local SNI = anytls, anytls.example.com, 443, password=secret, sni=localhost"
+    );
+
+    expect(disabledWs).toMatchObject({ servername: "127.0.0.1" });
+    expect(disabledWs).not.toHaveProperty("network");
+    expect(disabledWs).not.toHaveProperty("ws-opts");
+    expect(localSni).toMatchObject({ sni: "localhost" });
+  });
+
   it("parses Surge WireGuard through its referenced section", () => {
     const sections = new Map<string, string[]>([
       [
diff --git a/packages/core/src/parser/platform/peggy/surge.js b/packages/core/src/parser/platform/peggy/surge.js
index 2998758..5d426e8 100644
--- a/packages/core/src/parser/platform/peggy/surge.js
+++ b/packages/core/src/parser/platform/peggy/surge.js
@@ -191,7 +191,7 @@ username = & {
 password = comma match:[^,]+ { proxy.password = match.join("").replace(/^"(.*)"$/, '$1').replace(/^'(.*?)'$/, '$1'); }
 
 tls = comma "tls" equals flag:bool { proxy.tls = flag; }
-sni = comma "sni" equals sni:("off"/domain) { 
+sni = comma "sni" equals sni:("off"/server) {
     if (sni === "off") {
         proxy["disable-sni"] = true;
     } else {
@@ -214,7 +214,7 @@ method = comma "encrypt-method" equals cipher:cipher {
 }
 cipher = ("aes-128-cfb"/"aes-128-ctr"/"aes-128-gcm"/"aes-192-cfb"/"aes-192-ctr"/"aes-192-gcm"/"aes-256-cfb"/"aes-256-ctr"/"aes-256-gcm"/"bf-cfb"/"camellia-128-cfb"/"camellia-192-cfb"/"camellia-256-cfb"/"cast5-cfb"/"chacha20-ietf-poly1305"/"chacha20-ietf"/"chacha20-poly1305"/"chacha20"/"des-cfb"/"idea-cfb"/"none"/"rc2-cfb"/"rc4-md5"/"rc4"/"salsa20"/"seed-cfb"/"xchacha20-ietf-poly1305"/"2022-blake3-aes-128-gcm"/"2022-blake3-aes-256-gcm");
 
-ws = comma "ws" equals flag:bool { obfs.type = "ws"; }
+ws = comma "ws" equals flag:bool { if (flag) obfs.type = "ws"; }
 ws_headers = comma "ws-headers" equals headers:$[^,]+ {
     const pairs = headers.split("|");
     const result = {};
diff --git a/packages/core/src/parser/protocols/simple-proxy.test.ts b/packages/core/src/parser/protocols/simple-proxy.test.ts
index 489e131..e1987ca 100644
--- a/packages/core/src/parser/protocols/simple-proxy.test.ts
+++ b/packages/core/src/parser/protocols/simple-proxy.test.ts
@@ -15,6 +15,7 @@ describe("simple proxy parsers", () => {
     const colonAuth = parseHttp("http://colon.example.com:8080:user:p%40ss#Colon");
     const headerAlias = parseHttp("http://alias.example.com:8080?header=bad|:skip|X-Empty:&skip_cert_verify=no&peer=peer.example.com");
     const ipv6 = parseHttp("http://[2001:db8::1]:8080#IPv6");
+    const ipv6DefaultPort = parseHttp("http://[2001:db8::2]");
     const tlsVerified = parseHttp("http://verified.example.com:8080?tls-verification=true#Verified");
 
     expect(http).toMatchObject({
@@ -67,6 +68,10 @@ describe("simple proxy parsers", () => {
       server: "2001:db8::1",
       port: 8080,
     });
+    expect(ipv6DefaultPort).toMatchObject({
+      server: "2001:db8::2",
+      port: 80,
+    });
     expect(tlsVerified).toMatchObject({
       name: "Verified",
       "skip-cert-verify": false,
diff --git a/packages/core/src/parser/protocols/simple-proxy.ts b/packages/core/src/parser/protocols/simple-proxy.ts
index 0ed34e8..1977f09 100644
--- a/packages/core/src/parser/protocols/simple-proxy.ts
+++ b/packages/core/src/parser/protocols/simple-proxy.ts
@@ -42,7 +42,10 @@ function stripMetaSuffix(input: string): { value: string; name?: string } {
   }
 
   const bracket = takeTerminalEnclosedValue(remaining, "[", "]");
-  if (bracket.enclosed !== undefined) {
+  const bracketIsIpv6Host =
+    bracket.enclosed?.includes(":") &&
+    (remaining.startsWith("[") || /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/(?:[^/?#@]+@)?\[[^\]]+\]$/.test(remaining));
+  if (bracket.enclosed !== undefined && !bracketIsIpv6Host) {
     remaining = bracket.value;
   }
 
@@ -531,4 +534,3 @@ export function parseTelegramProxyLink(uri: string): SocksNode | HttpNode {
 
   return buildNode(kind, { name, server, port, username, password }) as HttpNode;
 }
-
diff --git a/packages/core/src/parser/protocols/ssr-snell.test.ts b/packages/core/src/parser/protocols/ssr-snell.test.ts
index 6515052..9b27b01 100644
--- a/packages/core/src/parser/protocols/ssr-snell.test.ts
+++ b/packages/core/src/parser/protocols/ssr-snell.test.ts
@@ -74,6 +74,19 @@ describe("SSR and Snell parsers", () => {
     });
   });
 
+  it("preserves literal plus and percent sequences after SSR base64 decoding", () => {
+    const literal = "A+B%20C";
+    const node = parseSSR(
+      `ssr://${b64(`literal.example.com:8388:origin:aes-256-cfb:plain:${b64("secret")}/?remarks=${b64(literal)}&protoparam=${b64(literal)}&obfsparam=${b64(literal)}`)}`
+    );
+
+    expect(node).toMatchObject({
+      name: literal,
+      "protocol-param": literal,
+      "obfs-param": literal,
+    });
+  });
+
   it("keeps SSR validation errors explicit", () => {
     expect(() => parseSSR("http://bad")).toThrow("无效的 SSR 链接");
     expect(() => parseSSR("ssr://")).toThrow("无效的 SSR 链接");
diff --git a/packages/core/src/parser/protocols/ssr.ts b/packages/core/src/parser/protocols/ssr.ts
index 686db20..4e8f46a 100644
--- a/packages/core/src/parser/protocols/ssr.ts
+++ b/packages/core/src/parser/protocols/ssr.ts
@@ -98,7 +98,7 @@ export function parseSSR(uri: string): SSRNode {
   const params = parseSsrQuery(query);
 
   const remarks = safeDecodeSsrBase64(params.remarks || params.remark || "");
-  const name = remarks ? safeDecodeFormUrlEncoded(remarks) : `SSR-${server}:${port}`;
+  const name = remarks || `SSR-${server}:${port}`;
 
   const node: SSRNode = {
     name,
@@ -114,14 +114,13 @@ export function parseSSR(uri: string): SSRNode {
 
   const protoparam = safeDecodeSsrBase64(params.protoparam || params["protocol-param"] || "");
   if (protoparam) {
-    node["protocol-param"] = safeDecodeFormUrlEncoded(protoparam);
+    node["protocol-param"] = protoparam;
   }
 
   const obfsparam = safeDecodeSsrBase64(params.obfsparam || params["obfs-param"] || "");
   if (obfsparam) {
-    node["obfs-param"] = safeDecodeFormUrlEncoded(obfsparam);
+    node["obfs-param"] = obfsparam;
   }
 
   return node;
 }
-
diff --git a/packages/core/src/proxy-group-targets.test.ts b/packages/core/src/proxy-group-targets.test.ts
index 27b51b3..8bf1c05 100644
--- a/packages/core/src/proxy-group-targets.test.ts
+++ b/packages/core/src/proxy-group-targets.test.ts
@@ -42,6 +42,9 @@ describe("proxy group target helpers", () => {
     expect(resolveProxyGroupTargetName({ kind: "custom", id: "media" }, options)).toBe("Media");
     expect(resolveProxyGroupTargetName({ kind: "custom", id: "missing" }, options)).toBe("DIRECT");
     expect(resolveProxyGroupTargetName({ kind: "module", id: "missing" }, options)).toBe("DIRECT");
+    expect(resolveProxyGroupTargetName({ kind: "module", id: "toString" }, options)).toBe("DIRECT");
+    expect(resolveProxyGroupTargetName({ kind: "module", id: "constructor" }, options)).toBe("DIRECT");
+    expect(resolveProxyGroupTargetName({ kind: "module", id: "hasOwnProperty" }, options)).toBe("DIRECT");
     expect(resolveProxyGroupTargetName({ kind: "node" } as never, options)).toBe("DIRECT");
     expect(ruleTargetMatchesName(" Proxy ", "Proxy")).toBe(true);
     expect(ruleTargetMatchesName({ kind: "module", id: "auto" }, "Auto")).toBe(false);
diff --git a/packages/core/src/proxy-group-targets.ts b/packages/core/src/proxy-group-targets.ts
index 3ca3f6d..862f88c 100644
--- a/packages/core/src/proxy-group-targets.ts
+++ b/packages/core/src/proxy-group-targets.ts
@@ -55,7 +55,10 @@ export function resolveProxyGroupTargetName(
   if (!normalized) return options.fallbackTarget || "";
 
   if (normalized.kind === "module") {
-    return options.moduleNames[normalized.id]?.trim() || options.fallbackTarget || "";
+    const moduleName = Object.prototype.hasOwnProperty.call(options.moduleNames, normalized.id)
+      ? options.moduleNames[normalized.id]
+      : undefined;
+    return (typeof moduleName === "string" ? moduleName.trim() : "") || options.fallbackTarget || "";
   }
 
   const customName = (options.customProxyGroups || []).find((group) => group.id === normalized.id)?.name?.trim();
diff --git a/packages/core/src/rules-database.test.ts b/packages/core/src/rules-database.test.ts
index 35863be..976a3e7 100644
--- a/packages/core/src/rules-database.test.ts
+++ b/packages/core/src/rules-database.test.ts
@@ -5,12 +5,6 @@ import {
   GEOSITE_RULES,
   RULE_CATEGORIES,
   TOTAL_RULES_COUNT,
-  createCustomRule,
-  generateRuleUrl,
-  getRuleById,
-  getRulesByCategory,
-  isValidRuleUrl,
-  searchRules,
 } from "./rules-database";
 
 describe("rules database index", () => {
@@ -28,75 +22,4 @@ describe("rules database index", () => {
       format: "mrs",
     });
   });
-
-  it("searches by id, English name, Chinese display name, and ignores empty input", () => {
-    expect(searchRules(" openai ")).toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({
-          id: "openai",
-          category: "ai",
-        }),
-      ])
-    );
-    expect(searchRules("TELEGRAM")).toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({
-          id: "telegram",
-          category: "social",
-        }),
-      ])
-    );
-    expect(searchRules("电报")).toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({
-          id: "telegram",
-        }),
-      ])
-    );
-    expect(searchRules("   ")).toEqual([]);
-  });
-
-  it("finds rules by category and exact id", () => {
-    const aiRules = getRulesByCategory("ai");
-
-    expect(aiRules.length).toBeGreaterThan(0);
-    expect(aiRules.every((rule) => rule.category === "ai")).toBe(true);
-    expect(getRuleById("netflix")).toMatchObject({
-      nameZh: "奈飞",
-      category: "media",
-    });
-    expect(getRuleById("missing-rule")).toBeUndefined();
-  });
-
-  it("generates and validates rule URLs for built-in and custom sources", () => {
-    expect(generateRuleUrl("openai")).toMatch(/\/geosite\/openai\.mrs$/);
-    expect(generateRuleUrl("telegram", "geoip")).toMatch(/\/geoip\/telegram\.mrs$/);
-
-    expect(
-      createCustomRule("custom-domain", "custom-domain", "自定义域名", "domain")
-    ).toMatchObject({
-      id: "custom-domain",
-      category: "other",
-      behavior: "domain",
-      url: expect.stringMatching(/\/geosite\/custom-domain\.mrs$/),
-    });
-    expect(
-      createCustomRule(
-        "custom-ip",
-        "custom-ip",
-        "自定义 IP",
-        "ipcidr",
-        "https://raw.githubusercontent.com/example/rules/custom-ip.mrs"
-      )
-    ).toMatchObject({
-      id: "custom-ip",
-      behavior: "ipcidr",
-      url: "https://raw.githubusercontent.com/example/rules/custom-ip.mrs",
-    });
-
-    expect(isValidRuleUrl(generateRuleUrl("openai"))).toBe(true);
-    expect(isValidRuleUrl("https://raw.githubusercontent.com/example/rules/list.mrs")).toBe(true);
-    expect(isValidRuleUrl("https://cdn.jsdelivr.net/gh/example/rules/list.mrs")).toBe(true);
-    expect(isValidRuleUrl("https://example.com/list.mrs")).toBe(false);
-  });
 });
diff --git a/packages/core/src/rules-database.ts b/packages/core/src/rules-database.ts
index 0d89898..7dc0ee7 100644
--- a/packages/core/src/rules-database.ts
+++ b/packages/core/src/rules-database.ts
@@ -397,72 +397,5 @@ export const GEOIP_RULES: RuleSetInfo[] = GEOIP_RULES_RAW;
 // 合并所有规则
 export const ALL_RULES: RuleSetInfo[] = [...GEOSITE_RULES, ...GEOIP_RULES];
 
-/**
- * 搜索规则集（支持中英文）
- */
-export function searchRules(keyword: string): RuleSetInfo[] {
-  const lowerKeyword = keyword.toLowerCase().trim();
-  if (!lowerKeyword) return [];
-  
-  return ALL_RULES.filter(
-    (rule) =>
-      rule.id.toLowerCase().includes(lowerKeyword) ||
-      rule.name.toLowerCase().includes(lowerKeyword) ||
-      rule.nameZh.toLowerCase().includes(keyword.toLowerCase())
-  );
-}
-
-/**
- * 按分类获取规则
- */
-export function getRulesByCategory(category: RuleSetInfo["category"]): RuleSetInfo[] {
-  return ALL_RULES.filter((rule) => rule.category === category);
-}
-
-/**
- * 获取规则详情
- */
-export function getRuleById(id: string): RuleSetInfo | undefined {
-  return ALL_RULES.find((rule) => rule.id === id);
-}
-
-/**
- * 根据规则名称生成 URL（用于用户输入自定义规则名）
- */
-export function generateRuleUrl(ruleName: string, type: "geosite" | "geoip" = "geosite"): string {
-  return `${BASE_URL}/${type}/${ruleName}.mrs`;
-}
-
-/**
- * 创建自定义规则
- */
-export function createCustomRule(
-  id: string,
-  name: string,
-  nameZh: string,
-  behavior: "domain" | "ipcidr",
-  url?: string
-): RuleSetInfo {
-  const type = behavior === "ipcidr" ? "geoip" : "geosite";
-  return {
-    id,
-    name,
-    nameZh,
-    category: "other",
-    behavior,
-    format: "mrs",
-    url: url || generateRuleUrl(name, type),
-  };
-}
-
-/**
- * 验证规则 URL 是否有效
- */
-export function isValidRuleUrl(url: string): boolean {
-  return url.startsWith(BASE_URL) || 
-         url.startsWith("https://raw.githubusercontent.com/") ||
-         url.startsWith("https://cdn.jsdelivr.net/");
-}
-
 // 导出规则总数
 export const TOTAL_RULES_COUNT = ALL_RULES.length;
diff --git a/packages/core/src/rules/custom-rule-helpers.test.ts b/packages/core/src/rules/custom-rule-helpers.test.ts
index 76a626a..c4fbce6 100644
--- a/packages/core/src/rules/custom-rule-helpers.test.ts
+++ b/packages/core/src/rules/custom-rule-helpers.test.ts
@@ -15,7 +15,6 @@ import {
   getCustomRuleOrderKey,
   isCustomRuleType,
   listEditableRuleOrderKeys,
-  reconcileRuleOrder,
 } from "./custom-rule-utils";
 import type { CustomProxyGroup, CustomRule, CustomRuleSet } from "@subboost/core/types/config";
 
@@ -29,7 +28,7 @@ describe("custom routing rule set helpers", () => {
     expect(parseRuleSetTargetValue("other:select")).toBeNull();
 
     expect(extractRuleSetPathFromUrl("https://cdn.example/rules/geosite/openai.mrs?token=1")).toBe(
-      "geosite/openai.mrs"
+      "https://cdn.example/rules/geosite/openai.mrs?token=1"
     );
     expect(extractRuleSetPathFromUrl("plain/rule.txt")).toBe("plain/rule.txt");
     expect(normalizeRuleSetPathInput(" /geoip/cn.mrs ")).toBe("geoip/cn.mrs");
@@ -98,7 +97,7 @@ describe("custom routing rule set helpers", () => {
           source: { kind: "custom-rule-set", id: "custom-rule" },
           id: "custom-rule",
           name: "custom-rule",
-          path: "geosite/custom.mrs",
+          path: "https://cdn.example/geosite/custom.mrs",
           target: expect.objectContaining({ id: "custom-a", value: "custom:custom-a" }),
           noResolve: true,
         }),
@@ -153,15 +152,6 @@ describe("custom rule id and order helpers", () => {
       `custom-rule:${ruleWithoutId.id}`,
       "custom-rule-set:rule-a",
     ]);
-    expect(reconcileRuleOrder(undefined, [], [])).toEqual([]);
-    expect(
-      reconcileRuleOrder(
-        [" missing ", "custom-rule-set:rule-a", "custom-rule-set:rule-a"],
-        customRules,
-        customRuleSets
-      )
-    ).toEqual(["custom-rule-set:rule-a", `custom-rule:${ruleWithoutId.id}`]);
-    expect(reconcileRuleOrder("bad" as never, customRules, [])).toEqual([`custom-rule:${ruleWithoutId.id}`]);
   });
 });
 
diff --git a/packages/core/src/rules/custom-rule-utils.ts b/packages/core/src/rules/custom-rule-utils.ts
index ad17ddd..0dc3527 100644
--- a/packages/core/src/rules/custom-rule-utils.ts
+++ b/packages/core/src/rules/custom-rule-utils.ts
@@ -93,33 +93,3 @@ export function listEditableRuleOrderKeys(customRules: CustomRule[], customRuleS
   }
   return keys;
 }
-
-export function reconcileRuleOrder(
-  ruleOrder: string[] | undefined,
-  customRules: CustomRule[],
-  customRuleSets: CustomRuleSet[] = []
-): string[] {
-  const available = listEditableRuleOrderKeys(customRules, customRuleSets);
-  if (available.length === 0) return [];
-
-  const availableSet = new Set(available);
-  const next: string[] = [];
-  const seen = new Set<string>();
-
-  if (Array.isArray(ruleOrder)) {
-    for (const rawKey of ruleOrder) {
-      const key = toTrimmedString(rawKey);
-      if (!key || seen.has(key) || !availableSet.has(key)) continue;
-      seen.add(key);
-      next.push(key);
-    }
-  }
-
-  for (const key of available) {
-    if (seen.has(key)) continue;
-    seen.add(key);
-    next.push(key);
-  }
-
-  return next;
-}
diff --git a/packages/core/src/rules/rule-model.test.ts b/packages/core/src/rules/rule-model.test.ts
index c625390..327370b 100644
--- a/packages/core/src/rules/rule-model.test.ts
+++ b/packages/core/src/rules/rule-model.test.ts
@@ -10,13 +10,16 @@ import {
 
 describe("rule model normalization", () => {
   it("normalizes rule set paths, URLs, and builtin edits", () => {
-    expect(extractRuleSetPathFromUrl(" https://example.com/meta/geosite/google.mrs?download=1 ")).toBe("geosite/google.mrs");
+    expect(extractRuleSetPathFromUrl(" https://example.com/meta/geosite/google.mrs?download=1 ")).toBe(
+      "https://example.com/meta/geosite/google.mrs?download=1"
+    );
     expect(extractRuleSetPathFromUrl("custom/list.txt")).toBe("custom/list.txt");
     expect(normalizeRuleSetPathInput("////geoip/private.mrs")).toBe("geoip/private.mrs");
     expect(isValidRuleSetPathOrUrl("geosite/google.mrs")).toBe(true);
     expect(isValidRuleSetPathOrUrl("https://example.com/rules/list.txt")).toBe(true);
     expect(isValidRuleSetPathOrUrl("plain.txt")).toBe(false);
     expect(buildRuleSetUrlFromPath("https://cdn.example.com/custom.mrs", "https://base.example.com/")).toBe("https://cdn.example.com/custom.mrs");
+    expect(normalizeRuleSetPathInput("geosite/google.mrs.bak")).toBe("geosite/google.mrs.bak");
     expect(buildRuleSetUrlFromPath("/geosite/google.mrs", "https://base.example.com////")).toBe("https://base.example.com/geosite/google.mrs");
     expect(normalizeBuiltinRuleEdits(null)).toEqual({});
     expect(
diff --git a/packages/core/src/rules/rule-model.ts b/packages/core/src/rules/rule-model.ts
index 399c74a..91a65a3 100644
--- a/packages/core/src/rules/rule-model.ts
+++ b/packages/core/src/rules/rule-model.ts
@@ -33,7 +33,8 @@ function trimTrailingSlashes(value: string): string {
 
 export function extractRuleSetPathFromUrl(url: string): string {
   const trimmed = url.trim();
-  const match = trimmed.match(/(?:^|\/)(geosite|geoip)\/[^/?#\s]+\.mrs/i);
+  if (/^https?:\/\//i.test(trimmed)) return trimmed;
+  const match = trimmed.match(/^(?:\/+)?(geosite|geoip)\/[^/?#\s]+\.mrs$/i);
   if (!match) return trimmed;
   return trimLeadingSlashes(match[0]);
 }
diff --git a/packages/core/src/rules/rules-utils.test.ts b/packages/core/src/rules/rules-utils.test.ts
index 895b4ed..01efd23 100644
--- a/packages/core/src/rules/rules-utils.test.ts
+++ b/packages/core/src/rules/rules-utils.test.ts
@@ -14,7 +14,6 @@ import {
   getCustomRuleOrderKey,
   isCustomRuleType,
   listEditableRuleOrderKeys,
-  reconcileRuleOrder,
 } from "./custom-rule-utils";
 
 describe("custom rule helpers", () => {
@@ -53,24 +52,6 @@ describe("custom rule helpers", () => {
       "custom-rule:custom-rule-domain-suffix-example-com-direct-3",
       "custom-rule-set:nested",
     ]);
-    expect(
-      reconcileRuleOrder(
-        ["missing", "custom-rule-set:nested", "custom-rule-set:nested"],
-        [rule],
-        [
-          {
-            id: "nested",
-            name: "Nested",
-            behavior: "domain",
-            path: "https://rules.example.com/a.mrs",
-            target: "Group",
-          },
-        ]
-      )
-    ).toEqual([
-      "custom-rule-set:nested",
-      "custom-rule:custom-rule-domain-suffix-example-com-direct-3",
-    ]);
   });
 
   it("previews batch custom rule imports with ready, skipped, error, and duplicate rows", () => {
diff --git a/packages/core/src/subscription/config-utils.ts b/packages/core/src/subscription/config-utils.ts
index 09d4517..9e64c25 100644
--- a/packages/core/src/subscription/config-utils.ts
+++ b/packages/core/src/subscription/config-utils.ts
@@ -19,6 +19,7 @@ import { DEFAULT_SUBBOOST_CONFIG } from "@subboost/core/config/defaults";
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
 import { normalizeProxyGroupTargetRef } from "@subboost/core/proxy-group-targets";
+import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -235,7 +236,7 @@ export function buildGenerateOptionsFromConfig(
     proxyProviders?: Record<string, unknown>;
   }
 ): GenerateOptions {
-  const config = rawConfig;
+  const config = migrateLegacyConfig(rawConfig);
   const { testUrl, testInterval } = getEffectiveTestOptions(config);
   const proxyProviders =
     opts.proxyProviders ?? buildProxyProvidersFromConfig(config, { testUrl, testInterval });
diff --git a/packages/core/src/subscription/import-error.test.ts b/packages/core/src/subscription/import-error.test.ts
index afab71d..e45928d 100644
--- a/packages/core/src/subscription/import-error.test.ts
+++ b/packages/core/src/subscription/import-error.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
   SubscriptionImportError,
   createSubscriptionImportErrorInfo,
+  extractHttpStatus,
   getSubscriptionImportErrorBadgeText,
   getSubscriptionImportErrorCategoryLabel,
   inferSubscriptionImportErrorCategory,
@@ -11,6 +12,16 @@ import {
   sanitizePublicErrorText,
 } from "./import-error";
 
+describe("extractHttpStatus", () => {
+  it("only extracts explicit HTTP error status context", () => {
+    expect(extractHttpStatus("upstream HTTP 503 then 404")).toBe(503);
+    expect(extractHttpStatus("request failed with status code 429")).toBe(429);
+    expect(extractHttpStatus("upstream returned 502")).toBe(502);
+    expect(extractHttpStatus("成功解析 502 个节点")).toBeNull();
+    expect(extractHttpStatus("HTTP 200")).toBeNull();
+  });
+});
+
 describe("sanitizePublicErrorText", () => {
   it("does not mistake protocol URIs for Windows file paths", () => {
     const protocols = [
diff --git a/packages/core/src/subscription/import-error.ts b/packages/core/src/subscription/import-error.ts
index 2bf513f..44e6dfa 100644
--- a/packages/core/src/subscription/import-error.ts
+++ b/packages/core/src/subscription/import-error.ts
@@ -71,13 +71,13 @@ const NETWORK_CODE_BADGE: Record<string, string> = {
   EAI_AGAIN: "DNS",
 };
 
-function extractHttpStatusFromText(text: string): number | null {
-  const match = text.match(/\b(4\d{2}|5\d{2})\b/);
-  if (match) {
-    const code = parseInt(match[1], 10);
-    if (code >= 400 && code < 600) return code;
-  }
-  return null;
+export function extractHttpStatus(text: string): number | null {
+  const match = text.match(
+    /\b(?:HTTP(?:\/\d(?:\.\d)?)?|status(?:\s+code)?|returned|responded(?:\s+with)?)\s*[:=]?\s*(\d{3})\b/i
+  );
+  if (!match) return null;
+  const code = Number.parseInt(match[1], 10);
+  return code >= 400 && code < 600 ? code : null;
 }
 
 function extractNetworkCodeFromText(text: string): string | null {
@@ -166,7 +166,7 @@ export function getSubscriptionImportErrorBadgeText(
   if (info.httpStatus && HTTP_STATUS_BADGE[info.httpStatus]) {
     return HTTP_STATUS_BADGE[info.httpStatus];
   }
-  const httpFromText = extractHttpStatusFromText(info.message) ?? extractHttpStatusFromText(info.detail || "");
+  const httpFromText = extractHttpStatus(info.message) ?? extractHttpStatus(info.detail || "");
   if (httpFromText && HTTP_STATUS_BADGE[httpFromText]) {
     return HTTP_STATUS_BADGE[httpFromText];
   }
diff --git a/packages/core/src/subscription/subscription-userinfo.test.ts b/packages/core/src/subscription/subscription-userinfo.test.ts
index 6c881cc..23b66a8 100644
--- a/packages/core/src/subscription/subscription-userinfo.test.ts
+++ b/packages/core/src/subscription/subscription-userinfo.test.ts
@@ -36,6 +36,12 @@ describe("subscription user info helpers", () => {
     });
   });
 
+  it("normalizes millisecond expiry values and rejects implausible magnitudes", () => {
+    expect(parseSubscriptionUserInfo("expire=1760000000000").expire).toBe(1760000000);
+    expect(parseSubscriptionUserInfo("expire=9999999999999999").expire).toBeUndefined();
+    expect(normalizeSubscriptionUserInfo({ expire: 1760000000000 }).expire).toBe(1760000000);
+  });
+
   it("normalizes plausibility and merges traffic snapshots", () => {
     expect(hasSubscriptionUserInfo(null)).toBe(false);
     expect(hasSubscriptionUserInfo(undefined)).toBe(false);
diff --git a/packages/core/src/subscription/subscription-userinfo.ts b/packages/core/src/subscription/subscription-userinfo.ts
index d668e27..35f9376 100644
--- a/packages/core/src/subscription/subscription-userinfo.ts
+++ b/packages/core/src/subscription/subscription-userinfo.ts
@@ -17,7 +17,8 @@ export function parseSubscriptionUserInfo(header: string): SubscriptionUserInfo
     if (key && value) {
       const numeric = parseHeaderNumericValue(value);
       if (numeric !== undefined) {
-        info[key] = numeric;
+        const normalizedNumeric = key === "expire" ? normalizeExpireTimestampSeconds(numeric) : numeric;
+        if (normalizedNumeric !== undefined) info[key] = normalizedNumeric;
         continue;
       }
 
@@ -72,9 +73,23 @@ function isFiniteNonNegativeNumber(value: unknown): value is number {
   return typeof value === "number" && Number.isFinite(value) && value >= 0;
 }
 
+const MIN_EXPIRE_TIMESTAMP_SECONDS = 946684800; // 2000-01-01
+const MAX_EXPIRE_TIMESTAMP_SECONDS = 253402300799; // 9999-12-31T23:59:59Z
+const MIN_EXPIRE_TIMESTAMP_MILLISECONDS = MIN_EXPIRE_TIMESTAMP_SECONDS * 1000;
+const MAX_EXPIRE_TIMESTAMP_MILLISECONDS = MAX_EXPIRE_TIMESTAMP_SECONDS * 1000;
+
+function normalizeExpireTimestampSeconds(value: unknown): number | undefined {
+  if (!isFiniteNonNegativeNumber(value)) return undefined;
+  const integer = Math.floor(value);
+  if (integer > MIN_EXPIRE_TIMESTAMP_SECONDS && integer <= MAX_EXPIRE_TIMESTAMP_SECONDS) return integer;
+  if (integer > MIN_EXPIRE_TIMESTAMP_MILLISECONDS && integer <= MAX_EXPIRE_TIMESTAMP_MILLISECONDS) {
+    return Math.floor(integer / 1000);
+  }
+  return undefined;
+}
+
 function isValidExpireTimestampSeconds(value: unknown): value is number {
-  // expire 通常为秒级 Unix 时间戳；过滤掉 0/1970 等无意义值
-  return isFiniteNonNegativeNumber(value) && value > 946684800; // 2000-01-01
+  return typeof value === "number" && normalizeExpireTimestampSeconds(value) === value;
 }
 
 function hasMeaningfulTrafficSnapshot(info: SubscriptionUserInfo): boolean {
@@ -257,7 +272,8 @@ export function normalizeSubscriptionUserInfo(info: SubscriptionUserInfo | null
   if (isFiniteNonNegativeNumber(info.upload)) out.upload = info.upload;
   if (isFiniteNonNegativeNumber(info.download)) out.download = info.download;
   if (isFiniteNonNegativeNumber(info.total)) out.total = info.total;
-  if (isValidExpireTimestampSeconds(info.expire)) out.expire = info.expire;
+  const expire = normalizeExpireTimestampSeconds(info.expire);
+  if (expire !== undefined) out.expire = expire;
   return out;
 }
 
diff --git a/packages/core/src/templates/config-template.fields.test.ts b/packages/core/src/templates/config-template.fields.test.ts
index a81947b..a7d8618 100644
--- a/packages/core/src/templates/config-template.fields.test.ts
+++ b/packages/core/src/templates/config-template.fields.test.ts
@@ -254,7 +254,7 @@ describe("validateSubBoostTemplateConfig field validation", () => {
           "module:cn:geolocation-cn": { target: 1 },
         } as never,
       },
-      "builtinRuleEdits.target 必须是字符串"
+      "builtinRuleEdits.target 必须是字符串或有效代理组引用"
     );
     expectInvalid(
       {
diff --git a/packages/core/src/templates/config-template.groups.test.ts b/packages/core/src/templates/config-template.groups.test.ts
index b581430..8292a7e 100644
--- a/packages/core/src/templates/config-template.groups.test.ts
+++ b/packages/core/src/templates/config-template.groups.test.ts
@@ -188,8 +188,8 @@ describe("validateSubBoostTemplateConfig custom groups", () => {
       "customProxyGroups.includeInGroupMembers 必须是布尔值"
     );
 
-    expectInvalid(
-      {
+    const migratedLegacyGroup = validateSubBoostTemplateConfig(
+      validConfig({
         customProxyGroups: [
           {
             id: "legacy",
@@ -199,9 +199,12 @@ describe("validateSubBoostTemplateConfig custom groups", () => {
             rules: [],
           } as never,
         ],
-      },
-      "模板配置包含已移除字段: customProxyGroups[0].rules"
+      })
     );
+    expect(migratedLegacyGroup.ok).toBe(true);
+    if (migratedLegacyGroup.ok) {
+      expect(migratedLegacyGroup.config.customProxyGroups[0]).not.toHaveProperty("rules");
+    }
 
     const validCustomGroup = validateSubBoostTemplateConfig(
       validConfig({
@@ -253,6 +256,12 @@ describe("validateSubBoostTemplateConfig custom groups", () => {
     }
 
     const removedField = `filtered${"ProxyGroups"}`;
-    expectInvalid({ [removedField]: [] } as never, `模板配置包含已移除字段: ${removedField}`);
+    const migratedEmptyFilteredGroups = validateSubBoostTemplateConfig(
+      validConfig({ [removedField]: [] } as never)
+    );
+    expect(migratedEmptyFilteredGroups.ok).toBe(true);
+    if (migratedEmptyFilteredGroups.ok) {
+      expect(migratedEmptyFilteredGroups.config).not.toHaveProperty(removedField);
+    }
   });
 });
diff --git a/packages/core/src/templates/config-template.test.ts b/packages/core/src/templates/config-template.test.ts
index 14bfc77..8231e27 100644
--- a/packages/core/src/templates/config-template.test.ts
+++ b/packages/core/src/templates/config-template.test.ts
@@ -59,6 +59,7 @@ describe("validateSubBoostTemplateConfig", () => {
             id: "custom",
             name: "Custom",
             emoji: "",
+            enabled: false,
             memberSource: "filtered-nodes",
             includeInGroupMembers: false,
             groupType: "load-balance",
@@ -70,7 +71,7 @@ describe("validateSubBoostTemplateConfig", () => {
             name: "Custom Rule",
             behavior: "domain",
             path: "https://rules.example.com/custom.mrs",
-            target: "Custom",
+            target: { kind: "custom", id: "custom" },
             noResolve: false,
           },
           {
@@ -87,7 +88,7 @@ describe("validateSubBoostTemplateConfig", () => {
             id: "custom-rule-a",
             type: "DOMAIN-SUFFIX",
             value: " example.com ",
-            target: "DIRECT",
+            target: { kind: "module", id: "select" },
             noResolve: true,
           },
         ],
@@ -102,7 +103,7 @@ describe("validateSubBoostTemplateConfig", () => {
           },
         ],
         builtinRuleEdits: {
-          [`module:${moduleId}:openai`]: { enabled: false },
+          [`module:${moduleId}:openai`]: { enabled: false, target: { kind: "custom", id: "custom" } },
         },
         proxyGroupNameOverrides: {
           [moduleId]: " Renamed ",
@@ -120,6 +121,7 @@ describe("validateSubBoostTemplateConfig", () => {
       emoji: "",
       memberSource: "filtered-nodes",
       includeInGroupMembers: false,
+      enabled: false,
       groupType: "load-balance",
       strategy: DEFAULT_LOAD_BALANCE_STRATEGY,
     });
@@ -130,7 +132,7 @@ describe("validateSubBoostTemplateConfig", () => {
           name: "Custom Rule",
           behavior: "domain",
           path: "https://rules.example.com/custom.mrs",
-          target: "Custom",
+          target: { kind: "custom", id: "custom" },
         }),
         expect.objectContaining({
           id: "extra",
@@ -145,6 +147,7 @@ describe("validateSubBoostTemplateConfig", () => {
       id: "custom-rule-a",
       value: "example.com",
       noResolve: true,
+      target: { kind: "module", id: "select" },
     });
     expect(result.config.dialerProxyGroups[0]).toMatchObject({
       id: "relay",
@@ -153,7 +156,10 @@ describe("validateSubBoostTemplateConfig", () => {
       targetNodes: ["Target A"],
       enabled: false,
     });
-    expect(result.config.builtinRuleEdits?.[`module:${moduleId}:openai`]).toEqual({ enabled: false });
+    expect(result.config.builtinRuleEdits?.[`module:${moduleId}:openai`]).toEqual({
+      enabled: false,
+      target: { kind: "custom", id: "custom" },
+    });
     expect(result.config.proxyGroupNameOverrides).toEqual({ [moduleId]: "Renamed" });
     expect(result.config).not.toHaveProperty("moduleRuleOverrides");
     expect(result.config).not.toHaveProperty("moduleRuleExclusions");
@@ -190,19 +196,40 @@ describe("validateSubBoostTemplateConfig", () => {
     expect(result.config).not.toHaveProperty("experimentalCnUseCnRuleSet");
   });
 
-  it("rejects removed rule-model compatibility fields", () => {
-    expectInvalid({ moduleRuleOverrides: {} } as never, "模板配置包含已移除字段: moduleRuleOverrides");
-    expectInvalid({ moduleRuleExclusions: {} } as never, "模板配置包含已移除字段: moduleRuleExclusions");
-    expectInvalid({ allRulesOrderEditingEnabled: true } as never, "模板配置包含已移除字段: allRulesOrderEditingEnabled");
-    const removedFilteredGroupsField = `filtered${"ProxyGroups"}`;
-    expectInvalid(
-      { [removedFilteredGroupsField]: [] } as never,
-      `模板配置包含已移除字段: ${removedFilteredGroupsField}`
-    );
-    expectInvalid(
-      { customProxyGroups: [{ id: "custom", name: "Custom", emoji: "", groupType: "select", rules: [] }] } as never,
-      "模板配置包含已移除字段: customProxyGroups[0].rules"
+  it("migrates removed rule-model compatibility fields at the template boundary", () => {
+    const result = validateSubBoostTemplateConfig(
+      validConfig({
+        moduleRuleExclusions: { ai: ["openai"] },
+        allRulesOrderEditingEnabled: true,
+        customProxyGroups: [
+          {
+            id: "custom",
+            name: "Custom",
+            emoji: "",
+            groupType: "select",
+            rules: [
+              {
+                id: "legacy-provider",
+                name: "Legacy Provider",
+                path: "geosite/legacy.mrs",
+                behavior: "domain",
+              },
+            ],
+          },
+        ],
+      } as never)
     );
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.config.builtinRuleEdits?.["module:ai:openai"]).toEqual({ enabled: false });
+    expect(result.config.customRuleSets).toEqual([
+      expect.objectContaining({
+        id: "legacy-provider",
+        target: { kind: "custom", id: "custom" },
+      }),
+    ]);
+    expect(result.config.customProxyGroups[0]).not.toHaveProperty("rules");
   });
 
   it("rejects template configs that hide every enabled module", () => {
diff --git a/packages/core/src/templates/config-template.ts b/packages/core/src/templates/config-template.ts
index 0af2254..471597a 100644
--- a/packages/core/src/templates/config-template.ts
+++ b/packages/core/src/templates/config-template.ts
@@ -3,6 +3,8 @@ import { normalizePersistedRuleOrder } from "@subboost/core/generator/rules";
 import { ensureCustomRuleId, isCustomRuleType } from "@subboost/core/rules/custom-rule-utils";
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
+import { normalizeProxyGroupTargetRef } from "@subboost/core/proxy-group-targets";
+import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 import {
   isValidRuleSetPathOrUrl,
   normalizeRuleModelFromConfig,
@@ -15,6 +17,7 @@ import {
   type CustomProxyGroup,
   type CustomRule,
   type LoadBalanceStrategy,
+  type ProxyGroupRuleTarget,
   type ProxyGroupGroupType,
   type TemplateType,
 } from "@subboost/core/types/config";
@@ -30,20 +33,13 @@ const BUILTIN_MODULE_IDS = new Set(PROXY_GROUP_MODULES.map((module) => module.id
 const BUILTIN_RULE_KEYS = new Set(
   PROXY_GROUP_MODULES.flatMap((module) => module.rules.map((rule) => `module:${module.id}:${rule.id}`))
 );
-const REMOVED_TEMPLATE_FIELDS = new Set([
-  "moduleRuleOverrides",
-  "moduleRuleExclusions",
-  "allRulesOrderEditingEnabled",
-  "filteredProxyGroups",
-]);
-
-export function validateSubBoostTemplateConfig(value: unknown): ValidationResult {
-  if (!isRecord(value)) return invalid("模板配置必须是对象");
+export function validateSubBoostTemplateConfig(rawValue: unknown): ValidationResult {
+  const migratedValue = migrateLegacyConfig(rawValue);
+  if (!isRecord(migratedValue)) return invalid("模板配置必须是对象");
+  const value = migratedValue;
   if (value.schema !== SUBBOOST_TEMPLATE_CONFIG_SCHEMA) {
     return invalid("模板配置 schema 无效");
   }
-  const removedField = findRemovedTemplateField(value);
-  if (removedField) return invalid(`模板配置包含已移除字段: ${removedField}`);
 
   const template = parseTemplateType(value.template);
   if (!template) return invalid("模板类型无效");
@@ -155,20 +151,6 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
-function findRemovedTemplateField(value: Record<string, unknown>): string | null {
-  for (const field of REMOVED_TEMPLATE_FIELDS) {
-    if (field in value) return field;
-  }
-
-  if (!Array.isArray(value.customProxyGroups)) return null;
-  for (let index = 0; index < value.customProxyGroups.length; index += 1) {
-    const group = value.customProxyGroups[index];
-    if (isRecord(group) && "rules" in group) return `customProxyGroups[${index}].rules`;
-  }
-
-  return null;
-}
-
 function parseTemplateType(value: unknown): TemplateType | null {
   if (value === "minimal" || value === "standard" || value === "full") return value;
   return null;
@@ -185,6 +167,16 @@ function parseRequiredString(
   return { ok: true, value: opts.allowEmpty ? value : trimmed };
 }
 
+function parseRuleTarget(
+  value: unknown,
+  field: string
+): { ok: true; value: ProxyGroupRuleTarget } | { ok: false; error: string } {
+  const ref = normalizeProxyGroupTargetRef(value);
+  if (ref) return { ok: true, value: ref };
+  if (typeof value === "string") return parseRequiredString(value, field);
+  return invalid(`${field} 必须是字符串或有效代理组引用`);
+}
+
 function parseBoolean(value: unknown, field: string): { ok: true; value: boolean } | { ok: false; error: string } {
   if (typeof value !== "boolean") return invalid(`${field} 必须是布尔值`);
   return { ok: true, value };
@@ -289,7 +281,7 @@ function parseCustomRules(value: unknown): { ok: true; value: CustomRule[] } | {
     if (typeof item.type !== "string" || !isCustomRuleType(item.type)) return invalid("customRules 包含无效类型");
     const ruleValue = parseRequiredString(item.value, "customRules.value");
     if (!ruleValue.ok) return ruleValue;
-    const target = parseRequiredString(item.target, "customRules.target");
+    const target = parseRuleTarget(item.target, "customRules.target");
     if (!target.ok) return target;
     const noResolve = parseOptionalBoolean(item.noResolve, "customRules.noResolve");
     if (!noResolve.ok) return noResolve;
@@ -324,6 +316,8 @@ function parseCustomProxyGroups(value: unknown): { ok: true; value: CustomProxyG
     if (!groupType.ok) return groupType;
     const strategy = parseOptionalLoadBalanceStrategy(item.strategy, "customProxyGroups.strategy");
     if (!strategy.ok) return strategy;
+    const enabled = parseOptionalBoolean(item.enabled, "customProxyGroups.enabled");
+    if (!enabled.ok) return enabled;
     if (item.memberSource !== undefined && item.memberSource !== "filtered-nodes") {
       return invalid("customProxyGroups.memberSource 无效");
     }
@@ -335,6 +329,7 @@ function parseCustomProxyGroups(value: unknown): { ok: true; value: CustomProxyG
       id: id.value,
       name: name.value,
       emoji: emoji.value,
+      ...(enabled.value !== undefined ? { enabled: enabled.value } : {}),
       ...(description ? { description } : {}),
       ...(item.memberSource === "filtered-nodes" ? { memberSource: "filtered-nodes" as const } : {}),
       ...(typeof item.includeInGroupMembers === "boolean"
@@ -378,7 +373,7 @@ function parseCustomRuleSets(value: unknown): { ok: true; value: true } | { ok:
     if (!path.ok) return path;
     const normalizedPath = normalizeRuleSetPathInput(path.value);
     if (!isValidRuleSetPathOrUrl(normalizedPath)) return invalid("customRuleSets.path 无效");
-    const target = parseRequiredString(item.target, "customRuleSets.target");
+    const target = parseRuleTarget(item.target, "customRuleSets.target");
     if (!target.ok) return target;
     const noResolve = parseOptionalBoolean(item.noResolve, "customRuleSets.noResolve");
     if (!noResolve.ok) return noResolve;
@@ -393,8 +388,9 @@ function parseBuiltinRuleEdits(value: unknown): { ok: true; value: true } | { ok
     const key = rawKey.trim();
     if (!BUILTIN_RULE_KEYS.has(key)) return invalid("builtinRuleEdits 包含未知内置规则");
     if (!isRecord(rawEdit)) return invalid("builtinRuleEdits 的值必须是对象");
-    if ("target" in rawEdit && typeof rawEdit.target !== "string") {
-      return invalid("builtinRuleEdits.target 必须是字符串");
+    if ("target" in rawEdit) {
+      const target = parseRuleTarget(rawEdit.target, "builtinRuleEdits.target");
+      if (!target.ok) return target;
     }
     if ("enabled" in rawEdit && rawEdit.enabled !== false) {
       return invalid("builtinRuleEdits.enabled 只能是 false");
diff --git a/packages/server-core/src/cron-auth.test.ts b/packages/server-core/src/cron-auth.test.ts
index ef22541..6ede0c2 100644
--- a/packages/server-core/src/cron-auth.test.ts
+++ b/packages/server-core/src/cron-auth.test.ts
@@ -19,6 +19,10 @@ describe("server-core cron auth helpers", () => {
       ok: false,
       reason: "unauthorized",
     });
+    expect(validateCronSecret({ cronSecret: "a-much-longer-secret", authorization: "Bearer short" })).toEqual({
+      ok: false,
+      reason: "unauthorized",
+    });
     expect(validateCronSecret({ cronSecret: "secret", authorization: "bearer secret  " })).toEqual({
       ok: true,
     });
diff --git a/packages/server-core/src/cron-auth.ts b/packages/server-core/src/cron-auth.ts
index 86a0478..19ed5a8 100644
--- a/packages/server-core/src/cron-auth.ts
+++ b/packages/server-core/src/cron-auth.ts
@@ -1,3 +1,5 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+
 export type CronSecretValidationResult =
   | { ok: true }
   | { ok: false; reason: "missing-secret" | "unauthorized" };
@@ -13,7 +15,9 @@ export function validateCronSecret(params: {
   authorization: string | null | undefined;
 }): CronSecretValidationResult {
   if (!params.cronSecret) return { ok: false, reason: "missing-secret" };
-  if (extractBearerToken(params.authorization) !== params.cronSecret) {
+  const suppliedDigest = createHash("sha256").update(extractBearerToken(params.authorization)).digest();
+  const expectedDigest = createHash("sha256").update(params.cronSecret).digest();
+  if (!timingSafeEqual(suppliedDigest, expectedDigest)) {
     return { ok: false, reason: "unauthorized" };
   }
   return { ok: true };
diff --git a/packages/server-core/src/crypto/encrypted-field.test.ts b/packages/server-core/src/crypto/encrypted-field.test.ts
index 2ba4176..d0000ad 100644
--- a/packages/server-core/src/crypto/encrypted-field.test.ts
+++ b/packages/server-core/src/crypto/encrypted-field.test.ts
@@ -24,4 +24,32 @@ describe("encrypted field crypto", () => {
     expect(() => decryptEncryptedFieldV2(oldShapeCiphertext, masterKey)).toThrow("Invalid ciphertext v2 format");
   });
 
+  it("round-trips an empty plaintext", () => {
+    const ciphertext = encryptEncryptedFieldV2("", masterKey);
+
+    expect(ciphertext.endsWith(":")).toBe(true);
+    expect(decryptEncryptedFieldV2(ciphertext, masterKey)).toBe("");
+  });
+
+  it("rejects missing segments and invalid hex encodings", () => {
+    expect(() =>
+      decryptEncryptedFieldV2(
+        "v2:00112233445566778899aabb:00112233445566778899aabbccddeeff",
+        masterKey
+      )
+    ).toThrow("Invalid ciphertext v2 format");
+    expect(() =>
+      decryptEncryptedFieldV2(
+        "v2:zz112233445566778899aabb:00112233445566778899aabbccddeeff:",
+        masterKey
+      )
+    ).toThrow("Invalid ciphertext v2 encoding");
+    expect(() =>
+      decryptEncryptedFieldV2(
+        "v2:00112233445566778899aabb:00112233445566778899aabbccddeeff:f",
+        masterKey
+      )
+    ).toThrow("Invalid ciphertext v2 encoding");
+  });
+
 });
diff --git a/packages/server-core/src/crypto/encrypted-field.ts b/packages/server-core/src/crypto/encrypted-field.ts
index 7821b9c..83dc9b8 100644
--- a/packages/server-core/src/crypto/encrypted-field.ts
+++ b/packages/server-core/src/crypto/encrypted-field.ts
@@ -40,10 +40,18 @@ export function decryptEncryptedFieldV2(ciphertext: string, masterKey: string):
 
   const parts = ciphertext.split(":");
   const [prefix, ivHex, authTagHex, encrypted] = parts;
-  if (prefix !== V2_PREFIX || !ivHex || !authTagHex || !encrypted || parts.length !== 4) {
+  if (prefix !== V2_PREFIX || !ivHex || !authTagHex || encrypted === undefined || parts.length !== 4) {
     throw new Error("Invalid ciphertext v2 format");
   }
 
+  if (
+    !/^[0-9a-f]{24}$/i.test(ivHex)
+    || !/^[0-9a-f]{32}$/i.test(authTagHex)
+    || !/^(?:[0-9a-f]{2})*$/i.test(encrypted)
+  ) {
+    throw new Error("Invalid ciphertext v2 encoding");
+  }
+
   const iv = Buffer.from(ivHex, "hex");
   const authTag = Buffer.from(authTagHex, "hex");
   if (iv.length !== IV_LENGTH || authTag.length !== TAG_LENGTH) {
diff --git a/packages/server-core/src/subscription/auto-update-failure.ts b/packages/server-core/src/subscription/auto-update-failure.ts
index 24e7ad2..bdb6b5a 100644
--- a/packages/server-core/src/subscription/auto-update-failure.ts
+++ b/packages/server-core/src/subscription/auto-update-failure.ts
@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { safeParseJsonObject } from "@subboost/core/json";
+import { extractHttpStatus } from "@subboost/core/subscription/import-error";
 
 // Product-neutral failure policy shared by server adapters.
 export const AUTO_UPDATE_EXTERNAL_FAILURE_THRESHOLD = 3;
@@ -96,13 +97,6 @@ export function serializeAutoUpdateFailureSourceState(state: AutoUpdateFailureSo
   return Object.keys(state).length > 0 ? JSON.stringify(state) : null;
 }
 
-function extractHttpStatus(text: string): number | null {
-  const match = text.match(/\bHTTP\s+(\d{3})\b/i) ?? text.match(/\b(4\d{2}|5\d{2})\b/);
-  if (!match) return null;
-  const status = Number.parseInt(match[1], 10);
-  return Number.isFinite(status) ? status : null;
-}
-
 export function classifyStableExternalAutoUpdateFailure(
   source: AutoUpdateFailureSourceLike
 ): AutoUpdateFailureClassification {
diff --git a/packages/server-core/src/subscription/crud.ts b/packages/server-core/src/subscription/crud.ts
index 142c19c..874182c 100644
--- a/packages/server-core/src/subscription/crud.ts
+++ b/packages/server-core/src/subscription/crud.ts
@@ -5,6 +5,7 @@ import type { ParsedNode } from "@subboost/core/types/node";
 import { resolveSubscriptionAutoUpdateState, type SubscriptionAutoUpdateStateFields } from "./auto-update-state";
 import { normalizeSavedSourcesForPersistence, type NormalizeSavedSourcesForPersistenceOptions } from "./saved-sources";
 import { resolveSmartNodeMatchingEnabled } from "./refresh-node-snapshot";
+import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 
 export type SubscriptionConfigInput = {
   config?: unknown;
@@ -114,7 +115,7 @@ export function normalizeSubscriptionConfigForPersistence(
     baseConfig.smartNodeMatchingEnabled = options.defaultSmartNodeMatchingEnabled;
   }
 
-  return baseConfig;
+  return migrateLegacyConfig(baseConfig);
 }
 
 export function serializeSubscriptionAutoUpdateState(
diff --git a/packages/server-core/src/subscription/ssrf-ip.test.ts b/packages/server-core/src/subscription/ssrf-ip.test.ts
index fb9b2a5..80e2f30 100644
--- a/packages/server-core/src/subscription/ssrf-ip.test.ts
+++ b/packages/server-core/src/subscription/ssrf-ip.test.ts
@@ -36,6 +36,7 @@ describe("SSRF IP classification", () => {
       "::",
       "0:0:0:0:0:0:0:0",
       "::1",
+      "0:0:0:0:0:0:0:1",
       "fc00::1",
       "fd00::1",
       "fe80::1",
@@ -45,6 +46,9 @@ describe("SSRF IP classification", () => {
       "2001:0db8::1",
       "::ffff:127.0.0.1",
       "::ffff:c0a8:1",
+      "0:0:0:0:0:ffff:7f00:1",
+      "0:0:0:0:0:ffff:c0a8:1",
+      "::127.0.0.1",
     ]) {
       expect(isPrivateOrReservedIp(ip), ip).toBe(true);
     }
diff --git a/packages/server-core/src/subscription/ssrf-ip.ts b/packages/server-core/src/subscription/ssrf-ip.ts
index 03e7c14..736bfb2 100644
--- a/packages/server-core/src/subscription/ssrf-ip.ts
+++ b/packages/server-core/src/subscription/ssrf-ip.ts
@@ -58,49 +58,63 @@ function isBenchmarkReservedIPv4(ip: string): boolean {
   return ipv4InCidr(ipInt, baseInt, 15);
 }
 
-function ipv4FromMappedHexTail(value: string): string | null {
-  const parts = value.split(":");
-  if (parts.length !== 2) return null;
-  const nums = parts.map((part) => Number.parseInt(part, 16));
-  if (nums.some((num) => !Number.isInteger(num) || num < 0 || num > 0xffff)) return null;
+function ipv4FromHextets(high: number, low: number): string {
   return [
-    nums[0] >> 8,
-    nums[0] & 0xff,
-    nums[1] >> 8,
-    nums[1] & 0xff,
+    high >> 8,
+    high & 0xff,
+    low >> 8,
+    low & 0xff,
   ].join(".");
 }
 
-function isDocumentationIPv6(ip: string): boolean {
-  const [first = "", second = ""] = ip.split(":");
-  return Number.parseInt(first, 16) === 0x2001 && Number.parseInt(second, 16) === 0x0db8;
-}
-
-function isPrivateOrReservedIPv6(ip: string): boolean {
-  const normalized = ip.toLowerCase();
-  if (normalized === "::" || normalized === "0:0:0:0:0:0:0:0") return true;
-  if (normalized === "::1") return true;
-
-  const firstHextet = normalized.split(":")[0] || "";
-  if (firstHextet.startsWith("fc") || firstHextet.startsWith("fd")) return true;
-  if (
-    firstHextet.startsWith("fe8") ||
-    firstHextet.startsWith("fe9") ||
-    firstHextet.startsWith("fea") ||
-    firstHextet.startsWith("feb")
-  ) {
-    return true;
+function expandIpv6Hextets(ip: string): number[] | null {
+  let normalized = ip.toLowerCase();
+  if (normalized.includes(".")) {
+    const lastColon = normalized.lastIndexOf(":");
+    if (lastColon < 0) return null;
+    const ipv4Int = ipv4ToInt(normalized.slice(lastColon + 1));
+    if (ipv4Int === null) return null;
+    normalized = `${normalized.slice(0, lastColon)}:${((ipv4Int >>> 16) & 0xffff).toString(16)}:${(
+      ipv4Int & 0xffff
+    ).toString(16)}`;
   }
-  if (firstHextet.startsWith("ff")) return true;
-  if (isDocumentationIPv6(normalized)) return true;
 
-  const lastSegment = normalized.split(":").slice(-1)[0] || "";
-  if (lastSegment.includes(".")) {
-    return isPrivateOrReservedIPv4(lastSegment);
+  const compressionIndex = normalized.indexOf("::");
+  if (compressionIndex !== normalized.lastIndexOf("::")) return null;
+
+  const left = (compressionIndex === -1 ? normalized : normalized.slice(0, compressionIndex))
+    .split(":")
+    .filter(Boolean);
+  const right = (compressionIndex === -1 ? "" : normalized.slice(compressionIndex + 2))
+    .split(":")
+    .filter(Boolean);
+  const missing = 8 - left.length - right.length;
+  if ((compressionIndex === -1 && missing !== 0) || (compressionIndex !== -1 && missing < 1)) return null;
+
+  const parts = compressionIndex === -1 ? left : [...left, ...Array(missing).fill("0"), ...right];
+  const hextets = parts.map((part) => Number.parseInt(part, 16));
+  if (hextets.length !== 8 || hextets.some((part) => !Number.isInteger(part) || part < 0 || part > 0xffff)) {
+    return null;
   }
-  if (normalized.startsWith("::ffff:")) {
-    const mappedIpv4 = ipv4FromMappedHexTail(normalized.slice("::ffff:".length));
-    return mappedIpv4 ? isPrivateOrReservedIPv4(mappedIpv4) : false;
+  return hextets;
+}
+
+function isPrivateOrReservedIPv6(ip: string): boolean {
+  const hextets = expandIpv6Hextets(ip);
+  if (!hextets) return true;
+
+  const [first, second] = hextets;
+  const allButLastZero = hextets.slice(0, 7).every((part) => part === 0);
+  if (hextets.every((part) => part === 0) || (allButLastZero && hextets[7] === 1)) return true;
+  if ((first & 0xfe00) === 0xfc00) return true;
+  if ((first & 0xffc0) === 0xfe80) return true;
+  if ((first & 0xff00) === 0xff00) return true;
+  if (first === 0x2001 && second === 0x0db8) return true;
+
+  const isIpv4Compatible = hextets.slice(0, 6).every((part) => part === 0);
+  const isIpv4Mapped = hextets.slice(0, 5).every((part) => part === 0) && hextets[5] === 0xffff;
+  if (isIpv4Compatible || isIpv4Mapped) {
+    return isPrivateOrReservedIPv4(ipv4FromHextets(hextets[6], hextets[7]));
   }
 
   return false;
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
index 35b862b..ccd59a3 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
@@ -318,8 +318,10 @@ describe("ProxyGroupsCategories", () => {
     expect(mocks.store.removeModuleRule).toHaveBeenCalledWith("auto", "rule-a");
     card.onMoveRule("rule-a", "top");
     expect(mocks.store.moveModuleRule).toHaveBeenCalledWith("auto", "rule-a", "top");
-    card.onMoveManualRule("manual-1", "Fallback");
-    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", { target: "Fallback" });
+    card.onMoveManualRule("manual-1", { kind: "module", id: "fallback", name: "Fallback" });
+    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", {
+      target: { kind: "module", id: "fallback" },
+    });
     card.onRestoreRule("rule-a");
     expect(mocks.store.restoreModuleRule).toHaveBeenCalledWith("auto", "rule-a");
     card.onResetRuleTarget("rule-a");
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
index e12d52d..aafe4be 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
@@ -582,8 +582,8 @@ export function ProxyGroupsCategories() {
                               onMoveRule={(ruleId, target) =>
                                 moveModuleRule(module.id, ruleId, target)
                               }
-                              onMoveManualRule={(ruleId, targetName) =>
-                                updateCustomRule(ruleId, { target: targetName })
+                              onMoveManualRule={(ruleId, target) =>
+                                updateCustomRule(ruleId, { target: { kind: target.kind, id: target.id } })
                               }
                               onRemoveManualRule={removeCustomRule}
                               onRestoreRule={(ruleId) =>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel-card-props.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel-card-props.test.ts
index 62bae9f..57b7cf9 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel-card-props.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel-card-props.test.ts
@@ -170,7 +170,7 @@ describe("ProxyGroupsCustomGroupsPanel card props", () => {
     card.onAddRuleToCustomGroup();
     card.onRemoveExtraRule();
     card.onMoveRule();
-    card.onMoveManualRule("manual-1", "Auto");
+    card.onMoveManualRule("manual-1", { kind: "module", id: "auto", name: "Auto" });
     card.onRemoveManualRule(0);
     card.onRestoreRule();
     card.onResetRuleTarget();
@@ -185,7 +185,9 @@ describe("ProxyGroupsCustomGroupsPanel card props", () => {
 
     expect(mocks.store.updateCustomProxyGroup).toHaveBeenCalledWith("custom-1", { enabled: true });
     expect(mocks.store.removeCustomProxyGroup).toHaveBeenCalledWith("custom-1");
-    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", { target: "Auto" });
+    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", {
+      target: { kind: "module", id: "auto" },
+    });
     expect(mocks.store.removeCustomRule).toHaveBeenCalledWith(0);
     expect(mocks.store.updateCustomProxyGroup).toHaveBeenCalledWith("custom-1", {
       groupType: "load-balance",
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.test.ts
index abbc63c..03f1d51 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.test.ts
@@ -66,8 +66,12 @@ vi.mock("@subboost/ui/components/ui/input", () => ({
 vi.mock("@subboost/ui/components/ui/toaster", () => ({ toast: mocks.toast }));
 vi.mock("@subboost/core/generator/proxy-groups", () => ({
   PROXY_GROUP_MODULES: [
-    { id: "auto", name: "Auto" },
-    { id: "fallback", name: "Fallback" },
+    {
+      id: "auto",
+      name: "Auto",
+      rules: [{ id: "builtin-a", name: "Builtin A", behavior: "domain", path: "geosite/builtin-a.mrs" }],
+    },
+    { id: "fallback", name: "Fallback", rules: [] },
   ],
 }));
 vi.mock("@subboost/core/proxy-group-name", () => ({
@@ -176,6 +180,7 @@ describe("ProxyGroupsCustomGroupsPanel", () => {
       customRules: [{ id: "manual-1", target: "🧩 Custom" }],
       customProxyGroups: [customGroup, targetGroup],
       customRuleSets: [sourceRule],
+      builtinRuleEdits: {},
       dialerProxyGroups: [{ name: "Dialer" }],
       addCustomProxyGroup: vi.fn(),
       removeCustomProxyGroup: vi.fn(),
@@ -290,11 +295,40 @@ describe("ProxyGroupsCustomGroupsPanel", () => {
 
   });
 
+  it("shows builtin rules moved into a custom group and wires their actions", () => {
+    mocks.store.builtinRuleEdits = {
+      "module:auto:builtin-a": { target: { kind: "custom", id: "custom-1" } },
+    };
+
+    renderPanel({ 0: new Set(["custom-1"]) });
+
+    expect(mocks.captures.ruleRows).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ name: "Builtin A", source: "preset", state: "moved" }),
+      ]),
+    );
+    const builtinMove = mocks.captures.moveMenus.find((menu: any) => menu.ariaLabel === "移动 Builtin A 规则集");
+    builtinMove.onMove({ kind: "module", id: "fallback", name: "Fallback" });
+    expect(mocks.store.moveModuleRule).toHaveBeenCalledWith("auto", "builtin-a", {
+      kind: "module",
+      id: "fallback",
+      name: "Fallback",
+    });
+
+    mocks.captures.buttons.find((button: any) => button["aria-label"] === "删除 Builtin A 规则集").onClick();
+    expect(mocks.store.removeModuleRule).toHaveBeenCalledWith("custom-1", "builtin-a");
+  });
+
   it("updates manual rules, deletes rule rows, and renders empty state", () => {
     renderPanel({ 0: new Set(["custom-1"]) });
 
-    mocks.captures.manualRows[0].onMove({ rule: { id: "manual-1" }, index: 0 }, { name: "Auto" });
-    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", { target: "Auto" });
+    mocks.captures.manualRows[0].onMove(
+      { rule: { id: "manual-1" }, index: 0 },
+      { kind: "module", id: "auto", name: "Auto" },
+    );
+    expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("manual-1", {
+      target: { kind: "module", id: "auto" },
+    });
     mocks.captures.manualRows[0].onRemove({ index: 0 });
     expect(mocks.store.removeCustomRule).toHaveBeenCalledWith(0);
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx
index 872909a..20f4946 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx
@@ -48,6 +48,7 @@ export function ProxyGroupsCustomGroupsPanel({
     proxyGroupNameOverrides = {},
     customRules = [],
     customRuleSets = [],
+    builtinRuleEdits = {},
     customProxyGroups = [],
     addCustomProxyGroup,
     removeCustomProxyGroup,
@@ -125,7 +126,7 @@ export function ProxyGroupsCustomGroupsPanel({
 
   const moveManualRule = React.useCallback(
     (item: { rule: { id: string }; index: number }, target: ProxyGroupRuleTarget) => {
-      updateCustomRule(item.rule.id, { target: target.name });
+      updateCustomRule(item.rule.id, { target: { kind: target.kind, id: target.id } });
     },
     [updateCustomRule],
   );
@@ -248,7 +249,20 @@ export function ProxyGroupsCustomGroupsPanel({
                   customProxyGroups,
                 }) === group.name,
             );
-            const totalRules = groupRuleSets.length + manualRules.length;
+            const movedBuiltinRules = Object.entries(builtinRuleEdits).flatMap(([key, edit]) => {
+              if (edit?.enabled === false || !edit?.target) return [];
+              const match = key.match(/^module:([^:]+):(.+)$/);
+              if (!match) return [];
+              const sourceModule = PROXY_GROUP_MODULES.find((module) => module.id === match[1]);
+              const rule = sourceModule?.rules.find((item) => item.id === match[2]);
+              if (!sourceModule || !rule) return [];
+              const targetName = resolveProxyGroupTargetName(edit.target, {
+                moduleNames,
+                customProxyGroups,
+              });
+              return targetName === group.name ? [{ sourceModule, rule }] : [];
+            });
+            const totalRules = groupRuleSets.length + movedBuiltinRules.length + manualRules.length;
             const description = group.description?.trim() || "自定义代理组";
             const nodeCount = nodeCounts?.get(group.name) ?? 0;
 
@@ -326,6 +340,44 @@ export function ProxyGroupsCustomGroupsPanel({
                       }
                     />
                   ))}
+                  {movedBuiltinRules.map(({ sourceModule, rule }) => (
+                    <ProxyGroupRuleSetRow
+                      key={`builtin:${sourceModule.id}:${rule.id}`}
+                      name={rule.name}
+                      path={rule.path}
+                      source="preset"
+                      behavior={rule.behavior}
+                      noResolve={rule.noResolve}
+                      state="moved"
+                      actions={
+                        <>
+                          <ProxyGroupRuleMoveMenu
+                            title="移动规则集"
+                            ariaLabel={`移动 ${rule.name} 规则集`}
+                            targets={ruleSetMoveTargets}
+                            kinds={["module", "custom"]}
+                            currentTarget={{ kind: "custom", id: group.id, name: group.name }}
+                            onMove={(target) => {
+                              if (isRuleSetMoveTarget(target)) {
+                                moveModuleRule(sourceModule.id, rule.id, target);
+                              }
+                            }}
+                          />
+                          <Button
+                            type="button"
+                            variant="ghost"
+                            size="sm"
+                            className="h-7 px-2 text-white/35 hover:text-red-300"
+                            onClick={() => removeModuleRule(group.id, rule.id)}
+                            title="删除规则集"
+                            aria-label={`删除 ${rule.name} 规则集`}
+                          >
+                            <Trash2 className="h-3.5 w-3.5" />
+                          </Button>
+                        </>
+                      }
+                    />
+                  ))}
                   {manualRules.map((item) => (
                     <ProxyGroupManualRuleRow
                       key={`manual:${item.rule.id}`}
@@ -391,7 +443,9 @@ export function ProxyGroupsCustomGroupsPanel({
                 onAddRuleToCustomGroup={() => undefined}
                 onRemoveExtraRule={() => undefined}
                 onMoveRule={() => undefined}
-                onMoveManualRule={(ruleId, targetName) => updateCustomRule(ruleId, { target: targetName })}
+                onMoveManualRule={(ruleId, target) =>
+                  updateCustomRule(ruleId, { target: { kind: target.kind, id: target.id } })
+                }
                 onRemoveManualRule={removeCustomRule}
                 onRestoreRule={() => undefined}
                 onResetRuleTarget={() => undefined}
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.test.ts
index e73a09b..4b082ac 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.test.ts
@@ -276,9 +276,15 @@ describe("ProxyGroupsCustomRules", () => {
           "Legacy Target",
         ],
         existingRules: [],
-        onImport: mocks.store.addCustomRules,
+        onImport: expect.any(Function),
       }),
     );
+    mocks.captures.batchDialogs[0].onImport([
+      { id: "batch-1", type: "DOMAIN", value: "batch.example", target: "Custom Group" },
+    ]);
+    expect(mocks.store.addCustomRules).toHaveBeenCalledWith([
+      expect.objectContaining({ target: { kind: "custom", id: "custom-1" } }),
+    ]);
 
     mocks.captures.buttons
       .find((props) => props.children === "批量导入")
@@ -348,7 +354,7 @@ describe("ProxyGroupsCustomRules", () => {
       id: "rule-1",
       type: "DOMAIN" as const,
       value: " edited.com ",
-      target: "Custom Group",
+      target: { kind: "custom", id: "custom-1" },
       noResolve: true,
     };
     const { html, setters } = renderRules({
@@ -412,7 +418,7 @@ describe("ProxyGroupsCustomRules", () => {
     expect(mocks.store.updateCustomRule).toHaveBeenCalledWith("rule-1", {
       type: "DOMAIN",
       value: "edited.com",
-      target: "Custom Group",
+      target: { kind: "custom", id: "custom-1" },
       noResolve: true,
     });
     expect(setters[5]).toHaveBeenCalledWith(null);
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx
index 5525b2c..a4075e1 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx
@@ -20,7 +20,7 @@ import {
   CUSTOM_RULE_TYPES,
 } from "@subboost/core/rules/custom-rule-utils";
 import { useConfigStore } from "@subboost/ui/store/config-store";
-import type { CustomRule } from "@subboost/core/types/config";
+import type { CustomProxyGroup, CustomRule, ProxyGroupRuleTarget } from "@subboost/core/types/config";
 import {
   useProductInteractionAdapter,
   type ProductRuleKind,
@@ -88,6 +88,20 @@ function getTargetOptions(enabledGroupNames: string[], selected?: string) {
   return Array.from(new Set(options));
 }
 
+function toStableRuleTarget(
+  targetName: string,
+  moduleNames: Record<string, string>,
+  customProxyGroups: CustomProxyGroup[],
+): ProxyGroupRuleTarget {
+  const normalized = targetName.trim();
+  for (const [id, name] of Object.entries(moduleNames)) {
+    if (name.trim() === normalized) return { kind: "module", id };
+  }
+  const customGroup = customProxyGroups.find((group) => group.name.trim() === normalized);
+  if (customGroup) return { kind: "custom", id: customGroup.id };
+  return normalized;
+}
+
 export function ProxyGroupsCustomRules() {
   const {
     customRules,
@@ -174,7 +188,7 @@ export function ProxyGroupsCustomRules() {
       id: createCustomRuleId(),
       type: addedRuleType,
       value,
-      target: newRuleTarget,
+      target: toStableRuleTarget(newRuleTarget, moduleNames, customProxyGroups),
       noResolve: newRuleNoResolve,
     });
     interactions.ruleAdded?.({
@@ -213,7 +227,7 @@ export function ProxyGroupsCustomRules() {
     updateCustomRule(editingRuleId, {
       type: editingRuleDraft.type,
       value,
-      target: editingRuleDraft.target,
+      target: toStableRuleTarget(resolveTargetName(editingRuleDraft.target), moduleNames, customProxyGroups),
       noResolve: Boolean(editingRuleDraft.noResolve),
     });
     cancelEditingRule();
@@ -245,7 +259,14 @@ export function ProxyGroupsCustomRules() {
         defaultNoResolve={newRuleNoResolve}
         targetOptions={batchTargetOptions}
         existingRules={customRules}
-        onImport={addCustomRules}
+        onImport={(rules) =>
+          addCustomRules(
+            rules.map((rule) => ({
+              ...rule,
+              target: toStableRuleTarget(resolveTargetName(rule.target), moduleNames, customProxyGroups),
+            })),
+          )
+        }
       />
 
       <div className={RULE_ADD_ROW_FRAME_CLASS}>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
index cc08d63..8c382f4 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
@@ -176,7 +176,7 @@ export function ProxyGroupsModuleCard({
   onAddRuleToCustomGroup: (groupId: string, rule: RuleSetDraft) => void;
   onRemoveExtraRule: (ruleId: string) => void;
   onMoveRule: (ruleId: string, target: { kind: "module" | "custom"; id: string }) => void;
-  onMoveManualRule: (ruleId: string, targetName: string) => void;
+  onMoveManualRule: (ruleId: string, target: ProxyGroupRuleTarget) => void;
   onRemoveManualRule: (index: number) => void;
   onRestoreRule: (ruleId: string) => void;
   onResetRuleTarget: (ruleId: string) => void;
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
index f62bdff..d00a97b 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
@@ -229,8 +229,9 @@ describe("ProxyGroupsModuleRulesPanel", () => {
     mocks.captures.buttons.find((button) => button["aria-label"] === "恢复默认目标 Removed 规则集").onClick();
     expect(props.onResetRuleTarget).toHaveBeenCalledWith("removed-rule");
 
-    mocks.captures.manualRows[0].onMove(mocks.captures.manualRows[0].item, { name: "自动选择" });
-    expect(props.onMoveManualRule).toHaveBeenCalledWith("manual-1", "自动选择");
+    const manualTarget = { kind: "module", id: "auto", name: "自动选择" };
+    mocks.captures.manualRows[0].onMove(mocks.captures.manualRows[0].item, manualTarget);
+    expect(props.onMoveManualRule).toHaveBeenCalledWith("manual-1", manualTarget);
     mocks.captures.manualRows[0].onRemove({ index: 0 });
     expect(props.onRemoveManualRule).toHaveBeenCalledWith(0);
   });
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
index 41e1af8..5531003 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
@@ -119,7 +119,7 @@ export function ProxyGroupsModuleRulesPanel({
   onAddRuleToCustomGroup: (groupId: string, rule: RuleSetDraft) => void;
   onRemoveRule: (ruleId: string) => void;
   onMoveRule: (ruleId: string, target: MoveTarget) => void;
-  onMoveManualRule: (ruleId: string, targetName: string) => void;
+  onMoveManualRule: (ruleId: string, target: ProxyGroupRuleTarget) => void;
   onRemoveManualRule: (index: number) => void;
   onRestoreRule: (ruleId: string) => void;
   onResetRuleTarget: (ruleId: string) => void;
@@ -386,7 +386,7 @@ export function ProxyGroupsModuleRulesPanel({
               item={item}
               targets={manualRuleTargets}
               currentTargetName={moduleDisplayName}
-              onMove={(nextItem, target) => onMoveManualRule(nextItem.rule.id, target.name)}
+              onMove={(nextItem, target) => onMoveManualRule(nextItem.rule.id, target)}
               onRemove={({ index }) => onRemoveManualRule(index)}
             />
           ))}
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts
index 7ed964c..e5a6fc9 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts
@@ -319,7 +319,7 @@ describe("ProxyGroupsRulesLibrary", () => {
         id: "telegram",
         name: "Telegram",
         behavior: "ipcidr",
-        path: "geoip/telegram.mrs",
+        path: "https://raw.example/geoip/telegram.mrs",
         noResolve: true,
       },
     ]);
@@ -340,7 +340,7 @@ describe("ProxyGroupsRulesLibrary", () => {
         id: "telegram",
         name: "Telegram",
         behavior: "ipcidr",
-        path: "geoip/telegram.mrs",
+        path: "https://raw.example/geoip/telegram.mrs",
         noResolve: true,
       },
     ]);
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx
index fd7d975..7fac3cc 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx
@@ -562,7 +562,13 @@ export function ProxyGroupsRulesLibrary() {
                           .filter((r) => builtinRuleEdits?.[getModuleRuleOrderKey(mod.id, r.id)]?.enabled !== false)
                           .map((r) => r.id),
                         ...customRuleSets
-                          .filter((r) => r.target === resolveModuleFullName(mod))
+                          .filter(
+                            (rule) =>
+                              resolveProxyGroupTargetName(rule.target, {
+                                moduleNames,
+                                customProxyGroups,
+                              }) === resolveModuleFullName(mod),
+                          )
                           .map((r) => r.id),
                       ],
                     );
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts
index ce271c1..ff52bbd 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts
@@ -320,7 +320,7 @@ describe("RulesManagementSection", () => {
 
   it("moves editable rules by buttons, absolute order input, blur, and escape cleanup", () => {
     stateMock.value = { "custom:one": "1" };
-    const tree = renderSection();
+    const tree = renderSection({ ruleOrder: ["module:geo", "custom:one"] });
     const orderInputs = collectElements(tree, (element) => (element.props as any).title === "最终规则行号（1=最前）");
     const upButtons = collectElements(tree, (element) => element.type === "button" && element.props.title === "上移");
     const downButtons = collectElements(tree, (element) => element.type === "button" && element.props.title === "下移");
@@ -346,6 +346,29 @@ describe("RulesManagementSection", () => {
     expect(mocks.store.setRuleOrder).toHaveBeenCalledWith(["custom:one", "module:geo"]);
   });
 
+  it("does not turn legacy custom-only ordering into full ordering after a custom move", () => {
+    const tree = renderSection({ ruleOrder: ["custom:one"] });
+    const orderInputs = collectElements(tree, (element) => (element.props as any).title === "最终规则行号（1=最前）");
+    const upButtons = collectElements(tree, (element) => element.type === "button" && element.props.title === "上移");
+    const downButtons = collectElements(tree, (element) => element.type === "button" && element.props.title === "下移");
+
+    stateMock.value = { "custom:one": "1" };
+    orderInputs[1].props.onKeyDown({ key: "Enter" });
+    upButtons[1].props.onClick();
+    downButtons[1].props.onClick();
+
+    expect(upButtons[1].props.disabled).toBe(true);
+    expect(downButtons[1].props.disabled).toBe(true);
+    expect(mocks.store.setRuleOrder).not.toHaveBeenCalled();
+  });
+
+  it("uses full non-MATCH ordering for a new empty rule-order state", () => {
+    const tree = renderSection({ ruleOrder: [] });
+    const header = collectElements(tree, (element) => element.props.title === "规则管理")[0];
+    expect(collectText(tree)).toContain("已开启全规则排序");
+    expect(collectText(header.props.badge)).toContain("可调 2 / 全部 3");
+  });
+
   it("keeps collapsed sections lightweight", () => {
     mocks.store = {
       enabledProxyGroups: [],
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx
index c55c7b1..3b408f6 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx
@@ -52,7 +52,7 @@ export function RulesManagementSection({
     setRuleOrder,
   } = useConfigStore();
   const [orderDrafts, setOrderDrafts] = React.useState<Record<string, string>>({});
-  const allRulesMode = hasFullRuleOrderKeys(ruleOrder);
+  const allRulesMode = ruleOrder.length === 0 || hasFullRuleOrderKeys(ruleOrder);
 
   const entries = React.useMemo(
     () =>
@@ -85,6 +85,7 @@ export function RulesManagementSection({
   const preMatchKeys = React.useMemo(() => preMatchEntries.map((entry) => entry.key), [preMatchEntries]);
   const editableEntries = React.useMemo(() => entries.filter((entry) => entry.editable), [entries]);
   const editableKeys = React.useMemo(() => editableEntries.map((entry) => entry.key), [editableEntries]);
+  const movableKeys = allRulesMode ? preMatchKeys : editableKeys;
 
   const applyRuleOrder = React.useCallback(
     (nextRuleOrder: string[]) => {
@@ -102,30 +103,30 @@ export function RulesManagementSection({
 
   const moveRule = React.useCallback(
     (key: string, direction: "up" | "down") => {
-      const from = preMatchKeys.indexOf(key);
+      const from = movableKeys.indexOf(key);
       if (from < 0) return;
-      const to = clamp(direction === "up" ? from - 1 : from + 1, 0, preMatchKeys.length - 1);
+      const to = clamp(direction === "up" ? from - 1 : from + 1, 0, movableKeys.length - 1);
       if (to === from) return;
-      const next = preMatchKeys.slice();
+      const next = movableKeys.slice();
       const [item] = next.splice(from, 1);
       next.splice(to, 0, item);
       applyRuleOrder(next);
     },
-    [applyRuleOrder, preMatchKeys]
+    [applyRuleOrder, movableKeys]
   );
 
   const setRuleAbsoluteOrder = React.useCallback(
     (key: string, absoluteOrder: number) => {
-      const from = preMatchKeys.indexOf(key);
+      const from = movableKeys.indexOf(key);
       if (from < 0 || !Number.isFinite(absoluteOrder)) return;
-      const to = clamp(Math.floor(absoluteOrder) - 1, 0, preMatchEntries.length - 1);
+      const to = clamp(Math.floor(absoluteOrder) - 1, 0, movableKeys.length - 1);
       if (to === from) return;
-      const next = preMatchKeys.slice();
+      const next = movableKeys.slice();
       const [item] = next.splice(from, 1);
       next.splice(to, 0, item);
       applyRuleOrder(next);
     },
-    [applyRuleOrder, preMatchEntries.length, preMatchKeys]
+    [applyRuleOrder, movableKeys]
   );
 
   const handleToggleAllRulesMode = React.useCallback(
@@ -194,11 +195,11 @@ export function RulesManagementSection({
 
           <div className="max-h-[460px] overflow-y-auto overflow-x-hidden rounded-lg border border-white/10 bg-black/10 pr-1 custom-scrollbar">
             {entries.map((entry, index) => {
-              const fullIndex = preMatchKeys.indexOf(entry.key);
+              const movableIndex = movableKeys.indexOf(entry.key);
               const canEditOrder = entry.key !== "special:match" && (allRulesMode || entry.editable);
-              const canMoveUp = canEditOrder && fullIndex > 0;
-              const canMoveDown = canEditOrder && fullIndex >= 0 && fullIndex < preMatchKeys.length - 1;
-              const absoluteOrder = index + 1;
+              const canMoveUp = canEditOrder && movableIndex > 0;
+              const canMoveDown = canEditOrder && movableIndex >= 0 && movableIndex < movableKeys.length - 1;
+              const absoluteOrder = allRulesMode ? index + 1 : movableIndex + 1;
               const displayDetail = getRuleDisplayDetail(entry);
               const shouldShowSourceLabel =
                 entry.sourceLabel.trim() !== entry.target.trim() &&
diff --git a/packages/ui/src/product/converter/quick-mode/constants.test.ts b/packages/ui/src/product/converter/quick-mode/constants.test.ts
index 43c4dd5..76e6173 100644
--- a/packages/ui/src/product/converter/quick-mode/constants.test.ts
+++ b/packages/ui/src/product/converter/quick-mode/constants.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { sourceTypeInfo, templates } from "./constants";
+import { getTemplateList } from "@subboost/core/templates";
 
 describe("quick mode constants", () => {
   it("defines all supported source type labels and placeholders", () => {
@@ -17,5 +18,11 @@ describe("quick mode constants", () => {
     expect(templates.map((item) => item.name)).toEqual(["精简版", "标准版", "完整版"]);
     expect(templates[0].groups).toBeLessThan(templates[2].groups);
     expect(templates[0].rules).toBeLessThan(templates[2].rules);
+    const currentCounts = new Map(
+      getTemplateList().map((template) => [template.id, [template.groupCount, template.ruleCount]])
+    );
+    for (const template of templates) {
+      expect([template.groups, template.rules]).toEqual(currentCounts.get(template.id));
+    }
   });
 });
diff --git a/packages/ui/src/product/converter/quick-mode/constants.ts b/packages/ui/src/product/converter/quick-mode/constants.ts
index 7d314d0..a83c81e 100644
--- a/packages/ui/src/product/converter/quick-mode/constants.ts
+++ b/packages/ui/src/product/converter/quick-mode/constants.ts
@@ -1,5 +1,6 @@
 import type { SourceType } from "@subboost/ui/store/config-store";
 import type { TemplateType } from "@subboost/core/types/config";
+import { getTemplateList } from "@subboost/core/templates";
 import { FileCode, Link2, Server } from "lucide-react";
 
 export const sourceTypeInfo: Record<
@@ -27,26 +28,31 @@ export const sourceTypeInfo: Record<
   },
 };
 
+const templateCounts = new Map(
+  getTemplateList().map((template) => [template.id, { groups: template.groupCount, rules: template.ruleCount }])
+);
+
+function countsFor(id: TemplateType) {
+  return templateCounts.get(id) ?? { groups: 0, rules: 0 };
+}
+
 export const templates = [
   {
     id: "minimal" as TemplateType,
     name: "精简版",
     description: "基础代理组 + 国内外分流",
-    groups: 7,
-    rules: 5,
+    ...countsFor("minimal"),
   },
   {
     id: "standard" as TemplateType,
     name: "标准版",
     description: "完整代理组 + 常用规则",
-    groups: 14,
-    rules: 15,
+    ...countsFor("standard"),
   },
   {
     id: "full" as TemplateType,
     name: "完整版",
     description: "全部功能 + 扩展规则集",
-    groups: 20,
-    rules: 40,
+    ...countsFor("full"),
   },
 ];
diff --git a/packages/ui/src/product/home/use-editing-subscription-loader.ts b/packages/ui/src/product/home/use-editing-subscription-loader.ts
index 5a615c7..81aafe3 100644
--- a/packages/ui/src/product/home/use-editing-subscription-loader.ts
+++ b/packages/ui/src/product/home/use-editing-subscription-loader.ts
@@ -9,6 +9,7 @@ import { ensureCustomRulesHaveIds } from "@subboost/core/rules/custom-rule-utils
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
+import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 import { tryNormalizeSubscriptionUrlInput } from "@subboost/core/subscription/url-input";
 import {
   hasSubscriptionUserInfo,
@@ -76,7 +77,9 @@ export function useEditingSubscriptionLoader({
           }
           return out;
         })();
-        const cfg = sub.config && typeof sub.config === "object" ? (sub.config as Record<string, unknown>) : {};
+        const cfg = migrateLegacyConfig(
+          sub.config && typeof sub.config === "object" ? (sub.config as Record<string, unknown>) : {}
+        );
         const subscriptionInfoFromRecord = normalizeSubscriptionUserInfo((sub as any).subscriptionInfo);
         const hasSubscriptionInfoFromRecord = hasSubscriptionUserInfo(subscriptionInfoFromRecord);
         const deletedNodesFromCfg = Array.isArray((cfg as any).deletedNodes)
diff --git a/packages/ui/src/store/config-store/actions/custom-actions.test.ts b/packages/ui/src/store/config-store/actions/custom-actions.test.ts
index 0404386..75c0cc9 100644
--- a/packages/ui/src/store/config-store/actions/custom-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/custom-actions.test.ts
@@ -76,9 +76,19 @@ describe("custom config-store actions", () => {
 
   it("adds, removes, and renames custom proxy groups while updating matching rules", () => {
     const { actions, getState } = createHarness({
-      customRules: [rule({ id: "r1", target: "Old Group" }), rule({ id: "r2", target: "DIRECT" })],
-      customRuleSets: [{ id: "cg-rule-1", name: "CG Rule", behavior: "domain", path: "geosite/example.mrs", target: "Old Group" }],
-      builtinRuleEdits: { "module:ai:openai": { target: "Old Group" } },
+      customRules: [
+        rule({ id: "r1", target: "Old Group" }),
+        rule({ id: "r2", target: "DIRECT" }),
+        rule({ id: "r3", target: { kind: "custom", id: "custom-group-1767225600000" } }),
+      ],
+      customRuleSets: [
+        { id: "cg-rule-1", name: "CG Rule", behavior: "domain", path: "geosite/example.mrs", target: "Old Group" },
+        { id: "cg-rule-2", name: "CG Rule 2", behavior: "domain", path: "geosite/example-2.mrs", target: { kind: "custom", id: "custom-group-1767225600000" } },
+      ],
+      builtinRuleEdits: {
+        "module:ai:openai": { target: "Old Group" },
+        "module:ai:anthropic": { target: { kind: "custom", id: "custom-group-1767225600000" }, enabled: false },
+      },
     });
 
     actions.addCustomProxyGroup({ name: "Old Group", emoji: "🧩", groupType: "select" });
@@ -100,10 +110,14 @@ describe("custom config-store actions", () => {
     expect(getState().customRules[1].target).toBe("DIRECT");
     expect(getState().customRuleSets[0].target).toBe("New Group");
     expect(getState().builtinRuleEdits["module:ai:openai"].target).toBe("New Group");
+    expect(getState().customRules[2].target).toEqual({ kind: "custom", id: groupId });
 
     actions.removeCustomProxyGroup(groupId);
     expect(getState().customProxyGroups).toEqual([]);
     expect(getState().customRuleSets).toEqual([]);
+    expect(getState().customRules).toEqual([expect.objectContaining({ id: "r2", target: "DIRECT" })]);
+    expect(getState().builtinRuleEdits["module:ai:openai"]).toBeUndefined();
+    expect(getState().builtinRuleEdits["module:ai:anthropic"]).toEqual({ enabled: false });
   });
 
   it("normalizes advanced custom proxy group fields and keeps blank-name removals narrow", () => {
diff --git a/packages/ui/src/store/config-store/actions/custom-actions.ts b/packages/ui/src/store/config-store/actions/custom-actions.ts
index fa125a0..d7d5de7 100644
--- a/packages/ui/src/store/config-store/actions/custom-actions.ts
+++ b/packages/ui/src/store/config-store/actions/custom-actions.ts
@@ -7,6 +7,10 @@ import { normalizePersistedRuleOrder } from "@subboost/core/generator/rules";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
 import type { ConfigActions } from "../definitions";
 import type { GetState, SetAndGenerateConfig, SetState } from "../store-types";
+import {
+  compactBuiltinRuleEdits,
+  ruleTargetMatchesContainer,
+} from "./proxy-group-rule-set-helpers";
 
 type CustomActions = Pick<
   ConfigActions,
@@ -160,19 +164,38 @@ export function createCustomActions(
     removeCustomProxyGroup: (id: string) => {
       setAndGenerateConfig((state) => {
         const removedGroup = state.customProxyGroups.find((g) => g.id === id);
+        if (!removedGroup) return state;
         const nextCustomProxyGroups = state.customProxyGroups.filter(
           (g) => g.id !== id,
         );
         const removedGroupName = removedGroup?.name?.trim() || "";
-        const nextCustomRuleSets = removedGroupName
-          ? state.customRuleSets.filter((ruleSet) => ruleSet.target !== removedGroupName)
-          : state.customRuleSets;
+        const removedTarget = { kind: "custom" as const, id };
+        const nextCustomRules = state.customRules.filter(
+          (rule) => !ruleTargetMatchesContainer(rule.target, removedTarget, removedGroupName),
+        );
+        const nextCustomRuleSets = state.customRuleSets.filter(
+          (ruleSet) => !ruleTargetMatchesContainer(ruleSet.target, removedTarget, removedGroupName),
+        );
+        const nextBuiltinRuleEdits = compactBuiltinRuleEdits(
+          Object.fromEntries(
+            Object.entries(state.builtinRuleEdits || {}).map(([key, edit]) => {
+              if (!ruleTargetMatchesContainer(edit?.target, removedTarget, removedGroupName)) return [key, edit];
+              const { target: _removedTarget, ...rest } = edit;
+              return [key, rest];
+            }),
+          ),
+        );
         return {
           customProxyGroups: nextCustomProxyGroups,
+          customRules: nextCustomRules,
           customRuleSets: nextCustomRuleSets,
+          builtinRuleEdits: nextBuiltinRuleEdits,
           ruleOrder: normalizeRuleOrderForState({
             ...state,
+            customProxyGroups: nextCustomProxyGroups,
+            customRules: nextCustomRules,
             customRuleSets: nextCustomRuleSets,
+            builtinRuleEdits: nextBuiltinRuleEdits,
           }),
         };
       });
diff --git a/packages/ui/src/store/config-store/actions/proxy-group-actions.test.ts b/packages/ui/src/store/config-store/actions/proxy-group-actions.test.ts
index 6cfe8e3..894f6aa 100644
--- a/packages/ui/src/store/config-store/actions/proxy-group-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/proxy-group-actions.test.ts
@@ -187,7 +187,7 @@ describe("createProxyGroupActions", () => {
 
     expect(getState().builtinRuleEdits).toEqual({});
     expect(getState().customRuleSets).toEqual([
-      { id: "custom-ai", name: "Custom AI", behavior: "domain", path: "geosite/custom-ai.mrs", target: "🤖 AI 服务" },
+      { id: "custom-ai", name: "Custom AI", behavior: "domain", path: "geosite/custom-ai.mrs", target: { kind: "module", id: "ai" } },
     ]);
 
     const beforeDuplicateAdd = getState();
@@ -207,7 +207,7 @@ describe("createProxyGroupActions", () => {
       name: "Custom AI IP",
       behavior: "ipcidr",
       path: "geoip/custom-ai.mrs",
-      target: "🤖 AI 服务",
+      target: { kind: "module", id: "ai" },
       noResolve: true,
     });
 
@@ -249,6 +249,12 @@ describe("createProxyGroupActions", () => {
     expect(getState().builtinRuleEdits).toEqual({
       "module:ai:openai": { target: "Custom", enabled: false },
     });
+
+    actions.restoreModuleRule("ai", "openai");
+
+    expect(getState().builtinRuleEdits).toEqual({
+      "module:ai:openai": { target: "Custom" },
+    });
   });
 
   it("keeps missing rule-set targets as no-ops and retargets moved builtin edits", () => {
@@ -279,7 +285,7 @@ describe("createProxyGroupActions", () => {
     actions.moveModuleRule("ai", "openai", { kind: "module", id: "youtube" });
     expect(getState().enabledProxyGroups).toContain("youtube");
     expect(getState().builtinRuleEdits).toEqual({
-      "module:ai:openai": { target: "📹 油管视频" },
+      "module:ai:openai": { target: { kind: "module", id: "youtube" } },
     });
   });
 
@@ -339,7 +345,7 @@ describe("createProxyGroupActions", () => {
 
     actions.moveModuleRule("streaming-west", "apple-tvplus", { kind: "module", id: "google" });
     expect(getState().ruleOrder).toContain(appleTvPlusKey);
-    expect(getState().builtinRuleEdits[appleTvPlusKey]).toEqual({ target: "🔍 谷歌服务" });
+    expect(getState().builtinRuleEdits[appleTvPlusKey]).toEqual({ target: { kind: "module", id: "google" } });
     expect(getAppliedOrder().indexOf(appleTvPlusKey)).toBe(appleTvPlusIndex);
     actions.resetModuleRuleTarget("streaming-west", "apple-tvplus");
     expect(getState().builtinRuleEdits).toEqual({});
@@ -366,7 +372,7 @@ describe("createProxyGroupActions", () => {
     ]);
 
     expect(getState().customRuleSets).toEqual([
-      { id: "custom", name: "custom", behavior: "ipcidr", path: "geoip/custom.mrs", target: "Custom Module", noResolve: true },
+      { id: "custom", name: "custom", behavior: "ipcidr", path: "geoip/custom.mrs", target: { kind: "custom", id: "custom-module" }, noResolve: true },
     ]);
 
     const beforePresetNoop = getState();
@@ -421,7 +427,7 @@ describe("createProxyGroupActions", () => {
         name: "Telegram",
         behavior: "ipcidr",
         path: "geoip/telegram.mrs",
-        target: "Custom",
+        target: { kind: "custom", id: "custom-1" },
         noResolve: true,
       },
     ]);
@@ -433,11 +439,11 @@ describe("createProxyGroupActions", () => {
     expect(getState().customRuleSets[0]).toMatchObject({
       id: "telegram",
       name: "Telegram Custom",
-      target: "Custom",
+      target: { kind: "custom", id: "custom-1" },
     });
 
     actions.moveModuleRule("custom-1", "telegram", { kind: "custom", id: "custom-2" });
-    expect(getState().customRuleSets[0].target).toBe("Target");
+    expect(getState().customRuleSets[0].target).toEqual({ kind: "custom", id: "custom-2" });
 
     actions.removeModuleRule("custom-2", "telegram");
     expect(getState().customRuleSets).toEqual([]);
@@ -447,7 +453,7 @@ describe("createProxyGroupActions", () => {
     const { actions, getState } = createHarness({
       builtinRuleEdits: {
         "module:ai:openai": { enabled: false },
-        "module:ai:anthropic": { enabled: false },
+        "module:ai:anthropic": { target: "Custom", enabled: false },
         "module:youtube:youtube": { enabled: false },
       },
       moduleRuleEditWarningAccepted: false,
@@ -455,11 +461,17 @@ describe("createProxyGroupActions", () => {
 
     actions.restoreModuleDefaultRules("ai");
     actions.restoreModuleDefaultRules("missing");
-    expect(getState().builtinRuleEdits).toEqual({ "module:youtube:youtube": { enabled: false } });
+    expect(getState().builtinRuleEdits).toEqual({
+      "module:ai:anthropic": { target: "Custom" },
+      "module:youtube:youtube": { enabled: false },
+    });
 
     actions.restoreModuleDefaultRules("");
     actions.restoreModuleDefaultRules("ai");
-    expect(getState().builtinRuleEdits).toEqual({ "module:youtube:youtube": { enabled: false } });
+    expect(getState().builtinRuleEdits).toEqual({
+      "module:ai:anthropic": { target: "Custom" },
+      "module:youtube:youtube": { enabled: false },
+    });
 
     actions.acceptModuleRuleEditWarning();
     expect(getState().moduleRuleEditWarningAccepted).toBe(true);
@@ -505,20 +517,22 @@ describe("createProxyGroupActions", () => {
     actions.moveModuleRule("ai", "openai", { kind: "module", id: "youtube" });
 
     expect(getState().enabledProxyGroups).toContain("youtube");
-    expect(getState().builtinRuleEdits).toEqual({ "module:ai:openai": { target: "📹 油管视频" } });
+    expect(getState().builtinRuleEdits).toEqual({
+      "module:ai:openai": { target: { kind: "module", id: "youtube" } },
+    });
 
     actions.moveModuleRule("ai", "anthropic", { kind: "custom", id: "custom-1" });
 
     expect(getState().customRuleSets).toEqual([]);
     expect(getState().builtinRuleEdits).toEqual({
-      "module:ai:openai": { target: "📹 油管视频" },
-      "module:ai:anthropic": { target: "Custom" },
+      "module:ai:openai": { target: { kind: "module", id: "youtube" } },
+      "module:ai:anthropic": { target: { kind: "custom", id: "custom-1" } },
     });
 
     actions.moveModuleRule("ai", "anthropic", { kind: "custom", id: "custom-1" });
     expect(getState().builtinRuleEdits).toEqual({
-      "module:ai:openai": { target: "📹 油管视频" },
-      "module:ai:anthropic": { target: "Custom" },
+      "module:ai:openai": { target: { kind: "module", id: "youtube" } },
+      "module:ai:anthropic": { target: { kind: "custom", id: "custom-1" } },
     });
 
     const beforeIgnoredMoves = getState();
@@ -546,7 +560,7 @@ describe("createProxyGroupActions", () => {
 
     expect(getState().enabledProxyGroups).toEqual(["select", "auto", "youtube"]);
     expect(getState().customRuleSets).toEqual([
-      { id: "custom-ai", name: "Custom AI", behavior: "domain", path: "geosite/custom-ai.mrs", target: "📹 油管视频" },
+      { id: "custom-ai", name: "Custom AI", behavior: "domain", path: "geosite/custom-ai.mrs", target: { kind: "module", id: "youtube" } },
     ]);
   });
 
@@ -594,7 +608,9 @@ describe("createProxyGroupActions", () => {
     actions.moveModuleRule("private", "private-ip", { kind: "custom", id: "custom-1" });
 
     expect(getState().customRuleSets).toEqual([]);
-    expect(getState().builtinRuleEdits).toEqual({ "module:private:private-ip": { target: "Custom" } });
+    expect(getState().builtinRuleEdits).toEqual({
+      "module:private:private-ip": { target: { kind: "custom", id: "custom-1" } },
+    });
   });
 
   it("renames non-core module groups and rewrites custom rule targets", () => {
diff --git a/packages/ui/src/store/config-store/actions/proxy-group-actions.ts b/packages/ui/src/store/config-store/actions/proxy-group-actions.ts
index ae03821..3d85e1a 100644
--- a/packages/ui/src/store/config-store/actions/proxy-group-actions.ts
+++ b/packages/ui/src/store/config-store/actions/proxy-group-actions.ts
@@ -1,5 +1,7 @@
 import {
+  type CustomProxyGroup,
   type CustomRuleSet,
+  type ProxyGroupTargetRef,
 } from "@subboost/core/types/config";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
 import { PROXY_GROUP_MODULES } from "@subboost/core/generator/proxy-groups";
@@ -15,6 +17,7 @@ import {
   resolveMoveTargetName,
   resolveRuleSetContainerTargetName,
   retargetBuiltinRuleEdits,
+  ruleTargetMatchesContainer,
   updateBuiltinRuleEdit,
 } from "./proxy-group-rule-set-helpers";
 
@@ -63,6 +66,14 @@ function isSupportedProxyGroupOrderKey(key: string): boolean {
   );
 }
 
+function resolveRuleSetContainerTargetRef(
+  id: string,
+  customProxyGroups: CustomProxyGroup[],
+): ProxyGroupTargetRef | null {
+  if (isBuiltinProxyGroup(id)) return { kind: "module", id };
+  return customProxyGroups.some((group) => group.id === id) ? { kind: "custom", id } : null;
+}
+
 export function createProxyGroupActions(
   _set: SetState,
   _get: GetState,
@@ -172,7 +183,8 @@ export function createProxyGroupActions(
           state.customProxyGroups,
           state.proxyGroupNameOverrides,
         );
-        if (!target) return state;
+        const targetRef = resolveRuleSetContainerTargetRef(id, state.customProxyGroups);
+        if (!target || !targetRef) return state;
         const proxyModule = PROXY_GROUP_MODULES.find((item) => item.id === id);
         let nextBuiltinRuleEdits = state.builtinRuleEdits;
         const customDrafts: RuleSetDraft[] = [];
@@ -189,7 +201,7 @@ export function createProxyGroupActions(
           }
           customDrafts.push(normalized);
         }
-        const nextCustomRuleSets = appendUniqueCustomRuleSets(state.customRuleSets, customDrafts, target);
+        const nextCustomRuleSets = appendUniqueCustomRuleSets(state.customRuleSets, customDrafts, targetRef);
         if (
           nextCustomRuleSets.length === state.customRuleSets.length &&
           nextBuiltinRuleEdits === state.builtinRuleEdits
@@ -222,8 +234,11 @@ export function createProxyGroupActions(
           state.customProxyGroups,
           state.proxyGroupNameOverrides,
         );
-        if (!target) return state;
-        const index = state.customRuleSets.findIndex((item) => item.id === rid && item.target === target);
+        const targetRef = resolveRuleSetContainerTargetRef(id, state.customProxyGroups);
+        if (!target || !targetRef) return state;
+        const index = state.customRuleSets.findIndex(
+          (item) => item.id === rid && ruleTargetMatchesContainer(item.target, targetRef, target),
+        );
         if (index < 0) return state;
 
         const normalized = normalizeRuleSetDraft({
@@ -234,7 +249,7 @@ export function createProxyGroupActions(
         if (!normalized) return state;
 
         const nextCustomRuleSets = state.customRuleSets.map((item, itemIndex) =>
-          itemIndex === index ? { ...normalized, target } : item
+          itemIndex === index ? { ...normalized, target: targetRef } : item
         );
 
         return {
@@ -271,8 +286,9 @@ export function createProxyGroupActions(
           state.customProxyGroups,
           state.proxyGroupNameOverrides,
         );
-        if (!target) return state;
-        const movedBuiltinKey = findBuiltinRuleEditKeyByTarget(state.builtinRuleEdits, target, rid);
+        const targetRef = resolveRuleSetContainerTargetRef(id, state.customProxyGroups);
+        if (!target || !targetRef) return state;
+        const movedBuiltinKey = findBuiltinRuleEditKeyByTarget(state.builtinRuleEdits, targetRef, target, rid);
         if (movedBuiltinKey) {
           const nextBuiltinRuleEdits = updateBuiltinRuleEdit(state.builtinRuleEdits, movedBuiltinKey, { enabled: false });
           return {
@@ -284,7 +300,7 @@ export function createProxyGroupActions(
           };
         }
         const nextCustomRuleSets = state.customRuleSets.filter(
-          (ruleSet) => !(ruleSet.id === rid && ruleSet.target === target)
+          (ruleSet) => !(ruleSet.id === rid && ruleTargetMatchesContainer(ruleSet.target, targetRef, target))
         );
         if (nextCustomRuleSets.length === state.customRuleSets.length) return state;
         return {
@@ -317,7 +333,8 @@ export function createProxyGroupActions(
           state.customProxyGroups,
           state.proxyGroupNameOverrides,
         );
-        if (!sourceTarget) return state;
+        const sourceTargetRef = resolveRuleSetContainerTargetRef(sourceId, state.customProxyGroups);
+        if (!sourceTarget || !sourceTargetRef) return state;
         if (sourceTarget === targetName) return state;
         if (target.kind === "module" && targetId === sourceId) return state;
 
@@ -330,7 +347,8 @@ export function createProxyGroupActions(
         }
 
         const customRuleSetIndex = state.customRuleSets.findIndex(
-          (ruleSet) => ruleSet.id === rid && ruleSet.target === sourceTarget
+          (ruleSet) =>
+            ruleSet.id === rid && ruleTargetMatchesContainer(ruleSet.target, sourceTargetRef, sourceTarget)
         );
         if (customRuleSetIndex >= 0) {
           const targetModule = target.kind === "module"
@@ -350,13 +368,13 @@ export function createProxyGroupActions(
               (ruleSet, index) =>
                 index !== customRuleSetIndex &&
                 ruleSet.id === rid &&
-                ruleSet.target === targetName
+                ruleTargetMatchesContainer(ruleSet.target, target, targetName)
             )
           ) {
             nextCustomRuleSets = state.customRuleSets.filter((_, index) => index !== customRuleSetIndex);
           } else {
             nextCustomRuleSets = state.customRuleSets.map((ruleSet, index) =>
-              index === customRuleSetIndex ? { ...ruleSet, target: targetName } : ruleSet
+              index === customRuleSetIndex ? { ...ruleSet, target } : ruleSet
             );
           }
           return {
@@ -372,10 +390,15 @@ export function createProxyGroupActions(
           };
         }
 
-        const movedBuiltinKey = findBuiltinRuleEditKeyByTarget(state.builtinRuleEdits, sourceTarget, rid);
+        const movedBuiltinKey = findBuiltinRuleEditKeyByTarget(
+          state.builtinRuleEdits,
+          sourceTargetRef,
+          sourceTarget,
+          rid,
+        );
         if (movedBuiltinKey) {
           const nextBuiltinRuleEdits = updateBuiltinRuleEdit(state.builtinRuleEdits, movedBuiltinKey, {
-            target: targetName,
+            target,
             enabled: true,
           });
           return {
@@ -392,7 +415,7 @@ export function createProxyGroupActions(
         if (!sourceModule || !isPresetModuleRule(sourceModule, rid)) return state;
         const key = getModuleRuleOrderKey(sourceId, rid);
         const nextBuiltinRuleEdits = updateBuiltinRuleEdit(state.builtinRuleEdits, key, {
-          target: targetName,
+          target,
           enabled: true,
         });
         return {
@@ -417,8 +440,11 @@ export function createProxyGroupActions(
         if (!mod || !isPresetModuleRule(mod, rid)) return state;
 
         const key = getModuleRuleOrderKey(id, rid);
-        if (state.builtinRuleEdits?.[key]?.enabled !== false) return state;
-        const nextBuiltinRuleEdits = updateBuiltinRuleEdit(state.builtinRuleEdits, key, { enabled: true });
+        const currentEdit = state.builtinRuleEdits?.[key];
+        if (currentEdit?.enabled !== false) return state;
+        const nextBuiltinRuleEdits = updateBuiltinRuleEdit(state.builtinRuleEdits, key, {
+          enabled: true,
+        });
         return {
           builtinRuleEdits: nextBuiltinRuleEdits,
           ruleOrder: normalizeRuleOrderForState({
@@ -459,7 +485,9 @@ export function createProxyGroupActions(
         for (const rule of proxyModule.rules) {
           const key = getModuleRuleOrderKey(id, rule.id);
           if (nextBuiltinRuleEdits?.[key]?.enabled === false) {
-            nextBuiltinRuleEdits = updateBuiltinRuleEdit(nextBuiltinRuleEdits, key, { enabled: true });
+            nextBuiltinRuleEdits = updateBuiltinRuleEdit(nextBuiltinRuleEdits, key, {
+              enabled: true,
+            });
           }
         }
         if (nextBuiltinRuleEdits === state.builtinRuleEdits) return state;
diff --git a/packages/ui/src/store/config-store/actions/proxy-group-rule-set-helpers.ts b/packages/ui/src/store/config-store/actions/proxy-group-rule-set-helpers.ts
index 08f9442..2286d37 100644
--- a/packages/ui/src/store/config-store/actions/proxy-group-rule-set-helpers.ts
+++ b/packages/ui/src/store/config-store/actions/proxy-group-rule-set-helpers.ts
@@ -1,11 +1,14 @@
 import { PROXY_GROUP_MODULES } from "@subboost/core/generator/proxy-groups";
 import { normalizePersistedRuleOrder } from "@subboost/core/generator/rules";
 import { resolveProxyGroupModuleName } from "@subboost/core/proxy-group-name";
+import { normalizeProxyGroupTargetRef } from "@subboost/core/proxy-group-targets";
 import { isValidRuleSetPathOrUrl, normalizeRuleSetPathInput } from "@subboost/core/rules/rule-model";
 import type {
   BuiltinRuleEdits,
   CustomProxyGroup,
   CustomRuleSet,
+  ProxyGroupRuleTarget,
+  ProxyGroupTargetRef,
   RuleSetBehavior,
 } from "@subboost/core/types/config";
 import type { RuleSetDraft } from "../definitions";
@@ -82,7 +85,8 @@ export function resolveRuleSetContainerTargetName(
 export function compactBuiltinRuleEdits(edits: BuiltinRuleEdits): BuiltinRuleEdits {
   const next: BuiltinRuleEdits = {};
   for (const [key, edit] of Object.entries(edits || {})) {
-    const target = typeof edit?.target === "string" ? edit.target.trim() : "";
+    const target = normalizeProxyGroupTargetRef(edit?.target) ??
+      (typeof edit?.target === "string" ? edit.target.trim() : "");
     const enabled = edit?.enabled === false ? false : undefined;
     if (!target && enabled !== false) continue;
     next[key] = {
@@ -96,12 +100,13 @@ export function compactBuiltinRuleEdits(edits: BuiltinRuleEdits): BuiltinRuleEdi
 export function updateBuiltinRuleEdit(
   edits: BuiltinRuleEdits,
   key: string,
-  patch: { target?: string | null; enabled?: false | true | null }
+  patch: { target?: ProxyGroupRuleTarget | null; enabled?: false | true | null }
 ): BuiltinRuleEdits {
   const prev = edits?.[key] || {};
   const next = { ...prev };
   if ("target" in patch) {
-    const target = typeof patch.target === "string" ? patch.target.trim() : "";
+    const target = normalizeProxyGroupTargetRef(patch.target) ??
+      (typeof patch.target === "string" ? patch.target.trim() : "");
     if (target) next.target = target;
     else delete next.target;
   }
@@ -129,12 +134,13 @@ export function retargetBuiltinRuleEdits(edits: BuiltinRuleEdits, from: string,
 
 export function findBuiltinRuleEditKeyByTarget(
   edits: BuiltinRuleEdits,
-  target: string,
+  target: ProxyGroupTargetRef,
+  legacyTargetName: string,
   ruleId: string
 ): string | null {
-  if (!target || !ruleId) return null;
+  if (!target.id || !legacyTargetName || !ruleId) return null;
   for (const [key, edit] of Object.entries(edits || {})) {
-    if (edit?.target !== target) continue;
+    if (!ruleTargetMatchesContainer(edit?.target, target, legacyTargetName)) continue;
     const parts = key.split(":");
     if (parts.length !== 3 || parts[0] !== "module") continue;
     if (parts[2] === ruleId) return key;
@@ -145,7 +151,7 @@ export function findBuiltinRuleEditKeyByTarget(
 export function appendUniqueCustomRuleSets(
   existing: CustomRuleSet[],
   drafts: RuleSetDraft[],
-  target: string
+  target: ProxyGroupRuleTarget
 ): CustomRuleSet[] {
   const seen = new Set(existing.map((item) => item.id));
   const next = [...existing];
@@ -157,3 +163,13 @@ export function appendUniqueCustomRuleSets(
   }
   return next;
 }
+
+export function ruleTargetMatchesContainer(
+  target: ProxyGroupRuleTarget | undefined,
+  container: ProxyGroupTargetRef,
+  legacyTargetName: string
+): boolean {
+  const ref = normalizeProxyGroupTargetRef(target);
+  if (ref) return ref.kind === container.kind && ref.id === container.id;
+  return typeof target === "string" && target.trim() === legacyTargetName.trim();
+}
diff --git a/packages/ui/src/store/config-store/actions/template-actions.ts b/packages/ui/src/store/config-store/actions/template-actions.ts
index 206bdcd..d0d1781 100644
--- a/packages/ui/src/store/config-store/actions/template-actions.ts
+++ b/packages/ui/src/store/config-store/actions/template-actions.ts
@@ -5,6 +5,7 @@ import { normalizePersistedRuleOrder } from "@subboost/core/generator/rules";
 import { PROXY_GROUP_MODULES } from "@subboost/core/generator/proxy-groups";
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
+import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 import type { ConfigActions, SubBoostTemplateConfig } from "../definitions";
 import type { GetState, SetAndGenerateConfig, SetState } from "../store-types";
 
@@ -79,8 +80,10 @@ export function createTemplateActions(
     // 应用模板配置（从模板库应用）
     applyTemplateConfig: (config: SubBoostTemplateConfig) => {
       if (!config || typeof config !== "object") return;
+      const migratedConfig = migrateLegacyConfig(config) as SubBoostTemplateConfig;
 
       setAndGenerateConfig((state) => {
+        const config = migratedConfig;
         const ruleModel = normalizeRuleModelFromConfig(config);
         const hasCustomProxyGroups = Array.isArray(config.customProxyGroups);
         const hasCustomRuleSets = Array.isArray(config.customRuleSets);
diff --git a/packages/ui/src/store/config-store/auth-handoff.ts b/packages/ui/src/store/config-store/auth-handoff.ts
index 79cee51..f1585c8 100644
--- a/packages/ui/src/store/config-store/auth-handoff.ts
+++ b/packages/ui/src/store/config-store/auth-handoff.ts
@@ -3,6 +3,7 @@ import { initialState } from "./definitions";
 import { safeParseJsonObject } from "@subboost/core/json";
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
+import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 
 export const AUTH_CONFIG_HANDOFF_STORAGE_NAME = "subboost-auth-config-handoff";
 
@@ -171,8 +172,10 @@ function buildHandoffState(state: ConfigState): Partial<ConfigState> {
   };
 }
 
-function normalizeHandoffState(raw: unknown): Partial<ConfigState> | null {
-  if (!isRecord(raw)) return null;
+function normalizeHandoffState(rawValue: unknown): Partial<ConfigState> | null {
+  const migratedRaw = migrateLegacyConfig(rawValue);
+  if (!isRecord(migratedRaw)) return null;
+  const raw = migratedRaw;
   const out: Partial<ConfigState> = {};
 
   const sources = sourceArray(raw.sources);

From b485967cb600dc11056f655f8f0992e8488d7f98 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Mon, 13 Jul 2026 19:58:48 +0800
Subject: [PATCH 02/36] fix: strengthen local runtime safeguards

---
 README-CN.md                                  |   6 +
 README.md                                     |   6 +
 local/Dockerfile                              |  28 +-
 local/app/api/auth/local-auth-routes.test.ts  |   2 +
 local/app/api/auth/login/route.ts             |  26 ++
 local/app/api/setup/admin/route.test.ts       |  30 ++
 local/app/api/setup/admin/route.ts            |  22 +-
 .../[id]/config.yaml/route.test.ts            |  73 ++++
 .../subscriptions/[id]/config.yaml/route.ts   |  19 +
 local/local.env.example                       |   2 +
 local/package.json                            |   4 +-
 local/prisma/schema.prisma                    |   2 +-
 local/src/lib/cron-auth.ts                    |   2 +-
 local/src/lib/http.ts                         |   1 +
 local/src/lib/rate-limit.test.ts              |  39 +++
 local/src/lib/rate-limit.ts                   |  64 ++++
 local/src/lib/subscription-service.test.ts    |  25 ++
 local/src/lib/subscription-service.ts         |   8 +-
 local/test/cron-route-contract.test.ts        |   3 +-
 package-lock.json                             | 200 +----------
 package.json                                  |   2 -
 packages/ui/package.json                      |   2 -
 packages/ui/src/components/ui/accordion.tsx   |  56 ---
 packages/ui/src/components/ui/dialog.tsx      |   4 +-
 .../ui/more-basic-components.test.ts          |   7 +-
 .../src/components/ui/radix-wrappers.test.ts  |  18 +-
 packages/ui/src/components/ui/select.tsx      |   3 +-
 packages/ui/src/components/ui/separator.tsx   |  31 --
 .../converter/sections/basic-sections.test.ts | 168 ---------
 .../converter/sections/dns-config-section.tsx |  52 ---
 .../src/product/converter/sections/index.ts   |   6 -
 .../sections/node-filter-section.tsx          |  91 -----
 .../sections/node-input-section.test.ts       | 297 ----------------
 .../converter/sections/node-input-section.tsx | 327 ------------------
 .../converter/sections/section-header.tsx     |  37 --
 .../src/product/home/unsaved-prompt.test.ts   | 121 +------
 .../ui/src/product/home/unsaved-prompt.tsx    | 113 +-----
 .../product/preview/diff-highlight.test.ts    |  29 +-
 .../ui/src/product/preview/diff-highlight.tsx | 205 -----------
 39 files changed, 372 insertions(+), 1759 deletions(-)
 create mode 100644 local/app/api/subscriptions/[id]/config.yaml/route.test.ts
 create mode 100644 local/src/lib/rate-limit.test.ts
 create mode 100644 local/src/lib/rate-limit.ts
 delete mode 100644 packages/ui/src/components/ui/accordion.tsx
 delete mode 100644 packages/ui/src/components/ui/separator.tsx
 delete mode 100644 packages/ui/src/product/converter/sections/basic-sections.test.ts
 delete mode 100644 packages/ui/src/product/converter/sections/dns-config-section.tsx
 delete mode 100644 packages/ui/src/product/converter/sections/index.ts
 delete mode 100644 packages/ui/src/product/converter/sections/node-filter-section.tsx
 delete mode 100644 packages/ui/src/product/converter/sections/node-input-section.test.ts
 delete mode 100644 packages/ui/src/product/converter/sections/node-input-section.tsx
 delete mode 100644 packages/ui/src/product/converter/sections/section-header.tsx

diff --git a/README-CN.md b/README-CN.md
index dfe967a..ce6b202 100644
--- a/README-CN.md
+++ b/README-CN.md
@@ -39,6 +39,12 @@
 - 部署文档：[高级部署 - 编译源码构建，速度慢配置要求高](https://docs.subboost.org/deploy/advanced)
 - 配置教程：[草履虫也能学会的 Clash 配置：UI 界面一键配置精确分流、链式代理](https://ryanvan.com/t/topic/59?u=ryan)
 
+## 订阅链接安全
+
+完整的订阅链接及其中的 token 属于“持有者即可使用”的访问凭证。任何拿到完整链接的人，都可能读取对应的生成配置并使用该订阅。请像保管密码一样保管它，不要把完整链接放进公开仓库、Issue、聊天记录、截图或日志；怀疑泄漏时，应立即删除并重新创建相应订阅，以更换 token。
+
+通过该 token 发起的请求会按订阅所属用户计入访问和风控记录。这是预期的权限模型，因此订阅所有者有责任避免完整链接泄漏。
+
 ## 开发说明
 
 开发者可以从源码启动本地开发环境：
diff --git a/README.md b/README.md
index caa58fa..f1f1d2c 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,12 @@
 - Deployment docs: [Advanced deployment - compiles from source, slower with higher requirements](https://docs.subboost.org/deploy/advanced)
 - Configuration guide: [Clash configuration simple enough for a paramecium: configure precise routing and chained proxies from the UI in one click](https://ryanvan.com/t/topic/59?u=ryan)
 
+## Subscription Link Security
+
+A complete subscription URL and its token are bearer credentials: anyone who obtains the full URL may read the generated configuration and use that subscription. Protect it like a password. Never place the complete URL in public repositories, issues, chat messages, screenshots, or logs. If exposure is suspected, delete and recreate the affected subscription to issue a new token.
+
+Requests made with a token are attributed to the user who owns the subscription for access controls and abuse prevention. This is the intended authorization model, so subscription owners are responsible for keeping complete subscription URLs confidential.
+
 ## Development Notes
 
 Developers can start a local development environment from source:
diff --git a/local/Dockerfile b/local/Dockerfile
index c361758..21c5173 100644
--- a/local/Dockerfile
+++ b/local/Dockerfile
@@ -2,14 +2,14 @@ FROM node:22-alpine AS deps
 WORKDIR /package
 RUN apk add --no-cache openssl
 
+COPY package.json package-lock.json ./
 COPY packages/core packages/core
 COPY packages/server-core packages/server-core
 COPY packages/ui packages/ui
 COPY packages/config packages/config
-COPY local/package*.json local/
+COPY local/package.json local/package.json
 
-WORKDIR /package/local
-RUN npm install
+RUN npm ci
 
 FROM node:22-alpine AS builder
 WORKDIR /package
@@ -24,8 +24,7 @@ ENV APP_BUILD_SHA=${APP_BUILD_SHA}
 ENV APP_VERSION=${APP_VERSION}
 ENV APP_VERSION_TOKEN=${APP_VERSION_TOKEN}
 
-COPY --from=deps /package/local/node_modules local/node_modules
-RUN ln -s local/node_modules node_modules
+COPY --from=deps /package/node_modules node_modules
 COPY packages/core packages/core
 COPY packages/server-core packages/server-core
 COPY packages/ui packages/ui
@@ -35,6 +34,9 @@ COPY local local
 WORKDIR /package/local
 RUN npm run build
 
+FROM deps AS production-deps
+RUN npm prune --omit=dev
+
 FROM node:22-alpine AS runner
 WORKDIR /app
 ENV NODE_ENV=production
@@ -48,14 +50,14 @@ ENV APP_VERSION=${APP_VERSION}
 ENV APP_VERSION_TOKEN=${APP_VERSION_TOKEN}
 RUN apk add --no-cache openssl
 
-COPY --from=builder /package/local/.next/standalone ./
-COPY --from=deps /package/local/node_modules local/node_modules
-COPY --from=builder /package/local/.next/static local/.next/static
-COPY --from=builder /package/local/public local/public
-COPY --from=builder /package/local/prisma.config.ts local/prisma.config.ts
-COPY --from=builder /package/local/prisma local/prisma
-RUN if [ ! -e node_modules ] && [ -d local/node_modules ]; then ln -s local/node_modules node_modules; fi
+COPY --chown=node:node --from=builder /package/local/.next/standalone ./
+COPY --chown=node:node --from=production-deps /package/node_modules ./node_modules
+COPY --chown=node:node --from=builder /package/local/.next/static local/.next/static
+COPY --chown=node:node --from=builder /package/local/public local/public
+COPY --chown=node:node --from=builder /package/local/prisma.config.ts local/prisma.config.ts
+COPY --chown=node:node --from=builder /package/local/prisma local/prisma
 
 WORKDIR /app/local
+USER node
 EXPOSE 3000
-CMD ["sh", "-c", "./node_modules/.bin/prisma migrate deploy --schema prisma/schema.prisma && node server.js"]
+CMD ["sh", "-c", "../node_modules/.bin/prisma migrate deploy --schema prisma/schema.prisma && node server.js"]
diff --git a/local/app/api/auth/local-auth-routes.test.ts b/local/app/api/auth/local-auth-routes.test.ts
index b419970..e793ea2 100644
--- a/local/app/api/auth/local-auth-routes.test.ts
+++ b/local/app/api/auth/local-auth-routes.test.ts
@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
+import { clearLocalRateLimitsForTests } from "@local/lib/rate-limit";
 
 const mocks = vi.hoisted(() => ({
   bcryptCompare: vi.fn(),
@@ -49,6 +50,7 @@ async function readJson(response: Response) {
 describe("local auth and health routes", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    clearLocalRateLimitsForTests();
   });
 
   it("logs in a valid local admin and sets the session cookie", async () => {
diff --git a/local/app/api/auth/login/route.ts b/local/app/api/auth/login/route.ts
index 949a36b..7a59498 100644
--- a/local/app/api/auth/login/route.ts
+++ b/local/app/api/auth/login/route.ts
@@ -3,13 +3,37 @@ import { NextResponse } from "next/server";
 import { apiError, getStringField, readJsonBody } from "@local/lib/http";
 import { prisma } from "@local/lib/prisma";
 import { sessionCookieOptions, signSession, SESSION_COOKIE } from "@local/lib/session";
+import {
+  consumeLocalRateLimit,
+  hashLocalRateLimitKey,
+  localRateLimitResponse,
+  resetLocalRateLimit,
+} from "@local/lib/rate-limit";
+
+const LOGIN_WINDOW_MS = 15 * 60 * 1000;
 
 export async function POST(request: Request) {
+  const globalLimit = consumeLocalRateLimit("auth-login-global", "all", {
+    limit: 30,
+    windowMs: LOGIN_WINDOW_MS,
+  });
+  if (!globalLimit.allowed) {
+    return localRateLimitResponse("Too many login attempts. Try again later.", globalLimit.retryAfterSeconds);
+  }
+
   const body = await readJsonBody(request);
   if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
 
   const username = getStringField(body, "username");
   const password = getStringField(body, "password");
+  const usernameLimitKey = hashLocalRateLimitKey(username.toLowerCase() || "missing");
+  const usernameLimit = consumeLocalRateLimit("auth-login-username", usernameLimitKey, {
+    limit: 8,
+    windowMs: LOGIN_WINDOW_MS,
+  });
+  if (!usernameLimit.allowed) {
+    return localRateLimitResponse("Too many login attempts. Try again later.", usernameLimit.retryAfterSeconds);
+  }
   const admin = username
     ? await prisma.localAdmin.findUnique({ where: { username }, select: { id: true, username: true, passwordHash: true } })
     : null;
@@ -18,6 +42,8 @@ export async function POST(request: Request) {
     return apiError("Invalid username or password.", "UNAUTHORIZED", 401);
   }
 
+  resetLocalRateLimit("auth-login-username", usernameLimitKey);
+
   await prisma.localAdmin.update({ where: { id: admin.id }, data: { lastLoginAt: new Date() } });
   const response = NextResponse.json({ success: true, user: { id: admin.id, username: admin.username } });
   response.cookies.set(SESSION_COOKIE, await signSession({ adminId: admin.id, username: admin.username }), sessionCookieOptions());
diff --git a/local/app/api/setup/admin/route.test.ts b/local/app/api/setup/admin/route.test.ts
index 0c52218..c1c9e8a 100644
--- a/local/app/api/setup/admin/route.test.ts
+++ b/local/app/api/setup/admin/route.test.ts
@@ -7,6 +7,8 @@ const mocks = vi.hoisted(() => ({
   getStringField: vi.fn((body: Record<string, unknown>, key: string) => (typeof body[key] === "string" ? String(body[key]).trim() : "")),
   count: vi.fn(),
   create: vi.fn(),
+  queryRaw: vi.fn(),
+  transaction: vi.fn(),
   signSession: vi.fn(),
   sessionCookieOptions: vi.fn(),
 }));
@@ -19,6 +21,7 @@ vi.mock("@local/lib/http", () => ({
 }));
 vi.mock("@local/lib/prisma", () => ({
   prisma: {
+    $transaction: mocks.transaction,
     localAdmin: {
       count: mocks.count,
       create: mocks.create,
@@ -32,6 +35,7 @@ vi.mock("@local/lib/session", () => ({
 }));
 
 import { POST } from "./route";
+import { clearLocalRateLimitsForTests } from "@local/lib/rate-limit";
 
 async function readJson(response: Response) {
   return { status: response.status, body: await response.json(), headers: response.headers };
@@ -40,9 +44,14 @@ async function readJson(response: Response) {
 describe("local setup admin route", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    clearLocalRateLimitsForTests();
     mocks.count.mockResolvedValue(0);
     mocks.hash.mockResolvedValue("hash");
     mocks.create.mockResolvedValue({ id: "admin-1", username: "ry" });
+    mocks.transaction.mockImplementation(async (callback) => callback({
+      $queryRaw: mocks.queryRaw,
+      localAdmin: { count: mocks.count, create: mocks.create },
+    }));
     mocks.signSession.mockResolvedValue("signed-session");
     mocks.sessionCookieOptions.mockReturnValue({ httpOnly: true, path: "/" });
   });
@@ -99,4 +108,25 @@ describe("local setup admin route", () => {
     expect(mocks.signSession).toHaveBeenCalledWith({ adminId: "admin-1", username: "ry" });
     expect(result.headers.get("set-cookie")).toContain("subboost_local_session=signed-session");
   });
+
+  it("rechecks setup state under a database lock", async () => {
+    mocks.readJsonBody.mockResolvedValue({
+      username: "ry",
+      password: "long-password",
+      passwordConfirm: "long-password",
+    });
+    mocks.count.mockResolvedValueOnce(0).mockResolvedValueOnce(1);
+
+    const result = await readJson(await POST(new Request("https://local.test/api/setup/admin")));
+
+    expect(result).toMatchObject({
+      status: 409,
+      body: { error: "已有管理员账号，请直接登录", code: "CONFLICT" },
+    });
+    expect(mocks.queryRaw).toHaveBeenCalledWith(
+      expect.arrayContaining(["SELECT pg_advisory_xact_lock(", ")"]),
+      1_397_704_283
+    );
+    expect(mocks.create).not.toHaveBeenCalled();
+  });
 });
diff --git a/local/app/api/setup/admin/route.ts b/local/app/api/setup/admin/route.ts
index 3b57f55..5159ad4 100644
--- a/local/app/api/setup/admin/route.ts
+++ b/local/app/api/setup/admin/route.ts
@@ -4,8 +4,17 @@ import { getLocalAdminSetupCredentialError, LOCAL_ADMIN_CREDENTIAL_MESSAGES } fr
 import { apiError, getStringField, readJsonBody } from "@local/lib/http";
 import { prisma } from "@local/lib/prisma";
 import { sessionCookieOptions, signSession, SESSION_COOKIE } from "@local/lib/session";
+import { consumeLocalRateLimit, localRateLimitResponse } from "@local/lib/rate-limit";
 
 export async function POST(request: Request) {
+  const setupLimit = consumeLocalRateLimit("admin-setup", "all", {
+    limit: 5,
+    windowMs: 15 * 60 * 1000,
+  });
+  if (!setupLimit.allowed) {
+    return localRateLimitResponse("Too many setup attempts. Try again later.", setupLimit.retryAfterSeconds);
+  }
+
   const body = await readJsonBody(request);
   if (!body) return apiError(LOCAL_ADMIN_CREDENTIAL_MESSAGES.invalidJson, "BAD_REQUEST", 400);
 
@@ -23,10 +32,17 @@ export async function POST(request: Request) {
   }
 
   const passwordHash = await bcrypt.hash(password, 12);
-  const admin = await prisma.localAdmin.create({
-    data: { username, passwordHash, lastLoginAt: new Date() },
-    select: { id: true, username: true },
+  const admin = await prisma.$transaction(async (transaction) => {
+    await transaction.$queryRaw`SELECT pg_advisory_xact_lock(${1_397_704_283})`;
+    if (await transaction.localAdmin.count()) return null;
+    return transaction.localAdmin.create({
+      data: { username, passwordHash, lastLoginAt: new Date() },
+      select: { id: true, username: true },
+    });
   });
+  if (!admin) {
+    return apiError(LOCAL_ADMIN_CREDENTIAL_MESSAGES.adminExists, "CONFLICT", 409);
+  }
 
   const response = NextResponse.json({
     success: true,
diff --git a/local/app/api/subscriptions/[id]/config.yaml/route.test.ts b/local/app/api/subscriptions/[id]/config.yaml/route.test.ts
new file mode 100644
index 0000000..6008a39
--- /dev/null
+++ b/local/app/api/subscriptions/[id]/config.yaml/route.test.ts
@@ -0,0 +1,73 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  consumeLocalRateLimit: vi.fn(),
+  generateSubscriptionYaml: vi.fn(),
+  hashLocalRateLimitKey: vi.fn(() => "token-hash"),
+  localRateLimitResponse: vi.fn(
+    () => new Response(JSON.stringify({ error: "limited", code: "RATE_LIMITED" }), { status: 429 })
+  ),
+}));
+
+vi.mock("@local/lib/rate-limit", () => ({
+  consumeLocalRateLimit: mocks.consumeLocalRateLimit,
+  hashLocalRateLimitKey: mocks.hashLocalRateLimitKey,
+  localRateLimitResponse: mocks.localRateLimitResponse,
+}));
+vi.mock("@local/lib/subscription-service", () => ({
+  generateSubscriptionYaml: mocks.generateSubscriptionYaml,
+}));
+
+import { GET } from "./route";
+
+describe("local subscription YAML route", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.consumeLocalRateLimit.mockReturnValue({ allowed: true, retryAfterSeconds: 0 });
+    mocks.generateSubscriptionYaml.mockResolvedValue({
+      yaml: "mixed-port: 7890\n",
+      name: "Test",
+      subscriptionInfo: {},
+      cacheExpirySeconds: 3600,
+      autoUpdateIntervalSeconds: null,
+      isAdmin: true,
+    });
+  });
+
+  it("applies global and per-token limits before generating YAML", async () => {
+    const response = await GET(new Request("https://local.test/config.yaml"), {
+      params: Promise.resolve({ id: "secret-token" }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(mocks.hashLocalRateLimitKey).toHaveBeenCalledWith("secret-token");
+    expect(mocks.consumeLocalRateLimit).toHaveBeenNthCalledWith(
+      1,
+      "subscription-yaml-global",
+      "all",
+      { limit: 600, windowMs: 60_000 }
+    );
+    expect(mocks.consumeLocalRateLimit).toHaveBeenNthCalledWith(
+      2,
+      "subscription-yaml-token",
+      "token-hash",
+      { limit: 120, windowMs: 60_000 }
+    );
+    expect(mocks.generateSubscriptionYaml).toHaveBeenCalledWith("secret-token");
+  });
+
+  it("returns 429 before touching subscription data", async () => {
+    mocks.consumeLocalRateLimit.mockReturnValueOnce({ allowed: false, retryAfterSeconds: 17 });
+
+    const response = await GET(new Request("https://local.test/config.yaml"), {
+      params: Promise.resolve({ id: "secret-token" }),
+    });
+
+    expect(response.status).toBe(429);
+    expect(mocks.localRateLimitResponse).toHaveBeenCalledWith(
+      "Too many subscription requests. Try again later.",
+      17
+    );
+    expect(mocks.generateSubscriptionYaml).not.toHaveBeenCalled();
+  });
+});
diff --git a/local/app/api/subscriptions/[id]/config.yaml/route.ts b/local/app/api/subscriptions/[id]/config.yaml/route.ts
index 38b8257..0a7d255 100644
--- a/local/app/api/subscriptions/[id]/config.yaml/route.ts
+++ b/local/app/api/subscriptions/[id]/config.yaml/route.ts
@@ -1,6 +1,11 @@
 import { apiError } from "@local/lib/http";
 import { generateSubscriptionYaml } from "@local/lib/subscription-service";
 import { buildSubscriptionResponseHeaders } from "@subboost/server-core/subscription";
+import {
+  consumeLocalRateLimit,
+  hashLocalRateLimitKey,
+  localRateLimitResponse,
+} from "@local/lib/rate-limit";
 
 type RouteContext = {
   params: Promise<{ id: string }>;
@@ -8,6 +13,20 @@ type RouteContext = {
 
 export async function GET(_request: Request, { params }: RouteContext) {
   const { id: token } = await params;
+  const globalLimit = consumeLocalRateLimit("subscription-yaml-global", "all", {
+    limit: 600,
+    windowMs: 60_000,
+  });
+  if (!globalLimit.allowed) {
+    return localRateLimitResponse("Too many subscription requests. Try again later.", globalLimit.retryAfterSeconds);
+  }
+  const tokenLimit = consumeLocalRateLimit("subscription-yaml-token", hashLocalRateLimitKey(token), {
+    limit: 120,
+    windowMs: 60_000,
+  });
+  if (!tokenLimit.allowed) {
+    return localRateLimitResponse("Too many subscription requests. Try again later.", tokenLimit.retryAfterSeconds);
+  }
   const result = await generateSubscriptionYaml(token);
   if (!result) return apiError("Subscription YAML not found.", "NOT_FOUND", 404);
   return new Response(result.yaml, {
diff --git a/local/local.env.example b/local/local.env.example
index ac3b24f..3463519 100644
--- a/local/local.env.example
+++ b/local/local.env.example
@@ -5,5 +5,7 @@ DATABASE_URL=<postgres-connection-string>
 ENCRYPTION_KEY=<generate-a-random-key>
 JWT_SECRET=<generate-a-random-key>
 CRON_SECRET=<generate-a-random-key>
+# 仅开发/测试可显式开启；生产环境即使设置也不会绕过 CRON_SECRET。
+ALLOW_UNAUTHENTICATED_CRON=false
 APP_URL=http://localhost:3000
 SUBBOOST_PORT=3000
diff --git a/local/package.json b/local/package.json
index d294337..4d32242 100644
--- a/local/package.json
+++ b/local/package.json
@@ -24,7 +24,6 @@
   "dependencies": {
     "@prisma/adapter-pg": "^7.8.0",
     "@prisma/client": "^7.8.0",
-    "@radix-ui/react-accordion": "^1.2.0",
     "@radix-ui/react-avatar": "^1.1.0",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -32,7 +31,6 @@
     "@radix-ui/react-popover": "^1.1.0",
     "@radix-ui/react-scroll-area": "^1.2.0",
     "@radix-ui/react-select": "^2.1.0",
-    "@radix-ui/react-separator": "^1.1.0",
     "@radix-ui/react-slot": "^1.1.0",
     "@radix-ui/react-switch": "^1.1.0",
     "@radix-ui/react-tabs": "^1.1.0",
@@ -50,6 +48,7 @@
     "lucide-react": "^1.17.0",
     "next": "^16.2.7",
     "peggy": "^5.1.0",
+    "prisma": "^7.8.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "react-remove-scroll-bar": "^2.3.8",
@@ -65,7 +64,6 @@
     "eslint": "^9.39.4",
     "eslint-config-next": "^16.2.7",
     "postcss": "8.5.15",
-    "prisma": "^7.8.0",
     "tailwindcss": "^4.3.0",
     "typescript": "^6.0.3"
   },
diff --git a/local/prisma/schema.prisma b/local/prisma/schema.prisma
index fadee48..a0e5bf1 100644
--- a/local/prisma/schema.prisma
+++ b/local/prisma/schema.prisma
@@ -38,7 +38,7 @@ model Subscription {
   id                            String    @id @default(cuid())
   ownerId                       String
   name                          String
-  token                         String    @unique @default(cuid())
+  token                         String    @unique
   isPrimary                     Boolean   @default(false)
   encryptedUrls                 String    @db.Text
   encryptedNodes                String    @db.Text
diff --git a/local/src/lib/cron-auth.ts b/local/src/lib/cron-auth.ts
index c4e86ae..f8912e7 100644
--- a/local/src/lib/cron-auth.ts
+++ b/local/src/lib/cron-auth.ts
@@ -20,7 +20,7 @@ export function requireLocalCronAuth(request: Request): ReturnType<typeof apiErr
 
   if (auth.reason === "missing-secret") {
     if (isDevelopmentBypassAllowed()) return null;
-    return apiError("CRON_SECRET not configured.", "CONFIGURATION_ERROR", 500);
+    return apiError("CRON_SECRET not configured.", "CONFIGURATION_ERROR", 503);
   }
 
   return apiError("Invalid cron secret.", "UNAUTHORIZED", 401);
diff --git a/local/src/lib/http.ts b/local/src/lib/http.ts
index 99768fe..43c8236 100644
--- a/local/src/lib/http.ts
+++ b/local/src/lib/http.ts
@@ -8,6 +8,7 @@ export type ApiErrorCode =
   | "FORBIDDEN"
   | "NOT_FOUND"
   | "CONFLICT"
+  | "RATE_LIMITED"
   | "CONFIGURATION_ERROR"
   | "INTERNAL_ERROR";
 
diff --git a/local/src/lib/rate-limit.test.ts b/local/src/lib/rate-limit.test.ts
new file mode 100644
index 0000000..7022479
--- /dev/null
+++ b/local/src/lib/rate-limit.test.ts
@@ -0,0 +1,39 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  clearLocalRateLimitsForTests,
+  consumeLocalRateLimit,
+  hashLocalRateLimitKey,
+  localRateLimitResponse,
+  resetLocalRateLimit,
+} from "./rate-limit";
+
+describe("local rate limits", () => {
+  beforeEach(() => clearLocalRateLimitsForTests());
+
+  it("blocks requests above a fixed-window limit and resets after expiry", () => {
+    expect(consumeLocalRateLimit("login", "all", { limit: 2, windowMs: 10_000, now: 1_000 }).allowed).toBe(true);
+    expect(consumeLocalRateLimit("login", "all", { limit: 2, windowMs: 10_000, now: 2_000 }).allowed).toBe(true);
+    expect(consumeLocalRateLimit("login", "all", { limit: 2, windowMs: 10_000, now: 3_000 })).toEqual({
+      allowed: false,
+      retryAfterSeconds: 8,
+    });
+    expect(consumeLocalRateLimit("login", "all", { limit: 2, windowMs: 10_000, now: 11_000 }).allowed).toBe(true);
+  });
+
+  it("hashes sensitive keys and supports clearing successful identity buckets", () => {
+    const key = hashLocalRateLimitKey("secret-token");
+    expect(key).toMatch(/^[a-f0-9]{64}$/);
+    expect(key).not.toContain("secret-token");
+    consumeLocalRateLimit("token", key, { limit: 1, windowMs: 10_000, now: 1_000 });
+    expect(consumeLocalRateLimit("token", key, { limit: 1, windowMs: 10_000, now: 2_000 }).allowed).toBe(false);
+    resetLocalRateLimit("token", key);
+    expect(consumeLocalRateLimit("token", key, { limit: 1, windowMs: 10_000, now: 2_000 }).allowed).toBe(true);
+  });
+
+  it("returns a structured 429 response with Retry-After", async () => {
+    const response = localRateLimitResponse("slow down", 7);
+    expect(response.status).toBe(429);
+    expect(response.headers.get("Retry-After")).toBe("7");
+    await expect(response.json()).resolves.toEqual({ error: "slow down", code: "RATE_LIMITED" });
+  });
+});
diff --git a/local/src/lib/rate-limit.ts b/local/src/lib/rate-limit.ts
new file mode 100644
index 0000000..f1d11cf
--- /dev/null
+++ b/local/src/lib/rate-limit.ts
@@ -0,0 +1,64 @@
+import { createHash } from "node:crypto";
+import { apiError } from "./http";
+
+type RateLimitBucket = {
+  count: number;
+  resetAt: number;
+};
+
+export type LocalRateLimitResult = {
+  allowed: boolean;
+  retryAfterSeconds: number;
+};
+
+const buckets = new Map<string, RateLimitBucket>();
+
+function cleanupExpiredBuckets(now: number): void {
+  if (buckets.size < 1024) return;
+  for (const [key, bucket] of buckets) {
+    if (bucket.resetAt <= now) buckets.delete(key);
+  }
+}
+
+export function hashLocalRateLimitKey(value: string): string {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+export function consumeLocalRateLimit(
+  scope: string,
+  key: string,
+  options: { limit: number; windowMs: number; now?: number }
+): LocalRateLimitResult {
+  const now = options.now ?? Date.now();
+  const limit = Math.max(1, Math.floor(options.limit));
+  const windowMs = Math.max(1000, Math.floor(options.windowMs));
+  cleanupExpiredBuckets(now);
+
+  const bucketKey = `${scope}:${key}`;
+  const current = buckets.get(bucketKey);
+  if (!current || current.resetAt <= now) {
+    buckets.set(bucketKey, { count: 1, resetAt: now + windowMs });
+    return { allowed: true, retryAfterSeconds: 0 };
+  }
+
+  current.count += 1;
+  if (current.count <= limit) return { allowed: true, retryAfterSeconds: 0 };
+  return {
+    allowed: false,
+    retryAfterSeconds: Math.max(1, Math.ceil((current.resetAt - now) / 1000)),
+  };
+}
+
+export function resetLocalRateLimit(scope: string, key: string): void {
+  buckets.delete(`${scope}:${key}`);
+}
+
+export function localRateLimitResponse(message: string, retryAfterSeconds: number): Response {
+  const response = apiError(message, "RATE_LIMITED", 429);
+  response.headers.set("Retry-After", String(Math.max(1, retryAfterSeconds)));
+  return response;
+}
+
+export function clearLocalRateLimitsForTests(): void {
+  if (process.env.NODE_ENV === "test") buckets.clear();
+}
diff --git a/local/src/lib/subscription-service.test.ts b/local/src/lib/subscription-service.test.ts
index 472b42a..aca6030 100644
--- a/local/src/lib/subscription-service.test.ts
+++ b/local/src/lib/subscription-service.test.ts
@@ -287,6 +287,7 @@ describe("local subscription service", () => {
       data: expect.objectContaining({
         ownerId: "owner-1",
         name: "Created",
+        token: expect.stringMatching(/^[A-Za-z0-9_-]{43}$/),
         encryptedUrls: JSON.stringify(["https://example.com/sub"]),
         encryptedNodes: expect.stringContaining('"name":"Node"'),
         encryptedConfig: expect.stringContaining('"smartNodeMatchingEnabled":false'),
@@ -389,6 +390,30 @@ describe("local subscription service", () => {
     });
   });
 
+  it("replaces submitted config instead of retaining omitted stale fields", async () => {
+    mocks.prisma.subscription.findFirst.mockResolvedValueOnce(
+      row({
+        encryptedConfig: JSON.stringify({
+          staleSetting: true,
+          sources: [{ id: "old", type: "url", content: "https://old.example/sub" }],
+        }),
+      })
+    );
+
+    await updateSubscription("owner-1", "sub-1", {
+      config: {
+        freshSetting: true,
+        sources: [{ id: "new", type: "url", content: "https://new.example/sub" }],
+      },
+    });
+
+    const update = mocks.prisma.subscription.update.mock.calls.at(-1)?.[0];
+    const encryptedConfig = update?.data?.encryptedConfig;
+    expect(typeof encryptedConfig).toBe("string");
+    expect(JSON.parse(encryptedConfig)).toMatchObject({ freshSetting: true });
+    expect(JSON.parse(encryptedConfig)).not.toHaveProperty("staleSetting");
+  });
+
   it("builds fetch callbacks for refresh source imports", async () => {
     const callbacks = buildSubscriptionFetchCallbacks();
 
diff --git a/local/src/lib/subscription-service.ts b/local/src/lib/subscription-service.ts
index 3850876..c5e3911 100644
--- a/local/src/lib/subscription-service.ts
+++ b/local/src/lib/subscription-service.ts
@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
 import { generateClashYaml } from "@subboost/core/generator";
 import { buildGenerateOptionsFromConfig, getEffectiveTestOptions } from "@subboost/core/subscription/config-utils";
 import { buildProxyProvidersFromConfig } from "@subboost/core/subscription/proxy-providers";
@@ -118,11 +118,16 @@ function buildLocalSubscriptionConfig(
       existingConfig,
       idFactory: randomUUID,
       splitUrlLines: true,
+      mergeExistingConfig: false,
       defaultSmartNodeMatchingEnabled: true,
     }
   );
 }
 
+export function generateLocalSubscriptionToken(): string {
+  return randomBytes(32).toString("base64url");
+}
+
 export function readSubscriptionSecrets(row: SubscriptionRow) {
   return {
     urls: decryptJson<string[]>(row.encryptedUrls, []),
@@ -187,6 +192,7 @@ export async function createSubscription(ownerId: string, body: unknown): Promis
     data: {
       ownerId,
       name,
+      token: generateLocalSubscriptionToken(),
       encryptedUrls: encryptJson(urls),
       encryptedNodes: encryptJson(nodes),
       encryptedConfig: encryptJson(config),
diff --git a/local/test/cron-route-contract.test.ts b/local/test/cron-route-contract.test.ts
index 34a9c76..817d2ad 100644
--- a/local/test/cron-route-contract.test.ts
+++ b/local/test/cron-route-contract.test.ts
@@ -62,7 +62,7 @@ describe("local cron routes", () => {
   it("rejects cron calls when CRON_SECRET is missing in production", async () => {
     vi.stubEnv("CRON_SECRET", "");
     const response = await updateSubscriptionsRoute.POST(cronRequest());
-    expect(response.status).toBe(500);
+    expect(response.status).toBe(503);
     expect(await readJson(response)).toEqual({
       error: "CRON_SECRET not configured.",
       code: "CONFIGURATION_ERROR",
@@ -120,4 +120,3 @@ describe("local cron routes", () => {
     expect((await readJson(response)).success).toBe(true);
   });
 });
-
diff --git a/package-lock.json b/package-lock.json
index b2793aa..f69eea1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15,7 +15,6 @@
       "dependencies": {
         "@prisma/adapter-pg": "^7.8.0",
         "@prisma/client": "^7.8.0",
-        "@radix-ui/react-accordion": "^1.2.0",
         "@radix-ui/react-avatar": "^1.1.0",
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -23,7 +22,6 @@
         "@radix-ui/react-popover": "^1.1.0",
         "@radix-ui/react-scroll-area": "^1.2.0",
         "@radix-ui/react-select": "^2.1.0",
-        "@radix-ui/react-separator": "^1.1.0",
         "@radix-ui/react-slot": "^1.1.0",
         "@radix-ui/react-switch": "^1.1.0",
         "@radix-ui/react-tabs": "^1.1.0",
@@ -72,7 +70,6 @@
       "dependencies": {
         "@prisma/adapter-pg": "^7.8.0",
         "@prisma/client": "^7.8.0",
-        "@radix-ui/react-accordion": "^1.2.0",
         "@radix-ui/react-avatar": "^1.1.0",
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -80,7 +77,6 @@
         "@radix-ui/react-popover": "^1.1.0",
         "@radix-ui/react-scroll-area": "^1.2.0",
         "@radix-ui/react-select": "^2.1.0",
-        "@radix-ui/react-separator": "^1.1.0",
         "@radix-ui/react-slot": "^1.1.0",
         "@radix-ui/react-switch": "^1.1.0",
         "@radix-ui/react-tabs": "^1.1.0",
@@ -98,6 +94,7 @@
         "lucide-react": "^1.17.0",
         "next": "^16.2.7",
         "peggy": "^5.1.0",
+        "prisma": "^7.8.0",
         "react": "^19.2.7",
         "react-dom": "^19.2.7",
         "react-remove-scroll-bar": "^2.3.8",
@@ -113,7 +110,6 @@
         "eslint": "^9.39.4",
         "eslint-config-next": "^16.2.7",
         "postcss": "8.5.15",
-        "prisma": "^7.8.0",
         "tailwindcss": "^4.3.0",
         "typescript": "^6.0.3"
       },
@@ -378,14 +374,12 @@
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/@electric-sql/pglite/-/pglite-0.4.1.tgz",
       "integrity": "sha512-mZ9NzzUSYPOCnxHH1oAHPRzoMFJHY472raDKwXl/+6oPbpdJ7g8LsCN4FSaIIfkiCKHhb3iF/Zqo3NYxaIhU7Q==",
-      "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/@electric-sql/pglite-socket": {
       "version": "0.1.1",
       "resolved": "https://registry.npmjs.org/@electric-sql/pglite-socket/-/pglite-socket-0.1.1.tgz",
       "integrity": "sha512-p2hoXw3Z3LQHwTeikdZNsFBOvXGqKY2hk51BBw+8NKND8eoH+8LFOtW9Z8CQKmTJ2qqGYu82ipqiyFZOTTXNfw==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
         "pglite-server": "dist/scripts/server.js"
@@ -398,7 +392,6 @@
       "version": "0.3.1",
       "resolved": "https://registry.npmjs.org/@electric-sql/pglite-tools/-/pglite-tools-0.3.1.tgz",
       "integrity": "sha512-C+T3oivmy9bpQvSxVqXA1UDY8cB9Eb9vZHL9zxWwEUfDixbXv4G3r2LjoTdR33LD8aomR3O9ZXEO3XEwr/cUCA==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "peerDependencies": {
         "@electric-sql/pglite": "0.4.1"
@@ -623,7 +616,6 @@
       "version": "1.19.13",
       "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.13.tgz",
       "integrity": "sha512-TsQLe4i2gvoTtrHje625ngThGBySOgSK3Xo2XRYOdqGN1teR8+I7vchQC46uLJi8OF62YTYA3AhSpumtkhsaKQ==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=18.14.1"
@@ -1218,7 +1210,6 @@
       "version": "0.3.4",
       "resolved": "https://registry.npmjs.org/@kurkle/color/-/color-0.3.4.tgz",
       "integrity": "sha512-M5UknZPHRu3DEDWoipU6sE8PdkZ6Z/S+v4dD+Ke8IaNlpdSQah50lz1KtcFBa2vsdOnwbbnxJwVM4wty6udA5w==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@napi-rs/wasm-runtime": {
@@ -1512,7 +1503,6 @@
       "version": "7.8.0",
       "resolved": "https://registry.npmjs.org/@prisma/config/-/config-7.8.0.tgz",
       "integrity": "sha512-HFESzd9rx2ZQxlK+TL7tu1HPvCqrHiL6LCxYykI2c34mvaUuIVVl3lYuicJD/MNnzgPnyeBEMlK4WTomJCV5jw==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "c12": "3.3.4",
@@ -1531,7 +1521,6 @@
       "version": "0.24.3",
       "resolved": "https://registry.npmjs.org/@prisma/dev/-/dev-0.24.3.tgz",
       "integrity": "sha512-ffHlQuKXZiaDt9Go0OnCTdJZrHxK0k7omJKNV86/VjpsXu5EIHZLK0T7JSWgvNlJwh56kW9JFu9v0qJciFzepg==",
-      "devOptional": true,
       "license": "ISC",
       "dependencies": {
         "@electric-sql/pglite": "0.4.1",
@@ -1566,7 +1555,6 @@
       "version": "7.8.0",
       "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-7.8.0.tgz",
       "integrity": "sha512-jx3rCnNNrt5uzbkKlegtQ2GZHxSlihMCzutgT/BP6UIDF1r9tDI39hV/0T/cHZgzJ3ELbuQPXlVZy+Y1n0pcgw==",
-      "devOptional": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -1580,14 +1568,12 @@
       "version": "7.8.0-6.3c6e192761c0362d496ed980de936e2f3cebcd3a",
       "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-7.8.0-6.3c6e192761c0362d496ed980de936e2f3cebcd3a.tgz",
       "integrity": "sha512-fJPQxCkLgA5EayWaW8eArgCvjJ+N+Kz3VyeNKMEeYiQC4alNkxRKFVAGxv/ZUzuJISKqdw+zGeDbS6mn6RCPOA==",
-      "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/engines/node_modules/@prisma/get-platform": {
       "version": "7.8.0",
       "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.8.0.tgz",
       "integrity": "sha512-WlxgRGnolL8VH2EmkH1R/DkKNr/mVdS3G2h42IZFFZ3eUrH9OT6t73kIOSlkkrv50wG123Iq8d96ufv5LlZktw==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@prisma/debug": "7.8.0"
@@ -1597,7 +1583,6 @@
       "version": "7.8.0",
       "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-7.8.0.tgz",
       "integrity": "sha512-gwB0Euiz/DDRyxFRpLXYlK3RfaZUj1c5dAYMuhZYfApg7arknJlcb9bIsOHDppJmbqYaVA+yBIiFMDBfprsNPQ==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@prisma/debug": "7.8.0",
@@ -1609,7 +1594,6 @@
       "version": "7.8.0",
       "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.8.0.tgz",
       "integrity": "sha512-WlxgRGnolL8VH2EmkH1R/DkKNr/mVdS3G2h42IZFFZ3eUrH9OT6t73kIOSlkkrv50wG123Iq8d96ufv5LlZktw==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@prisma/debug": "7.8.0"
@@ -1619,7 +1603,6 @@
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.2.0.tgz",
       "integrity": "sha512-k1V0l0Td1732EHpAfi2eySTezyllok9dXb6UQanajkJQzPUGi3vO2z7jdkz67SypFTdmbnyGYxvEvYZdZsMAVA==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@prisma/debug": "7.2.0"
@@ -1629,21 +1612,18 @@
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.2.0.tgz",
       "integrity": "sha512-YSGTiSlBAVJPzX4ONZmMotL+ozJwQjRmZweQNIq/ER0tQJKJynNkRB3kyvt37eOfsbMCXk3gnLF6J9OJ4QWftw==",
-      "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/query-plan-executor": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/@prisma/query-plan-executor/-/query-plan-executor-7.2.0.tgz",
       "integrity": "sha512-EOZmNzcV8uJ0mae3DhTsiHgoNCuu1J9mULQpGCh62zN3PxPTd+qI9tJvk5jOst8WHKQNwJWR3b39t0XvfBB0WQ==",
-      "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/streams-local": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/@prisma/streams-local/-/streams-local-0.1.2.tgz",
       "integrity": "sha512-l49yTxKKF2odFxaAXTmwmkBKL3+bVQ1tFOooGifu4xkdb9NMNLxHj27XAhTylWZod8I+ISGM5erU1xcl/oBCtg==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "ajv": "^8.12.0",
@@ -1660,7 +1640,6 @@
       "version": "8.20.0",
       "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
       "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -1677,14 +1656,12 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
       "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@prisma/studio-core": {
       "version": "0.27.3",
       "resolved": "https://registry.npmjs.org/@prisma/studio-core/-/studio-core-0.27.3.tgz",
       "integrity": "sha512-AADjNFPdsrglxHQVTmHFqv6DuKQZ5WY4p5/gVFY017twvNrSwpLJ9lqUbYYxEu2W7nbvVxTZA8deJ8LseNALsw==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@radix-ui/react-toggle": "1.1.10",
@@ -1712,37 +1689,6 @@
       "integrity": "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==",
       "license": "MIT"
     },
-    "node_modules/@radix-ui/react-accordion": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-accordion/-/react-accordion-1.2.12.tgz",
-      "integrity": "sha512-T4nygeh9YE9dLRPhAHSeOZi7HBXo+0kYIPJXayZfvWOWA0+n3dESrZbjfDPUABkUNym6Hd+f2IR113To8D2GPA==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.3",
-        "@radix-ui/react-collapsible": "1.1.12",
-        "@radix-ui/react-collection": "1.1.7",
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-context": "1.1.2",
-        "@radix-ui/react-direction": "1.1.1",
-        "@radix-ui/react-id": "1.1.1",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-controllable-state": "1.2.2"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@radix-ui/react-arrow": {
       "version": "1.1.7",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.7.tgz",
@@ -1831,36 +1777,6 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-collapsible": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-collapsible/-/react-collapsible-1.1.12.tgz",
-      "integrity": "sha512-Uu+mSh4agx2ib1uIGPP4/CKNULyajb3p92LsVXmH2EHVMTfZWpll88XJ0j4W0z3f8NK1eYl1+Mf/szHPmcHzyA==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.3",
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-context": "1.1.2",
-        "@radix-ui/react-id": "1.1.1",
-        "@radix-ui/react-presence": "1.1.5",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-controllable-state": "1.2.2",
-        "@radix-ui/react-use-layout-effect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@radix-ui/react-collection": {
       "version": "1.1.7",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.7.tgz",
@@ -2521,52 +2437,6 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-separator": {
-      "version": "1.1.8",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-separator/-/react-separator-1.1.8.tgz",
-      "integrity": "sha512-sDvqVY4itsKwwSMEe0jtKgfTh+72Sy3gPmQpjqcQneqQ4PFmr/1I0YA+2/puilhggCe2gJcx5EBAYFkWkdpa5g==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-primitive": "2.1.4"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-separator/node_modules/@radix-ui/react-primitive": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.4.tgz",
-      "integrity": "sha512-9hQc4+GNVtJAIEPEqlYqW5RiYdrr8ea5XQ0ZOnD6fgru+83kqT15mq2OCcbe8KnjRZl5vF3ks69AKz3kh1jrhg==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-slot": "1.2.4"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@radix-ui/react-slot": {
       "version": "1.2.4",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.2.4.tgz",
@@ -2682,7 +2552,6 @@
       "version": "1.1.10",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-toggle/-/react-toggle-1.1.10.tgz",
       "integrity": "sha512-lS1odchhFTeZv3xwHH31YPObmJn8gOg7Lq12inrr0+BH/l3Tsq32VfjqH1oh80ARM3mlkfMic15n0kg4sD1poQ==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.3",
@@ -3162,7 +3031,6 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
       "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@subboost/config": {
@@ -3546,7 +3414,6 @@
       "version": "19.2.16",
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.16.tgz",
       "integrity": "sha512-esJiCAnl0kfpNdE69f3So4WJUXy95dLZydX0KwK46riIHDzHM7O9Vtf9xCHW0PXIqvgqNrswl522kA/5yx+F4w==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "csstype": "^3.2.2"
@@ -4574,7 +4441,6 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/aws-ssl-profiles/-/aws-ssl-profiles-1.1.2.tgz",
       "integrity": "sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 6.0.0"
@@ -4632,7 +4498,6 @@
       "version": "2.9.2",
       "resolved": "https://registry.npmjs.org/better-result/-/better-result-2.9.2.tgz",
       "integrity": "sha512-WIFoBPCdnTOdk9inkE1ZRvCZ4P0CpSkAiLlchC65N7n9DcjZ3NhqkBOlafzpOVnO8ixyi37kicmSJ3ENhPZl7Q==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
@@ -4697,7 +4562,6 @@
       "version": "3.3.4",
       "resolved": "https://registry.npmjs.org/c12/-/c12-3.3.4.tgz",
       "integrity": "sha512-cM0ApFQSBXuourJejzwv/AuPRvAxordTyParRVcHjjtXirtkzM0uK2L9TTn9s0cXZbG7E55jCivRQzoxYmRAlA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "chokidar": "^5.0.0",
@@ -4833,7 +4697,6 @@
       "version": "4.5.1",
       "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-4.5.1.tgz",
       "integrity": "sha512-GIjfiT9dbmHRiYi6Nl2yFCq7kkwdkp1W/lp2J99rX0yo9tgJGn3lKQATztIjb5tVtevcBtIdICNWqlq5+E8/Pw==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@kurkle/color": "^0.3.0"
@@ -4846,7 +4709,6 @@
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-5.0.0.tgz",
       "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "readdirp": "^5.0.0"
@@ -4925,7 +4787,6 @@
       "version": "0.2.4",
       "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.4.tgz",
       "integrity": "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/convert-source-map": {
@@ -4939,7 +4800,6 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
@@ -4954,7 +4814,6 @@
       "version": "3.2.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
       "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/damerau-levenshtein": {
@@ -5047,7 +4906,6 @@
       "version": "7.1.5",
       "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.5.tgz",
       "integrity": "sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==",
-      "devOptional": true,
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=16.0.0"
@@ -5093,14 +4951,12 @@
       "version": "6.1.7",
       "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
       "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/denque": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/denque/-/denque-2.1.0.tgz",
       "integrity": "sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw==",
-      "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">=0.10"
@@ -5110,7 +4966,6 @@
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/destr/-/destr-2.0.5.tgz",
       "integrity": "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/detect-libc": {
@@ -5173,7 +5028,6 @@
       "version": "3.20.0",
       "resolved": "https://registry.npmjs.org/effect/-/effect-3.20.0.tgz",
       "integrity": "sha512-qMLfDJscrNG8p/aw+IkT9W7fgj50Z4wG5bLBy0Txsxz8iUHjDIkOgO3SV0WZfnQbNG2VJYb0b+rDLMrhM4+Krw==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.0.0",
@@ -5198,7 +5052,6 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/empathic/-/empathic-2.0.0.tgz",
       "integrity": "sha512-i6UzDscO/XfAcNYD75CfICkmfLedpyPDdozrLMmQc5ORaQcdMoc21OnlEylMIqI7U8eniKrPMxxtj8k0vhmJhA==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=14"
@@ -5222,7 +5075,6 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-3.0.0.tgz",
       "integrity": "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
@@ -5868,14 +5720,12 @@
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
       "integrity": "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/fast-check": {
       "version": "3.23.2",
       "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz",
       "integrity": "sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==",
-      "devOptional": true,
       "funding": [
         {
           "type": "individual",
@@ -5898,7 +5748,6 @@
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/fast-glob": {
@@ -5949,7 +5798,6 @@
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
       "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
-      "devOptional": true,
       "funding": [
         {
           "type": "github",
@@ -6056,7 +5904,6 @@
       "version": "3.3.1",
       "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
       "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
-      "devOptional": true,
       "license": "ISC",
       "dependencies": {
         "cross-spawn": "^7.0.6",
@@ -6129,7 +5976,6 @@
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-2.3.1.tgz",
       "integrity": "sha512-eeB5GfMNeevm/GRYq20ShmsaGcmI81kIX2K9XQx5miC8KdHaC6Jm0qQ8ZNeGOi7wYB8OsdxKs+Y2oVuTFuVwKQ==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "is-property": "^1.0.2"
@@ -6193,7 +6039,6 @@
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/get-port-please/-/get-port-please-3.2.0.tgz",
       "integrity": "sha512-I9QVvBw5U/hw3RmWpYKRumUeaDgxTPd401x364rLmWBJcOQ753eov1eTgzDqRG9bqFIfDc7gfzcQEWrUri3o1A==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/get-proto": {
@@ -6245,7 +6090,6 @@
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/giget/-/giget-3.2.0.tgz",
       "integrity": "sha512-GvHTWcykIR/fP8cj8dMpuMMkvaeJfPvYnhq0oW+chSeIr+ldX21ifU2Ms6KBoyKZQZmVaUAAhQ2EZ68KJF8a7A==",
-      "devOptional": true,
       "license": "MIT",
       "bin": {
         "giget": "dist/cli.mjs"
@@ -6311,21 +6155,18 @@
       "version": "4.2.11",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
       "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
-      "devOptional": true,
       "license": "ISC"
     },
     "node_modules/grammex": {
       "version": "3.1.12",
       "resolved": "https://registry.npmjs.org/grammex/-/grammex-3.1.12.tgz",
       "integrity": "sha512-6ufJOsSA7LcQehIJNCO7HIBykfM7DXQual0Ny780/DEcJIpBlHRvcqEBWGPYd7hrXL2GJ3oJI1MIhaXjWmLQOQ==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/graphmatch": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/graphmatch/-/graphmatch-1.1.1.tgz",
       "integrity": "sha512-5ykVn/EXM1hF0XCaWh05VbYvEiOL2lY1kBxZtaYsyvjp7cmWOU1XsAdfQBwClraEofXDT197lFbXOEVMHpvQOg==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/has-bigints": {
@@ -6443,7 +6284,6 @@
       "version": "4.12.25",
       "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.25.tgz",
       "integrity": "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -6453,14 +6293,12 @@
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/http-status-codes/-/http-status-codes-2.3.0.tgz",
       "integrity": "sha512-RJ8XvFvpPM/Dmc5SV+dC4y5PCeOhT3x1Hq0NU3rjGeg5a/CqlhZ7uudknPwZFz4aeAXDcbAyaeP7GAo9lvngtA==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/iconv-lite": {
       "version": "0.7.2",
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
       "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -6799,7 +6637,6 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/is-property/-/is-property-1.0.2.tgz",
       "integrity": "sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/is-regex": {
@@ -6958,7 +6795,6 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "devOptional": true,
       "license": "ISC"
     },
     "node_modules/iterator.prototype": {
@@ -6983,7 +6819,6 @@
       "version": "2.7.0",
       "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
       "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
-      "devOptional": true,
       "license": "MIT",
       "bin": {
         "jiti": "lib/jiti-cli.mjs"
@@ -7422,7 +7257,6 @@
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/loose-envify": {
@@ -7452,7 +7286,6 @@
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/lru.min/-/lru.min-1.1.4.tgz",
       "integrity": "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "bun": ">=1.0.0",
@@ -7551,7 +7384,6 @@
       "version": "3.15.3",
       "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.15.3.tgz",
       "integrity": "sha512-FBrGau0IXmuqg4haEZRBfHNWB5mUARw6hNwPDXXGg0XzVJ50mr/9hb267lvpVMnhZ1FON3qNd4Xfcez1rbFwSg==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "aws-ssl-profiles": "^1.1.1",
@@ -7572,7 +7404,6 @@
       "version": "1.1.6",
       "resolved": "https://registry.npmjs.org/named-placeholders/-/named-placeholders-1.1.6.tgz",
       "integrity": "sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "lru.min": "^1.1.0"
@@ -7842,7 +7673,6 @@
       "version": "2.0.11",
       "resolved": "https://registry.npmjs.org/ohash/-/ohash-2.0.11.tgz",
       "integrity": "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/optionator": {
@@ -7940,7 +7770,6 @@
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7957,7 +7786,6 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
       "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/peggy": {
@@ -7981,7 +7809,6 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-2.1.0.tgz",
       "integrity": "sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/pg": {
@@ -8105,7 +7932,6 @@
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.1.tgz",
       "integrity": "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "confbox": "^0.2.4",
@@ -8155,7 +7981,6 @@
       "version": "3.4.7",
       "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.7.tgz",
       "integrity": "sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw==",
-      "devOptional": true,
       "license": "Unlicense",
       "engines": {
         "node": ">=12"
@@ -8218,7 +8043,6 @@
       "version": "7.8.0",
       "resolved": "https://registry.npmjs.org/prisma/-/prisma-7.8.0.tgz",
       "integrity": "sha512-yfN4yrw7HV9kEJhoy1+jgah0jafEIQsf7uWouSsM8MvJtlubsk+kM7AIBWZ8+GJl74Yj3c+nbYqBkMOxtsZ3Lw==",
-      "devOptional": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -8264,7 +8088,6 @@
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
       "integrity": "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
@@ -8276,7 +8099,6 @@
       "version": "3.0.7",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
       "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
-      "devOptional": true,
       "license": "ISC"
     },
     "node_modules/punycode": {
@@ -8293,7 +8115,6 @@
       "version": "6.1.0",
       "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz",
       "integrity": "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==",
-      "devOptional": true,
       "funding": [
         {
           "type": "individual",
@@ -8331,7 +8152,6 @@
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/rc9/-/rc9-3.0.1.tgz",
       "integrity": "sha512-gMDyleLWVE+i6Sgtc0QbbY6pEKqYs97NGi6isHQPqYlLemPoO8dxQ3uGi0f4NiP98c+jMW6cG1Kx9dDwfvqARQ==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "defu": "^6.1.6",
@@ -8439,7 +8259,6 @@
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.0.0.tgz",
       "integrity": "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 20.19.0"
@@ -8497,7 +8316,6 @@
       "version": "2.33.4",
       "resolved": "https://registry.npmjs.org/remeda/-/remeda-2.33.4.tgz",
       "integrity": "sha512-ygHswjlc/opg2VrtiYvUOPLjxjtdKvjGz1/plDhkG66hjNjFr1xmfrs2ClNFo/E6TyUFiwYNh53bKV26oBoMGQ==",
-      "devOptional": true,
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/remeda"
@@ -8507,7 +8325,6 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
       "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -8561,7 +8378,6 @@
       "version": "0.12.0",
       "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
       "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 4"
@@ -8695,7 +8511,6 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/scheduler": {
@@ -8717,8 +8532,7 @@
     "node_modules/seq-queue": {
       "version": "0.0.5",
       "resolved": "https://registry.npmjs.org/seq-queue/-/seq-queue-0.0.5.tgz",
-      "integrity": "sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q==",
-      "devOptional": true
+      "integrity": "sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q=="
     },
     "node_modules/set-function-length": {
       "version": "1.2.2",
@@ -8831,7 +8645,6 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -8844,7 +8657,6 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -8937,7 +8749,6 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
       "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "devOptional": true,
       "license": "ISC",
       "engines": {
         "node": ">=14"
@@ -8977,7 +8788,6 @@
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/sqlstring/-/sqlstring-2.3.3.tgz",
       "integrity": "sha512-qC9iz2FlN7DQl3+wjwn3802RTyjCx7sDvfQEXchwa6CWOx07/WVfh91gBmQ9fahw8snwGEWU3xGzOt4tFyHLxg==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -9001,7 +8811,6 @@
       "version": "3.10.0",
       "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
       "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/stop-iteration-iterator": {
@@ -9656,7 +9465,6 @@
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.2.0.tgz",
       "integrity": "sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==",
-      "devOptional": true,
       "license": "MIT",
       "peerDependencies": {
         "typescript": ">=5"
@@ -9872,7 +9680,6 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "devOptional": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -10033,7 +9840,6 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/zeptomatch/-/zeptomatch-2.1.0.tgz",
       "integrity": "sha512-KiGErG2J0G82LSpniV0CtIzjlJ10E04j02VOudJsPyPwNZgGnRKQy7I1R7GMyg/QswnE4l7ohSGrQbQbjXPPDA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "grammex": "^3.1.11",
@@ -10119,7 +9925,6 @@
       "version": "0.1.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "@radix-ui/react-accordion": "^1.2.0",
         "@radix-ui/react-avatar": "^1.1.0",
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -10127,7 +9932,6 @@
         "@radix-ui/react-popover": "^1.1.0",
         "@radix-ui/react-scroll-area": "^1.2.0",
         "@radix-ui/react-select": "^2.1.0",
-        "@radix-ui/react-separator": "^1.1.0",
         "@radix-ui/react-slot": "^1.1.0",
         "@radix-ui/react-switch": "^1.1.0",
         "@radix-ui/react-tabs": "^1.1.0",
diff --git a/package.json b/package.json
index f95b720..a421add 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,6 @@
   "dependencies": {
     "@prisma/adapter-pg": "^7.8.0",
     "@prisma/client": "^7.8.0",
-    "@radix-ui/react-accordion": "^1.2.0",
     "@radix-ui/react-avatar": "^1.1.0",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -33,7 +32,6 @@
     "@radix-ui/react-popover": "^1.1.0",
     "@radix-ui/react-scroll-area": "^1.2.0",
     "@radix-ui/react-select": "^2.1.0",
-    "@radix-ui/react-separator": "^1.1.0",
     "@radix-ui/react-slot": "^1.1.0",
     "@radix-ui/react-switch": "^1.1.0",
     "@radix-ui/react-tabs": "^1.1.0",
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 395a731..2fb3228 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -9,7 +9,6 @@
     "./*": "./src/*"
   },
   "dependencies": {
-    "@radix-ui/react-accordion": "^1.2.0",
     "@radix-ui/react-avatar": "^1.1.0",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -17,7 +16,6 @@
     "@radix-ui/react-popover": "^1.1.0",
     "@radix-ui/react-scroll-area": "^1.2.0",
     "@radix-ui/react-select": "^2.1.0",
-    "@radix-ui/react-separator": "^1.1.0",
     "@radix-ui/react-slot": "^1.1.0",
     "@radix-ui/react-switch": "^1.1.0",
     "@radix-ui/react-tabs": "^1.1.0",
diff --git a/packages/ui/src/components/ui/accordion.tsx b/packages/ui/src/components/ui/accordion.tsx
deleted file mode 100644
index b7e1c85..0000000
--- a/packages/ui/src/components/ui/accordion.tsx
+++ /dev/null
@@ -1,56 +0,0 @@
-"use client";
-
-import * as React from "react";
-import * as AccordionPrimitive from "@radix-ui/react-accordion";
-import { ChevronDown } from "lucide-react";
-import { cn } from "@subboost/ui/lib/utils";
-
-const Accordion = AccordionPrimitive.Root;
-
-const AccordionItem = React.forwardRef<
-  React.ElementRef<typeof AccordionPrimitive.Item>,
-  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Item>
->(({ className, ...props }, ref) => (
-  <AccordionPrimitive.Item
-    ref={ref}
-    className={cn("border-b border-white/10", className)}
-    {...props}
-  />
-));
-AccordionItem.displayName = "AccordionItem";
-
-const AccordionTrigger = React.forwardRef<
-  React.ElementRef<typeof AccordionPrimitive.Trigger>,
-  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Trigger>
->(({ className, children, ...props }, ref) => (
-  <AccordionPrimitive.Header className="flex">
-    <AccordionPrimitive.Trigger
-      ref={ref}
-      className={cn(
-        "flex flex-1 items-center justify-between py-4 px-2 text-sm font-medium text-white/80 hover:text-white transition-all [&[data-state=open]>svg]:rotate-180",
-        className
-      )}
-      {...props}
-    >
-      {children}
-      <ChevronDown className="h-4 w-4 shrink-0 text-white/50 transition-transform duration-200" />
-    </AccordionPrimitive.Trigger>
-  </AccordionPrimitive.Header>
-));
-AccordionTrigger.displayName = AccordionPrimitive.Trigger.displayName;
-
-const AccordionContent = React.forwardRef<
-  React.ElementRef<typeof AccordionPrimitive.Content>,
-  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Content>
->(({ className, children, ...props }, ref) => (
-  <AccordionPrimitive.Content
-    ref={ref}
-    className="overflow-hidden text-sm data-[state=closed]:animate-accordion-up data-[state=open]:animate-accordion-down"
-    {...props}
-  >
-    <div className={cn("pb-4 pt-0 px-2 text-white/60", className)}>{children}</div>
-  </AccordionPrimitive.Content>
-));
-AccordionContent.displayName = AccordionPrimitive.Content.displayName;
-
-export { Accordion, AccordionItem, AccordionTrigger, AccordionContent };
diff --git a/packages/ui/src/components/ui/dialog.tsx b/packages/ui/src/components/ui/dialog.tsx
index b259c16..ded4e9b 100644
--- a/packages/ui/src/components/ui/dialog.tsx
+++ b/packages/ui/src/components/ui/dialog.tsx
@@ -20,7 +20,7 @@ const DialogOverlay = React.forwardRef<
   <DialogPrimitive.Overlay
     ref={ref}
     className={cn(
-      "fixed inset-0 z-50 bg-black/70 backdrop-blur-sm data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+      "fixed inset-0 z-50 bg-black/70 backdrop-blur-sm",
       className
     )}
     {...props}
@@ -37,7 +37,7 @@ const DialogContent = React.forwardRef<
     <DialogPrimitive.Content
       ref={ref}
       className={cn(
-        "fixed left-[50%] top-[50%] z-50 grid w-full max-w-lg translate-x-[-50%] translate-y-[-50%] gap-4 p-6 duration-200 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[state=closed]:slide-out-to-left-1/2 data-[state=closed]:slide-out-to-top-[48%] data-[state=open]:slide-in-from-left-1/2 data-[state=open]:slide-in-from-top-[48%] rounded-2xl glass-card max-h-[85vh] overflow-y-auto custom-scrollbar",
+        "fixed left-[50%] top-[50%] z-50 grid w-full max-w-lg translate-x-[-50%] translate-y-[-50%] gap-4 p-6 rounded-2xl glass-card max-h-[85vh] overflow-y-auto custom-scrollbar",
         className
       )}
       {...props}
diff --git a/packages/ui/src/components/ui/more-basic-components.test.ts b/packages/ui/src/components/ui/more-basic-components.test.ts
index 43df280..7bfb5c1 100644
--- a/packages/ui/src/components/ui/more-basic-components.test.ts
+++ b/packages/ui/src/components/ui/more-basic-components.test.ts
@@ -11,7 +11,6 @@ function mockPrimitive(tag: keyof React.JSX.IntrinsicElements, displayName: stri
 }
 
 vi.mock("@radix-ui/react-label", () => ({ Root: mockPrimitive("label", "LabelRoot") }));
-vi.mock("@radix-ui/react-separator", () => ({ Root: mockPrimitive("hr", "SeparatorRoot") }));
 
 import {
   artisticNavContainerClassName,
@@ -24,17 +23,15 @@ import {
 import { Label } from "./label";
 import { ProtocolBadge, getProtocolBadgeClass } from "./protocol-badge";
 import { SafeImage } from "./safe-image";
-import { Separator } from "./separator";
 import { Textarea } from "./textarea";
 
 describe("additional basic UI components", () => {
-  it("renders label, separator, textarea, protocol badges, and safe images", () => {
+  it("renders label, textarea, protocol badges, and safe images", () => {
     const html = renderToStaticMarkup(
       React.createElement(
         "div",
         null,
         React.createElement(Label, { htmlFor: "name", className: "label-extra" }, "Name"),
-        React.createElement(Separator, { orientation: "vertical", className: "separator-extra" }),
         React.createElement(Textarea, { placeholder: "Write", className: "textarea-extra", readOnly: true }),
         React.createElement(ProtocolBadge, { type: "VMess", className: "badge-extra" }),
         React.createElement(SafeImage, { src: "https://example.test/a.png", alt: "avatar", fallback: React.createElement("span", null, "fallback") }),
@@ -44,8 +41,6 @@ describe("additional basic UI components", () => {
 
     expect(html).toContain("label-extra");
     expect(html).toContain("Name");
-    expect(html).toContain("separator-extra");
-    expect(html).toContain("h-full w-[1px]");
     expect(html).toContain("textarea-extra");
     expect(html).toContain("placeholder=\"Write\"");
     expect(html).toContain("VMess");
diff --git a/packages/ui/src/components/ui/radix-wrappers.test.ts b/packages/ui/src/components/ui/radix-wrappers.test.ts
index 5d85972..5404e92 100644
--- a/packages/ui/src/components/ui/radix-wrappers.test.ts
+++ b/packages/ui/src/components/ui/radix-wrappers.test.ts
@@ -1,7 +1,6 @@
 import * as React from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it, vi } from "vitest";
-import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from "./accordion";
 import { Avatar, AvatarFallback, AvatarImage } from "./avatar";
 import {
   Dialog,
@@ -42,21 +41,11 @@ vi.mock("@radix-ui/react-dialog", async () => {
 });
 
 describe("Radix UI wrappers", () => {
-  it("renders accordion, avatar, dialog, switch, and tabs wrappers with merged classes", () => {
+  it("renders avatar, dialog, switch, and tabs wrappers with merged classes", () => {
     const html = renderToStaticMarkup(
       React.createElement(
         "div",
         null,
-        React.createElement(
-          Accordion,
-          { type: "single", collapsible: true, defaultValue: "item-1" },
-          React.createElement(
-            AccordionItem,
-            { value: "item-1", className: "item-extra" },
-            React.createElement(AccordionTrigger, { className: "trigger-extra" }, "Question"),
-            React.createElement(AccordionContent, { className: "content-extra" }, "Answer")
-          )
-        ),
         React.createElement(
           Avatar,
           { className: "avatar-extra" },
@@ -85,11 +74,6 @@ describe("Radix UI wrappers", () => {
       )
     );
 
-    expect(html).toContain("Question");
-    expect(html).toContain("Answer");
-    expect(html).toContain("item-extra");
-    expect(html).toContain("trigger-extra");
-    expect(html).toContain("content-extra");
     expect(html).toContain("avatar-extra");
     expect(html).toContain("fallback-extra");
     expect(html).toContain("dialog-extra");
diff --git a/packages/ui/src/components/ui/select.tsx b/packages/ui/src/components/ui/select.tsx
index 694eed9..ab774a4 100644
--- a/packages/ui/src/components/ui/select.tsx
+++ b/packages/ui/src/components/ui/select.tsx
@@ -75,7 +75,7 @@ const SelectContent = React.forwardRef<
     <SelectPrimitive.Content
       ref={ref}
       className={cn(
-        "relative z-50 max-h-[min(var(--radix-select-content-available-height,24rem),24rem)] min-w-[8rem] overflow-hidden rounded-xl border border-white/10 bg-[#1a1a1a] text-white shadow-md data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+        "relative z-50 max-h-[min(var(--radix-select-content-available-height,24rem),24rem)] min-w-[8rem] overflow-hidden rounded-xl border border-white/10 bg-[#1a1a1a] text-white shadow-md",
         position === "popper" &&
           "data-[side=bottom]:translate-y-1 data-[side=left]:-translate-x-1 data-[side=right]:translate-x-1 data-[side=top]:-translate-y-1",
         className
@@ -157,4 +157,3 @@ export {
   SelectScrollUpButton,
   SelectScrollDownButton,
 };
-
diff --git a/packages/ui/src/components/ui/separator.tsx b/packages/ui/src/components/ui/separator.tsx
deleted file mode 100644
index 6eefaa1..0000000
--- a/packages/ui/src/components/ui/separator.tsx
+++ /dev/null
@@ -1,31 +0,0 @@
-"use client";
-
-import * as React from "react";
-import * as SeparatorPrimitive from "@radix-ui/react-separator";
-import { cn } from "@subboost/ui/lib/utils";
-
-const Separator = React.forwardRef<
-  React.ElementRef<typeof SeparatorPrimitive.Root>,
-  React.ComponentPropsWithoutRef<typeof SeparatorPrimitive.Root>
->(
-  (
-    { className, orientation = "horizontal", decorative = true, ...props },
-    ref
-  ) => (
-    <SeparatorPrimitive.Root
-      ref={ref}
-      decorative={decorative}
-      orientation={orientation}
-      className={cn(
-        "shrink-0 bg-dark-300",
-        orientation === "horizontal" ? "h-[1px] w-full" : "h-full w-[1px]",
-        className
-      )}
-      {...props}
-    />
-  )
-);
-Separator.displayName = SeparatorPrimitive.Root.displayName;
-
-export { Separator };
-
diff --git a/packages/ui/src/product/converter/sections/basic-sections.test.ts b/packages/ui/src/product/converter/sections/basic-sections.test.ts
deleted file mode 100644
index 3815636..0000000
--- a/packages/ui/src/product/converter/sections/basic-sections.test.ts
+++ /dev/null
@@ -1,168 +0,0 @@
-import * as React from "react";
-import { renderToStaticMarkup } from "react-dom/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const captures = vi.hoisted(() => ({
-  inputs: [] as any[],
-  textareas: [] as any[],
-}));
-
-vi.mock("lucide-react", () => ({
-  ChevronDown: () => React.createElement("span", null, "down-icon"),
-  ChevronRight: () => React.createElement("span", null, "right-icon"),
-  Filter: () => React.createElement("span", null, "filter-icon"),
-  Globe: () => React.createElement("span", null, "globe-icon"),
-}));
-
-vi.mock("@subboost/ui/components/ui/badge", () => ({
-  Badge: (props: any) => React.createElement("span", props, props.children),
-}));
-
-vi.mock("@subboost/ui/components/ui/input", () => ({
-  Input: (props: any) => {
-    captures.inputs.push(props);
-    return React.createElement("input", props);
-  },
-}));
-
-vi.mock("@subboost/ui/components/ui/textarea", () => ({
-  Textarea: (props: any) => {
-    captures.textareas.push(props);
-    return React.createElement("textarea", props);
-  },
-}));
-
-vi.mock("@subboost/ui/lib/utils", () => ({
-  cn: (...parts: Array<string | false | null | undefined>) => parts.filter(Boolean).join(" "),
-}));
-
-import { DNSConfigSection } from "./dns-config-section";
-import { NodeFilterSection } from "./node-filter-section";
-import { SectionHeader } from "./section-header";
-
-function TestIcon() {
-  return React.createElement("span", null, "test-icon");
-}
-
-describe("converter shared sections", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    captures.inputs = [];
-    captures.textareas = [];
-  });
-
-  it("renders section headers and forwards the toggle callback", () => {
-    const onToggle = vi.fn();
-    const expanded = renderToStaticMarkup(
-      React.createElement(SectionHeader, {
-        expanded: true,
-        onToggle,
-        icon: TestIcon,
-        title: "标题",
-        badge: React.createElement("span", null, "badge"),
-      })
-    );
-    const collapsed = renderToStaticMarkup(
-      React.createElement(SectionHeader, {
-        expanded: false,
-        onToggle,
-        icon: TestIcon,
-        title: "折叠",
-      })
-    );
-
-    expect(expanded).toContain("down-icon");
-    expect(expanded).toContain("test-icon");
-    expect(expanded).toContain("badge");
-    expect(collapsed).toContain("right-icon");
-
-    const element = SectionHeader({
-      expanded: true,
-      onToggle,
-      icon: TestIcon,
-      title: "标题",
-    }) as React.ReactElement<{ onClick: () => void }>;
-    element.props.onClick();
-    expect(onToggle).toHaveBeenCalled();
-  });
-
-  it("renders and updates DNS config when expanded", () => {
-    const onDnsYamlChange = vi.fn();
-    const html = renderToStaticMarkup(
-      React.createElement(DNSConfigSection, {
-        expanded: true,
-        onToggle: vi.fn(),
-        dnsYaml: "dns: {}",
-        onDnsYamlChange,
-      })
-    );
-
-    expect(html).toContain("基础和 DNS 配置");
-    expect(html).toContain("直接编辑 YAML 格式的基础配置");
-    expect(captures.textareas[0]).toMatchObject({ value: "dns: {}" });
-
-    captures.textareas[0].onChange({ target: { value: "mixed-port: 7890" } });
-    expect(onDnsYamlChange).toHaveBeenCalledWith("mixed-port: 7890");
-  });
-
-  it("hides DNS config body when collapsed", () => {
-    const html = renderToStaticMarkup(
-      React.createElement(DNSConfigSection, {
-        expanded: false,
-        onToggle: vi.fn(),
-        dnsYaml: "dns: {}",
-        onDnsYamlChange: vi.fn(),
-      })
-    );
-
-    expect(html).toContain("基础和 DNS 配置");
-    expect(html).not.toContain("直接编辑 YAML 格式的基础配置");
-    expect(captures.textareas).toHaveLength(0);
-  });
-
-  it("renders node filter controls and dispatches include/exclude changes", () => {
-    const onFilterChange = vi.fn();
-    const onFilterModeChange = vi.fn();
-    const html = renderToStaticMarkup(
-      React.createElement(NodeFilterSection, {
-        expanded: true,
-        onToggle: vi.fn(),
-        filterKeyword: "香港",
-        onFilterChange,
-        filterMode: "include",
-        onFilterModeChange,
-        totalNodes: 10,
-        filteredCount: 3,
-      })
-    );
-
-    expect(html).toContain("节点筛选");
-    expect(html).toContain("3/10");
-    expect(html).toContain("包含");
-    expect(html).toContain("排除");
-    expect(captures.inputs[0]).toMatchObject({ value: "香港" });
-
-    captures.inputs[0].onChange({ target: { value: "日本" } });
-    expect(onFilterChange).toHaveBeenCalledWith("日本");
-    expect(html).toContain("bg-green-500/20");
-  });
-
-  it("omits filter body and badge when collapsed or empty", () => {
-    const html = renderToStaticMarkup(
-      React.createElement(NodeFilterSection, {
-        expanded: false,
-        onToggle: vi.fn(),
-        filterKeyword: "   ",
-        onFilterChange: vi.fn(),
-        filterMode: "exclude",
-        onFilterModeChange: vi.fn(),
-        totalNodes: 0,
-        filteredCount: 0,
-      })
-    );
-
-    expect(html).toContain("节点筛选");
-    expect(html).not.toContain("0/0");
-    expect(html).not.toContain("输入关键词过滤节点");
-  });
-});
diff --git a/packages/ui/src/product/converter/sections/dns-config-section.tsx b/packages/ui/src/product/converter/sections/dns-config-section.tsx
deleted file mode 100644
index 6cc8928..0000000
--- a/packages/ui/src/product/converter/sections/dns-config-section.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-"use client";
-
-import { Globe } from "lucide-react";
-import { DEFAULT_SUBBOOST_CONFIG } from "@subboost/core/config/defaults";
-import { Textarea } from "@subboost/ui/components/ui/textarea";
-import { SectionHeader } from "./section-header";
-
-interface DNSConfigSectionProps {
-  expanded: boolean;
-  onToggle: () => void;
-  dnsYaml: string;
-  onDnsYamlChange: (value: string) => void;
-}
-
-export function DNSConfigSection({
-  expanded,
-  onToggle,
-  dnsYaml,
-  onDnsYamlChange,
-}: DNSConfigSectionProps) {
-  return (
-    <div>
-      <SectionHeader
-        expanded={expanded}
-        onToggle={onToggle}
-        icon={Globe}
-        title="基础和 DNS 配置"
-      />
-      {expanded && (
-        <div className="mt-2 space-y-2 pl-6">
-          <p className="text-[10px] text-white/40 mb-1">
-            直接编辑 YAML 格式的基础配置（包括 mixed-port、allow-lan、dns、profile、sniffer 等）
-          </p>
-          <Textarea
-            value={dnsYaml}
-            onChange={(e) => onDnsYamlChange(e.target.value)}
-            placeholder={`# 基础配置示例
-mixed-port: ${DEFAULT_SUBBOOST_CONFIG.mixedPort}
-allow-lan: ${DEFAULT_SUBBOOST_CONFIG.allowLan}
-
-dns:
-  enable: true
-  listen: 0.0.0.0:5335
-  ...`}
-            className="min-h-[200px] max-h-[400px] text-xs font-mono resize-y"
-          />
-        </div>
-      )}
-    </div>
-  );
-}
-
diff --git a/packages/ui/src/product/converter/sections/index.ts b/packages/ui/src/product/converter/sections/index.ts
deleted file mode 100644
index 0631424..0000000
--- a/packages/ui/src/product/converter/sections/index.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-export { SectionHeader } from "./section-header";
-export type { SectionHeaderProps } from "./section-header";
-
-export { NodeInputSection } from "./node-input-section";
-export { NodeFilterSection } from "./node-filter-section";
-
diff --git a/packages/ui/src/product/converter/sections/node-filter-section.tsx b/packages/ui/src/product/converter/sections/node-filter-section.tsx
deleted file mode 100644
index afdfdf2..0000000
--- a/packages/ui/src/product/converter/sections/node-filter-section.tsx
+++ /dev/null
@@ -1,91 +0,0 @@
-"use client";
-
-import * as React from "react";
-import { Filter } from "lucide-react";
-import { Input } from "@subboost/ui/components/ui/input";
-import { Badge } from "@subboost/ui/components/ui/badge";
-import { cn } from "@subboost/ui/lib/utils";
-import { SectionHeader } from "./section-header";
-
-interface NodeFilterSectionProps {
-  expanded: boolean;
-  onToggle: () => void;
-  filterKeyword: string;
-  onFilterChange: (value: string) => void;
-  filterMode: "include" | "exclude";
-  onFilterModeChange: (mode: "include" | "exclude") => void;
-  totalNodes: number;
-  filteredCount: number;
-}
-
-export function NodeFilterSection({
-  expanded,
-  onToggle,
-  filterKeyword,
-  onFilterChange,
-  filterMode,
-  onFilterModeChange,
-  totalNodes,
-  filteredCount,
-}: NodeFilterSectionProps) {
-  const hasFilter = filterKeyword.trim().length > 0;
-  const filtered = hasFilter ? filteredCount : totalNodes;
-
-  return (
-    <div>
-      <SectionHeader
-        expanded={expanded}
-        onToggle={onToggle}
-        icon={Filter}
-        title="节点筛选"
-        badge={
-          hasFilter && totalNodes > 0 && (
-            <Badge variant="outline" className="ml-auto text-xs">
-              {filtered}/{totalNodes}
-            </Badge>
-          )
-        }
-      />
-      {expanded && (
-        <div className="mt-2 space-y-2 pl-6">
-          <div className="space-y-1.5">
-            <div className="flex gap-1 text-xs">
-              <button
-                onClick={() => onFilterModeChange("include")}
-                className={cn(
-                  "px-2 py-0.5 rounded transition-colors",
-                  filterMode === "include"
-                    ? "bg-green-500/20 text-green-400"
-                    : "text-white/40 hover:text-white/60"
-                )}
-              >
-                包含
-              </button>
-              <button
-                onClick={() => onFilterModeChange("exclude")}
-                className={cn(
-                  "px-2 py-0.5 rounded transition-colors",
-                  filterMode === "exclude"
-                    ? "bg-red-500/20 text-red-400"
-                    : "text-white/40 hover:text-white/60"
-                )}
-              >
-                排除
-              </button>
-            </div>
-            <Input
-              value={filterKeyword}
-              onChange={(e) => onFilterChange(e.target.value)}
-              placeholder="输入关键词过滤节点..."
-              className="h-7 text-xs"
-            />
-            <p className="text-[10px] text-white/30">
-              支持多个关键词，用 | 分隔，例如: 香港|日本|新加坡
-            </p>
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}
-
diff --git a/packages/ui/src/product/converter/sections/node-input-section.test.ts b/packages/ui/src/product/converter/sections/node-input-section.test.ts
deleted file mode 100644
index 04d6f83..0000000
--- a/packages/ui/src/product/converter/sections/node-input-section.test.ts
+++ /dev/null
@@ -1,297 +0,0 @@
-import * as React from "react";
-import { renderToStaticMarkup } from "react-dom/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import type { ParsedNode } from "@subboost/core/types/node";
-import type { SubscriptionSource } from "@subboost/ui/store/config-store";
-
-const mocks = vi.hoisted(() => ({
-  buttons: [] as any[],
-  inputs: [] as any[],
-  intrinsics: [] as any[],
-  textareas: [] as any[],
-  sectionHeaders: [] as any[],
-}));
-
-const stateMock = vi.hoisted(() => ({
-  enabled: false,
-  callIndex: 0,
-  overrides: {} as Record<number, unknown>,
-  setters: [] as Array<ReturnType<typeof vi.fn>>,
-}));
-
-vi.mock("react", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("react")>();
-  return {
-    ...actual,
-    useMemo: (factory: () => unknown) => factory(),
-    useState: (initial: unknown) => {
-      if (!stateMock.enabled) return actual.useState(initial);
-      const index = stateMock.callIndex++;
-      const value = Object.prototype.hasOwnProperty.call(stateMock.overrides, index)
-        ? stateMock.overrides[index]
-        : initial;
-      const setter = vi.fn((next: unknown) => {
-        const resolved = typeof next === "function" ? (next as (prev: unknown) => unknown)(value) : next;
-        (setter as any).lastValue = resolved;
-        return resolved;
-      });
-      stateMock.setters[index] = setter;
-      return [value, setter];
-    },
-  };
-});
-
-vi.mock("react/jsx-runtime", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("react/jsx-runtime")>();
-  const capture = (type: unknown, props: Record<string, unknown> | null, key?: unknown) => {
-    if (typeof type === "string") {
-      mocks.intrinsics.push({ type, props: props ?? {}, key });
-    }
-  };
-  return {
-    ...actual,
-    jsx: (type: unknown, props: Record<string, unknown> | null, key?: unknown) => {
-      capture(type, props, key);
-      return actual.jsx(type as any, props, key as any);
-    },
-    jsxs: (type: unknown, props: Record<string, unknown> | null, key?: unknown) => {
-      capture(type, props, key);
-      return actual.jsxs(type as any, props, key as any);
-    },
-  };
-});
-
-vi.mock("lucide-react", () => ({
-  Plus: () => React.createElement("span", null, "plus"),
-  Trash2: () => React.createElement("span", null, "trash"),
-  Link2: () => React.createElement("span", null, "link"),
-  FileCode: () => React.createElement("span", null, "file"),
-  Server: () => React.createElement("span", null, "server"),
-  Check: () => React.createElement("span", null, "check"),
-  Loader2: () => React.createElement("span", null, "loading"),
-  Pencil: () => React.createElement("span", null, "pencil"),
-  X: () => React.createElement("span", null, "x"),
-  Search: () => React.createElement("span", null, "search"),
-}));
-
-vi.mock("@subboost/ui/components/ui/button", () => ({
-  Button: (props: any) => {
-    mocks.buttons.push(props);
-    return React.createElement("button", props, props.children);
-  },
-}));
-
-vi.mock("@subboost/ui/components/ui/input", () => ({
-  Input: (props: any) => {
-    mocks.inputs.push(props);
-    return React.createElement("input", props);
-  },
-}));
-
-vi.mock("@subboost/ui/components/ui/textarea", () => ({
-  Textarea: (props: any) => {
-    mocks.textareas.push(props);
-    return React.createElement("textarea", props);
-  },
-}));
-
-vi.mock("@subboost/ui/components/ui/badge", () => ({
-  Badge: (props: any) => React.createElement("span", { className: props.className }, props.children),
-}));
-
-vi.mock("@subboost/ui/lib/utils", () => ({
-  cn: (...parts: Array<string | false | null | undefined>) => parts.filter(Boolean).join(" "),
-}));
-
-vi.mock("./section-header", () => ({
-  SectionHeader: (props: any) => {
-    mocks.sectionHeaders.push(props);
-    return React.createElement("header", null, props.title, props.badge);
-  },
-}));
-
-vi.mock("@subboost/ui/product/converter/subscription-import-error", () => ({
-  SubscriptionImportErrorBadge: () => React.createElement("span", null, "import-error"),
-}));
-
-import { NodeInputSection } from "./node-input-section";
-
-function source(overrides: Partial<SubscriptionSource> = {}): SubscriptionSource {
-  return {
-    id: "source-1",
-    type: "url",
-    content: "https://example.test/sub",
-    parsed: false,
-    parsing: false,
-    ...overrides,
-  } as SubscriptionSource;
-}
-
-function node(name: string): ParsedNode {
-  return { name, type: "direct" } as ParsedNode;
-}
-
-function renderSection(
-  props: Partial<React.ComponentProps<typeof NodeInputSection>> = {},
-  stateOverrides: Record<number, unknown> = {}
-) {
-  const callbacks = {
-    onToggle: vi.fn(),
-    onAddSource: vi.fn(),
-    onRemoveSource: vi.fn(),
-    onUpdateSourceType: vi.fn(),
-    onUpdateSourceContent: vi.fn(),
-    onParseSource: vi.fn(),
-    onRemoveNode: vi.fn(),
-    onRenameNode: vi.fn(),
-  };
-  const fullProps: React.ComponentProps<typeof NodeInputSection> = {
-    expanded: true,
-    sources: [source()],
-    nodes: [],
-    ...callbacks,
-    ...props,
-  };
-
-  stateMock.enabled = true;
-  stateMock.callIndex = 0;
-  stateMock.overrides = stateOverrides;
-  stateMock.setters = [];
-  mocks.buttons = [];
-  mocks.inputs = [];
-  mocks.intrinsics = [];
-  mocks.textareas = [];
-  mocks.sectionHeaders = [];
-  try {
-    const html = renderToStaticMarkup(React.createElement(NodeInputSection, fullProps));
-    return {
-      html,
-      callbacks,
-      setters: stateMock.setters,
-      buttons: mocks.buttons,
-      inputs: mocks.inputs,
-      intrinsics: mocks.intrinsics,
-      textareas: mocks.textareas,
-    };
-  } finally {
-    stateMock.enabled = false;
-  }
-}
-
-function textOf(children: unknown): string {
-  if (typeof children === "string" || typeof children === "number") return String(children);
-  if (Array.isArray(children)) return children.map(textOf).join("");
-  if (React.isValidElement(children)) return textOf((children.props as { children?: unknown }).children);
-  return "";
-}
-
-function findIntrinsic(type: string, predicate: (props: any) => boolean) {
-  const found = mocks.intrinsics.find((item: any) => item.type === type && predicate(item.props));
-  expect(found).toBeTruthy();
-  return found.props;
-}
-
-describe("NodeInputSection", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it("renders only the section header when collapsed", () => {
-    const { html } = renderSection({ expanded: false, sources: [source(), source({ id: "source-2", type: "yaml" })] });
-
-    expect(html).toContain("节点导入");
-    expect(html).toContain("2 个导入源");
-    expect(html).not.toContain("添加订阅源");
-  });
-
-  it("renders subscription sources and dispatches source actions", () => {
-    const { html, callbacks, buttons, textareas } = renderSection({
-      sources: [
-        source({ id: "url", type: "url", parsed: true, nodeCount: 3 }),
-        source({ id: "yaml", type: "yaml", content: "proxies: []", error: "bad yaml" }),
-      ],
-    });
-
-    expect(html).toContain("订阅链接 #1");
-    expect(html).toContain("YAML 配置 #2");
-    expect(html).toContain("✓ 3");
-    expect(html).toContain("import-error");
-
-    textareas[0].onChange({ target: { value: "https://new.example/sub" } });
-    expect(callbacks.onUpdateSourceContent).toHaveBeenCalledWith("url", "https://new.example/sub");
-
-    buttons[0].onClick();
-    expect(callbacks.onAddSource).toHaveBeenCalled();
-
-    findIntrinsic("button", (props) => props.title === "YAML 配置").onClick();
-    expect(callbacks.onUpdateSourceType).toHaveBeenCalledWith("url", "yaml");
-
-    findIntrinsic("button", (props) => props.title === "节点链接").onClick();
-    expect(callbacks.onUpdateSourceType).toHaveBeenCalledWith("url", "nodes");
-
-    findIntrinsic("button", (props) => props.title === "解析导入").onClick();
-    expect(callbacks.onParseSource).toHaveBeenCalledWith("url");
-
-    findIntrinsic("button", (props) => props.title === "删除").onClick();
-    expect(callbacks.onRemoveSource).toHaveBeenCalledWith("url");
-  });
-
-  it("limits very large node lists and toggles show-all state", () => {
-    const nodes = Array.from({ length: 201 }, (_, index) => node(`node-${index}`));
-    const { html, buttons, setters } = renderSection({ nodes });
-
-    expect(html).toContain("已导入节点");
-    expect(html).toContain("仅显示前 200 个节点");
-    expect(html).toContain("显示全部 (201)");
-
-    const showAllButton = buttons.find((button) => String(button.children).includes("显示全部"));
-    showAllButton.onClick();
-    expect(setters[3]).toHaveBeenCalled();
-    expect((setters[3] as any).lastValue).toBe(true);
-  });
-
-  it("renders search empty state without list limiting", () => {
-    const { html, inputs, setters } = renderSection({ nodes: [node("Alpha"), node("Beta")] }, { 2: "missing" });
-
-    expect(inputs[0]).toMatchObject({ value: "missing", placeholder: "搜索节点..." });
-    inputs[0].onChange({ target: { value: "Alpha" } });
-    expect(setters[2]).toHaveBeenCalledWith("Alpha");
-    expect(html).toContain("未找到匹配节点");
-    expect(html).not.toContain("仅显示前 200 个节点");
-  });
-
-  it("renders node edit mode and saves with Enter", () => {
-    const { callbacks, html, setters } = renderSection({ nodes: [node("Old")] }, { 0: "Old", 1: "New" });
-
-    expect(html).toContain('value="New"');
-    expect(html).toContain("check");
-    expect(html).toContain("x");
-
-    const editInput = findIntrinsic("input", (props) => props.type === "text" && props.value === "New");
-    editInput.onChange({ target: { value: "Next" } });
-    expect(setters[1]).toHaveBeenCalledWith("Next");
-    editInput.onKeyDown({ key: "Enter" });
-    expect(callbacks.onRenameNode).toHaveBeenCalledWith("Old", "New");
-    expect(setters[0]).toHaveBeenCalledWith(null);
-    expect(setters[1]).toHaveBeenCalledWith("");
-
-    const sameName = renderSection({ nodes: [node("Old")] }, { 0: "Old", 1: "Old" });
-    findIntrinsic("button", (props) => typeof props.className === "string" && props.className.includes("text-green-400")).onClick();
-    expect(sameName.callbacks.onRenameNode).not.toHaveBeenCalledWith("Old", "Old");
-
-    const cancel = renderSection({ nodes: [node("Old")] }, { 0: "Old", 1: "New" });
-    findIntrinsic("button", (props) => typeof props.className === "string" && props.className.includes("text-red-400")).onClick();
-    expect(cancel.setters[0]).toHaveBeenCalledWith(null);
-  });
-
-  it("starts node editing and removes nodes from action buttons", () => {
-    const { callbacks, setters } = renderSection({ nodes: [node("Alpha")] });
-
-    findIntrinsic("button", (props) => props.title === "重命名").onClick();
-    expect(setters[0]).toHaveBeenCalledWith("Alpha");
-    expect(setters[1]).toHaveBeenCalledWith("Alpha");
-
-    findIntrinsic("button", (props) => props.title === "删除").onClick();
-    expect(callbacks.onRemoveNode).toHaveBeenCalledWith("Alpha");
-  });
-});
diff --git a/packages/ui/src/product/converter/sections/node-input-section.tsx b/packages/ui/src/product/converter/sections/node-input-section.tsx
deleted file mode 100644
index 32029e4..0000000
--- a/packages/ui/src/product/converter/sections/node-input-section.tsx
+++ /dev/null
@@ -1,327 +0,0 @@
-"use client";
-
-import * as React from "react";
-import {
-  Plus,
-  Trash2,
-  Link2,
-  FileCode,
-  Server,
-  Check,
-  Loader2,
-  Pencil,
-  X,
-  Search,
-} from "lucide-react";
-import { Button } from "@subboost/ui/components/ui/button";
-import { Input } from "@subboost/ui/components/ui/input";
-import { Textarea } from "@subboost/ui/components/ui/textarea";
-import { Badge } from "@subboost/ui/components/ui/badge";
-import { cn } from "@subboost/ui/lib/utils";
-import { SectionHeader } from "./section-header";
-import type { SubscriptionSource, SourceType } from "@subboost/ui/store/config-store";
-import type { ParsedNode } from "@subboost/core/types/node";
-import { SubscriptionImportErrorBadge } from "@subboost/ui/product/converter/subscription-import-error";
-
-const sourceTypeInfo: Record<
-  SourceType,
-  { label: string; icon: typeof Link2; placeholder: string }
-> = {
-  url: {
-    label: "订阅链接",
-    icon: Link2,
-    placeholder: "https://example.com/sub?token=xxx",
-  },
-  yaml: {
-    label: "YAML 配置",
-    icon: FileCode,
-    placeholder: "proxies:\n  - name: 节点名称\n    type: vmess\n    ...",
-  },
-  nodes: {
-    label: "节点链接",
-    icon: Server,
-    placeholder:
-      "ss://...\nssr://...\nvmess://...\nvless://...\ntrojan://...\nanytls://...\nhysteria2://... / hy2://...\ntuic://...\n(socks5://... / socks4://...)",
-  },
-};
-
-interface NodeInputSectionProps {
-  expanded: boolean;
-  onToggle: () => void;
-  sources: SubscriptionSource[];
-  nodes: ParsedNode[];
-  onAddSource: () => void;
-  onRemoveSource: (id: string) => void;
-  onUpdateSourceType: (id: string, type: SourceType) => void;
-  onUpdateSourceContent: (id: string, content: string) => void;
-  onParseSource: (id: string) => void;
-  onRemoveNode: (name: string) => void;
-  onRenameNode: (oldName: string, newName: string) => void;
-}
-
-export function NodeInputSection({
-  expanded,
-  onToggle,
-  sources,
-  nodes,
-  onAddSource,
-  onRemoveSource,
-  onUpdateSourceType,
-  onUpdateSourceContent,
-  onParseSource,
-  onRemoveNode,
-  onRenameNode,
-}: NodeInputSectionProps) {
-  const [editingNodeName, setEditingNodeName] = React.useState<string | null>(null);
-  const [editNodeValue, setEditNodeValue] = React.useState("");
-  const [nodeSearch, setNodeSearch] = React.useState("");
-  const [showAllNodes, setShowAllNodes] = React.useState(false);
-
-  const NODE_RENDER_LIMIT = 200;
-  const normalizedSearch = nodeSearch.trim().toLowerCase();
-
-  const filteredNodes = React.useMemo(() => {
-    if (!normalizedSearch) return nodes;
-    return nodes.filter((n) => n.name.toLowerCase().includes(normalizedSearch));
-  }, [nodes, normalizedSearch]);
-
-  const shouldLimit = !showAllNodes && !normalizedSearch && filteredNodes.length > NODE_RENDER_LIMIT;
-  const displayedNodes = shouldLimit ? filteredNodes.slice(0, NODE_RENDER_LIMIT) : filteredNodes;
-
-  const handleStartEdit = (name: string) => {
-    setEditingNodeName(name);
-    setEditNodeValue(name);
-  };
-
-  const handleSaveEdit = (oldName: string) => {
-    if (editNodeValue.trim() && editNodeValue !== oldName) {
-      onRenameNode(oldName, editNodeValue.trim());
-    }
-    setEditingNodeName(null);
-    setEditNodeValue("");
-  };
-
-  const handleCancelEdit = () => {
-    setEditingNodeName(null);
-    setEditNodeValue("");
-  };
-
-  const sourceCount = sources.length;
-
-  return (
-    <div>
-      <SectionHeader
-        expanded={expanded}
-        onToggle={onToggle}
-        icon={Server}
-        title="节点导入"
-        badge={
-          sourceCount > 0 && (
-            <Badge variant="outline" className="ml-auto border-blue-500/50 bg-blue-500/10 text-blue-300">
-              {sourceCount} 个导入源
-            </Badge>
-          )
-        }
-      />
-      {expanded && (
-        <div className="mt-2 space-y-2 pl-6">
-          {sources.map((source, index) => {
-            const typeInfo = sourceTypeInfo[source.type];
-            return (
-              <div key={source.id} className="space-y-1">
-                <div className="flex items-center justify-between">
-                  <div className="flex items-center gap-2">
-                    <div className="flex gap-0.5">
-                      {(Object.keys(sourceTypeInfo) as SourceType[]).map(
-                        (type) => {
-                          const info = sourceTypeInfo[type];
-                          const Icon = info.icon;
-                          return (
-                            <button
-                              key={type}
-                              onClick={() => onUpdateSourceType(source.id, type)}
-                              className={cn(
-                                "p-1 rounded transition-colors",
-                                source.type === type
-                                  ? "bg-indigo-500/20 text-indigo-400"
-                                  : "text-white/30 hover:text-white/50 hover:bg-white/5"
-                              )}
-                              title={info.label}
-                            >
-                              <Icon className="h-3.5 w-3.5" />
-                            </button>
-                          );
-                        }
-                      )}
-                    </div>
-                    <span className="text-xs text-white/50">
-                      {typeInfo.label} {sources.length > 1 && `#${index + 1}`}
-                    </span>
-                    {source.parsed && source.nodeCount !== undefined && (
-                      <span className="text-xs text-green-400">
-                        ✓ {source.nodeCount}
-                      </span>
-                    )}
-                    {(source.errorInfo || source.error) && (
-                      <SubscriptionImportErrorBadge errorInfo={source.errorInfo} errorMessage={source.error} />
-                    )}
-                  </div>
-                  <div className="flex items-center gap-0.5">
-                    <button
-                      onClick={() => onParseSource(source.id)}
-                      disabled={!source.content.trim() || source.parsing}
-                      className={cn(
-                        "p-1 rounded transition-colors",
-                        source.parsing
-                          ? "text-indigo-400"
-                          : source.parsed
-                          ? "text-green-400 hover:text-green-300"
-                          : source.content.trim()
-                          ? "text-white/30 hover:text-indigo-400 hover:bg-indigo-500/10"
-                          : "text-white/10 cursor-not-allowed"
-                      )}
-                      title="解析导入"
-                    >
-                      {source.parsing ? (
-                        <Loader2 className="h-3.5 w-3.5 animate-spin" />
-                      ) : source.parsed ? (
-                        <Check className="h-3.5 w-3.5" />
-                      ) : (
-                        <Check className="h-3.5 w-3.5" />
-                      )}
-                    </button>
-                    {sources.length > 1 && (
-                      <button
-                        onClick={() => onRemoveSource(source.id)}
-                        className="p-1 rounded text-white/30 hover:text-red-400 hover:bg-red-500/10 transition-colors"
-                        title="删除"
-                      >
-                        <Trash2 className="h-3.5 w-3.5" />
-                      </button>
-                    )}
-                  </div>
-                </div>
-                <Textarea
-                  value={source.content}
-                  onChange={(e) =>
-                    onUpdateSourceContent(source.id, e.target.value)
-                  }
-                  placeholder={typeInfo.placeholder}
-                  className={cn(
-                    "min-h-[60px] max-h-[120px] text-xs font-mono resize-y",
-                    source.type === "url" && "min-h-[36px] max-h-[36px]"
-                  )}
-                />
-              </div>
-            );
-          })}
-
-          <Button
-            variant="outline"
-            size="sm"
-            onClick={onAddSource}
-            className="w-full text-xs h-7"
-          >
-            <Plus className="h-3 w-3 mr-1" />
-            添加订阅源
-          </Button>
-
-          {/* 已导入节点列表 */}
-          {nodes.length > 0 && (
-            <div className="pt-2 border-t border-white/10">
-              <div className="text-xs text-white/40 mb-1.5">已导入节点</div>
-              <div className="flex items-center gap-2 mb-2">
-                <div className="relative flex-1">
-                  <Search className="absolute left-2 top-1/2 -translate-y-1/2 h-3.5 w-3.5 text-white/30" />
-                  <Input
-                    value={nodeSearch}
-                    onChange={(e) => setNodeSearch(e.target.value)}
-                    placeholder="搜索节点..."
-                    className="h-8 pl-7 text-xs"
-                  />
-                </div>
-                {nodes.length > NODE_RENDER_LIMIT && !normalizedSearch && (
-                  <Button
-                    variant="ghost"
-                    size="sm"
-                    className="h-8 px-2 text-xs text-white/60 hover:text-white"
-                    onClick={() => setShowAllNodes((v) => !v)}
-                    title={showAllNodes ? "仅显示部分节点" : "显示全部节点"}
-                  >
-                    {showAllNodes ? "收起" : `显示全部 (${nodes.length})`}
-                  </Button>
-                )}
-              </div>
-
-              {!normalizedSearch && shouldLimit && (
-                <div className="text-[10px] text-white/40 mb-1">
-                  为避免卡顿，仅显示前 {NODE_RENDER_LIMIT} 个节点；可用搜索查看其它节点
-                </div>
-              )}
-
-              <div className="flex flex-wrap gap-1 max-h-[150px] overflow-y-auto">
-                {displayedNodes.map((node) => (
-                  <div
-                    key={node.name}
-                    className="group flex items-center gap-0.5 px-1.5 py-0.5 rounded bg-white/5 text-xs"
-                  >
-                    {editingNodeName === node.name ? (
-                      <div className="flex items-center gap-1">
-                        <input
-                          type="text"
-                          value={editNodeValue}
-                          onChange={(e) => setEditNodeValue(e.target.value)}
-                          className="w-20 px-1 py-0.5 bg-white/5 border border-indigo-500/50 rounded text-xs"
-                          autoFocus
-                          onKeyDown={(e) => {
-                            if (e.key === "Enter") handleSaveEdit(node.name);
-                            if (e.key === "Escape") handleCancelEdit();
-                          }}
-                        />
-                        <button
-                          onClick={() => handleSaveEdit(node.name)}
-                          className="p-0.5 text-green-400 hover:bg-green-500/20 rounded"
-                        >
-                          <Check className="h-3 w-3" />
-                        </button>
-                        <button
-                          onClick={handleCancelEdit}
-                          className="p-0.5 text-red-400 hover:bg-red-500/20 rounded"
-                        >
-                          <X className="h-3 w-3" />
-                        </button>
-                      </div>
-                    ) : (
-                      <>
-                        <span className="text-white/70 truncate max-w-[100px]">
-                          {node.name}
-                        </span>
-                        <button
-                          onClick={() => handleStartEdit(node.name)}
-                          className="p-0.5 opacity-0 group-hover:opacity-100 text-white/30 hover:text-indigo-400 transition-opacity"
-                          title="重命名"
-                        >
-                          <Pencil className="h-2.5 w-2.5" />
-                        </button>
-                        <button
-                          onClick={() => onRemoveNode(node.name)}
-                          className="p-0.5 opacity-0 group-hover:opacity-100 text-white/30 hover:text-red-400 transition-opacity"
-                          title="删除"
-                        >
-                          <X className="h-2.5 w-2.5" />
-                        </button>
-                      </>
-                    )}
-                  </div>
-                ))}
-                {displayedNodes.length === 0 && (
-                  <div className="text-[10px] text-white/40 py-1">未找到匹配节点</div>
-                )}
-              </div>
-            </div>
-          )}
-        </div>
-      )}
-    </div>
-  );
-}
diff --git a/packages/ui/src/product/converter/sections/section-header.tsx b/packages/ui/src/product/converter/sections/section-header.tsx
deleted file mode 100644
index 4d3212e..0000000
--- a/packages/ui/src/product/converter/sections/section-header.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-"use client";
-
-import * as React from "react";
-import { ChevronDown, ChevronRight } from "lucide-react";
-
-export interface SectionHeaderProps {
-  expanded: boolean;
-  onToggle: () => void;
-  icon: React.ComponentType<{ className?: string }>;
-  title: string;
-  badge?: React.ReactNode;
-}
-
-export function SectionHeader({
-  expanded,
-  onToggle,
-  icon: Icon,
-  title,
-  badge,
-}: SectionHeaderProps) {
-  return (
-    <button
-      onClick={onToggle}
-      className="w-full flex items-center gap-2 py-1.5 px-2 rounded-lg hover:bg-white/5 transition-colors"
-    >
-      {expanded ? (
-        <ChevronDown className="h-4 w-4 text-white/50" />
-      ) : (
-        <ChevronRight className="h-4 w-4 text-white/50" />
-      )}
-      <Icon className="h-4 w-4 text-indigo-400" />
-      <span className="text-sm font-medium text-white">{title}</span>
-      {badge}
-    </button>
-  );
-}
-
diff --git a/packages/ui/src/product/home/unsaved-prompt.test.ts b/packages/ui/src/product/home/unsaved-prompt.test.ts
index 0e4c350..9eeea39 100644
--- a/packages/ui/src/product/home/unsaved-prompt.test.ts
+++ b/packages/ui/src/product/home/unsaved-prompt.test.ts
@@ -3,110 +3,38 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
-  buttons: [] as any[],
-  routerPush: vi.fn(),
   storeState: { nodes: [] as any[], sources: [] as any[] },
   isSourcePendingImport: vi.fn(),
   listeners: new Map<string, EventListener>(),
 }));
 
-const stateMock = vi.hoisted(() => ({
-  enabled: false,
-  callIndex: 0,
-  overrides: {} as Record<number, unknown>,
-  setters: [] as Array<ReturnType<typeof vi.fn>>,
-}));
-
 vi.mock("react", async (importOriginal) => {
   const actual = await importOriginal<typeof import("react")>();
   return {
     ...actual,
     useMemo: (factory: () => unknown) => factory(),
-    useEffect: (effect: () => void | (() => void)) => {
-      effect();
-    },
-    useState: (initial: unknown) => {
-      if (!stateMock.enabled) return actual.useState(initial);
-      const index = stateMock.callIndex++;
-      const value = Object.prototype.hasOwnProperty.call(stateMock.overrides, index)
-        ? stateMock.overrides[index]
-        : initial;
-      const setter = vi.fn((next: unknown) => {
-        const resolved = typeof next === "function" ? (next as (prev: unknown) => unknown)(value) : next;
-        (setter as any).lastValue = resolved;
-        return resolved;
-      });
-      stateMock.setters[index] = setter;
-      return [value, setter];
-    },
+    useEffect: (effect: () => void | (() => void)) => effect(),
   };
 });
-
-vi.mock("next/navigation", () => ({
-  useRouter: () => ({ push: mocks.routerPush }),
-}));
-
-vi.mock("lucide-react", () => ({
-  AlertTriangle: () => React.createElement("span", null, "alert"),
-}));
-
-vi.mock("zustand/react/shallow", () => ({
-  useShallow: (selector: unknown) => selector,
-}));
-
-vi.mock("@subboost/ui/components/ui/dialog", () => ({
-  Dialog: (props: any) => React.createElement("div", { "data-open": props.open }, props.children),
-  DialogContent: (props: any) => React.createElement("section", null, props.children),
-  DialogDescription: (props: any) => React.createElement("p", null, props.children),
-  DialogFooter: (props: any) => React.createElement("footer", null, props.children),
-  DialogHeader: (props: any) => React.createElement("header", null, props.children),
-  DialogTitle: (props: any) => React.createElement("h2", null, props.children),
-}));
-
-vi.mock("@subboost/ui/components/ui/button", () => ({
-  Button: (props: any) => {
-    mocks.buttons.push(props);
-    return React.createElement("button", props, props.children);
-  },
-}));
-
+vi.mock("zustand/react/shallow", () => ({ useShallow: (selector: unknown) => selector }));
 vi.mock("@subboost/ui/product/subscription/source-import-state", () => ({
   isSourcePendingImport: mocks.isSourcePendingImport,
 }));
-
 vi.mock("@subboost/ui/store/config-store", () => ({
   useConfigStore: (selector: (state: typeof mocks.storeState) => unknown) => selector(mocks.storeState),
 }));
 
-import { UnsavedPrompt, useUnsavedChanges } from "./unsaved-prompt";
+import { UnsavedPrompt } from "./unsaved-prompt";
 
 function stubBrowser(webdriver = false) {
   mocks.listeners.clear();
   vi.stubGlobal("navigator", { webdriver });
   vi.stubGlobal("window", {
-    addEventListener: vi.fn((type: string, listener: EventListener) => {
-      mocks.listeners.set(type, listener);
-    }),
-    removeEventListener: vi.fn((type: string) => {
-      mocks.listeners.delete(type);
-    }),
+    addEventListener: vi.fn((type: string, listener: EventListener) => mocks.listeners.set(type, listener)),
+    removeEventListener: vi.fn((type: string) => mocks.listeners.delete(type)),
   });
 }
 
-function renderPrompt(overrides: Record<number, unknown> = {}) {
-  stateMock.enabled = true;
-  stateMock.callIndex = 0;
-  stateMock.overrides = overrides;
-  stateMock.setters = [];
-  mocks.buttons = [];
-  try {
-    const html = renderToStaticMarkup(React.createElement(UnsavedPrompt));
-    return { html, setters: stateMock.setters, buttons: mocks.buttons };
-  } finally {
-    stateMock.enabled = false;
-  }
-}
-
 describe("UnsavedPrompt", () => {
   beforeEach(() => {
     vi.clearAllMocks();
@@ -116,46 +44,25 @@ describe("UnsavedPrompt", () => {
     stubBrowser(false);
   });
 
-  it("registers beforeunload and exposes the global unsaved-check function", () => {
+  it("registers beforeunload and warns when imported work exists", () => {
     mocks.storeState = { nodes: [{ name: "node-1" }], sources: [] };
-    renderPrompt();
+    expect(renderToStaticMarkup(React.createElement(UnsavedPrompt))).toBe("");
 
-    expect((window as any).__checkUnsavedChanges()).toBe(true);
     const event = { preventDefault: vi.fn(), returnValue: "" } as any;
     mocks.listeners.get("beforeunload")?.(event);
     expect(event.preventDefault).toHaveBeenCalled();
     expect(event.returnValue).toBe("您有未保存的配置更改，确定要离开吗？");
   });
 
-  it("skips beforeunload in webdriver environments", () => {
+  it("does not warn without pending work and skips automation environments", () => {
+    renderToStaticMarkup(React.createElement(UnsavedPrompt));
+    const event = { preventDefault: vi.fn(), returnValue: "" } as any;
+    mocks.listeners.get("beforeunload")?.(event);
+    expect(event.preventDefault).not.toHaveBeenCalled();
+
     stubBrowser(true);
     mocks.storeState = { nodes: [{ name: "node-1" }], sources: [] };
-    renderPrompt();
-
+    renderToStaticMarkup(React.createElement(UnsavedPrompt));
     expect(mocks.listeners.has("beforeunload")).toBe(false);
   });
-
-  it("renders the dialog and handles cancel/confirm callbacks", () => {
-    const { html, buttons, setters } = renderPrompt({ 0: true, 1: "/next" });
-
-    expect(html).toContain("未保存的更改");
-    buttons.find((button) => button.variant === "outline").onClick();
-    expect(setters[0]).toHaveBeenCalledWith(false);
-    expect(setters[1]).toHaveBeenCalledWith(null);
-
-    buttons.find((button) => button.variant === "destructive").onClick();
-    expect(mocks.routerPush).toHaveBeenCalledWith("/next");
-    expect(setters[1]).toHaveBeenLastCalledWith(null);
-  });
-
-  it("computes unsaved state from nodes and pending sources", () => {
-    mocks.storeState = { nodes: [], sources: [] };
-    expect(useUnsavedChanges()).toBe(false);
-
-    mocks.storeState = { nodes: [], sources: [{ pending: true }] };
-    expect(useUnsavedChanges()).toBe(true);
-
-    mocks.storeState = { nodes: [{ name: "node-1" }], sources: [] };
-    expect(useUnsavedChanges()).toBe(true);
-  });
 });
diff --git a/packages/ui/src/product/home/unsaved-prompt.tsx b/packages/ui/src/product/home/unsaved-prompt.tsx
index 84420ce..bc8ac0e 100644
--- a/packages/ui/src/product/home/unsaved-prompt.tsx
+++ b/packages/ui/src/product/home/unsaved-prompt.tsx
@@ -1,124 +1,35 @@
 "use client";
 
 import * as React from "react";
-import { useRouter } from "next/navigation";
-import { AlertTriangle } from "lucide-react";
 import { useShallow } from "zustand/react/shallow";
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from "@subboost/ui/components/ui/dialog";
-import { Button } from "@subboost/ui/components/ui/button";
 import { isSourcePendingImport } from "@subboost/ui/product/subscription/source-import-state";
 import { useConfigStore } from "@subboost/ui/store/config-store";
 
-/**
- * 未保存提醒组件
- * 监听页面离开事件，如果有未保存的更改则提示用户
- */
+/** Warns before a browser refresh or close would discard imported work. */
 export function UnsavedPrompt() {
   const { nodes, sources } = useConfigStore(
     useShallow((state) => ({ nodes: state.nodes, sources: state.sources }))
   );
-  const [showDialog, setShowDialog] = React.useState(false);
-  const [pendingNavigation, setPendingNavigation] = React.useState<string | null>(null);
-  const router = useRouter();
-
-  // 检测是否有未保存的更改
-  const hasUnsavedChanges = React.useMemo(() => {
-    // 有节点但没有生成配置，或者有有效的订阅源但没有解析
-    const hasNodes = nodes.length > 0;
-    const hasUnparsedSources = sources.some(isSourcePendingImport);
-    
-    // 如果有节点或未解析的源，但没有下载过配置（这里简化处理）
-    return hasNodes || hasUnparsedSources;
-  }, [nodes, sources]);
+  const hasUnsavedChanges = React.useMemo(
+    () => nodes.length > 0 || sources.some(isSourcePendingImport),
+    [nodes, sources]
+  );
 
-  // 监听 beforeunload 事件（浏览器关闭/刷新）
   React.useEffect(() => {
-    // 自动化/测试环境（如 Playwright）下禁用 beforeunload，避免阻塞自动化回归与开发调试
-    if (typeof navigator !== "undefined" && (navigator as unknown as { webdriver?: boolean }).webdriver) {
+    if (typeof navigator !== "undefined" && (navigator as { webdriver?: boolean }).webdriver) {
       return;
     }
 
-    const handleBeforeUnload = (e: BeforeUnloadEvent) => {
-      if (hasUnsavedChanges) {
-        e.preventDefault();
-        e.returnValue = "您有未保存的配置更改，确定要离开吗？";
-        return e.returnValue;
-      }
+    const handleBeforeUnload = (event: BeforeUnloadEvent) => {
+      if (!hasUnsavedChanges) return;
+      event.preventDefault();
+      event.returnValue = "您有未保存的配置更改，确定要离开吗？";
+      return event.returnValue;
     };
 
     window.addEventListener("beforeunload", handleBeforeUnload);
     return () => window.removeEventListener("beforeunload", handleBeforeUnload);
   }, [hasUnsavedChanges]);
 
-  // 处理确认离开
-  const handleConfirmLeave = () => {
-    setShowDialog(false);
-    if (pendingNavigation) {
-      router.push(pendingNavigation);
-      setPendingNavigation(null);
-    }
-  };
-
-  // 处理取消离开
-  const handleCancelLeave = () => {
-    setShowDialog(false);
-    setPendingNavigation(null);
-  };
-
-  // 暴露方法供外部调用（如导航拦截）
-  React.useEffect(() => {
-    // 在全局对象上挂载检查函数
-    (window as unknown as { __checkUnsavedChanges?: () => boolean }).__checkUnsavedChanges = () => hasUnsavedChanges;
-    
-    return () => {
-      delete (window as unknown as { __checkUnsavedChanges?: () => boolean }).__checkUnsavedChanges;
-    };
-  }, [hasUnsavedChanges]);
-
-  return (
-    <Dialog open={showDialog} onOpenChange={setShowDialog}>
-      <DialogContent className="sm:max-w-md">
-        <DialogHeader>
-          <DialogTitle className="flex items-center gap-2">
-            <AlertTriangle className="h-5 w-5 text-yellow-500" />
-            未保存的更改
-          </DialogTitle>
-          <DialogDescription>
-            您有未保存的配置更改。如果现在离开，这些更改将会丢失。
-          </DialogDescription>
-        </DialogHeader>
-        <DialogFooter className="gap-2 sm:gap-0">
-          <Button variant="outline" onClick={handleCancelLeave}>
-            继续编辑
-          </Button>
-          <Button variant="destructive" onClick={handleConfirmLeave}>
-            放弃更改
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  );
-}
-
-/**
- * Hook: 检查是否有未保存的更改
- */
-export function useUnsavedChanges() {
-  const { nodes, sources } = useConfigStore(
-    useShallow((state) => ({ nodes: state.nodes, sources: state.sources }))
-  );
-  
-  return React.useMemo(() => {
-    const hasNodes = nodes.length > 0;
-    const hasUnparsedSources = sources.some(isSourcePendingImport);
-    return hasNodes || hasUnparsedSources;
-  }, [nodes, sources]);
+  return null;
 }
-
diff --git a/packages/ui/src/product/preview/diff-highlight.test.ts b/packages/ui/src/product/preview/diff-highlight.test.ts
index ba8a024..de78259 100644
--- a/packages/ui/src/product/preview/diff-highlight.test.ts
+++ b/packages/ui/src/product/preview/diff-highlight.test.ts
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { DiffHighlight, YamlHighlight } from "./diff-highlight";
+import { YamlHighlight } from "./diff-highlight";
 
 const reactMocks = vi.hoisted(() => ({
   useMemo: vi.fn((factory: () => unknown) => factory()),
@@ -51,33 +51,6 @@ function collectHtml(value: unknown): string[] {
   return html;
 }
 
-describe("DiffHighlight", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it("returns null for empty input", () => {
-    expect(DiffHighlight({ oldText: "", newText: "" })).toBeNull();
-  });
-
-  it("renders line-level additions and removals", () => {
-    const rendered = DiffHighlight({
-      oldText: "a\nb\nc",
-      newText: "a\nx\nc\nd",
-      className: "custom",
-    });
-
-    const text = collectText(rendered);
-    expect(text).toContain("变更统计:");
-    expect(text).toContain("+2 行");
-    expect(text).toContain("-1 行");
-    expect(text).toContain("a");
-    expect(text).toContain("b");
-    expect(text).toContain("x");
-    expect(text).toContain("d");
-  });
-});
-
 describe("YamlHighlight", () => {
   beforeEach(() => {
     vi.clearAllMocks();
diff --git a/packages/ui/src/product/preview/diff-highlight.tsx b/packages/ui/src/product/preview/diff-highlight.tsx
index 5ca81d0..3c6ee8e 100644
--- a/packages/ui/src/product/preview/diff-highlight.tsx
+++ b/packages/ui/src/product/preview/diff-highlight.tsx
@@ -3,211 +3,6 @@
 import * as React from "react";
 import { cn } from "@subboost/ui/lib/utils";
 
-interface DiffLine {
-  type: "add" | "remove" | "unchanged";
-  content: string;
-  lineNumber: number;
-}
-
-interface DiffHighlightProps {
-  oldText: string;
-  newText: string;
-  className?: string;
-}
-
-/**
- * 变更高亮组件
- * 对比两个文本并高亮显示差异
- */
-export function DiffHighlight({ oldText, newText, className }: DiffHighlightProps) {
-  const diffLines = React.useMemo(() => {
-    return computeDiff(oldText, newText);
-  }, [oldText, newText]);
-
-  const stats = React.useMemo(() => {
-    const added = diffLines.filter(l => l.type === "add").length;
-    const removed = diffLines.filter(l => l.type === "remove").length;
-    return { added, removed };
-  }, [diffLines]);
-
-  if (!oldText && !newText) {
-    return null;
-  }
-
-  return (
-    <div className={cn("rounded-lg overflow-hidden", className)}>
-      {/* 统计信息 */}
-      {(stats.added > 0 || stats.removed > 0) && (
-        <div className="flex items-center gap-3 px-3 py-2 bg-white/5 border-b border-white/10 text-xs">
-          <span className="text-white/60">变更统计:</span>
-          {stats.added > 0 && (
-            <span className="text-green-400">+{stats.added} 行</span>
-          )}
-          {stats.removed > 0 && (
-            <span className="text-red-400">-{stats.removed} 行</span>
-          )}
-        </div>
-      )}
-
-      {/* 差异内容 */}
-      <div className="overflow-auto max-h-[500px]">
-        <pre className="text-xs font-mono">
-          {diffLines.map((line, idx) => (
-            <div
-              key={idx}
-              className={cn(
-                "flex",
-                line.type === "add" && "bg-green-500/10",
-                line.type === "remove" && "bg-red-500/10"
-              )}
-            >
-              {/* 行号 */}
-              <span className="w-10 px-2 py-0.5 text-right text-white/50 select-none border-r border-white/10 flex-shrink-0">
-                {line.lineNumber}
-              </span>
-              
-              {/* 差异标记 */}
-              <span className={cn(
-                "w-6 px-1.5 py-0.5 text-center select-none flex-shrink-0",
-                line.type === "add" && "text-green-400",
-                line.type === "remove" && "text-red-400",
-                line.type === "unchanged" && "text-white/50"
-              )}>
-                {line.type === "add" ? "+" : line.type === "remove" ? "-" : " "}
-              </span>
-              
-              {/* 内容 */}
-              <span className={cn(
-                "flex-1 px-2 py-0.5 whitespace-pre",
-                line.type === "add" && "text-green-300",
-                line.type === "remove" && "text-red-300",
-                line.type === "unchanged" && "text-dark-300"
-              )}>
-                {line.content || " "}
-              </span>
-            </div>
-          ))}
-        </pre>
-      </div>
-    </div>
-  );
-}
-
-/**
- * 简单的行级差异算法
- */
-function computeDiff(oldText: string, newText: string): DiffLine[] {
-  const oldLines = oldText.split("\n");
-  const newLines = newText.split("\n");
-  const result: DiffLine[] = [];
-  
-  // 使用 LCS (最长公共子序列) 简化版本
-  const lcs = computeLCS(oldLines, newLines);
-  
-  let oldIdx = 0;
-  let newIdx = 0;
-  let lineNumber = 1;
-  
-  for (const match of lcs) {
-    // 添加删除的行
-    while (oldIdx < match.oldIndex) {
-      result.push({
-        type: "remove",
-        content: oldLines[oldIdx],
-        lineNumber: lineNumber++,
-      });
-      oldIdx++;
-    }
-    
-    // 添加新增的行
-    while (newIdx < match.newIndex) {
-      result.push({
-        type: "add",
-        content: newLines[newIdx],
-        lineNumber: lineNumber++,
-      });
-      newIdx++;
-    }
-    
-    // 添加未变更的行
-    result.push({
-      type: "unchanged",
-      content: newLines[newIdx],
-      lineNumber: lineNumber++,
-    });
-    
-    oldIdx++;
-    newIdx++;
-  }
-  
-  // 添加剩余的删除行
-  while (oldIdx < oldLines.length) {
-    result.push({
-      type: "remove",
-      content: oldLines[oldIdx],
-      lineNumber: lineNumber++,
-    });
-    oldIdx++;
-  }
-  
-  // 添加剩余的新增行
-  while (newIdx < newLines.length) {
-    result.push({
-      type: "add",
-      content: newLines[newIdx],
-      lineNumber: lineNumber++,
-    });
-    newIdx++;
-  }
-  
-  return result;
-}
-
-interface LCSMatch {
-  oldIndex: number;
-  newIndex: number;
-}
-
-/**
- * 计算最长公共子序列
- */
-function computeLCS(oldLines: string[], newLines: string[]): LCSMatch[] {
-  const m = oldLines.length;
-  const n = newLines.length;
-  
-  // 构建 LCS 表
-  const dp: number[][] = Array(m + 1).fill(null).map(() => Array(n + 1).fill(0));
-  
-  for (let i = 1; i <= m; i++) {
-    for (let j = 1; j <= n; j++) {
-      if (oldLines[i - 1] === newLines[j - 1]) {
-        dp[i][j] = dp[i - 1][j - 1] + 1;
-      } else {
-        dp[i][j] = Math.max(dp[i - 1][j], dp[i][j - 1]);
-      }
-    }
-  }
-  
-  // 回溯找出匹配
-  const matches: LCSMatch[] = [];
-  let i = m;
-  let j = n;
-  
-  while (i > 0 && j > 0) {
-    if (oldLines[i - 1] === newLines[j - 1]) {
-      matches.unshift({ oldIndex: i - 1, newIndex: j - 1 });
-      i--;
-      j--;
-    } else if (dp[i - 1][j] > dp[i][j - 1]) {
-      i--;
-    } else {
-      j--;
-    }
-  }
-  
-  return matches;
-}
-
 /**
  * YAML 语法高亮（简单版本）
  */

From 58f14a03b3f244aafdcf171294698d6a59c33ff7 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Mon, 13 Jul 2026 20:34:22 +0800
Subject: [PATCH 03/36] refactor: clarify public type contracts

---
 local/src/lib/http.ts                         |  4 ++--
 packages/core/src/generator/proxy-groups.ts   |  9 +++++---
 .../core/src/migrations/legacy-config.test.ts |  2 +-
 .../sections/proxy-group-rule-row.tsx         | 21 +++++++++++--------
 .../sections/proxy-group-rule-targets.ts      |  6 +++---
 .../proxy-groups-custom-groups-panel.tsx      |  4 ++--
 .../sections/proxy-groups-module-card.tsx     |  6 +++---
 .../proxy-groups-module-rules-panel.tsx       | 10 +++++----
 8 files changed, 35 insertions(+), 27 deletions(-)

diff --git a/local/src/lib/http.ts b/local/src/lib/http.ts
index 43c8236..40eb3c2 100644
--- a/local/src/lib/http.ts
+++ b/local/src/lib/http.ts
@@ -1,7 +1,7 @@
 import { NextResponse } from "next/server";
 import { buildApiErrorBody } from "@subboost/server-core/http";
 
-export type ApiErrorCode =
+export type LocalApiErrorCode =
   | "BAD_REQUEST"
   | "VALIDATION_ERROR"
   | "UNAUTHORIZED"
@@ -16,7 +16,7 @@ export function json(data: unknown, status = 200): NextResponse {
   return NextResponse.json(data, { status });
 }
 
-export function apiError(error: string, code: ApiErrorCode, status: number): NextResponse {
+export function apiError(error: string, code: LocalApiErrorCode, status: number): NextResponse {
   return NextResponse.json(buildApiErrorBody(error, code), { status });
 }
 
diff --git a/packages/core/src/generator/proxy-groups.ts b/packages/core/src/generator/proxy-groups.ts
index 63d56d5..167549b 100644
--- a/packages/core/src/generator/proxy-groups.ts
+++ b/packages/core/src/generator/proxy-groups.ts
@@ -48,7 +48,7 @@ export const CATEGORY_INFO: Record<string, { name: string; order: number }> = {
   custom: { name: "自定义分组", order: 8 },
 };
 
-export interface GenerateOptions {
+export interface ProxyGroupGenerateOptions {
   nodes: ParsedNode[];
   proxyProviderNames?: string[];
   enabledModules: string[];
@@ -67,6 +67,9 @@ export interface GenerateOptions {
   ruleOrder?: string[];
 }
 
+/** @deprecated Use `ProxyGroupGenerateOptions`; retained for 2.x source compatibility. */
+export type GenerateOptions = ProxyGroupGenerateOptions;
+
 export { isSubscriptionInfoNodeName };
 
 function getEnabledCustomProxyGroups(customProxyGroups: CustomProxyGroup[]): CustomProxyGroup[] {
@@ -130,7 +133,7 @@ const PROXY_GROUP_ORDER: string[] = [
 /**
  * 生成代理组配置
  */
-export function generateProxyGroups(options: GenerateOptions): ProxyGroup[] {
+export function generateProxyGroups(options: ProxyGroupGenerateOptions): ProxyGroup[] {
   const {
     nodes,
     proxyProviderNames = [],
@@ -479,7 +482,7 @@ export function generateProxyGroups(options: GenerateOptions): ProxyGroup[] {
 /**
  * 生成规则提供者配置
  */
-export function generateRuleProviders(options: GenerateOptions): Record<string, RuleProvider> {
+export function generateRuleProviders(options: ProxyGroupGenerateOptions): Record<string, RuleProvider> {
   const {
     enabledModules,
     ruleProviderBaseUrl,
diff --git a/packages/core/src/migrations/legacy-config.test.ts b/packages/core/src/migrations/legacy-config.test.ts
index 0d24326..fbf926b 100644
--- a/packages/core/src/migrations/legacy-config.test.ts
+++ b/packages/core/src/migrations/legacy-config.test.ts
@@ -13,7 +13,7 @@ describe("migrateLegacyConfig", () => {
   });
 
   it("migrates filtered groups and every supported legacy rule shape", () => {
-    const result = migrateLegacyConfig({
+    const result = migrateLegacyConfig<Record<string, unknown>>({
       filteredProxyGroups: [
         {
           id: "us-only",
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-row.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-row.tsx
index d61b724..cee5dba 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-row.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-row.tsx
@@ -16,16 +16,16 @@ import { cn } from "@subboost/ui/lib/utils";
 import type { CustomRule } from "@subboost/core/types/config";
 import type {
   CustomRuleListItem,
-  ProxyGroupRuleTarget,
+  ProxyGroupRuleTargetOption,
   ProxyGroupRuleTargetKind,
 } from "./proxy-group-rule-targets";
 
-export type RuleSetMoveTarget = ProxyGroupRuleTarget & { kind: "module" | "custom" };
+export type RuleSetMoveTarget = ProxyGroupRuleTargetOption & { kind: "module" | "custom" };
 export type ProxyGroupRuleRowState = "active" | "moved" | "removed";
 
 type RuleSource = "preset" | "custom" | "manual" | "experimental";
 
-export function isRuleSetMoveTarget(target: ProxyGroupRuleTarget): target is RuleSetMoveTarget {
+export function isRuleSetMoveTarget(target: ProxyGroupRuleTargetOption): target is RuleSetMoveTarget {
   return target.kind === "module" || target.kind === "custom";
 }
 
@@ -153,9 +153,9 @@ export function ProxyGroupManualRuleRow({
   onRemove,
 }: {
   item: CustomRuleListItem;
-  targets: ProxyGroupRuleTarget[];
+  targets: ProxyGroupRuleTargetOption[];
   currentTargetName: string;
-  onMove: (item: CustomRuleListItem, target: ProxyGroupRuleTarget) => void;
+  onMove: (item: CustomRuleListItem, target: ProxyGroupRuleTargetOption) => void;
   onRemove: (item: CustomRuleListItem) => void;
 }) {
   const { rule } = item;
@@ -210,10 +210,10 @@ export function ProxyGroupRuleMoveMenu({
 }: {
   title: string;
   ariaLabel: string;
-  targets: ProxyGroupRuleTarget[];
+  targets: ProxyGroupRuleTargetOption[];
   kinds: ProxyGroupRuleTargetKind[];
-  currentTarget?: Partial<ProxyGroupRuleTarget>;
-  onMove: (target: ProxyGroupRuleTarget) => void | Promise<void>;
+  currentTarget?: Partial<ProxyGroupRuleTargetOption>;
+  onMove: (target: ProxyGroupRuleTargetOption) => void | Promise<void>;
 }) {
   return (
     <DropdownMenu>
@@ -322,7 +322,10 @@ function NoResolveBadge() {
   );
 }
 
-function isCurrentTarget(target: ProxyGroupRuleTarget, currentTarget?: Partial<ProxyGroupRuleTarget>) {
+function isCurrentTarget(
+  target: ProxyGroupRuleTargetOption,
+  currentTarget?: Partial<ProxyGroupRuleTargetOption>,
+) {
   if (!currentTarget) return false;
   if (currentTarget.kind && currentTarget.id) {
     return currentTarget.kind === target.kind && currentTarget.id === target.id;
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-targets.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-targets.ts
index 0c66fac..97cd83b 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-targets.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-rule-targets.ts
@@ -5,7 +5,7 @@ import type { CustomProxyGroup, CustomRule } from "@subboost/core/types/config";
 
 export type ProxyGroupRuleTargetKind = "module" | "custom";
 
-export type ProxyGroupRuleTarget = {
+export type ProxyGroupRuleTargetOption = {
   kind: ProxyGroupRuleTargetKind;
   id: string;
   name: string;
@@ -48,10 +48,10 @@ export function buildManualRuleTargets({
   hiddenProxyGroups?: string[];
   customProxyGroups: CustomProxyGroup[];
   proxyGroupNameOverrides?: Record<string, string>;
-}): ProxyGroupRuleTarget[] {
+}): ProxyGroupRuleTargetOption[] {
   const hidden = new Set(hiddenProxyGroups || []);
   const enabled = new Set(enabledProxyGroups);
-  const targets: ProxyGroupRuleTarget[] = [];
+  const targets: ProxyGroupRuleTargetOption[] = [];
 
   for (const proxyModule of PROXY_GROUP_MODULES) {
     if (!enabled.has(proxyModule.id) || hidden.has(proxyModule.id)) continue;
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx
index 20f4946..9d159f7 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-groups-panel.tsx
@@ -14,7 +14,7 @@ import { useProductInteractionAdapter } from "@subboost/ui/product/interactions"
 import {
   buildManualRuleTargets,
   listCustomRulesForTarget,
-  type ProxyGroupRuleTarget,
+  type ProxyGroupRuleTargetOption,
 } from "./proxy-group-rule-targets";
 import {
   ProxyGroupManualRuleRow,
@@ -125,7 +125,7 @@ export function ProxyGroupsCustomGroupsPanel({
   }, [customProxyGroups, hiddenProxyGroups, proxyGroupNameOverrides]);
 
   const moveManualRule = React.useCallback(
-    (item: { rule: { id: string }; index: number }, target: ProxyGroupRuleTarget) => {
+    (item: { rule: { id: string }; index: number }, target: ProxyGroupRuleTargetOption) => {
       updateCustomRule(item.rule.id, { target: { kind: target.kind, id: target.id } });
     },
     [updateCustomRule],
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
index 8c382f4..030b844 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
@@ -17,7 +17,7 @@ import type { CustomProxyGroup, RuleSetDraft } from "@subboost/ui/store/config-s
 import { cn } from "@subboost/ui/lib/utils";
 import type {
   CustomRuleListItem,
-  ProxyGroupRuleTarget,
+  ProxyGroupRuleTargetOption,
 } from "./proxy-group-rule-targets";
 import { ProxyGroupsModuleRulesPanel } from "./proxy-groups-module-rules-panel";
 import {
@@ -163,7 +163,7 @@ export function ProxyGroupsModuleCard({
   hiddenPresetRuleIds: HiddenPresetRuleIds;
   customProxyGroups: CustomProxyGroup[];
   manualRules: CustomRuleListItem[];
-  manualRuleTargets: ProxyGroupRuleTarget[];
+  manualRuleTargets: ProxyGroupRuleTargetOption[];
   enabledProxyGroups: string[];
   hiddenProxyGroups: string[];
   proxyGroupNameOverrides: Record<string, string>;
@@ -176,7 +176,7 @@ export function ProxyGroupsModuleCard({
   onAddRuleToCustomGroup: (groupId: string, rule: RuleSetDraft) => void;
   onRemoveExtraRule: (ruleId: string) => void;
   onMoveRule: (ruleId: string, target: { kind: "module" | "custom"; id: string }) => void;
-  onMoveManualRule: (ruleId: string, target: ProxyGroupRuleTarget) => void;
+  onMoveManualRule: (ruleId: string, target: ProxyGroupRuleTargetOption) => void;
   onRemoveManualRule: (index: number) => void;
   onRestoreRule: (ruleId: string) => void;
   onResetRuleTarget: (ruleId: string) => void;
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
index 5531003..e5b4918 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
@@ -22,7 +22,7 @@ import { useProductApiAdapter } from "@subboost/ui/product/api-adapter";
 import type { CustomProxyGroup, RuleSetDraft } from "@subboost/ui/store/config-store";
 import type {
   CustomRuleListItem,
-  ProxyGroupRuleTarget,
+  ProxyGroupRuleTargetOption,
 } from "./proxy-group-rule-targets";
 import {
   ProxyGroupManualRuleRow,
@@ -46,7 +46,9 @@ type CnCandidateRule = {
   parentModuleId?: string;
 };
 
-function isModuleRuleMoveTarget(target: ProxyGroupRuleTarget): target is ProxyGroupRuleTarget & MoveTarget {
+function isModuleRuleMoveTarget(
+  target: ProxyGroupRuleTargetOption,
+): target is ProxyGroupRuleTargetOption & MoveTarget {
   return target.kind === "module" || target.kind === "custom";
 }
 
@@ -110,7 +112,7 @@ export function ProxyGroupsModuleRulesPanel({
   hiddenPresetRuleIds: HiddenPresetRuleIds;
   customProxyGroups: CustomProxyGroup[];
   manualRules: CustomRuleListItem[];
-  manualRuleTargets: ProxyGroupRuleTarget[];
+  manualRuleTargets: ProxyGroupRuleTargetOption[];
   proxyGroupNameOverrides: Record<string, string>;
   moduleRuleEditWarningAccepted: boolean;
   acceptModuleRuleEditWarning: () => void;
@@ -119,7 +121,7 @@ export function ProxyGroupsModuleRulesPanel({
   onAddRuleToCustomGroup: (groupId: string, rule: RuleSetDraft) => void;
   onRemoveRule: (ruleId: string) => void;
   onMoveRule: (ruleId: string, target: MoveTarget) => void;
-  onMoveManualRule: (ruleId: string, target: ProxyGroupRuleTarget) => void;
+  onMoveManualRule: (ruleId: string, target: ProxyGroupRuleTargetOption) => void;
   onRemoveManualRule: (index: number) => void;
   onRestoreRule: (ruleId: string) => void;
   onResetRuleTarget: (ruleId: string) => void;

From e5e36e24165f4b5f269159241782a1e5d8960203 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Mon, 13 Jul 2026 20:34:48 +0800
Subject: [PATCH 04/36] test: split oversized public contract suites

---
 .../mihomo/proxy-sanitizer-boundaries.test.ts | 495 ++++++++++++++++++
 .../core/src/mihomo/proxy-sanitizer.test.ts   | 481 -----------------
 .../src/parser/config-line-parser.test.ts     | 216 --------
 .../src/parser/config-line-tokenizer.test.ts  | 217 ++++++++
 .../subscription/config-utils-legacy.test.ts  | 350 +++++++++++++
 .../src/subscription/config-utils.test.ts     | 333 +-----------
 ...roups-added-rule-sets-invalid-save.test.ts | 202 +++++++
 .../proxy-groups-added-rule-sets.test.ts      |  54 --
 8 files changed, 1265 insertions(+), 1083 deletions(-)
 create mode 100644 packages/core/src/mihomo/proxy-sanitizer-boundaries.test.ts
 create mode 100644 packages/core/src/parser/config-line-tokenizer.test.ts
 create mode 100644 packages/core/src/subscription/config-utils-legacy.test.ts
 create mode 100644 packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets-invalid-save.test.ts

diff --git a/packages/core/src/mihomo/proxy-sanitizer-boundaries.test.ts b/packages/core/src/mihomo/proxy-sanitizer-boundaries.test.ts
new file mode 100644
index 0000000..eb34d5d
--- /dev/null
+++ b/packages/core/src/mihomo/proxy-sanitizer-boundaries.test.ts
@@ -0,0 +1,495 @@
+import { describe, expect, it } from "vitest";
+import {
+  isMihomoSupportedProxyNode,
+  isStandardBase64String,
+  normalizeMihomoVlessForGeneration,
+  sanitizeMihomoProxyNode,
+} from "./proxy-sanitizer";
+
+const REALITY_PUBLIC_KEY = "A".repeat(43);
+const WIREGUARD_KEY = `${"A".repeat(43)}=`;
+const PRIVATE_KEY = ["-----BEGIN OPENSSH ", "PRIVATE ", "KEY-----\nabc\n-----END OPENSSH ", "PRIVATE ", "KEY-----"].join("");
+
+describe("Mihomo proxy sanitizer boundaries", () => {
+  it("covers sanitizer boundary aliases and optional protocol fallbacks", () => {
+    const ecdsaSsh = sanitizeMihomoProxyNode({
+      name: "SSH",
+      type: "ssh",
+      server: "ssh.example.com",
+      port: 22,
+      password: "secret",
+      "host-key": [
+        "ssh-ecdsa-nistp256 AAAAC3NzaC1lZDI1NTE5AAAAIA==",
+        "ssh-ecdsa-!bad AAAAC3NzaC1lZDI1NTE5AAAAIA==",
+        "ssh-rsa bad!token",
+      ],
+    });
+    const certless = sanitizeMihomoProxyNode({
+      name: "HTTP",
+      type: "http",
+      server: "http.example.com",
+      port: 80,
+      fingerprint: 1,
+    });
+    const clientFingerprintAlreadySet = sanitizeMihomoProxyNode({
+      name: "Trojan",
+      type: "trojan",
+      server: "trojan.example.com",
+      port: 443,
+      password: "secret",
+      fingerprint: "Chrome",
+      "client-fingerprint": "safari",
+    });
+    const wireguardReservedArray = sanitizeMihomoProxyNode({
+      name: "WG",
+      type: "wireguard",
+      server: "wg.example.com",
+      port: 51820,
+      "private-key": WIREGUARD_KEY,
+      reserved: [1, "2", 3],
+    });
+    const xhttpNoReality = normalizeMihomoVlessForGeneration({
+      name: "XHTTP",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "xhttp-opts": {
+        "download-settings": {
+          "ech-opts": {
+            enable: false,
+            config: Buffer.from("ech").toString("base64"),
+            "query-server-name": " ech.example.com ",
+          },
+        },
+      },
+    });
+
+    expect(ecdsaSsh).toMatchObject({
+      "host-key": ["ssh-ecdsa-nistp256 AAAAC3NzaC1lZDI1NTE5AAAAIA=="],
+    });
+    expect(certless).not.toHaveProperty("fingerprint");
+    expect(clientFingerprintAlreadySet).toMatchObject({ "client-fingerprint": "safari" });
+    expect(clientFingerprintAlreadySet).not.toHaveProperty("fingerprint");
+    expect(wireguardReservedArray).toHaveProperty("reserved", [1, 2, 3]);
+    expect(xhttpNoReality).toMatchObject({
+      "xhttp-opts": {
+        "download-settings": {
+          "ech-opts": {
+            enable: false,
+            config: Buffer.from("ech").toString("base64"),
+            "query-server-name": "ech.example.com",
+          },
+        },
+      },
+    });
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "trojan",
+        name: "Trojan",
+        server: "trojan.example.com",
+        port: 443,
+        password: "secret",
+      })
+    ).toBe(true);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "ss",
+        name: "SS",
+        server: "ss.example.com",
+        port: 8388,
+        cipher: "aes-128-gcm",
+        password: "secret",
+        plugin: "v2ray-plugin",
+      })
+    ).toBe(true);
+  });
+
+  it("rejects explicit malformed optional transport fields", () => {
+    const ssh = sanitizeMihomoProxyNode({
+      name: "SSH",
+      type: "ssh",
+      server: "ssh.example.com",
+      port: 22,
+      password: "secret",
+      "host-key": [
+        "ssh-rsa AAAA",
+        "ssh-dss AAAA comment",
+        "ssh-ed25519",
+        "ssh-ecdsa-!bad AAAA",
+      ],
+    });
+    const invalidReserved = sanitizeMihomoProxyNode({
+      name: "WG",
+      type: "wireguard",
+      server: "wg.example.com",
+      port: 51820,
+      "private-key": WIREGUARD_KEY,
+      reserved: "1,2",
+    });
+    const explicitEmptyDownloadReality = normalizeMihomoVlessForGeneration({
+      name: "XHTTP",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "reality-opts": {
+        "public-key": REALITY_PUBLIC_KEY,
+      },
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": "",
+          },
+        },
+      },
+    });
+    const invalidDownloadReality = normalizeMihomoVlessForGeneration({
+      name: "XHTTP",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "reality-opts": {
+        "public-key": REALITY_PUBLIC_KEY,
+      },
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": "bad",
+          },
+        },
+      },
+    });
+    const invalidMainReality = normalizeMihomoVlessForGeneration({
+      name: "Reality",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      "reality-opts": "bad",
+    });
+    const prefixedCertificate = sanitizeMihomoProxyNode({
+      name: "HTTPS",
+      type: "https",
+      server: "https.example.com",
+      port: 443,
+      fingerprint: "SHA256=" + "C".repeat(64).match(/.{1,2}/g)?.join(":"),
+    });
+
+    expect(isMihomoSupportedProxyNode({ type: "ss", cipher: "", password: "secret" })).toBe(false);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "vless",
+        uuid: "11111111-1111-4111-8111-111111111111",
+        network: "xhttp",
+        "reality-opts": {
+          "public-key": REALITY_PUBLIC_KEY,
+        },
+        "xhttp-opts": {
+          "download-settings": {
+            "reality-opts": {
+              "public-key": "bad",
+            },
+          },
+        },
+      })
+    ).toBe(false);
+    expect(ssh).toMatchObject({ "host-key": ["ssh-rsa AAAA", "ssh-dss AAAA comment"] });
+    expect(invalidReserved).not.toHaveProperty("reserved");
+    expect(explicitEmptyDownloadReality).toMatchObject({
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": "",
+          },
+        },
+      },
+    });
+    expect(invalidDownloadReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
+    expect(invalidMainReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
+    expect(prefixedCertificate).toHaveProperty("fingerprint", "c".repeat(64));
+  });
+
+  it("covers conservative sanitizer fallbacks for omitted and malformed optional fields", () => {
+    const sshWithScalarHostKey = sanitizeMihomoProxyNode({
+      name: "SSH",
+      type: "ssh",
+      server: "ssh.example.com",
+      port: 22,
+      password: "secret",
+      "host-key": "ssh-rsa AAAA",
+      "private-key": undefined,
+      "server-fingerprint": 1,
+    });
+    const sshWithEmptyHostKeyMaterial = sanitizeMihomoProxyNode({
+      name: "SSH",
+      type: "ssh",
+      server: "ssh.example.com",
+      port: 22,
+      password: "secret",
+      "host-key": ["ssh-rsa ", "ssh-ecdsa- AAAA", "ssh-ed25519 AAAA"],
+    });
+    const wireguardWithUndefinedOptionalKeys = sanitizeMihomoProxyNode({
+      name: "WG",
+      type: "wireguard",
+      server: "wg.example.com",
+      port: 51820,
+      "private-key": WIREGUARD_KEY,
+      "public-key": undefined,
+      "pre-shared-key": undefined,
+      reserved: "",
+    });
+    const plainHttp = sanitizeMihomoProxyNode({
+      name: "HTTP",
+      type: "http",
+      server: "http.example.com",
+      port: 80,
+      udp: "TRUE",
+      tls: "FALSE",
+      alpn: [],
+      fingerprint: "Not-A-Known-Alias",
+      "ws-opts": {},
+    });
+    const vlessWithoutReality = sanitizeMihomoProxyNode({
+      name: "VLESS",
+      type: "vless",
+      server: "vless.example.com",
+      port: 443,
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": REALITY_PUBLIC_KEY,
+            "short-id": "not-hex",
+          },
+          "ech-opts": {
+            enable: "0",
+            config: "",
+            "query-server-name": " ",
+          },
+        },
+      },
+    });
+
+    expect(sshWithScalarHostKey).not.toHaveProperty("host-key");
+    expect(sshWithScalarHostKey).not.toHaveProperty("private-key");
+    expect(sshWithScalarHostKey).not.toHaveProperty("server-fingerprint");
+    expect(sshWithEmptyHostKeyMaterial).toHaveProperty("host-key", ["ssh-ed25519 AAAA"]);
+    expect(wireguardWithUndefinedOptionalKeys).toMatchObject({
+      "private-key": WIREGUARD_KEY,
+    });
+    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("public-key");
+    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("pre-shared-key");
+    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("reserved");
+    expect(plainHttp).toMatchObject({ udp: true, tls: false });
+    expect(plainHttp).not.toHaveProperty("alpn");
+    expect(plainHttp).not.toHaveProperty("fingerprint");
+    expect(plainHttp).not.toHaveProperty("ws-opts");
+    expect(vlessWithoutReality).toMatchObject({
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": REALITY_PUBLIC_KEY,
+          },
+          "ech-opts": {
+            enable: false,
+          },
+        },
+      },
+    });
+    expect(
+      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"][
+        "reality-opts"
+      ]
+    ).not.toHaveProperty("short-id");
+    expect(
+      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"]["ech-opts"]
+    ).not.toHaveProperty("config");
+    expect(
+      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"]["ech-opts"]
+    ).not.toHaveProperty("query-server-name");
+
+    expect(isMihomoSupportedProxyNode({ type: "http", name: "HTTP" })).toBe(true);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "wireguard",
+        name: "WG",
+        server: "wg.example.com",
+        port: 51820,
+        "private-key": WIREGUARD_KEY,
+        "public-key": undefined,
+        "pre-shared-key": WIREGUARD_KEY,
+      })
+    ).toBe(true);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "ssh",
+        name: "SSH",
+        server: "ssh.example.com",
+        port: 22,
+        "private-key": "bad",
+      })
+    ).toBe(false);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "ssh",
+        name: "SSH",
+        server: "ssh.example.com",
+        port: 22,
+        "private-key": PRIVATE_KEY,
+      })
+    ).toBe(true);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "ss",
+        name: "SS",
+        server: "ss.example.com",
+        port: 8388,
+        cipher: "aes-128-gcm",
+        password: "secret",
+        plugin: "simple-obfs",
+      })
+    ).toBe(true);
+  });
+
+  it("covers remaining protocol support and cleanup fallbacks", () => {
+    expect(isStandardBase64String("abcd!")).toBe(false);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "ssr",
+        name: "SSR",
+        server: "ssr.example.com",
+        port: 8388,
+        cipher: "aes-128-gcm",
+        password: "secret",
+        protocol: "",
+        obfs: "plain",
+      })
+    ).toBe(false);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "vless",
+        name: "XHTTP",
+        server: "vless.example.com",
+        port: 443,
+        uuid: "11111111-1111-4111-8111-111111111111",
+        network: "xhttp",
+        "reality-opts": { "public-key": REALITY_PUBLIC_KEY },
+        "xhttp-opts": {
+          mode: "stream-one",
+          "download-settings": {
+            path: "/download",
+          },
+        },
+      })
+    ).toBe(false);
+    expect(
+      isMihomoSupportedProxyNode({
+        type: "vless",
+        name: "XHTTP",
+        server: "vless.example.com",
+        port: 443,
+        uuid: "11111111-1111-4111-8111-111111111111",
+        network: "xhttp",
+        "reality-opts": { "public-key": REALITY_PUBLIC_KEY },
+        "xhttp-opts": {
+          "download-settings": {
+            "reality-opts": {
+              "public-key": "",
+            },
+          },
+        },
+      })
+    ).toBe(true);
+
+    const invalidContainers = sanitizeMihomoProxyNode({
+      name: "Containers",
+      type: "vmess",
+      server: "vmess.example.com",
+      port: 443,
+      uuid: "11111111-1111-4111-8111-111111111111",
+      ech: "bad",
+      alpn: 443,
+      "ech-opts": [],
+      "ws-opts": {},
+      fingerprint: "unknown",
+    });
+    const sshWithoutHostKey = sanitizeMihomoProxyNode({
+      name: "SSH",
+      type: "ssh",
+      server: "ssh.example.com",
+      port: 22,
+      password: "secret",
+      "host-key": "ssh-ed25519 AAAA",
+      "server-fingerprint": `SHA256:${"B".repeat(43)}=`,
+    });
+    const wireguardMissingReserved = sanitizeMihomoProxyNode({
+      name: "WG",
+      type: "wireguard",
+      server: "wg.example.com",
+      port: 51820,
+      "private-key": WIREGUARD_KEY,
+      reserved: "1,2",
+    });
+    const noRealityDownloadSettings = normalizeMihomoVlessForGeneration({
+      name: "XHTTP",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "xhttp-opts": {
+        "download-settings": {
+          path: "/download",
+        },
+      },
+    });
+    const invalidDownloadReality = normalizeMihomoVlessForGeneration({
+      name: "XHTTP",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      network: "xhttp",
+      "xhttp-opts": {
+        "download-settings": {
+          "reality-opts": {
+            "public-key": "bad",
+          },
+        },
+      },
+    });
+    const explicitTlsReality = normalizeMihomoVlessForGeneration({
+      name: "Reality",
+      type: "vless",
+      uuid: "11111111-1111-4111-8111-111111111111",
+      tls: true,
+      "client-fingerprint": "edge",
+      "reality-opts": {
+        "public-key": REALITY_PUBLIC_KEY,
+      },
+    });
+    const noEncryption = sanitizeMihomoProxyNode({
+      name: "VLESS",
+      type: "vless",
+      server: "vless.example.com",
+      port: 443,
+      uuid: "11111111-1111-4111-8111-111111111111",
+      encryption: " ",
+    });
+
+    expect(invalidContainers).not.toHaveProperty("alpn");
+    expect(invalidContainers).not.toHaveProperty("ech-opts");
+    expect(invalidContainers).not.toHaveProperty("fingerprint");
+    expect(invalidContainers).not.toHaveProperty("ws-opts");
+    expect(sshWithoutHostKey).not.toHaveProperty("host-key");
+    expect(sshWithoutHostKey).toHaveProperty("server-fingerprint", `SHA256:${"B".repeat(43)}=`);
+    expect(wireguardMissingReserved).not.toHaveProperty("reserved");
+    expect(noRealityDownloadSettings).toMatchObject({
+      "xhttp-opts": {
+        "download-settings": {
+          path: "/download",
+        },
+      },
+    });
+    expect(invalidDownloadReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
+    expect(explicitTlsReality).toMatchObject({
+      tls: true,
+      "client-fingerprint": "edge",
+    });
+    expect(noEncryption).not.toHaveProperty("encryption");
+  });
+});
diff --git a/packages/core/src/mihomo/proxy-sanitizer.test.ts b/packages/core/src/mihomo/proxy-sanitizer.test.ts
index 84cb7a9..7397ed2 100644
--- a/packages/core/src/mihomo/proxy-sanitizer.test.ts
+++ b/packages/core/src/mihomo/proxy-sanitizer.test.ts
@@ -545,485 +545,4 @@ describe("Mihomo proxy sanitizer", () => {
     });
   });
 
-  it("covers sanitizer boundary aliases and optional protocol fallbacks", () => {
-    const ecdsaSsh = sanitizeMihomoProxyNode({
-      name: "SSH",
-      type: "ssh",
-      server: "ssh.example.com",
-      port: 22,
-      password: "secret",
-      "host-key": [
-        "ssh-ecdsa-nistp256 AAAAC3NzaC1lZDI1NTE5AAAAIA==",
-        "ssh-ecdsa-!bad AAAAC3NzaC1lZDI1NTE5AAAAIA==",
-        "ssh-rsa bad!token",
-      ],
-    });
-    const certless = sanitizeMihomoProxyNode({
-      name: "HTTP",
-      type: "http",
-      server: "http.example.com",
-      port: 80,
-      fingerprint: 1,
-    });
-    const clientFingerprintAlreadySet = sanitizeMihomoProxyNode({
-      name: "Trojan",
-      type: "trojan",
-      server: "trojan.example.com",
-      port: 443,
-      password: "secret",
-      fingerprint: "Chrome",
-      "client-fingerprint": "safari",
-    });
-    const wireguardReservedArray = sanitizeMihomoProxyNode({
-      name: "WG",
-      type: "wireguard",
-      server: "wg.example.com",
-      port: 51820,
-      "private-key": WIREGUARD_KEY,
-      reserved: [1, "2", 3],
-    });
-    const xhttpNoReality = normalizeMihomoVlessForGeneration({
-      name: "XHTTP",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "xhttp-opts": {
-        "download-settings": {
-          "ech-opts": {
-            enable: false,
-            config: Buffer.from("ech").toString("base64"),
-            "query-server-name": " ech.example.com ",
-          },
-        },
-      },
-    });
-
-    expect(ecdsaSsh).toMatchObject({
-      "host-key": ["ssh-ecdsa-nistp256 AAAAC3NzaC1lZDI1NTE5AAAAIA=="],
-    });
-    expect(certless).not.toHaveProperty("fingerprint");
-    expect(clientFingerprintAlreadySet).toMatchObject({ "client-fingerprint": "safari" });
-    expect(clientFingerprintAlreadySet).not.toHaveProperty("fingerprint");
-    expect(wireguardReservedArray).toHaveProperty("reserved", [1, 2, 3]);
-    expect(xhttpNoReality).toMatchObject({
-      "xhttp-opts": {
-        "download-settings": {
-          "ech-opts": {
-            enable: false,
-            config: Buffer.from("ech").toString("base64"),
-            "query-server-name": "ech.example.com",
-          },
-        },
-      },
-    });
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "trojan",
-        name: "Trojan",
-        server: "trojan.example.com",
-        port: 443,
-        password: "secret",
-      })
-    ).toBe(true);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "ss",
-        name: "SS",
-        server: "ss.example.com",
-        port: 8388,
-        cipher: "aes-128-gcm",
-        password: "secret",
-        plugin: "v2ray-plugin",
-      })
-    ).toBe(true);
-  });
-
-  it("rejects explicit malformed optional transport fields", () => {
-    const ssh = sanitizeMihomoProxyNode({
-      name: "SSH",
-      type: "ssh",
-      server: "ssh.example.com",
-      port: 22,
-      password: "secret",
-      "host-key": [
-        "ssh-rsa AAAA",
-        "ssh-dss AAAA comment",
-        "ssh-ed25519",
-        "ssh-ecdsa-!bad AAAA",
-      ],
-    });
-    const invalidReserved = sanitizeMihomoProxyNode({
-      name: "WG",
-      type: "wireguard",
-      server: "wg.example.com",
-      port: 51820,
-      "private-key": WIREGUARD_KEY,
-      reserved: "1,2",
-    });
-    const explicitEmptyDownloadReality = normalizeMihomoVlessForGeneration({
-      name: "XHTTP",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "reality-opts": {
-        "public-key": REALITY_PUBLIC_KEY,
-      },
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": "",
-          },
-        },
-      },
-    });
-    const invalidDownloadReality = normalizeMihomoVlessForGeneration({
-      name: "XHTTP",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "reality-opts": {
-        "public-key": REALITY_PUBLIC_KEY,
-      },
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": "bad",
-          },
-        },
-      },
-    });
-    const invalidMainReality = normalizeMihomoVlessForGeneration({
-      name: "Reality",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      "reality-opts": "bad",
-    });
-    const prefixedCertificate = sanitizeMihomoProxyNode({
-      name: "HTTPS",
-      type: "https",
-      server: "https.example.com",
-      port: 443,
-      fingerprint: "SHA256=" + "C".repeat(64).match(/.{1,2}/g)?.join(":"),
-    });
-
-    expect(isMihomoSupportedProxyNode({ type: "ss", cipher: "", password: "secret" })).toBe(false);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "vless",
-        uuid: "11111111-1111-4111-8111-111111111111",
-        network: "xhttp",
-        "reality-opts": {
-          "public-key": REALITY_PUBLIC_KEY,
-        },
-        "xhttp-opts": {
-          "download-settings": {
-            "reality-opts": {
-              "public-key": "bad",
-            },
-          },
-        },
-      })
-    ).toBe(false);
-    expect(ssh).toMatchObject({ "host-key": ["ssh-rsa AAAA", "ssh-dss AAAA comment"] });
-    expect(invalidReserved).not.toHaveProperty("reserved");
-    expect(explicitEmptyDownloadReality).toMatchObject({
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": "",
-          },
-        },
-      },
-    });
-    expect(invalidDownloadReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
-    expect(invalidMainReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
-    expect(prefixedCertificate).toHaveProperty("fingerprint", "c".repeat(64));
-  });
-
-  it("covers conservative sanitizer fallbacks for omitted and malformed optional fields", () => {
-    const sshWithScalarHostKey = sanitizeMihomoProxyNode({
-      name: "SSH",
-      type: "ssh",
-      server: "ssh.example.com",
-      port: 22,
-      password: "secret",
-      "host-key": "ssh-rsa AAAA",
-      "private-key": undefined,
-      "server-fingerprint": 1,
-    });
-    const sshWithEmptyHostKeyMaterial = sanitizeMihomoProxyNode({
-      name: "SSH",
-      type: "ssh",
-      server: "ssh.example.com",
-      port: 22,
-      password: "secret",
-      "host-key": ["ssh-rsa ", "ssh-ecdsa- AAAA", "ssh-ed25519 AAAA"],
-    });
-    const wireguardWithUndefinedOptionalKeys = sanitizeMihomoProxyNode({
-      name: "WG",
-      type: "wireguard",
-      server: "wg.example.com",
-      port: 51820,
-      "private-key": WIREGUARD_KEY,
-      "public-key": undefined,
-      "pre-shared-key": undefined,
-      reserved: "",
-    });
-    const plainHttp = sanitizeMihomoProxyNode({
-      name: "HTTP",
-      type: "http",
-      server: "http.example.com",
-      port: 80,
-      udp: "TRUE",
-      tls: "FALSE",
-      alpn: [],
-      fingerprint: "Not-A-Known-Alias",
-      "ws-opts": {},
-    });
-    const vlessWithoutReality = sanitizeMihomoProxyNode({
-      name: "VLESS",
-      type: "vless",
-      server: "vless.example.com",
-      port: 443,
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": REALITY_PUBLIC_KEY,
-            "short-id": "not-hex",
-          },
-          "ech-opts": {
-            enable: "0",
-            config: "",
-            "query-server-name": " ",
-          },
-        },
-      },
-    });
-
-    expect(sshWithScalarHostKey).not.toHaveProperty("host-key");
-    expect(sshWithScalarHostKey).not.toHaveProperty("private-key");
-    expect(sshWithScalarHostKey).not.toHaveProperty("server-fingerprint");
-    expect(sshWithEmptyHostKeyMaterial).toHaveProperty("host-key", ["ssh-ed25519 AAAA"]);
-    expect(wireguardWithUndefinedOptionalKeys).toMatchObject({
-      "private-key": WIREGUARD_KEY,
-    });
-    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("public-key");
-    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("pre-shared-key");
-    expect(wireguardWithUndefinedOptionalKeys).not.toHaveProperty("reserved");
-    expect(plainHttp).toMatchObject({ udp: true, tls: false });
-    expect(plainHttp).not.toHaveProperty("alpn");
-    expect(plainHttp).not.toHaveProperty("fingerprint");
-    expect(plainHttp).not.toHaveProperty("ws-opts");
-    expect(vlessWithoutReality).toMatchObject({
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": REALITY_PUBLIC_KEY,
-          },
-          "ech-opts": {
-            enable: false,
-          },
-        },
-      },
-    });
-    expect(
-      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"][
-        "reality-opts"
-      ]
-    ).not.toHaveProperty("short-id");
-    expect(
-      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"]["ech-opts"]
-    ).not.toHaveProperty("config");
-    expect(
-      (vlessWithoutReality["xhttp-opts"] as Record<string, Record<string, unknown>>)["download-settings"]["ech-opts"]
-    ).not.toHaveProperty("query-server-name");
-
-    expect(isMihomoSupportedProxyNode({ type: "http", name: "HTTP" })).toBe(true);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "wireguard",
-        name: "WG",
-        server: "wg.example.com",
-        port: 51820,
-        "private-key": WIREGUARD_KEY,
-        "public-key": undefined,
-        "pre-shared-key": WIREGUARD_KEY,
-      })
-    ).toBe(true);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "ssh",
-        name: "SSH",
-        server: "ssh.example.com",
-        port: 22,
-        "private-key": "bad",
-      })
-    ).toBe(false);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "ssh",
-        name: "SSH",
-        server: "ssh.example.com",
-        port: 22,
-        "private-key": PRIVATE_KEY,
-      })
-    ).toBe(true);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "ss",
-        name: "SS",
-        server: "ss.example.com",
-        port: 8388,
-        cipher: "aes-128-gcm",
-        password: "secret",
-        plugin: "simple-obfs",
-      })
-    ).toBe(true);
-  });
-
-  it("covers remaining protocol support and cleanup fallbacks", () => {
-    expect(isStandardBase64String("abcd!")).toBe(false);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "ssr",
-        name: "SSR",
-        server: "ssr.example.com",
-        port: 8388,
-        cipher: "aes-128-gcm",
-        password: "secret",
-        protocol: "",
-        obfs: "plain",
-      })
-    ).toBe(false);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "vless",
-        name: "XHTTP",
-        server: "vless.example.com",
-        port: 443,
-        uuid: "11111111-1111-4111-8111-111111111111",
-        network: "xhttp",
-        "reality-opts": { "public-key": REALITY_PUBLIC_KEY },
-        "xhttp-opts": {
-          mode: "stream-one",
-          "download-settings": {
-            path: "/download",
-          },
-        },
-      })
-    ).toBe(false);
-    expect(
-      isMihomoSupportedProxyNode({
-        type: "vless",
-        name: "XHTTP",
-        server: "vless.example.com",
-        port: 443,
-        uuid: "11111111-1111-4111-8111-111111111111",
-        network: "xhttp",
-        "reality-opts": { "public-key": REALITY_PUBLIC_KEY },
-        "xhttp-opts": {
-          "download-settings": {
-            "reality-opts": {
-              "public-key": "",
-            },
-          },
-        },
-      })
-    ).toBe(true);
-
-    const invalidContainers = sanitizeMihomoProxyNode({
-      name: "Containers",
-      type: "vmess",
-      server: "vmess.example.com",
-      port: 443,
-      uuid: "11111111-1111-4111-8111-111111111111",
-      ech: "bad",
-      alpn: 443,
-      "ech-opts": [],
-      "ws-opts": {},
-      fingerprint: "unknown",
-    });
-    const sshWithoutHostKey = sanitizeMihomoProxyNode({
-      name: "SSH",
-      type: "ssh",
-      server: "ssh.example.com",
-      port: 22,
-      password: "secret",
-      "host-key": "ssh-ed25519 AAAA",
-      "server-fingerprint": `SHA256:${"B".repeat(43)}=`,
-    });
-    const wireguardMissingReserved = sanitizeMihomoProxyNode({
-      name: "WG",
-      type: "wireguard",
-      server: "wg.example.com",
-      port: 51820,
-      "private-key": WIREGUARD_KEY,
-      reserved: "1,2",
-    });
-    const noRealityDownloadSettings = normalizeMihomoVlessForGeneration({
-      name: "XHTTP",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "xhttp-opts": {
-        "download-settings": {
-          path: "/download",
-        },
-      },
-    });
-    const invalidDownloadReality = normalizeMihomoVlessForGeneration({
-      name: "XHTTP",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      network: "xhttp",
-      "xhttp-opts": {
-        "download-settings": {
-          "reality-opts": {
-            "public-key": "bad",
-          },
-        },
-      },
-    });
-    const explicitTlsReality = normalizeMihomoVlessForGeneration({
-      name: "Reality",
-      type: "vless",
-      uuid: "11111111-1111-4111-8111-111111111111",
-      tls: true,
-      "client-fingerprint": "edge",
-      "reality-opts": {
-        "public-key": REALITY_PUBLIC_KEY,
-      },
-    });
-    const noEncryption = sanitizeMihomoProxyNode({
-      name: "VLESS",
-      type: "vless",
-      server: "vless.example.com",
-      port: 443,
-      uuid: "11111111-1111-4111-8111-111111111111",
-      encryption: " ",
-    });
-
-    expect(invalidContainers).not.toHaveProperty("alpn");
-    expect(invalidContainers).not.toHaveProperty("ech-opts");
-    expect(invalidContainers).not.toHaveProperty("fingerprint");
-    expect(invalidContainers).not.toHaveProperty("ws-opts");
-    expect(sshWithoutHostKey).not.toHaveProperty("host-key");
-    expect(sshWithoutHostKey).toHaveProperty("server-fingerprint", `SHA256:${"B".repeat(43)}=`);
-    expect(wireguardMissingReserved).not.toHaveProperty("reserved");
-    expect(noRealityDownloadSettings).toMatchObject({
-      "xhttp-opts": {
-        "download-settings": {
-          path: "/download",
-        },
-      },
-    });
-    expect(invalidDownloadReality).toHaveProperty("_subboost-invalid-mihomo-node", true);
-    expect(explicitTlsReality).toMatchObject({
-      tls: true,
-      "client-fingerprint": "edge",
-    });
-    expect(noEncryption).not.toHaveProperty("encryption");
-  });
 });
diff --git a/packages/core/src/parser/config-line-parser.test.ts b/packages/core/src/parser/config-line-parser.test.ts
index b1cbded..bf90f70 100644
--- a/packages/core/src/parser/config-line-parser.test.ts
+++ b/packages/core/src/parser/config-line-parser.test.ts
@@ -1,221 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { looksLikeConfigLine } from "./config-line-parser";
 import { mustParseConfigLine } from "./config-line-parser.test-helpers";
-import {
-  applyCommonNodeParams,
-  applyTransport,
-  inferSkipCertVerify,
-  isUuidLike,
-  parseBooleanish,
-  parseIntParam,
-  parseStringList,
-  parseWsHeaders,
-  tokenizeConfigLine,
-} from "./config-line-tokenizer";
-
-describe("config line tokenizer helpers", () => {
-  it("tokenizes quoted config lines and mirrors dashed/underscored params", () => {
-    expect(looksLikeConfigLine("Node = ss, example.com, 8388")).toBe(true);
-    expect(looksLikeConfigLine("# Node = ss, example.com, 8388")).toBe(false);
-
-    const tokenized = tokenizeConfigLine(
-      '"My Node" = ss, "ss.example.com", 8388, encrypt_method=aes-128-gcm, password=secret, extra'
-    );
-
-    expect(tokenized).toMatchObject({
-      name: "My Node",
-      type: "ss",
-      host: "ss.example.com",
-      port: 8388,
-      params: {
-        encrypt_method: "aes-128-gcm",
-        "encrypt-method": "aes-128-gcm",
-        password: "secret",
-      },
-      extras: ["extra"],
-    });
-    expect(() => tokenizeConfigLine("broken")).toThrow("无效的配置行格式");
-    expect(() => tokenizeConfigLine("Bad = ss, example.com, 70000")).toThrow("配置行中的地址或端口无效");
-    for (const invalidPort of ["1.5", "0x50", "8e3", "+80", "-1"]) {
-      expect(() => tokenizeConfigLine(`Bad = ss, example.com, ${invalidPort}`), invalidPort).toThrow(
-        "配置行中的地址或端口无效"
-      );
-    }
-    expect(tokenizeConfigLine("Ignored = ss, ignored.example.com, 8388, =empty, flag")).toMatchObject({
-      params: {},
-      extras: ["flag"],
-    });
-  });
-
-  it("normalizes common primitive params", () => {
-    expect(parseBooleanish("yes")).toBe(true);
-    expect(parseBooleanish("off")).toBe(false);
-    expect(parseBooleanish("maybe")).toBeUndefined();
-    expect(parseStringList(undefined)).toBeUndefined();
-    expect(parseStringList(" , ")).toBeUndefined();
-    expect(parseStringList("a, b,,c")).toEqual(["a", "b", "c"]);
-    expect(parseWsHeaders(undefined)).toBeUndefined();
-    expect(parseWsHeaders("bad|also-bad")).toBeUndefined();
-    expect(parseWsHeaders("Host:|:missing|Good:yes")).toEqual({ Good: "yes" });
-    expect(parseWsHeaders('Host:cdn.example.com|X-Test:"yes"')).toEqual({
-      Host: "cdn.example.com",
-      "X-Test": "yes",
-    });
-    expect(parseIntParam(undefined)).toBeUndefined();
-    expect(parseIntParam("42ms")).toBe(42);
-    expect(parseIntParam("x")).toBeUndefined();
-    expect(isUuidLike("11111111-1111-4111-8111-111111111111")).toBe(true);
-    expect(isUuidLike("not-a-uuid")).toBe(false);
-    expect(inferSkipCertVerify({ "skip-cert-verify": "false" })).toBe(false);
-    expect(inferSkipCertVerify({ "tls-verification": "false" })).toBe(true);
-    expect(inferSkipCertVerify({ "tls-verification": "true" })).toBeUndefined();
-    expect(inferSkipCertVerify({ "allow-insecure": "0" })).toBe(false);
-  });
-
-  it("applies shared node params to non-VMess protocols and rare TLS aliases", () => {
-    const trojan: Record<string, unknown> = { type: "trojan" };
-    applyCommonNodeParams(trojan, {
-      peer: "trojan-sni.example.com",
-      "tls-cert-sha256": "cert",
-      "tls_pubkey_sha256": "pub",
-      "disable-sni": "true",
-      "block-quic": "true",
-      "udp-port": "53",
-      "fast-open": "false",
-      "shadow-tls-version": "3",
-      "shadow-tls-sni": "shadow.example.com",
-      "shadow-tls-password": "shadow-secret",
-    });
-
-    expect(trojan).toMatchObject({
-      sni: "trojan-sni.example.com",
-      "tls-cert-sha256": "cert",
-      "tls-pubkey-sha256": "pub",
-      "disable-sni": true,
-      "block-quic": true,
-      "udp-port": 53,
-      tfo: false,
-      "shadow-tls-version": 3,
-      "shadow-tls-sni": "shadow.example.com",
-      "shadow-tls-password": "shadow-secret",
-    });
-
-    const hysteria2: Record<string, unknown> = { type: "hysteria2" };
-    applyCommonNodeParams(hysteria2, { fingerprint: "chrome" });
-    expect(hysteria2).toMatchObject({ fingerprint: "chrome" });
-  });
-
-  it("applies transport helpers across default, header, and xHTTP edge branches", () => {
-    const defaultWs: Record<string, unknown> = {};
-    applyTransport(defaultWs, { "ws-path": "/ws?ed=128", "ws-headers": "Host:from-header.example.com|X-Test:yes" }, {
-      defaultTransport: "ws",
-    });
-    expect(defaultWs).toMatchObject({
-      network: "ws",
-      "ws-opts": {
-        path: "/ws",
-        headers: {
-          Host: "from-header.example.com",
-          "X-Test": "yes",
-        },
-        "early-data-header-name": "Sec-WebSocket-Protocol",
-        "max-early-data": 128,
-      },
-    });
-
-    const plainGrpc: Record<string, unknown> = {};
-    applyTransport(plainGrpc, { transport: "grpc", path: "/svc" });
-    expect(plainGrpc).toMatchObject({
-      network: "grpc",
-      "grpc-opts": {
-        "grpc-service-name": "svc",
-      },
-    });
-
-    const blankHttp: Record<string, unknown> = {};
-    applyTransport(blankHttp, { transport: "http", method: "   ", path: " , " });
-    expect(blankHttp).toMatchObject({
-      network: "http",
-      "http-opts": {
-        method: "GET",
-        path: ["/"],
-        headers: undefined,
-      },
-    });
-
-    const xhttp: Record<string, unknown> = {};
-    applyTransport(xhttp, {
-      transport: "xhttp",
-      path: "/x",
-      host: "cdn.example.com",
-      mode: "packet-up",
-      "xhttp-headers": "User-Agent:SubBoost",
-      "no-grpc-header": "off",
-      "sc-max-each-post-bytes": "bad",
-      "download-headers": "Accept:yaml",
-    }, {
-      allowedTransports: ["tcp", "xhttp"],
-    });
-    expect(xhttp).toMatchObject({
-      network: "xhttp",
-      "xhttp-opts": {
-        path: "/x",
-        host: "cdn.example.com",
-        mode: "packet-up",
-        headers: { "User-Agent": "SubBoost" },
-        "no-grpc-header": false,
-        "download-settings": {
-          headers: { Accept: "yaml" },
-        },
-      },
-    });
-
-    expect(() => applyTransport({}, { transport: "udp" }, { allowedTransports: ["tcp"], protocolName: "测试" })).toThrow(
-      "不支持的 测试 传输层"
-    );
-    expect(() => applyTransport({}, { transport: " " }, { allowedTransports: ["tcp"] })).toThrow(
-      "transport=(empty)"
-    );
-
-    const tcp: Record<string, unknown> = {};
-    applyTransport(tcp, { transport: "tcp" });
-    expect(tcp).toMatchObject({ network: "tcp" });
-
-    const xhttpAliases: Record<string, unknown> = {};
-    applyTransport(xhttpAliases, {
-      network: "xhttp",
-      path: "/alias",
-      headers: "Host:edge.example.com",
-      "max-connections": "2",
-      "c-max-reuse-times": "3",
-      "h-max-request-times": "4",
-      "h-max-reusable-secs": "5",
-      no_grpc_header: "yes",
-      sc_max_each_post_bytes: "4096",
-      downloadheaders: "Accept:yaml",
-    }, {
-      allowedTransports: ["tcp", "xhttp"],
-    });
-    expect(xhttpAliases).toMatchObject({
-      network: "xhttp",
-      "xhttp-opts": {
-        path: "/alias",
-        headers: { Host: "edge.example.com" },
-        "no-grpc-header": true,
-        "sc-max-each-post-bytes": 4096,
-        "reuse-settings": {
-          "max-connections": "2",
-          "c-max-reuse-times": "3",
-          "h-max-request-times": "4",
-          "h-max-reusable-secs": "5",
-        },
-        "download-settings": {
-          headers: { Accept: "yaml" },
-        },
-      },
-    });
-  });
-});
 
 describe("config line parser", () => {
   it("builds VMess and VLESS transport options", () => {
diff --git a/packages/core/src/parser/config-line-tokenizer.test.ts b/packages/core/src/parser/config-line-tokenizer.test.ts
new file mode 100644
index 0000000..7894147
--- /dev/null
+++ b/packages/core/src/parser/config-line-tokenizer.test.ts
@@ -0,0 +1,217 @@
+import { describe, expect, it } from "vitest";
+import { looksLikeConfigLine } from "./config-line-parser";
+import {
+  applyCommonNodeParams,
+  applyTransport,
+  inferSkipCertVerify,
+  isUuidLike,
+  parseBooleanish,
+  parseIntParam,
+  parseStringList,
+  parseWsHeaders,
+  tokenizeConfigLine,
+} from "./config-line-tokenizer";
+
+describe("config line tokenizer helpers", () => {
+  it("tokenizes quoted config lines and mirrors dashed/underscored params", () => {
+    expect(looksLikeConfigLine("Node = ss, example.com, 8388")).toBe(true);
+    expect(looksLikeConfigLine("# Node = ss, example.com, 8388")).toBe(false);
+
+    const tokenized = tokenizeConfigLine(
+      '"My Node" = ss, "ss.example.com", 8388, encrypt_method=aes-128-gcm, password=secret, extra'
+    );
+
+    expect(tokenized).toMatchObject({
+      name: "My Node",
+      type: "ss",
+      host: "ss.example.com",
+      port: 8388,
+      params: {
+        encrypt_method: "aes-128-gcm",
+        "encrypt-method": "aes-128-gcm",
+        password: "secret",
+      },
+      extras: ["extra"],
+    });
+    expect(() => tokenizeConfigLine("broken")).toThrow("无效的配置行格式");
+    expect(() => tokenizeConfigLine("Bad = ss, example.com, 70000")).toThrow("配置行中的地址或端口无效");
+    for (const invalidPort of ["1.5", "0x50", "8e3", "+80", "-1"]) {
+      expect(() => tokenizeConfigLine(`Bad = ss, example.com, ${invalidPort}`), invalidPort).toThrow(
+        "配置行中的地址或端口无效"
+      );
+    }
+    expect(tokenizeConfigLine("Ignored = ss, ignored.example.com, 8388, =empty, flag")).toMatchObject({
+      params: {},
+      extras: ["flag"],
+    });
+  });
+
+  it("normalizes common primitive params", () => {
+    expect(parseBooleanish("yes")).toBe(true);
+    expect(parseBooleanish("off")).toBe(false);
+    expect(parseBooleanish("maybe")).toBeUndefined();
+    expect(parseStringList(undefined)).toBeUndefined();
+    expect(parseStringList(" , ")).toBeUndefined();
+    expect(parseStringList("a, b,,c")).toEqual(["a", "b", "c"]);
+    expect(parseWsHeaders(undefined)).toBeUndefined();
+    expect(parseWsHeaders("bad|also-bad")).toBeUndefined();
+    expect(parseWsHeaders("Host:|:missing|Good:yes")).toEqual({ Good: "yes" });
+    expect(parseWsHeaders('Host:cdn.example.com|X-Test:"yes"')).toEqual({
+      Host: "cdn.example.com",
+      "X-Test": "yes",
+    });
+    expect(parseIntParam(undefined)).toBeUndefined();
+    expect(parseIntParam("42ms")).toBe(42);
+    expect(parseIntParam("x")).toBeUndefined();
+    expect(isUuidLike("11111111-1111-4111-8111-111111111111")).toBe(true);
+    expect(isUuidLike("not-a-uuid")).toBe(false);
+    expect(inferSkipCertVerify({ "skip-cert-verify": "false" })).toBe(false);
+    expect(inferSkipCertVerify({ "tls-verification": "false" })).toBe(true);
+    expect(inferSkipCertVerify({ "tls-verification": "true" })).toBeUndefined();
+    expect(inferSkipCertVerify({ "allow-insecure": "0" })).toBe(false);
+  });
+
+  it("applies shared node params to non-VMess protocols and rare TLS aliases", () => {
+    const trojan: Record<string, unknown> = { type: "trojan" };
+    applyCommonNodeParams(trojan, {
+      peer: "trojan-sni.example.com",
+      "tls-cert-sha256": "cert",
+      "tls_pubkey_sha256": "pub",
+      "disable-sni": "true",
+      "block-quic": "true",
+      "udp-port": "53",
+      "fast-open": "false",
+      "shadow-tls-version": "3",
+      "shadow-tls-sni": "shadow.example.com",
+      "shadow-tls-password": "shadow-secret",
+    });
+
+    expect(trojan).toMatchObject({
+      sni: "trojan-sni.example.com",
+      "tls-cert-sha256": "cert",
+      "tls-pubkey-sha256": "pub",
+      "disable-sni": true,
+      "block-quic": true,
+      "udp-port": 53,
+      tfo: false,
+      "shadow-tls-version": 3,
+      "shadow-tls-sni": "shadow.example.com",
+      "shadow-tls-password": "shadow-secret",
+    });
+
+    const hysteria2: Record<string, unknown> = { type: "hysteria2" };
+    applyCommonNodeParams(hysteria2, { fingerprint: "chrome" });
+    expect(hysteria2).toMatchObject({ fingerprint: "chrome" });
+  });
+
+  it("applies transport helpers across default, header, and xHTTP edge branches", () => {
+    const defaultWs: Record<string, unknown> = {};
+    applyTransport(defaultWs, { "ws-path": "/ws?ed=128", "ws-headers": "Host:from-header.example.com|X-Test:yes" }, {
+      defaultTransport: "ws",
+    });
+    expect(defaultWs).toMatchObject({
+      network: "ws",
+      "ws-opts": {
+        path: "/ws",
+        headers: {
+          Host: "from-header.example.com",
+          "X-Test": "yes",
+        },
+        "early-data-header-name": "Sec-WebSocket-Protocol",
+        "max-early-data": 128,
+      },
+    });
+
+    const plainGrpc: Record<string, unknown> = {};
+    applyTransport(plainGrpc, { transport: "grpc", path: "/svc" });
+    expect(plainGrpc).toMatchObject({
+      network: "grpc",
+      "grpc-opts": {
+        "grpc-service-name": "svc",
+      },
+    });
+
+    const blankHttp: Record<string, unknown> = {};
+    applyTransport(blankHttp, { transport: "http", method: "   ", path: " , " });
+    expect(blankHttp).toMatchObject({
+      network: "http",
+      "http-opts": {
+        method: "GET",
+        path: ["/"],
+        headers: undefined,
+      },
+    });
+
+    const xhttp: Record<string, unknown> = {};
+    applyTransport(xhttp, {
+      transport: "xhttp",
+      path: "/x",
+      host: "cdn.example.com",
+      mode: "packet-up",
+      "xhttp-headers": "User-Agent:SubBoost",
+      "no-grpc-header": "off",
+      "sc-max-each-post-bytes": "bad",
+      "download-headers": "Accept:yaml",
+    }, {
+      allowedTransports: ["tcp", "xhttp"],
+    });
+    expect(xhttp).toMatchObject({
+      network: "xhttp",
+      "xhttp-opts": {
+        path: "/x",
+        host: "cdn.example.com",
+        mode: "packet-up",
+        headers: { "User-Agent": "SubBoost" },
+        "no-grpc-header": false,
+        "download-settings": {
+          headers: { Accept: "yaml" },
+        },
+      },
+    });
+
+    expect(() => applyTransport({}, { transport: "udp" }, { allowedTransports: ["tcp"], protocolName: "测试" })).toThrow(
+      "不支持的 测试 传输层"
+    );
+    expect(() => applyTransport({}, { transport: " " }, { allowedTransports: ["tcp"] })).toThrow(
+      "transport=(empty)"
+    );
+
+    const tcp: Record<string, unknown> = {};
+    applyTransport(tcp, { transport: "tcp" });
+    expect(tcp).toMatchObject({ network: "tcp" });
+
+    const xhttpAliases: Record<string, unknown> = {};
+    applyTransport(xhttpAliases, {
+      network: "xhttp",
+      path: "/alias",
+      headers: "Host:edge.example.com",
+      "max-connections": "2",
+      "c-max-reuse-times": "3",
+      "h-max-request-times": "4",
+      "h-max-reusable-secs": "5",
+      no_grpc_header: "yes",
+      sc_max_each_post_bytes: "4096",
+      downloadheaders: "Accept:yaml",
+    }, {
+      allowedTransports: ["tcp", "xhttp"],
+    });
+    expect(xhttpAliases).toMatchObject({
+      network: "xhttp",
+      "xhttp-opts": {
+        path: "/alias",
+        headers: { Host: "edge.example.com" },
+        "no-grpc-header": true,
+        "sc-max-each-post-bytes": 4096,
+        "reuse-settings": {
+          "max-connections": "2",
+          "c-max-reuse-times": "3",
+          "h-max-request-times": "4",
+          "h-max-reusable-secs": "5",
+        },
+        "download-settings": {
+          headers: { Accept: "yaml" },
+        },
+      },
+    });
+  });
+});
diff --git a/packages/core/src/subscription/config-utils-legacy.test.ts b/packages/core/src/subscription/config-utils-legacy.test.ts
new file mode 100644
index 0000000..ecfdc15
--- /dev/null
+++ b/packages/core/src/subscription/config-utils-legacy.test.ts
@@ -0,0 +1,350 @@
+import { describe, expect, it, vi } from "vitest";
+import { buildGenerateOptionsFromConfig } from "./config-utils";
+import type { ParsedNode } from "@subboost/core/types/node";
+
+function node(patch: Partial<ParsedNode> = {}): ParsedNode {
+  return {
+    name: "Node",
+    type: "ss",
+    server: "ss.example.com",
+    port: 8388,
+    cipher: "aes-128-gcm",
+    password: "secret",
+    "dialer-proxy": "Imported Control",
+    ...patch,
+  } as ParsedNode;
+}
+
+describe("subscription config utils legacy and mixed persistence", () => {
+  it("uses legacy custom group fallback when rule model normalization returns no groups", async () => {
+    vi.resetModules();
+    vi.doMock("@subboost/core/rules/rule-model", () => ({
+      normalizeRuleModelFromConfig: () => ({
+        customProxyGroups: [],
+        customRuleSets: [],
+        builtinRuleEdits: {},
+      }),
+    }));
+
+    try {
+      const { buildGenerateOptionsFromConfig: buildWithMockedRuleModel } = await import("./config-utils");
+      const options = buildWithMockedRuleModel(
+        {
+          template: "minimal",
+          customProxyGroups: [
+            "bad",
+            { id: "", name: "Bad", emoji: "B", groupType: "select" },
+            { id: "select", name: " Select ", emoji: null, groupType: "select", enabled: true },
+            { id: "auto", name: "Auto", emoji: "A", groupType: "url-test" },
+            { id: "fallback", name: "Fallback", emoji: "F", groupType: "fallback" },
+            { id: "direct", name: "Direct", emoji: "D", groupType: "direct-first" },
+            { id: "reject", name: "Reject", emoji: "R", groupType: "reject-first" },
+            { id: "balance", name: "Balance", emoji: "B", groupType: "load-balance", strategy: "bad" },
+          ],
+          dialerProxyGroups: [
+            {
+              id: "direct-dialer",
+              name: "Direct Dialer",
+              type: "direct-first",
+              enabled: true,
+              relayNodes: [" Relay ", ""],
+              targetNodes: "bad",
+            },
+            {
+              id: "reject-dialer",
+              name: "Reject Dialer",
+              type: "reject-first",
+              strategy: "round-robin",
+            },
+          ],
+        },
+        { nodes: [node()] },
+      );
+
+      expect(options.customProxyGroups?.map((group) => group.groupType)).toEqual([
+        "select",
+        "url-test",
+        "fallback",
+        "direct-first",
+        "reject-first",
+        "load-balance",
+      ]);
+      expect(options.customProxyGroups?.find((group) => group.id === "balance")).toMatchObject({
+        strategy: "consistent-hashing",
+      });
+      expect(options.dialerProxyGroups).toEqual([
+        {
+          enabled: true,
+          id: "direct-dialer",
+          name: "Direct Dialer",
+          relayNodes: ["Relay"],
+          targetNodes: [],
+          type: "direct-first",
+        },
+        {
+          id: "reject-dialer",
+          name: "Reject Dialer",
+          relayNodes: [],
+          targetNodes: [],
+          type: "reject-first",
+        },
+      ]);
+
+      const sparse = buildWithMockedRuleModel(
+        {
+          customProxyGroups: "bad",
+          dialerProxyGroups: "bad",
+          proxyGroupAdvanced: {
+            " missing ": "bad",
+            " select ": { groupType: "select" },
+            " empty ": { regions: ["bad"] },
+          },
+        },
+        { nodes: [node()] },
+      );
+
+      expect(sparse.customProxyGroups).toBeUndefined();
+      expect(sparse.dialerProxyGroups).toBeUndefined();
+      expect(sparse.proxyGroupAdvanced).toEqual({ select: { groupType: "select" } });
+    } finally {
+      vi.doUnmock("@subboost/core/rules/rule-model");
+      vi.resetModules();
+    }
+  });
+
+  it("normalizes legacy custom groups with dense optional field variants", async () => {
+    vi.resetModules();
+    vi.doMock("@subboost/core/rules/rule-model", () => ({
+      normalizeRuleModelFromConfig: () => ({
+        customProxyGroups: [],
+        customRuleSets: [],
+        builtinRuleEdits: {},
+      }),
+    }));
+
+    try {
+      const { buildGenerateOptionsFromConfig: buildWithMockedRuleModel } = await import("./config-utils");
+      const options = buildWithMockedRuleModel(
+        {
+          customProxyGroups: [
+            { id: "missing-name", name: "", emoji: "M", groupType: "select" },
+            { id: "missing-type", name: "Missing Type", emoji: "M", groupType: "invalid" },
+            {
+              id: "select",
+              name: " Select ",
+              emoji: " S ",
+              enabled: false,
+              description: " Primary group ",
+              memberSource: "filtered-nodes",
+              includeInGroupMembers: false,
+              groupType: "select",
+              strategy: "round-robin",
+              advanced: {
+                includeRegex: "JP",
+                regions: ["jp"],
+              },
+            },
+            {
+              id: "balance",
+              name: "Balance",
+              emoji: undefined,
+              enabled: true,
+              description: " ",
+              memberSource: "all",
+              includeInGroupMembers: "yes",
+              groupType: "load-balance",
+              strategy: "round-robin",
+              advanced: { regions: ["bad"] },
+            },
+          ],
+          dialerProxyGroups: [
+            { id: "missing-name", name: "", type: "select" },
+            { id: "missing-type", name: "Missing Type", type: "invalid" },
+            {
+              id: "balance-dialer",
+              name: "Balance Dialer",
+              type: "load-balance",
+              enabled: "yes",
+              relayNodes: [" Relay "],
+              targetNodes: [" Target "],
+            },
+          ],
+        },
+        { nodes: [node()] },
+      );
+
+      expect(options.customProxyGroups).toEqual([
+        {
+          id: "select",
+          name: "Select",
+          emoji: "S",
+          enabled: false,
+          description: "Primary group",
+          memberSource: "filtered-nodes",
+          includeInGroupMembers: false,
+          groupType: "select",
+          advanced: {
+            includeRegex: "JP",
+            regions: ["jp"],
+          },
+        },
+        {
+          id: "balance",
+          name: "Balance",
+          emoji: "",
+          groupType: "load-balance",
+          strategy: "round-robin",
+        },
+      ]);
+      expect(options.dialerProxyGroups).toEqual([
+        {
+          id: "balance-dialer",
+          name: "Balance Dialer",
+          type: "load-balance",
+          strategy: "consistent-hashing",
+          relayNodes: ["Relay"],
+          targetNodes: ["Target"],
+        },
+      ]);
+    } finally {
+      vi.doUnmock("@subboost/core/rules/rule-model");
+      vi.resetModules();
+    }
+  });
+
+  it("normalizes mixed persisted options without emitting empty optional sections", () => {
+    const options = buildGenerateOptionsFromConfig(
+      {
+        template: "full",
+        testUrl: " http://probe.example.com/204 ",
+        testInterval: 0,
+        enabledGroups: [1, " ", "auto", "auto", "cn"],
+        enabledRules: [null, "global", " "],
+        customRules: [
+          { id: "", type: "DST-PORT", value: " 443 ", target: { kind: "module", id: " auto " } },
+          { id: "bad-target", type: "DOMAIN", value: "bad.example", target: { kind: "node", name: "" } },
+          { id: "src-port", type: "SRC-PORT", value: " 6881 ", target: { kind: "custom", id: " media " } },
+        ],
+        customProxyGroups: [
+          {
+            id: "media",
+            name: " Media ",
+            emoji: undefined,
+            enabled: false,
+            description: " Media group ",
+            memberSource: "filtered-nodes",
+            includeInGroupMembers: true,
+            groupType: "load-balance",
+            strategy: "round-robin",
+            advanced: {
+              sourceIds: ["source-a"],
+              regions: ["tw"],
+              includeRegex: "TW",
+              excludeRegex: "test",
+              extraMembers: [{ kind: "reject" }],
+              excludedMembers: [{ kind: "direct" }],
+              memberOrder: [{ kind: "reject" }],
+            },
+          },
+        ],
+        customRuleSets: [
+          {
+            id: "manual",
+            name: " Manual ",
+            behavior: "classical",
+            path: "https://rules.example.com/manual.yaml",
+            target: { kind: "module", id: " cn " },
+            noResolve: true,
+          },
+        ],
+        dialerProxyGroups: [
+          {
+            id: "direct",
+            name: " Direct Dialer ",
+            type: "direct-first",
+            strategy: "round-robin",
+            relayNodes: ["Relay", "Relay", ""],
+            targetNodes: ["Target", null, "Target"],
+          },
+        ],
+        listenerPorts: {
+          socks: 65535,
+          negative: -1,
+          nan: Number.NaN,
+        },
+        proxyGroupNameOverrides: {
+          cn: " China ",
+        },
+        proxyGroupOrder: [" cn ", "cn", "", null],
+        mixedPort: 65535,
+        allowLan: false,
+        autoSelectStrategy: "load-balance",
+        cnIpNoResolve: true,
+        experimentalCnUseCnRuleSet: false,
+      },
+      { nodes: [node({ name: "TW Node" })] },
+    );
+
+    expect(options.template).toBe("full");
+    expect(options.userConfig).toMatchObject({
+      enabledGroups: ["auto", "auto", "cn"],
+      enabledRules: ["global"],
+      mixedPort: 65535,
+      allowLan: false,
+      autoSelectStrategy: "load-balance",
+      cnIpNoResolve: true,
+      experimentalCnUseCnRuleSet: false,
+      listenerPorts: { socks: 65535 },
+      testUrl: "http://probe.example.com/204",
+      testInterval: 0,
+    });
+    expect(options.userConfig?.customRules).toEqual([
+      {
+        id: "custom-rule-dst-port-443-module-auto-1",
+        type: "DST-PORT",
+        value: "443",
+        target: { kind: "module", id: "auto" },
+      },
+      {
+        id: "src-port",
+        type: "SRC-PORT",
+        value: "6881",
+        target: { kind: "custom", id: "media" },
+      },
+    ]);
+    expect(options.customProxyGroups).toEqual([
+      {
+        id: "media",
+        name: "Media",
+        emoji: "",
+        enabled: false,
+        description: "Media group",
+        memberSource: "filtered-nodes",
+        includeInGroupMembers: true,
+        groupType: "load-balance",
+        strategy: "round-robin",
+        advanced: {
+          sourceIds: ["source-a"],
+          regions: ["tw"],
+          includeRegex: "TW",
+          excludeRegex: "test",
+          extraMembers: [{ kind: "reject" }],
+          excludedMembers: [{ kind: "direct" }],
+          memberOrder: [{ kind: "reject" }],
+        },
+      },
+    ]);
+    expect(options.customRuleSets).toBeUndefined();
+    expect(options.dialerProxyGroups).toEqual([
+      {
+        id: "direct",
+        name: "Direct Dialer",
+        type: "direct-first",
+        relayNodes: ["Relay", "Relay"],
+        targetNodes: ["Target", "Target"],
+      },
+    ]);
+    expect(options.proxyGroupNameOverrides).toEqual({ cn: "China" });
+    expect(options.proxyGroupOrder).toEqual(["cn", "cn"]);
+  });
+});
diff --git a/packages/core/src/subscription/config-utils.test.ts b/packages/core/src/subscription/config-utils.test.ts
index 27bbf7a..310139f 100644
--- a/packages/core/src/subscription/config-utils.test.ts
+++ b/packages/core/src/subscription/config-utils.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from "vitest";
+import { describe, expect, it } from "vitest";
 import {
   buildGenerateOptionsFromConfig,
   getEffectiveTestOptions,
@@ -448,335 +448,4 @@ describe("subscription config utils", () => {
     expect(options.dialerProxyGroups).toBeUndefined();
   });
 
-  it("uses legacy custom group fallback when rule model normalization returns no groups", async () => {
-    vi.resetModules();
-    vi.doMock("@subboost/core/rules/rule-model", () => ({
-      normalizeRuleModelFromConfig: () => ({
-        customProxyGroups: [],
-        customRuleSets: [],
-        builtinRuleEdits: {},
-      }),
-    }));
-
-    try {
-      const { buildGenerateOptionsFromConfig: buildWithMockedRuleModel } = await import("./config-utils");
-      const options = buildWithMockedRuleModel(
-        {
-          template: "minimal",
-          customProxyGroups: [
-            "bad",
-            { id: "", name: "Bad", emoji: "B", groupType: "select" },
-            { id: "select", name: " Select ", emoji: null, groupType: "select", enabled: true },
-            { id: "auto", name: "Auto", emoji: "A", groupType: "url-test" },
-            { id: "fallback", name: "Fallback", emoji: "F", groupType: "fallback" },
-            { id: "direct", name: "Direct", emoji: "D", groupType: "direct-first" },
-            { id: "reject", name: "Reject", emoji: "R", groupType: "reject-first" },
-            { id: "balance", name: "Balance", emoji: "B", groupType: "load-balance", strategy: "bad" },
-          ],
-          dialerProxyGroups: [
-            {
-              id: "direct-dialer",
-              name: "Direct Dialer",
-              type: "direct-first",
-              enabled: true,
-              relayNodes: [" Relay ", ""],
-              targetNodes: "bad",
-            },
-            {
-              id: "reject-dialer",
-              name: "Reject Dialer",
-              type: "reject-first",
-              strategy: "round-robin",
-            },
-          ],
-        },
-        { nodes: [node()] },
-      );
-
-      expect(options.customProxyGroups?.map((group) => group.groupType)).toEqual([
-        "select",
-        "url-test",
-        "fallback",
-        "direct-first",
-        "reject-first",
-        "load-balance",
-      ]);
-      expect(options.customProxyGroups?.find((group) => group.id === "balance")).toMatchObject({
-        strategy: "consistent-hashing",
-      });
-      expect(options.dialerProxyGroups).toEqual([
-        {
-          enabled: true,
-          id: "direct-dialer",
-          name: "Direct Dialer",
-          relayNodes: ["Relay"],
-          targetNodes: [],
-          type: "direct-first",
-        },
-        {
-          id: "reject-dialer",
-          name: "Reject Dialer",
-          relayNodes: [],
-          targetNodes: [],
-          type: "reject-first",
-        },
-      ]);
-
-      const sparse = buildWithMockedRuleModel(
-        {
-          customProxyGroups: "bad",
-          dialerProxyGroups: "bad",
-          proxyGroupAdvanced: {
-            " missing ": "bad",
-            " select ": { groupType: "select" },
-            " empty ": { regions: ["bad"] },
-          },
-        },
-        { nodes: [node()] },
-      );
-
-      expect(sparse.customProxyGroups).toBeUndefined();
-      expect(sparse.dialerProxyGroups).toBeUndefined();
-      expect(sparse.proxyGroupAdvanced).toEqual({ select: { groupType: "select" } });
-    } finally {
-      vi.doUnmock("@subboost/core/rules/rule-model");
-      vi.resetModules();
-    }
-  });
-
-  it("normalizes legacy custom groups with dense optional field variants", async () => {
-    vi.resetModules();
-    vi.doMock("@subboost/core/rules/rule-model", () => ({
-      normalizeRuleModelFromConfig: () => ({
-        customProxyGroups: [],
-        customRuleSets: [],
-        builtinRuleEdits: {},
-      }),
-    }));
-
-    try {
-      const { buildGenerateOptionsFromConfig: buildWithMockedRuleModel } = await import("./config-utils");
-      const options = buildWithMockedRuleModel(
-        {
-          customProxyGroups: [
-            { id: "missing-name", name: "", emoji: "M", groupType: "select" },
-            { id: "missing-type", name: "Missing Type", emoji: "M", groupType: "invalid" },
-            {
-              id: "select",
-              name: " Select ",
-              emoji: " S ",
-              enabled: false,
-              description: " Primary group ",
-              memberSource: "filtered-nodes",
-              includeInGroupMembers: false,
-              groupType: "select",
-              strategy: "round-robin",
-              advanced: {
-                includeRegex: "JP",
-                regions: ["jp"],
-              },
-            },
-            {
-              id: "balance",
-              name: "Balance",
-              emoji: undefined,
-              enabled: true,
-              description: " ",
-              memberSource: "all",
-              includeInGroupMembers: "yes",
-              groupType: "load-balance",
-              strategy: "round-robin",
-              advanced: { regions: ["bad"] },
-            },
-          ],
-          dialerProxyGroups: [
-            { id: "missing-name", name: "", type: "select" },
-            { id: "missing-type", name: "Missing Type", type: "invalid" },
-            {
-              id: "balance-dialer",
-              name: "Balance Dialer",
-              type: "load-balance",
-              enabled: "yes",
-              relayNodes: [" Relay "],
-              targetNodes: [" Target "],
-            },
-          ],
-        },
-        { nodes: [node()] },
-      );
-
-      expect(options.customProxyGroups).toEqual([
-        {
-          id: "select",
-          name: "Select",
-          emoji: "S",
-          enabled: false,
-          description: "Primary group",
-          memberSource: "filtered-nodes",
-          includeInGroupMembers: false,
-          groupType: "select",
-          advanced: {
-            includeRegex: "JP",
-            regions: ["jp"],
-          },
-        },
-        {
-          id: "balance",
-          name: "Balance",
-          emoji: "",
-          groupType: "load-balance",
-          strategy: "round-robin",
-        },
-      ]);
-      expect(options.dialerProxyGroups).toEqual([
-        {
-          id: "balance-dialer",
-          name: "Balance Dialer",
-          type: "load-balance",
-          strategy: "consistent-hashing",
-          relayNodes: ["Relay"],
-          targetNodes: ["Target"],
-        },
-      ]);
-    } finally {
-      vi.doUnmock("@subboost/core/rules/rule-model");
-      vi.resetModules();
-    }
-  });
-
-  it("normalizes mixed persisted options without emitting empty optional sections", () => {
-    const options = buildGenerateOptionsFromConfig(
-      {
-        template: "full",
-        testUrl: " http://probe.example.com/204 ",
-        testInterval: 0,
-        enabledGroups: [1, " ", "auto", "auto", "cn"],
-        enabledRules: [null, "global", " "],
-        customRules: [
-          { id: "", type: "DST-PORT", value: " 443 ", target: { kind: "module", id: " auto " } },
-          { id: "bad-target", type: "DOMAIN", value: "bad.example", target: { kind: "node", name: "" } },
-          { id: "src-port", type: "SRC-PORT", value: " 6881 ", target: { kind: "custom", id: " media " } },
-        ],
-        customProxyGroups: [
-          {
-            id: "media",
-            name: " Media ",
-            emoji: undefined,
-            enabled: false,
-            description: " Media group ",
-            memberSource: "filtered-nodes",
-            includeInGroupMembers: true,
-            groupType: "load-balance",
-            strategy: "round-robin",
-            advanced: {
-              sourceIds: ["source-a"],
-              regions: ["tw"],
-              includeRegex: "TW",
-              excludeRegex: "test",
-              extraMembers: [{ kind: "reject" }],
-              excludedMembers: [{ kind: "direct" }],
-              memberOrder: [{ kind: "reject" }],
-            },
-          },
-        ],
-        customRuleSets: [
-          {
-            id: "manual",
-            name: " Manual ",
-            behavior: "classical",
-            path: "https://rules.example.com/manual.yaml",
-            target: { kind: "module", id: " cn " },
-            noResolve: true,
-          },
-        ],
-        dialerProxyGroups: [
-          {
-            id: "direct",
-            name: " Direct Dialer ",
-            type: "direct-first",
-            strategy: "round-robin",
-            relayNodes: ["Relay", "Relay", ""],
-            targetNodes: ["Target", null, "Target"],
-          },
-        ],
-        listenerPorts: {
-          socks: 65535,
-          negative: -1,
-          nan: Number.NaN,
-        },
-        proxyGroupNameOverrides: {
-          cn: " China ",
-        },
-        proxyGroupOrder: [" cn ", "cn", "", null],
-        mixedPort: 65535,
-        allowLan: false,
-        autoSelectStrategy: "load-balance",
-        cnIpNoResolve: true,
-        experimentalCnUseCnRuleSet: false,
-      },
-      { nodes: [node({ name: "TW Node" })] },
-    );
-
-    expect(options.template).toBe("full");
-    expect(options.userConfig).toMatchObject({
-      enabledGroups: ["auto", "auto", "cn"],
-      enabledRules: ["global"],
-      mixedPort: 65535,
-      allowLan: false,
-      autoSelectStrategy: "load-balance",
-      cnIpNoResolve: true,
-      experimentalCnUseCnRuleSet: false,
-      listenerPorts: { socks: 65535 },
-      testUrl: "http://probe.example.com/204",
-      testInterval: 0,
-    });
-    expect(options.userConfig?.customRules).toEqual([
-      {
-        id: "custom-rule-dst-port-443-module-auto-1",
-        type: "DST-PORT",
-        value: "443",
-        target: { kind: "module", id: "auto" },
-      },
-      {
-        id: "src-port",
-        type: "SRC-PORT",
-        value: "6881",
-        target: { kind: "custom", id: "media" },
-      },
-    ]);
-    expect(options.customProxyGroups).toEqual([
-      {
-        id: "media",
-        name: "Media",
-        emoji: "",
-        enabled: false,
-        description: "Media group",
-        memberSource: "filtered-nodes",
-        includeInGroupMembers: true,
-        groupType: "load-balance",
-        strategy: "round-robin",
-        advanced: {
-          sourceIds: ["source-a"],
-          regions: ["tw"],
-          includeRegex: "TW",
-          excludeRegex: "test",
-          extraMembers: [{ kind: "reject" }],
-          excludedMembers: [{ kind: "direct" }],
-          memberOrder: [{ kind: "reject" }],
-        },
-      },
-    ]);
-    expect(options.customRuleSets).toBeUndefined();
-    expect(options.dialerProxyGroups).toEqual([
-      {
-        id: "direct",
-        name: "Direct Dialer",
-        type: "direct-first",
-        relayNodes: ["Relay", "Relay"],
-        targetNodes: ["Target", "Target"],
-      },
-    ]);
-    expect(options.proxyGroupNameOverrides).toEqual({ cn: "China" });
-    expect(options.proxyGroupOrder).toEqual(["cn", "cn"]);
-  });
 });
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets-invalid-save.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets-invalid-save.test.ts
new file mode 100644
index 0000000..f6bac42
--- /dev/null
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets-invalid-save.test.ts
@@ -0,0 +1,202 @@
+import * as React from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  buttons: [] as any[],
+  ruleSets: [] as any[],
+  store: {} as Record<string, any>,
+  toast: vi.fn(),
+}));
+
+const stateMock = vi.hoisted(() => ({
+  callIndex: 0,
+  overrides: {} as Record<number, unknown>,
+}));
+
+vi.mock("react", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react")>();
+  return {
+    ...actual,
+    useState: (initial: unknown) => {
+      const index = stateMock.callIndex++;
+      const value = Object.prototype.hasOwnProperty.call(
+        stateMock.overrides,
+        index,
+      )
+        ? stateMock.overrides[index]
+        : initial;
+      return [value, vi.fn()];
+    },
+  };
+});
+
+vi.mock("lucide-react", () => ({
+  ArrowRight: () => null,
+  Check: () => null,
+  Pencil: () => null,
+  Trash2: () => null,
+  X: () => null,
+}));
+vi.mock("@subboost/ui/components/ui/button", () => ({
+  Button: (props: any) => {
+    mocks.buttons.push(props);
+    return null;
+  },
+}));
+vi.mock("@subboost/ui/components/ui/select", () => ({
+  Select: (props: any) => props.children,
+  SelectContent: (props: any) => props.children,
+  SelectItem: (props: any) => props.children,
+  SelectTrigger: (props: any) => props.children,
+  SelectValue: () => null,
+}));
+vi.mock("@subboost/ui/components/ui/switch", () => ({
+  Switch: () => null,
+}));
+vi.mock("@subboost/ui/components/ui/toaster", () => ({ toast: mocks.toast }));
+vi.mock("@subboost/core/generator/proxy-groups", () => ({
+  PROXY_GROUP_MODULES: [
+    { id: "auto", name: "Auto", rules: [] },
+    { id: "fallback", name: "Fallback", rules: [] },
+  ],
+}));
+vi.mock("@subboost/core/generator/module-rules", () => ({
+  getModuleRuleOrderKey: (moduleId: string, ruleId: string) =>
+    `${moduleId}:${ruleId}`,
+}));
+vi.mock("@subboost/core/proxy-group-name", () => ({
+  resolveProxyGroupModuleName: (module: { name: string }, override?: string) =>
+    override || module.name,
+}));
+vi.mock("@subboost/core/proxy-group-targets", () => ({
+  resolveProxyGroupTargetName: (target: unknown) =>
+    typeof target === "string" ? target : "",
+}));
+vi.mock("@subboost/core/rules/custom-routing-rule-sets", () => ({
+  collectCustomRoutingRuleSets: () => mocks.ruleSets,
+  getRuleSetTargetValue: (target: { kind: string; id: string }) =>
+    `${target.kind}:${target.id}`,
+  normalizeRuleSetPathInput: (path: string) => path.trim(),
+  parseRuleSetTargetValue: (value: string) => {
+    const [kind, id] = value.split(":");
+    return (kind === "module" || kind === "custom") && id
+      ? { kind, id }
+      : null;
+  },
+}));
+vi.mock("@subboost/ui/store/config-store", () => ({
+  useConfigStore: () => mocks.store,
+}));
+
+import { ProxyGroupsAddedRuleSets } from "./proxy-groups-added-rule-sets";
+
+const moduleItem = {
+  key: "custom-rule-set:rule-a",
+  id: "rule-a",
+  name: "Rule A",
+  behavior: "domain",
+  path: "geosite/rule-a.mrs",
+  noResolve: true,
+  source: { kind: "custom-rule-set", id: "rule-a" },
+  target: {
+    kind: "module",
+    id: "auto",
+    value: "module:auto",
+    name: "Auto",
+  },
+};
+
+const customItem = {
+  key: "custom-rule-set:rule-b",
+  id: "rule-b",
+  name: "Rule B",
+  behavior: "ipcidr",
+  path: "geoip/rule-b.mrs",
+  source: { kind: "custom-rule-set", id: "rule-b" },
+  target: {
+    kind: "custom",
+    id: "custom-1",
+    value: "custom:custom-1",
+    name: "Custom",
+  },
+};
+
+function renderEditing(item: typeof moduleItem | typeof customItem, draft: unknown) {
+  stateMock.callIndex = 0;
+  stateMock.overrides = { 0: item.key, 1: draft };
+  mocks.buttons = [];
+  mocks.ruleSets = [item];
+  renderToStaticMarkup(
+    React.createElement(ProxyGroupsAddedRuleSets, {
+      showSearchHint: false,
+      totalRules: null,
+    }),
+  );
+}
+
+function clickSave() {
+  mocks.buttons
+    .find((props: any) => props.title === "保存规则集")
+    .onClick();
+}
+
+describe("ProxyGroupsAddedRuleSets invalid saves", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.store = {
+      enabledProxyGroups: ["auto"],
+      hiddenProxyGroups: [],
+      customRuleSets: [],
+      builtinRuleEdits: {},
+      customProxyGroups: [{ id: "custom-1", name: "Custom" }],
+      proxyGroupNameOverrides: { auto: "Auto" },
+      toggleProxyGroup: vi.fn(),
+      updateModuleRule: vi.fn(),
+      removeModuleRule: vi.fn(),
+      moveModuleRule: vi.fn(),
+    };
+  });
+
+  it("ignores invalid saves and reports missing targets as conflicts", () => {
+    renderEditing(moduleItem, {
+      path: "geosite/rule-a.mrs",
+      targetValue: "bad",
+      noResolve: false,
+    });
+    clickSave();
+    expect(mocks.store.updateModuleRule).not.toHaveBeenCalled();
+
+    renderEditing(moduleItem, {
+      path: "geosite/rule-a.mrs",
+      targetValue: "module:missing",
+      noResolve: false,
+    });
+    clickSave();
+    expect(mocks.toast).toHaveBeenCalledWith(
+      expect.objectContaining({ title: "规则集已存在", variant: "warning" }),
+    );
+
+    renderEditing(customItem, {
+      path: "geoip/rule-b.mrs",
+      targetValue: "custom:missing",
+      noResolve: false,
+    });
+    clickSave();
+    expect(mocks.toast).toHaveBeenCalledWith(
+      expect.objectContaining({ title: "规则集已存在", variant: "warning" }),
+    );
+
+    renderEditing(moduleItem, {
+      path: "   ",
+      targetValue: "module:auto",
+      noResolve: false,
+    });
+    clickSave();
+    expect(mocks.store.updateModuleRule).not.toHaveBeenCalledWith(
+      "auto",
+      "rule-a",
+      expect.objectContaining({ path: "" }),
+    );
+  });
+});
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.test.ts
index ce2de32..9d89941 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.test.ts
@@ -673,58 +673,4 @@ describe("ProxyGroupsAddedRuleSets", () => {
     expect(stateMock.setters[1]).toHaveBeenCalledWith(null);
   });
 
-  it("ignores invalid saves and reports missing targets as conflicts", () => {
-    renderAdded({
-      0: moduleItem.key,
-      1: { path: "geosite/rule-a.mrs", targetValue: "bad", noResolve: false },
-    });
-    mocks.captures.buttons
-      .find((props: any) => props.title === "保存规则集")
-      .onClick();
-    expect(mocks.store.updateModuleRule).not.toHaveBeenCalled();
-
-    renderAdded({
-      0: moduleItem.key,
-      1: {
-        path: "geosite/rule-a.mrs",
-        targetValue: "module:missing",
-        noResolve: false,
-      },
-    });
-    mocks.captures.buttons
-      .find((props: any) => props.title === "保存规则集")
-      .onClick();
-    expect(mocks.toast).toHaveBeenCalledWith(
-      expect.objectContaining({ title: "规则集已存在", variant: "warning" }),
-    );
-
-    renderAdded({
-      0: customItem.key,
-      1: {
-        path: "geoip/rule-b.mrs",
-        targetValue: "custom:missing",
-        noResolve: false,
-      },
-    });
-    mocks.captures.buttons
-      .find((props: any) => props.title === "保存规则集")
-      .onClick();
-    expect(mocks.toast).toHaveBeenCalledWith(
-      expect.objectContaining({ title: "规则集已存在", variant: "warning" }),
-    );
-
-    renderAdded({
-      0: moduleItem.key,
-      1: { path: "   ", targetValue: "module:auto", noResolve: false },
-    });
-    mocks.captures.buttons
-      .find((props: any) => props.title === "保存规则集")
-      .onClick();
-    expect(mocks.store.updateModuleRule).not.toHaveBeenCalledWith(
-      "auto",
-      "rule-a",
-      expect.objectContaining({ path: "" }),
-    );
-
-  });
 });

From ef47e3928caa9869c750d2f4a0b159b85cdc24c4 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Mon, 13 Jul 2026 20:44:38 +0800
Subject: [PATCH 05/36] fix: keep internal legacy migrations private

---
 packages/core/package.json                    |   1 -
 .../core/src/migrations/legacy-config.test.ts | 179 --------
 packages/core/src/migrations/legacy-config.ts | 396 ------------------
 .../core/src/subscription/config-utils.ts     |   3 +-
 .../templates/config-template.groups.test.ts  |  19 +-
 .../src/templates/config-template.test.ts     |  45 +-
 .../core/src/templates/config-template.ts     |  30 +-
 packages/server-core/src/subscription/crud.ts |   3 +-
 .../home/use-editing-subscription-loader.ts   |   5 +-
 .../config-store/actions/template-actions.ts  |   4 -
 .../ui/src/store/config-store/auth-handoff.ts |   7 +-
 11 files changed, 47 insertions(+), 645 deletions(-)
 delete mode 100644 packages/core/src/migrations/legacy-config.test.ts
 delete mode 100644 packages/core/src/migrations/legacy-config.ts

diff --git a/packages/core/package.json b/packages/core/package.json
index e29f699..85859fb 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -13,7 +13,6 @@
     "./generator/yaml-semantics": "./src/generator/yaml-semantics.ts",
     "./json": "./src/json.ts",
     "./mihomo/*": "./src/mihomo/*.ts",
-    "./migrations/*": "./src/migrations/*.ts",
     "./node-name-template": "./src/node-name-template.ts",
     "./node-identity": "./src/node-identity.ts",
     "./parser": "./src/parser/index.ts",
diff --git a/packages/core/src/migrations/legacy-config.test.ts b/packages/core/src/migrations/legacy-config.test.ts
deleted file mode 100644
index fbf926b..0000000
--- a/packages/core/src/migrations/legacy-config.test.ts
+++ /dev/null
@@ -1,179 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { migrateLegacyConfig } from "./legacy-config";
-
-describe("migrateLegacyConfig", () => {
-  it("keeps current configs unchanged", () => {
-    const config = {
-      customProxyGroups: [],
-      customRuleSets: [],
-      builtinRuleEdits: {},
-    };
-
-    expect(migrateLegacyConfig(config)).toBe(config);
-  });
-
-  it("migrates filtered groups and every supported legacy rule shape", () => {
-    const result = migrateLegacyConfig<Record<string, unknown>>({
-      filteredProxyGroups: [
-        {
-          id: "us-only",
-          name: "US Only",
-          groupType: "url-test",
-          sourceIds: ["airport", "airport"],
-          regions: ["us"],
-          excludedNodeNames: ["Old Node"],
-        },
-      ],
-      customProxyGroups: [
-        {
-          id: "custom-lab",
-          name: "Lab",
-          emoji: "🧪",
-          groupType: "select",
-          rules: [
-            {
-              id: "lab-provider",
-              name: "Lab Provider",
-              path: "geosite/lab.mrs",
-              behavior: "domain",
-            },
-          ],
-        },
-      ],
-      customRules: [
-        { id: "ordinary", type: "DOMAIN", value: "example.com", target: "US Only" },
-        {
-          id: "manual-provider",
-          type: "RULE-SET",
-          value: "geoip/manual.mrs",
-          target: "US Only",
-        },
-      ],
-      customRuleSets: [
-        {
-          id: "existing-provider",
-          name: "Existing",
-          path: "geosite/existing.mrs",
-          behavior: "domain",
-          target: "US Only",
-        },
-      ],
-      builtinRuleEdits: {
-        "module:youtube:youtube": { target: "US Only" },
-      },
-      moduleRuleExclusions: {
-        ai: ["openai", "anthropic"],
-      },
-      moduleRuleOverrides: {
-        google: [
-          {
-            id: "openai",
-            name: "OpenAI",
-            path: "geosite/openai.mrs",
-            behavior: "domain",
-          },
-          {
-            id: "new-provider",
-            name: "New Provider",
-            path: "geoip/new-provider.mrs",
-          },
-        ],
-      },
-      allRulesOrderEditingEnabled: true,
-      dialerProxyGroups: [{ id: "relay", relayNodes: ["US Only"] }],
-      proxyGroupOrder: ["filtered:us-only"],
-      ruleOrder: [
-        "module:ai:openai",
-        "module:google:new-provider",
-        "custom-group:custom-lab:lab-provider",
-        "custom-rule:manual-provider",
-      ],
-    });
-
-    expect(result).not.toHaveProperty("filteredProxyGroups");
-    expect(result).not.toHaveProperty("moduleRuleExclusions");
-    expect(result).not.toHaveProperty("moduleRuleOverrides");
-    expect(result).not.toHaveProperty("allRulesOrderEditingEnabled");
-    expect(result.proxyGroupAdvancedModeEnabled).toBe(true);
-    expect(result.customProxyGroups).toEqual([
-      {
-        id: "custom-lab",
-        name: "Lab",
-        emoji: "🧪",
-        groupType: "select",
-      },
-      expect.objectContaining({
-        id: "migrated-filtered-us-only",
-        name: "US Only",
-        memberSource: "filtered-nodes",
-        groupType: "url-test",
-        advanced: {
-          sourceIds: ["airport"],
-          regions: ["us"],
-          excludedMembers: [{ kind: "node", name: "Old Node" }],
-        },
-      }),
-    ]);
-    expect(result.customRules).toEqual([
-      {
-        id: "ordinary",
-        type: "DOMAIN",
-        value: "example.com",
-        target: { kind: "custom", id: "migrated-filtered-us-only" },
-      },
-    ]);
-    expect(result.customRuleSets).toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({
-          id: "existing-provider",
-          target: { kind: "custom", id: "migrated-filtered-us-only" },
-        }),
-        expect.objectContaining({
-          id: "manual-provider",
-          behavior: "ipcidr",
-          target: { kind: "custom", id: "migrated-filtered-us-only" },
-        }),
-        expect.objectContaining({
-          id: "lab-provider",
-          target: { kind: "custom", id: "custom-lab" },
-        }),
-        expect.objectContaining({
-          id: "new-provider",
-          behavior: "ipcidr",
-          target: { kind: "module", id: "google" },
-        }),
-      ])
-    );
-    expect(result.builtinRuleEdits).toEqual({
-      "module:youtube:youtube": {
-        target: { kind: "custom", id: "migrated-filtered-us-only" },
-      },
-      "module:ai:openai": { target: { kind: "module", id: "google" } },
-      "module:ai:anthropic": { enabled: false },
-    });
-    expect(result.dialerProxyGroups).toEqual([{ id: "relay", relayNodes: ["US Only"] }]);
-    expect(result.proxyGroupOrder).toEqual(["custom:migrated-filtered-us-only"]);
-    expect(result.ruleOrder).toEqual([
-      "module:ai:openai",
-      "custom-rule-set:new-provider",
-      "custom-rule-set:lab-provider",
-      "custom-rule-set:manual-provider",
-    ]);
-  });
-
-  it("lets current builtin edits win when old and new fields overlap", () => {
-    const result = migrateLegacyConfig({
-      moduleRuleExclusions: { ai: ["openai"] },
-      builtinRuleEdits: {
-        "module:ai:openai": { target: { kind: "module", id: "select" } },
-      },
-    });
-
-    expect(result.builtinRuleEdits).toEqual({
-      "module:ai:openai": {
-        enabled: false,
-        target: { kind: "module", id: "select" },
-      },
-    });
-  });
-});
diff --git a/packages/core/src/migrations/legacy-config.ts b/packages/core/src/migrations/legacy-config.ts
deleted file mode 100644
index 9513f3f..0000000
--- a/packages/core/src/migrations/legacy-config.ts
+++ /dev/null
@@ -1,396 +0,0 @@
-import { PROXY_GROUP_MODULES } from "@subboost/core/generator/proxy-group-modules";
-import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
-import { normalizeProxyGroupTargetRef } from "@subboost/core/proxy-group-targets";
-import {
-  isValidRuleSetPathOrUrl,
-  normalizeRuleSetPathInput,
-} from "@subboost/core/rules/rule-model";
-import type {
-  CustomRuleSet,
-  ProxyGroupAdvancedConfig,
-  ProxyGroupRuleTarget,
-  RuleSetBehavior,
-} from "@subboost/core/types/config";
-
-type MutableRecord = Record<string, unknown>;
-
-const LEGACY_GROUP_TYPES = new Set([
-  "select",
-  "url-test",
-  "fallback",
-  "load-balance",
-  "direct-first",
-  "reject-first",
-]);
-const BUILTIN_MODULE_IDS = new Set(PROXY_GROUP_MODULES.map((module) => module.id));
-const BUILTIN_RULE_SOURCE_BY_ID = new Map(
-  PROXY_GROUP_MODULES.flatMap((module) => module.rules.map((rule) => [rule.id, module.id] as const))
-);
-
-function isRecord(value: unknown): value is MutableRecord {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
-function hasOwn(value: MutableRecord, key: string): boolean {
-  return Object.prototype.hasOwnProperty.call(value, key);
-}
-
-function stringValue(value: unknown): string {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-function uniqueStringArray(value: unknown): string[] {
-  if (!Array.isArray(value)) return [];
-  const out: string[] = [];
-  const seen = new Set<string>();
-  for (const item of value) {
-    const text = stringValue(item);
-    if (!text || seen.has(text)) continue;
-    seen.add(text);
-    out.push(text);
-  }
-  return out;
-}
-
-function makeUniqueValue(base: string, used: Set<string>, fallback: string): string {
-  const normalized = base.trim() || fallback;
-  if (!used.has(normalized)) {
-    used.add(normalized);
-    return normalized;
-  }
-  let index = 2;
-  let candidate = `${normalized}-${index}`;
-  while (used.has(candidate)) {
-    index += 1;
-    candidate = `${normalized}-${index}`;
-  }
-  used.add(candidate);
-  return candidate;
-}
-
-function makeUniqueName(base: string, used: Set<string>): string {
-  const normalized = base.trim() || "自定义代理组";
-  if (!used.has(normalized)) {
-    used.add(normalized);
-    return normalized;
-  }
-  let index = 2;
-  let candidate = `${normalized} (${index})`;
-  while (used.has(candidate)) {
-    index += 1;
-    candidate = `${normalized} (${index})`;
-  }
-  used.add(candidate);
-  return candidate;
-}
-
-function migrateFilteredAdvanced(group: MutableRecord): ProxyGroupAdvancedConfig {
-  return normalizeProxyGroupAdvancedConfig({
-    sourceIds: uniqueStringArray(group.sourceIds),
-    regions: uniqueStringArray(group.regions),
-    includeRegex: stringValue(group.includeRegex),
-    excludeRegex: stringValue(group.excludeRegex),
-    excludedMembers: uniqueStringArray(group.excludedNodeNames).map((name) => ({
-      kind: "node" as const,
-      name,
-    })),
-  });
-}
-
-function retargetRuleTarget(
-  value: unknown,
-  nameMap: Map<string, { id: string; name: string }>,
-  idMap: Map<string, { id: string; name: string }>
-): unknown {
-  const ref = normalizeProxyGroupTargetRef(value);
-  if (ref?.kind === "custom" && idMap.has(ref.id)) {
-    return { kind: "custom" as const, id: idMap.get(ref.id)!.id };
-  }
-  const text = stringValue(value);
-  const migrated = text ? nameMap.get(text) : undefined;
-  return migrated ? { kind: "custom" as const, id: migrated.id } : value;
-}
-
-function retargetStringArray(value: unknown, nameMap: Map<string, { id: string; name: string }>): unknown {
-  if (!Array.isArray(value)) return value;
-  return value.map((item) => {
-    if (typeof item !== "string") return item;
-    return nameMap.get(item.trim())?.name ?? item;
-  });
-}
-
-function migrateFilteredProxyGroups(record: MutableRecord): MutableRecord {
-  if (!hasOwn(record, "filteredProxyGroups")) return record;
-
-  const next = { ...record };
-  const existingCustomGroups = Array.isArray(next.customProxyGroups) ? [...next.customProxyGroups] : [];
-  const validExistingGroups = existingCustomGroups.filter(isRecord);
-  const usedIds = new Set(validExistingGroups.map((group) => stringValue(group.id)).filter(Boolean));
-  const usedNames = new Set(validExistingGroups.map((group) => stringValue(group.name)).filter(Boolean));
-  const nameMap = new Map<string, { id: string; name: string }>();
-  const idMap = new Map<string, { id: string; name: string }>();
-  const migratedGroups: MutableRecord[] = [];
-
-  if (Array.isArray(record.filteredProxyGroups)) {
-    for (const rawGroup of record.filteredProxyGroups) {
-      if (!isRecord(rawGroup) || rawGroup.enabled === false) continue;
-      const oldId = stringValue(rawGroup.id);
-      const oldName = stringValue(rawGroup.name);
-      if (!oldId || !oldName) continue;
-
-      const id = makeUniqueValue(`migrated-filtered-${oldId}`, usedIds, "migrated-filtered-group");
-      const name = makeUniqueName(oldName, usedNames);
-      const mapped = { id, name };
-      idMap.set(oldId, mapped);
-      nameMap.set(oldName, mapped);
-
-      const rawGroupType = stringValue(rawGroup.groupType) || "select";
-      const groupType = LEGACY_GROUP_TYPES.has(rawGroupType) ? rawGroupType : "select";
-      migratedGroups.push({
-        id,
-        name,
-        emoji: stringValue(rawGroup.emoji),
-        description: "自定义代理组",
-        memberSource: "filtered-nodes",
-        groupType,
-        ...(groupType === "load-balance" && stringValue(rawGroup.strategy)
-          ? { strategy: stringValue(rawGroup.strategy) }
-          : {}),
-        advanced: migrateFilteredAdvanced(rawGroup),
-      });
-    }
-  }
-
-  next.customProxyGroups = [...existingCustomGroups, ...migratedGroups];
-  if (migratedGroups.length > 0) next.proxyGroupAdvancedModeEnabled = true;
-  delete next.filteredProxyGroups;
-
-  if (Array.isArray(next.customRules)) {
-    next.customRules = next.customRules.map((rule) =>
-      isRecord(rule) && hasOwn(rule, "target")
-        ? { ...rule, target: retargetRuleTarget(rule.target, nameMap, idMap) }
-        : rule
-    );
-  }
-  if (Array.isArray(next.customRuleSets)) {
-    next.customRuleSets = next.customRuleSets.map((ruleSet) =>
-      isRecord(ruleSet) && hasOwn(ruleSet, "target")
-        ? { ...ruleSet, target: retargetRuleTarget(ruleSet.target, nameMap, idMap) }
-        : ruleSet
-    );
-  }
-  if (isRecord(next.builtinRuleEdits)) {
-    next.builtinRuleEdits = Object.fromEntries(
-      Object.entries(next.builtinRuleEdits).map(([key, edit]) => [
-        key,
-        isRecord(edit) && hasOwn(edit, "target")
-          ? { ...edit, target: retargetRuleTarget(edit.target, nameMap, idMap) }
-          : edit,
-      ])
-    );
-  }
-  if (Array.isArray(next.dialerProxyGroups)) {
-    next.dialerProxyGroups = next.dialerProxyGroups.map((group) =>
-      isRecord(group) && hasOwn(group, "relayNodes")
-        ? { ...group, relayNodes: retargetStringArray(group.relayNodes, nameMap) }
-        : group
-    );
-  }
-  if (Array.isArray(next.proxyGroupOrder)) {
-    next.proxyGroupOrder = next.proxyGroupOrder.map((key) => {
-      const text = stringValue(key);
-      if (!text.startsWith("filtered:")) return key;
-      const mapped = idMap.get(text.slice("filtered:".length));
-      return mapped ? `custom:${mapped.id}` : key;
-    });
-  }
-
-  return next;
-}
-
-type LegacyRuleProvider = Omit<CustomRuleSet, "target"> & { legacyIndex: number };
-
-function normalizeBehavior(value: unknown, path: string): RuleSetBehavior | null {
-  if (value === "domain" || value === "ipcidr") return value;
-  if (path.toLowerCase().startsWith("geoip/")) return "ipcidr";
-  if (path.toLowerCase().startsWith("geosite/")) return "domain";
-  return null;
-}
-
-function parseLegacyRuleProvider(
-  value: unknown,
-  legacyIndex: number,
-  pathFields: string[] = ["path"]
-): LegacyRuleProvider | null {
-  if (!isRecord(value)) return null;
-  const id = stringValue(value.id);
-  let rawPath = "";
-  for (const field of pathFields) {
-    rawPath = stringValue(value[field]);
-    if (rawPath) break;
-  }
-  const path = normalizeRuleSetPathInput(rawPath);
-  const behavior = normalizeBehavior(value.behavior, path);
-  if (!id || !behavior || !path || !isValidRuleSetPathOrUrl(path)) return null;
-  const noResolve = typeof value.noResolve === "boolean" ? value.noResolve : behavior === "ipcidr";
-  return {
-    id,
-    name: stringValue(value.name) || id,
-    behavior,
-    path,
-    ...(noResolve ? { noResolve: true } : {}),
-    legacyIndex,
-  };
-}
-
-function parseLegacyOverrides(value: unknown): Record<string, LegacyRuleProvider[]> {
-  if (!isRecord(value)) return {};
-  const out: Record<string, LegacyRuleProvider[]> = {};
-  for (const [rawModuleId, rawRules] of Object.entries(value)) {
-    const moduleId = rawModuleId.trim();
-    if (!moduleId || !Array.isArray(rawRules)) continue;
-    const rules = rawRules
-      .map((rule, index) => parseLegacyRuleProvider(rule, index))
-      .filter((rule): rule is LegacyRuleProvider => Boolean(rule));
-    if (rules.length > 0) out[moduleId] = rules;
-  }
-  return out;
-}
-
-function moduleRuleKey(moduleId: string, ruleId: string): string {
-  return `module:${moduleId}:${ruleId}`;
-}
-
-function targetForModule(moduleId: string, config: MutableRecord): ProxyGroupRuleTarget {
-  if (BUILTIN_MODULE_IDS.has(moduleId)) return { kind: "module", id: moduleId };
-  const overrides = isRecord(config.proxyGroupNameOverrides) ? config.proxyGroupNameOverrides : {};
-  return stringValue(overrides[moduleId]) || moduleId;
-}
-
-function addUniqueRuleSet(ruleSets: unknown[], ruleSet: CustomRuleSet): string {
-  const existing = new Set(
-    ruleSets.filter(isRecord).map((item) => stringValue(item.id)).filter(Boolean)
-  );
-  const id = makeUniqueValue(ruleSet.id, existing, "migrated-rule-set");
-  ruleSets.push(id === ruleSet.id ? ruleSet : { ...ruleSet, id });
-  return id;
-}
-
-function migrateLegacyRuleFields(record: MutableRecord): MutableRecord {
-  const groupsHaveLegacyRules = Array.isArray(record.customProxyGroups)
-    && record.customProxyGroups.some((group) => isRecord(group) && hasOwn(group, "rules"));
-  const customRulesHaveRuleSet = Array.isArray(record.customRules)
-    && record.customRules.some((rule) => isRecord(rule) && rule.type === "RULE-SET");
-  const hasLegacyFields = hasOwn(record, "moduleRuleOverrides")
-    || hasOwn(record, "moduleRuleExclusions")
-    || hasOwn(record, "allRulesOrderEditingEnabled")
-    || groupsHaveLegacyRules
-    || customRulesHaveRuleSet;
-  if (!hasLegacyFields) return record;
-
-  const next = { ...record };
-  const ruleSets = Array.isArray(record.customRuleSets) ? [...record.customRuleSets] : [];
-  const edits: MutableRecord = isRecord(record.builtinRuleEdits) ? { ...record.builtinRuleEdits } : {};
-  const orderMoves = new Map<string, string | null>();
-
-  if (Array.isArray(record.customRules)) {
-    const rules: unknown[] = [];
-    record.customRules.forEach((rule, index) => {
-      if (!isRecord(rule) || rule.type !== "RULE-SET") {
-        rules.push(rule);
-        return;
-      }
-      const parsed = parseLegacyRuleProvider(rule, index, ["value", "path"]);
-      const target = normalizeProxyGroupTargetRef(rule.target) ?? stringValue(rule.target);
-      if (!parsed || !target) {
-        rules.push(rule);
-        return;
-      }
-      const { legacyIndex: _legacyIndex, ...provider } = parsed;
-      const id = addUniqueRuleSet(ruleSets, { ...provider, target });
-      orderMoves.set(`custom-rule:${parsed.id}`, `custom-rule-set:${id}`);
-    });
-    next.customRules = rules;
-  }
-
-  if (Array.isArray(record.customProxyGroups)) {
-    next.customProxyGroups = record.customProxyGroups.map((group) => {
-      if (!isRecord(group) || !hasOwn(group, "rules")) return group;
-      const { rules, ...rest } = group;
-      const target = stringValue(group.id)
-        ? { kind: "custom" as const, id: stringValue(group.id) }
-        : stringValue(group.name);
-      if (Array.isArray(rules) && target) {
-        rules.forEach((rule, index) => {
-          const parsed = parseLegacyRuleProvider(rule, index, ["path", "url"]);
-          if (!parsed) return;
-          const { legacyIndex: _legacyIndex, ...provider } = parsed;
-          const id = addUniqueRuleSet(ruleSets, { ...provider, target });
-          orderMoves.set(`custom-group:${stringValue(group.id)}:${parsed.id}`, `custom-rule-set:${id}`);
-        });
-      }
-      return rest;
-    });
-  }
-
-  const overrides = parseLegacyOverrides(record.moduleRuleOverrides);
-  const consumedOverrides = new Set<string>();
-  if (isRecord(record.moduleRuleExclusions)) {
-    for (const [rawSourceId, rawRuleIds] of Object.entries(record.moduleRuleExclusions)) {
-      const sourceId = rawSourceId.trim();
-      if (!sourceId || !Array.isArray(rawRuleIds)) continue;
-      for (const ruleId of uniqueStringArray(rawRuleIds)) {
-        const canonicalSourceId = BUILTIN_RULE_SOURCE_BY_ID.get(ruleId) ?? sourceId;
-        const key = moduleRuleKey(canonicalSourceId, ruleId);
-        let legacyEdit: MutableRecord = { enabled: false };
-        for (const [targetModuleId, rules] of Object.entries(overrides)) {
-          const moved = rules.find((rule) => rule.id === ruleId);
-          if (!moved) continue;
-          legacyEdit = { target: targetForModule(targetModuleId, record) };
-          consumedOverrides.add(`${targetModuleId}:${moved.legacyIndex}`);
-          break;
-        }
-        edits[key] = isRecord(edits[key]) ? { ...legacyEdit, ...edits[key] } : legacyEdit;
-      }
-    }
-  }
-
-  for (const [targetModuleId, rules] of Object.entries(overrides)) {
-    const target = targetForModule(targetModuleId, record);
-    for (const rule of rules) {
-      if (consumedOverrides.has(`${targetModuleId}:${rule.legacyIndex}`)) continue;
-      const sourceId = BUILTIN_RULE_SOURCE_BY_ID.get(rule.id);
-      if (sourceId === targetModuleId) continue;
-      const { legacyIndex: _legacyIndex, ...provider } = rule;
-      const id = addUniqueRuleSet(ruleSets, { ...provider, target });
-      orderMoves.set(moduleRuleKey(targetModuleId, rule.id), `custom-rule-set:${id}`);
-    }
-  }
-
-  if (Array.isArray(record.ruleOrder)) {
-    next.ruleOrder = record.ruleOrder.flatMap((item) => {
-      if (typeof item !== "string") return [];
-      if (orderMoves.has(item)) {
-        const moved = orderMoves.get(item);
-        return moved ? [moved] : [];
-      }
-      return item.startsWith("custom-group:") ? [] : [item];
-    });
-  }
-
-  delete next.moduleRuleOverrides;
-  delete next.moduleRuleExclusions;
-  delete next.allRulesOrderEditingEnabled;
-  next.customRuleSets = ruleSets;
-  next.builtinRuleEdits = edits;
-  return next;
-}
-
-/**
- * Converts accepted pre-v3 configuration fields at trust-boundary entry points.
- * Runtime state and newly persisted data must only use the current rule model.
- */
-export function migrateLegacyConfig<T>(config: T): T {
-  if (!isRecord(config)) return config;
-  return migrateLegacyRuleFields(migrateFilteredProxyGroups(config)) as T;
-}
diff --git a/packages/core/src/subscription/config-utils.ts b/packages/core/src/subscription/config-utils.ts
index 9e64c25..09d4517 100644
--- a/packages/core/src/subscription/config-utils.ts
+++ b/packages/core/src/subscription/config-utils.ts
@@ -19,7 +19,6 @@ import { DEFAULT_SUBBOOST_CONFIG } from "@subboost/core/config/defaults";
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
 import { normalizeProxyGroupTargetRef } from "@subboost/core/proxy-group-targets";
-import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -236,7 +235,7 @@ export function buildGenerateOptionsFromConfig(
     proxyProviders?: Record<string, unknown>;
   }
 ): GenerateOptions {
-  const config = migrateLegacyConfig(rawConfig);
+  const config = rawConfig;
   const { testUrl, testInterval } = getEffectiveTestOptions(config);
   const proxyProviders =
     opts.proxyProviders ?? buildProxyProvidersFromConfig(config, { testUrl, testInterval });
diff --git a/packages/core/src/templates/config-template.groups.test.ts b/packages/core/src/templates/config-template.groups.test.ts
index 8292a7e..b581430 100644
--- a/packages/core/src/templates/config-template.groups.test.ts
+++ b/packages/core/src/templates/config-template.groups.test.ts
@@ -188,8 +188,8 @@ describe("validateSubBoostTemplateConfig custom groups", () => {
       "customProxyGroups.includeInGroupMembers 必须是布尔值"
     );
 
-    const migratedLegacyGroup = validateSubBoostTemplateConfig(
-      validConfig({
+    expectInvalid(
+      {
         customProxyGroups: [
           {
             id: "legacy",
@@ -199,12 +199,9 @@ describe("validateSubBoostTemplateConfig custom groups", () => {
             rules: [],
           } as never,
         ],
-      })
+      },
+      "模板配置包含已移除字段: customProxyGroups[0].rules"
     );
-    expect(migratedLegacyGroup.ok).toBe(true);
-    if (migratedLegacyGroup.ok) {
-      expect(migratedLegacyGroup.config.customProxyGroups[0]).not.toHaveProperty("rules");
-    }
 
     const validCustomGroup = validateSubBoostTemplateConfig(
       validConfig({
@@ -256,12 +253,6 @@ describe("validateSubBoostTemplateConfig custom groups", () => {
     }
 
     const removedField = `filtered${"ProxyGroups"}`;
-    const migratedEmptyFilteredGroups = validateSubBoostTemplateConfig(
-      validConfig({ [removedField]: [] } as never)
-    );
-    expect(migratedEmptyFilteredGroups.ok).toBe(true);
-    if (migratedEmptyFilteredGroups.ok) {
-      expect(migratedEmptyFilteredGroups.config).not.toHaveProperty(removedField);
-    }
+    expectInvalid({ [removedField]: [] } as never, `模板配置包含已移除字段: ${removedField}`);
   });
 });
diff --git a/packages/core/src/templates/config-template.test.ts b/packages/core/src/templates/config-template.test.ts
index 8231e27..6bb4603 100644
--- a/packages/core/src/templates/config-template.test.ts
+++ b/packages/core/src/templates/config-template.test.ts
@@ -196,40 +196,19 @@ describe("validateSubBoostTemplateConfig", () => {
     expect(result.config).not.toHaveProperty("experimentalCnUseCnRuleSet");
   });
 
-  it("migrates removed rule-model compatibility fields at the template boundary", () => {
-    const result = validateSubBoostTemplateConfig(
-      validConfig({
-        moduleRuleExclusions: { ai: ["openai"] },
-        allRulesOrderEditingEnabled: true,
-        customProxyGroups: [
-          {
-            id: "custom",
-            name: "Custom",
-            emoji: "",
-            groupType: "select",
-            rules: [
-              {
-                id: "legacy-provider",
-                name: "Legacy Provider",
-                path: "geosite/legacy.mrs",
-                behavior: "domain",
-              },
-            ],
-          },
-        ],
-      } as never)
+  it("rejects removed rule-model compatibility fields", () => {
+    expectInvalid({ moduleRuleOverrides: {} } as never, "模板配置包含已移除字段: moduleRuleOverrides");
+    expectInvalid({ moduleRuleExclusions: {} } as never, "模板配置包含已移除字段: moduleRuleExclusions");
+    expectInvalid({ allRulesOrderEditingEnabled: true } as never, "模板配置包含已移除字段: allRulesOrderEditingEnabled");
+    const removedFilteredGroupsField = `filtered${"ProxyGroups"}`;
+    expectInvalid(
+      { [removedFilteredGroupsField]: [] } as never,
+      `模板配置包含已移除字段: ${removedFilteredGroupsField}`
+    );
+    expectInvalid(
+      { customProxyGroups: [{ id: "custom", name: "Custom", emoji: "", groupType: "select", rules: [] }] } as never,
+      "模板配置包含已移除字段: customProxyGroups[0].rules"
     );
-
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    expect(result.config.builtinRuleEdits?.["module:ai:openai"]).toEqual({ enabled: false });
-    expect(result.config.customRuleSets).toEqual([
-      expect.objectContaining({
-        id: "legacy-provider",
-        target: { kind: "custom", id: "custom" },
-      }),
-    ]);
-    expect(result.config.customProxyGroups[0]).not.toHaveProperty("rules");
   });
 
   it("rejects template configs that hide every enabled module", () => {
diff --git a/packages/core/src/templates/config-template.ts b/packages/core/src/templates/config-template.ts
index 471597a..17547d3 100644
--- a/packages/core/src/templates/config-template.ts
+++ b/packages/core/src/templates/config-template.ts
@@ -4,7 +4,6 @@ import { ensureCustomRuleId, isCustomRuleType } from "@subboost/core/rules/custo
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
 import { normalizeProxyGroupTargetRef } from "@subboost/core/proxy-group-targets";
-import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 import {
   isValidRuleSetPathOrUrl,
   normalizeRuleModelFromConfig,
@@ -33,13 +32,20 @@ const BUILTIN_MODULE_IDS = new Set(PROXY_GROUP_MODULES.map((module) => module.id
 const BUILTIN_RULE_KEYS = new Set(
   PROXY_GROUP_MODULES.flatMap((module) => module.rules.map((rule) => `module:${module.id}:${rule.id}`))
 );
-export function validateSubBoostTemplateConfig(rawValue: unknown): ValidationResult {
-  const migratedValue = migrateLegacyConfig(rawValue);
-  if (!isRecord(migratedValue)) return invalid("模板配置必须是对象");
-  const value = migratedValue;
+const REMOVED_TEMPLATE_FIELDS = new Set([
+  "moduleRuleOverrides",
+  "moduleRuleExclusions",
+  "allRulesOrderEditingEnabled",
+  "filteredProxyGroups",
+]);
+
+export function validateSubBoostTemplateConfig(value: unknown): ValidationResult {
+  if (!isRecord(value)) return invalid("模板配置必须是对象");
   if (value.schema !== SUBBOOST_TEMPLATE_CONFIG_SCHEMA) {
     return invalid("模板配置 schema 无效");
   }
+  const removedField = findRemovedTemplateField(value);
+  if (removedField) return invalid(`模板配置包含已移除字段: ${removedField}`);
 
   const template = parseTemplateType(value.template);
   if (!template) return invalid("模板类型无效");
@@ -151,6 +157,20 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
+function findRemovedTemplateField(value: Record<string, unknown>): string | null {
+  for (const field of REMOVED_TEMPLATE_FIELDS) {
+    if (field in value) return field;
+  }
+
+  if (!Array.isArray(value.customProxyGroups)) return null;
+  for (let index = 0; index < value.customProxyGroups.length; index += 1) {
+    const group = value.customProxyGroups[index];
+    if (isRecord(group) && "rules" in group) return `customProxyGroups[${index}].rules`;
+  }
+
+  return null;
+}
+
 function parseTemplateType(value: unknown): TemplateType | null {
   if (value === "minimal" || value === "standard" || value === "full") return value;
   return null;
diff --git a/packages/server-core/src/subscription/crud.ts b/packages/server-core/src/subscription/crud.ts
index 874182c..142c19c 100644
--- a/packages/server-core/src/subscription/crud.ts
+++ b/packages/server-core/src/subscription/crud.ts
@@ -5,7 +5,6 @@ import type { ParsedNode } from "@subboost/core/types/node";
 import { resolveSubscriptionAutoUpdateState, type SubscriptionAutoUpdateStateFields } from "./auto-update-state";
 import { normalizeSavedSourcesForPersistence, type NormalizeSavedSourcesForPersistenceOptions } from "./saved-sources";
 import { resolveSmartNodeMatchingEnabled } from "./refresh-node-snapshot";
-import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 
 export type SubscriptionConfigInput = {
   config?: unknown;
@@ -115,7 +114,7 @@ export function normalizeSubscriptionConfigForPersistence(
     baseConfig.smartNodeMatchingEnabled = options.defaultSmartNodeMatchingEnabled;
   }
 
-  return migrateLegacyConfig(baseConfig);
+  return baseConfig;
 }
 
 export function serializeSubscriptionAutoUpdateState(
diff --git a/packages/ui/src/product/home/use-editing-subscription-loader.ts b/packages/ui/src/product/home/use-editing-subscription-loader.ts
index 81aafe3..5a615c7 100644
--- a/packages/ui/src/product/home/use-editing-subscription-loader.ts
+++ b/packages/ui/src/product/home/use-editing-subscription-loader.ts
@@ -9,7 +9,6 @@ import { ensureCustomRulesHaveIds } from "@subboost/core/rules/custom-rule-utils
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
 import { normalizeProxyGroupAdvancedConfig } from "@subboost/core/proxy-group-advanced";
-import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 import { tryNormalizeSubscriptionUrlInput } from "@subboost/core/subscription/url-input";
 import {
   hasSubscriptionUserInfo,
@@ -77,9 +76,7 @@ export function useEditingSubscriptionLoader({
           }
           return out;
         })();
-        const cfg = migrateLegacyConfig(
-          sub.config && typeof sub.config === "object" ? (sub.config as Record<string, unknown>) : {}
-        );
+        const cfg = sub.config && typeof sub.config === "object" ? (sub.config as Record<string, unknown>) : {};
         const subscriptionInfoFromRecord = normalizeSubscriptionUserInfo((sub as any).subscriptionInfo);
         const hasSubscriptionInfoFromRecord = hasSubscriptionUserInfo(subscriptionInfoFromRecord);
         const deletedNodesFromCfg = Array.isArray((cfg as any).deletedNodes)
diff --git a/packages/ui/src/store/config-store/actions/template-actions.ts b/packages/ui/src/store/config-store/actions/template-actions.ts
index d0d1781..f01aab6 100644
--- a/packages/ui/src/store/config-store/actions/template-actions.ts
+++ b/packages/ui/src/store/config-store/actions/template-actions.ts
@@ -5,7 +5,6 @@ import { normalizePersistedRuleOrder } from "@subboost/core/generator/rules";
 import { PROXY_GROUP_MODULES } from "@subboost/core/generator/proxy-groups";
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
-import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 import type { ConfigActions, SubBoostTemplateConfig } from "../definitions";
 import type { GetState, SetAndGenerateConfig, SetState } from "../store-types";
 
@@ -80,10 +79,7 @@ export function createTemplateActions(
     // 应用模板配置（从模板库应用）
     applyTemplateConfig: (config: SubBoostTemplateConfig) => {
       if (!config || typeof config !== "object") return;
-      const migratedConfig = migrateLegacyConfig(config) as SubBoostTemplateConfig;
-
       setAndGenerateConfig((state) => {
-        const config = migratedConfig;
         const ruleModel = normalizeRuleModelFromConfig(config);
         const hasCustomProxyGroups = Array.isArray(config.customProxyGroups);
         const hasCustomRuleSets = Array.isArray(config.customRuleSets);
diff --git a/packages/ui/src/store/config-store/auth-handoff.ts b/packages/ui/src/store/config-store/auth-handoff.ts
index f1585c8..79cee51 100644
--- a/packages/ui/src/store/config-store/auth-handoff.ts
+++ b/packages/ui/src/store/config-store/auth-handoff.ts
@@ -3,7 +3,6 @@ import { initialState } from "./definitions";
 import { safeParseJsonObject } from "@subboost/core/json";
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
-import { migrateLegacyConfig } from "@subboost/core/migrations/legacy-config";
 
 export const AUTH_CONFIG_HANDOFF_STORAGE_NAME = "subboost-auth-config-handoff";
 
@@ -172,10 +171,8 @@ function buildHandoffState(state: ConfigState): Partial<ConfigState> {
   };
 }
 
-function normalizeHandoffState(rawValue: unknown): Partial<ConfigState> | null {
-  const migratedRaw = migrateLegacyConfig(rawValue);
-  if (!isRecord(migratedRaw)) return null;
-  const raw = migratedRaw;
+function normalizeHandoffState(raw: unknown): Partial<ConfigState> | null {
+  if (!isRecord(raw)) return null;
   const out: Partial<ConfigState> = {};
 
   const sources = sourceArray(raw.sources);

From 7857ad9b9840b60ef09401da8d70c09ed75f2e88 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Mon, 13 Jul 2026 21:35:56 +0800
Subject: [PATCH 06/36] test: detach self-host shell probes from terminals

---
 local/scripts/selfhost-shell.test.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/local/scripts/selfhost-shell.test.ts b/local/scripts/selfhost-shell.test.ts
index 3895239..dd0b9f2 100644
--- a/local/scripts/selfhost-shell.test.ts
+++ b/local/scripts/selfhost-shell.test.ts
@@ -3,8 +3,7 @@ import { spawnSync } from "node:child_process";
 import { describe, expect, it } from "vitest";
 
 const publicRoot = path.resolve(__dirname, "../..");
-const BASH_NON_INTERACTIVE_COMMAND =
-  "if command -v setsid >/dev/null 2>&1; then exec setsid \"$BASH\" -s; fi; exec \"$BASH\" -s";
+const BASH_NON_INTERACTIVE_COMMAND = "exec \"$BASH\" -s";
 
 function runBash(script: string) {
   return spawnSync("bash", ["-lc", BASH_NON_INTERACTIVE_COMMAND], {
@@ -12,6 +11,7 @@ function runBash(script: string) {
     encoding: "utf8",
     input: script,
     timeout: 30_000,
+    detached: true,
     env: {
       ...process.env,
       LC_ALL: "C.UTF-8",

From a615bdc4ea25ba92bf7ee0e89296c32ec2985754 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Mon, 13 Jul 2026 22:00:17 +0800
Subject: [PATCH 07/36] docs: clarify subscription bearer responsibility

---
 README-CN.md                                  |  2 +-
 README.md                                     |  2 +-
 .../readme-security-contract.test.ts          | 20 +++++++++++++++++++
 .../home/subscription-link-dialog.test.ts     |  3 +++
 .../product/home/subscription-link-dialog.tsx |  5 ++---
 5 files changed, 27 insertions(+), 5 deletions(-)
 create mode 100644 packages/core/src/subscription/readme-security-contract.test.ts

diff --git a/README-CN.md b/README-CN.md
index ce6b202..e48e4b6 100644
--- a/README-CN.md
+++ b/README-CN.md
@@ -43,7 +43,7 @@
 
 完整的订阅链接及其中的 token 属于“持有者即可使用”的访问凭证。任何拿到完整链接的人，都可能读取对应的生成配置并使用该订阅。请像保管密码一样保管它，不要把完整链接放进公开仓库、Issue、聊天记录、截图或日志；怀疑泄漏时，应立即删除并重新创建相应订阅，以更换 token。
 
-通过该 token 发起的请求会按订阅所属用户计入访问和风控记录。这是预期的权限模型，因此订阅所有者有责任避免完整链接泄漏。
+通过该 token 发起的所有请求（包括匿名请求和第三方客户端请求）都会按订阅所属用户计入访问和风控记录；反复触发限流可能临时封禁订阅所有者的账号。这是预期的权限模型。请勿公开完整链接或把它交给不受信任的第三方；即使主动在受信任客户端或与受信任的人使用，相关请求和滥用风险仍由订阅所有者承担。
 
 ## 开发说明
 
diff --git a/README.md b/README.md
index f1f1d2c..b60f9cb 100644
--- a/README.md
+++ b/README.md
@@ -43,7 +43,7 @@
 
 A complete subscription URL and its token are bearer credentials: anyone who obtains the full URL may read the generated configuration and use that subscription. Protect it like a password. Never place the complete URL in public repositories, issues, chat messages, screenshots, or logs. If exposure is suspected, delete and recreate the affected subscription to issue a new token.
 
-Requests made with a token are attributed to the user who owns the subscription for access controls and abuse prevention. This is the intended authorization model, so subscription owners are responsible for keeping complete subscription URLs confidential.
+Every request made with a token, including anonymous requests and requests from third-party clients, is attributed to the subscription owner for access controls and abuse prevention. Repeated rate-limit violations may temporarily ban the owner's account. This is the intended authorization model. Do not publish a complete URL or give it to an untrusted third party; even when using it in a trusted client or with a trusted person, the owner remains responsible for the resulting traffic and abuse risk.
 
 ## Development Notes
 
diff --git a/packages/core/src/subscription/readme-security-contract.test.ts b/packages/core/src/subscription/readme-security-contract.test.ts
new file mode 100644
index 0000000..99c53f1
--- /dev/null
+++ b/packages/core/src/subscription/readme-security-contract.test.ts
@@ -0,0 +1,20 @@
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const publicRoot = fileURLToPath(new URL("../../../..", import.meta.url));
+
+describe("public subscription bearer credential guidance", () => {
+  it("warns in both READMEs that token traffic belongs to the owner and may temporarily ban the owner", () => {
+    const chinese = fs.readFileSync(`${publicRoot}/README-CN.md`, "utf8");
+    const english = fs.readFileSync(`${publicRoot}/README.md`, "utf8");
+
+    expect(chinese).toContain("持有者即可使用");
+    expect(chinese).toContain("匿名请求和第三方客户端请求");
+    expect(chinese).toContain("临时封禁订阅所有者");
+
+    expect(english).toContain("bearer credentials");
+    expect(english).toContain("anonymous requests and requests from third-party clients");
+    expect(english).toContain("temporarily ban the owner's account");
+  });
+});
diff --git a/packages/ui/src/product/home/subscription-link-dialog.test.ts b/packages/ui/src/product/home/subscription-link-dialog.test.ts
index 2e1ac64..258fd98 100644
--- a/packages/ui/src/product/home/subscription-link-dialog.test.ts
+++ b/packages/ui/src/product/home/subscription-link-dialog.test.ts
@@ -140,6 +140,9 @@ describe("SubscriptionLinkDialog", () => {
     expect(html).toContain("启用自动更新");
     expect(html).toContain("自动更新间隔");
     expect(html).toContain("注意事项");
+    expect(html).toContain("完整订阅链接是持有者凭证");
+    expect(html).toContain("所有请求均归属您的账号");
+    expect(html).toContain("反复触发限流会临时封禁账号");
     expect(captures.inputs[0]).toMatchObject({ value: "我的配置", maxLength: 100 });
     expect(captures.inputs[1]).toMatchObject({ type: "number", min: 12, step: 1, value: 8 });
     expect(captures.switches).toHaveLength(2);
diff --git a/packages/ui/src/product/home/subscription-link-dialog.tsx b/packages/ui/src/product/home/subscription-link-dialog.tsx
index 007cb0e..8b4da95 100644
--- a/packages/ui/src/product/home/subscription-link-dialog.tsx
+++ b/packages/ui/src/product/home/subscription-link-dialog.tsx
@@ -133,8 +133,8 @@ export function SubscriptionLinkDialog({
               <p className="font-medium mb-1">注意事项</p>
               <ul className="text-xs text-amber-200/70 space-y-1">
                 <li>🔒 配置数据将加密存储于服务器</li>
-                <li>🔑 订阅链接相当于访问凭证，请勿公开分享</li>
-                <li>⏱️ 客户端高频拉取订阅会被封禁，请合理配置</li>
+                <li>🔑 完整订阅链接是持有者凭证，仅在自己控制或信任的客户端中使用</li>
+                <li>⏱️ 所有请求均归属您的账号；反复触发限流会临时封禁账号</li>
                 {isEditingExistingSubscription ? (
                   <>
                     <li>⚠️ 更新将覆盖原订阅配置与订阅源</li>
@@ -204,4 +204,3 @@ export function SubscriptionLinkDialog({
     </Dialog>
   );
 }
-

From d82e2b44a076bd880283edb7e360ce639af21f1f Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Mon, 13 Jul 2026 22:07:09 +0800
Subject: [PATCH 08/36] docs: surface subscription owner warning

---
 .../ui/src/dashboard/subscription-dashboard-surface.test.ts    | 3 +++
 packages/ui/src/dashboard/subscription-dashboard-surface.tsx   | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts b/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
index 775253b..9f6bc2c 100644
--- a/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
+++ b/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
@@ -262,6 +262,9 @@ describe("SubscriptionDashboardSurface", () => {
     mocks.userStore = { user, isLoading: false, fetchUser: vi.fn() };
     const { html } = renderSurface(createAdapter(), { 0: [], 1: false });
     expect(html).toContain("暂无订阅");
+    expect(html).toContain("完整订阅链接是持有者凭证");
+    expect(html).toContain("所有请求均归属您的账号");
+    expect(html).toContain("账号临时封禁");
     expect(html).toContain("announcement");
     expect(html).toContain("extra-action");
     expect(mocks.captures.stats).toEqual({ subscriptionCount: 0, user });
diff --git a/packages/ui/src/dashboard/subscription-dashboard-surface.tsx b/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
index 5326baf..8a6d5ea 100644
--- a/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
+++ b/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
@@ -351,6 +351,9 @@ export function SubscriptionDashboardSurface({ adapter }: Props) {
         <div>
           <h1 className="text-2xl font-bold mb-1">我的订阅</h1>
           <p className="text-white/50">管理您的订阅链接</p>
+          <p className="mt-1 max-w-xl text-xs leading-relaxed text-amber-200/70">
+            完整订阅链接是持有者凭证；所有请求均归属您的账号，泄漏后反复触发限流可能导致账号临时封禁。
+          </p>
         </div>
         <div className="flex items-center gap-2">
           {adapter.renderHeaderActions?.({ user })}

From 73f9f7260b5d205a01260822bdb94e0d3b124cea Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Tue, 14 Jul 2026 05:47:54 +0800
Subject: [PATCH 09/36] fix(copy): keep subscription warnings concise

---
 README-CN.md                                  |  6 ------
 README.md                                     |  6 ------
 .../readme-security-contract.test.ts          | 20 -------------------
 .../subscription/auto-update-failure.test.ts  |  2 +-
 .../src/subscription/auto-update-failure.ts   |  5 ++---
 .../subscription-dashboard-surface.test.ts    |  5 ++---
 .../subscription-dashboard-surface.tsx        |  3 ---
 .../home/subscription-link-dialog.test.ts     |  5 ++---
 .../product/home/subscription-link-dialog.tsx |  4 ++--
 9 files changed, 9 insertions(+), 47 deletions(-)
 delete mode 100644 packages/core/src/subscription/readme-security-contract.test.ts

diff --git a/README-CN.md b/README-CN.md
index e48e4b6..dfe967a 100644
--- a/README-CN.md
+++ b/README-CN.md
@@ -39,12 +39,6 @@
 - 部署文档：[高级部署 - 编译源码构建，速度慢配置要求高](https://docs.subboost.org/deploy/advanced)
 - 配置教程：[草履虫也能学会的 Clash 配置：UI 界面一键配置精确分流、链式代理](https://ryanvan.com/t/topic/59?u=ryan)
 
-## 订阅链接安全
-
-完整的订阅链接及其中的 token 属于“持有者即可使用”的访问凭证。任何拿到完整链接的人，都可能读取对应的生成配置并使用该订阅。请像保管密码一样保管它，不要把完整链接放进公开仓库、Issue、聊天记录、截图或日志；怀疑泄漏时，应立即删除并重新创建相应订阅，以更换 token。
-
-通过该 token 发起的所有请求（包括匿名请求和第三方客户端请求）都会按订阅所属用户计入访问和风控记录；反复触发限流可能临时封禁订阅所有者的账号。这是预期的权限模型。请勿公开完整链接或把它交给不受信任的第三方；即使主动在受信任客户端或与受信任的人使用，相关请求和滥用风险仍由订阅所有者承担。
-
 ## 开发说明
 
 开发者可以从源码启动本地开发环境：
diff --git a/README.md b/README.md
index b60f9cb..caa58fa 100644
--- a/README.md
+++ b/README.md
@@ -39,12 +39,6 @@
 - Deployment docs: [Advanced deployment - compiles from source, slower with higher requirements](https://docs.subboost.org/deploy/advanced)
 - Configuration guide: [Clash configuration simple enough for a paramecium: configure precise routing and chained proxies from the UI in one click](https://ryanvan.com/t/topic/59?u=ryan)
 
-## Subscription Link Security
-
-A complete subscription URL and its token are bearer credentials: anyone who obtains the full URL may read the generated configuration and use that subscription. Protect it like a password. Never place the complete URL in public repositories, issues, chat messages, screenshots, or logs. If exposure is suspected, delete and recreate the affected subscription to issue a new token.
-
-Every request made with a token, including anonymous requests and requests from third-party clients, is attributed to the subscription owner for access controls and abuse prevention. Repeated rate-limit violations may temporarily ban the owner's account. This is the intended authorization model. Do not publish a complete URL or give it to an untrusted third party; even when using it in a trusted client or with a trusted person, the owner remains responsible for the resulting traffic and abuse risk.
-
 ## Development Notes
 
 Developers can start a local development environment from source:
diff --git a/packages/core/src/subscription/readme-security-contract.test.ts b/packages/core/src/subscription/readme-security-contract.test.ts
deleted file mode 100644
index 99c53f1..0000000
--- a/packages/core/src/subscription/readme-security-contract.test.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import fs from "node:fs";
-import { fileURLToPath } from "node:url";
-import { describe, expect, it } from "vitest";
-
-const publicRoot = fileURLToPath(new URL("../../../..", import.meta.url));
-
-describe("public subscription bearer credential guidance", () => {
-  it("warns in both READMEs that token traffic belongs to the owner and may temporarily ban the owner", () => {
-    const chinese = fs.readFileSync(`${publicRoot}/README-CN.md`, "utf8");
-    const english = fs.readFileSync(`${publicRoot}/README.md`, "utf8");
-
-    expect(chinese).toContain("持有者即可使用");
-    expect(chinese).toContain("匿名请求和第三方客户端请求");
-    expect(chinese).toContain("临时封禁订阅所有者");
-
-    expect(english).toContain("bearer credentials");
-    expect(english).toContain("anonymous requests and requests from third-party clients");
-    expect(english).toContain("temporarily ban the owner's account");
-  });
-});
diff --git a/packages/server-core/src/subscription/auto-update-failure.test.ts b/packages/server-core/src/subscription/auto-update-failure.test.ts
index 44d7942..c178204 100644
--- a/packages/server-core/src/subscription/auto-update-failure.test.ts
+++ b/packages/server-core/src/subscription/auto-update-failure.test.ts
@@ -75,7 +75,7 @@ describe("classifyStableExternalAutoUpdateFailure", () => {
   it("separates stable external failures from project-side or transient failures", () => {
     expect(classifyStableExternalAutoUpdateFailure({ errorMessage: "当前解析任务较多" })).toEqual({
       isStableExternalFailure: false,
-      reason: "项目侧队列或代理资源暂不可用",
+      reason: "服务暂时不可用",
     });
     expect(classifyStableExternalAutoUpdateFailure({ httpStatus: 502 })).toEqual({
       isStableExternalFailure: false,
diff --git a/packages/server-core/src/subscription/auto-update-failure.ts b/packages/server-core/src/subscription/auto-update-failure.ts
index bdb6b5a..ee72429 100644
--- a/packages/server-core/src/subscription/auto-update-failure.ts
+++ b/packages/server-core/src/subscription/auto-update-failure.ts
@@ -109,10 +109,9 @@ export function classifyStableExternalAutoUpdateFailure(
 
   if (
     text.includes("当前解析任务较多") ||
-    text.includes("服务暂时不可用，请稍后再试") ||
-    text.includes("没有可用的代理服务器")
+    text.includes("服务暂时不可用，请稍后再试")
   ) {
-    return { isStableExternalFailure: false, reason: "项目侧队列或代理资源暂不可用" };
+    return { isStableExternalFailure: false, reason: "服务暂时不可用" };
   }
 
   if (
diff --git a/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts b/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
index 9f6bc2c..592db21 100644
--- a/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
+++ b/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
@@ -262,9 +262,8 @@ describe("SubscriptionDashboardSurface", () => {
     mocks.userStore = { user, isLoading: false, fetchUser: vi.fn() };
     const { html } = renderSurface(createAdapter(), { 0: [], 1: false });
     expect(html).toContain("暂无订阅");
-    expect(html).toContain("完整订阅链接是持有者凭证");
-    expect(html).toContain("所有请求均归属您的账号");
-    expect(html).toContain("账号临时封禁");
+    expect(html).not.toContain("完整订阅链接是持有者凭证");
+    expect(html).not.toContain("账号临时封禁");
     expect(html).toContain("announcement");
     expect(html).toContain("extra-action");
     expect(mocks.captures.stats).toEqual({ subscriptionCount: 0, user });
diff --git a/packages/ui/src/dashboard/subscription-dashboard-surface.tsx b/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
index 8a6d5ea..5326baf 100644
--- a/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
+++ b/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
@@ -351,9 +351,6 @@ export function SubscriptionDashboardSurface({ adapter }: Props) {
         <div>
           <h1 className="text-2xl font-bold mb-1">我的订阅</h1>
           <p className="text-white/50">管理您的订阅链接</p>
-          <p className="mt-1 max-w-xl text-xs leading-relaxed text-amber-200/70">
-            完整订阅链接是持有者凭证；所有请求均归属您的账号，泄漏后反复触发限流可能导致账号临时封禁。
-          </p>
         </div>
         <div className="flex items-center gap-2">
           {adapter.renderHeaderActions?.({ user })}
diff --git a/packages/ui/src/product/home/subscription-link-dialog.test.ts b/packages/ui/src/product/home/subscription-link-dialog.test.ts
index 258fd98..aadeb6c 100644
--- a/packages/ui/src/product/home/subscription-link-dialog.test.ts
+++ b/packages/ui/src/product/home/subscription-link-dialog.test.ts
@@ -140,9 +140,8 @@ describe("SubscriptionLinkDialog", () => {
     expect(html).toContain("启用自动更新");
     expect(html).toContain("自动更新间隔");
     expect(html).toContain("注意事项");
-    expect(html).toContain("完整订阅链接是持有者凭证");
-    expect(html).toContain("所有请求均归属您的账号");
-    expect(html).toContain("反复触发限流会临时封禁账号");
+    expect(html).toContain("订阅链接相当于访问凭证，请勿公开分享");
+    expect(html).toContain("客户端高频拉取订阅会被封禁，请合理配置");
     expect(captures.inputs[0]).toMatchObject({ value: "我的配置", maxLength: 100 });
     expect(captures.inputs[1]).toMatchObject({ type: "number", min: 12, step: 1, value: 8 });
     expect(captures.switches).toHaveLength(2);
diff --git a/packages/ui/src/product/home/subscription-link-dialog.tsx b/packages/ui/src/product/home/subscription-link-dialog.tsx
index 8b4da95..191051b 100644
--- a/packages/ui/src/product/home/subscription-link-dialog.tsx
+++ b/packages/ui/src/product/home/subscription-link-dialog.tsx
@@ -133,8 +133,8 @@ export function SubscriptionLinkDialog({
               <p className="font-medium mb-1">注意事项</p>
               <ul className="text-xs text-amber-200/70 space-y-1">
                 <li>🔒 配置数据将加密存储于服务器</li>
-                <li>🔑 完整订阅链接是持有者凭证，仅在自己控制或信任的客户端中使用</li>
-                <li>⏱️ 所有请求均归属您的账号；反复触发限流会临时封禁账号</li>
+                <li>🔑 订阅链接相当于访问凭证，请勿公开分享</li>
+                <li>⏱️ 客户端高频拉取订阅会被封禁，请合理配置</li>
                 {isEditingExistingSubscription ? (
                   <>
                     <li>⚠️ 更新将覆盖原订阅配置与订阅源</li>

From a0f6c83c1605c649f404ee5ce88378c04f87ae69 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Tue, 14 Jul 2026 05:48:08 +0800
Subject: [PATCH 10/36] feat(local): add high-risk source import toggle

---
 .../api/settings/source-import/route.test.ts  | 105 ++++++++++++++++++
 local/app/api/settings/source-import/route.ts |  38 +++++++
 local/app/dashboard/settings/page.tsx         |  93 +++++++++++++++-
 local/app/local-pages.test.ts                 |  15 +++
 .../migration.sql                             |   2 +
 local/prisma/schema.prisma                    |   1 +
 local/src/lib/source-import-settings.test.ts  |  34 ++++++
 local/src/lib/source-import-settings.ts       |   9 ++
 local/src/lib/source-import.test.ts           |  74 ++++++++++++
 local/src/lib/source-import.ts                |  36 ++++--
 local/test/source-import-guard.test.ts        |   6 +-
 11 files changed, 399 insertions(+), 14 deletions(-)
 create mode 100644 local/app/api/settings/source-import/route.test.ts
 create mode 100644 local/app/api/settings/source-import/route.ts
 create mode 100644 local/prisma/migrations/20260714000000_allow_unsafe_subscription_sources/migration.sql
 create mode 100644 local/src/lib/source-import-settings.test.ts
 create mode 100644 local/src/lib/source-import-settings.ts

diff --git a/local/app/api/settings/source-import/route.test.ts b/local/app/api/settings/source-import/route.test.ts
new file mode 100644
index 0000000..1a7dfda
--- /dev/null
+++ b/local/app/api/settings/source-import/route.test.ts
@@ -0,0 +1,105 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  getCurrentAdmin: vi.fn(),
+  prisma: {
+    localAdmin: {
+      findUnique: vi.fn(),
+      update: vi.fn(),
+    },
+  },
+}));
+
+vi.mock("@local/lib/auth", () => ({
+  getCurrentAdmin: mocks.getCurrentAdmin,
+}));
+
+vi.mock("@local/lib/prisma", () => ({
+  prisma: mocks.prisma,
+}));
+
+import { GET, PATCH } from "./route";
+
+async function readJson(response: Response) {
+  return { status: response.status, body: await response.json() };
+}
+
+function patchRequest(body: string) {
+  return new Request("https://local.test/api/settings/source-import", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body,
+  });
+}
+
+describe("local source import settings route", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.getCurrentAdmin.mockResolvedValue({ id: "admin-1", username: "admin" });
+  });
+
+  it("requires the local administrator for reads and writes", async () => {
+    mocks.getCurrentAdmin.mockResolvedValue(null);
+
+    await expect(readJson(await GET())).resolves.toEqual({
+      status: 401,
+      body: { error: "Authentication required.", code: "UNAUTHORIZED" },
+    });
+    await expect(readJson(await PATCH(patchRequest("{}")))).resolves.toEqual({
+      status: 401,
+      body: { error: "Authentication required.", code: "UNAUTHORIZED" },
+    });
+    expect(mocks.prisma.localAdmin.findUnique).not.toHaveBeenCalled();
+    expect(mocks.prisma.localAdmin.update).not.toHaveBeenCalled();
+  });
+
+  it("returns the persisted setting", async () => {
+    mocks.prisma.localAdmin.findUnique.mockResolvedValueOnce({
+      allowUnsafeSubscriptionSources: true,
+    });
+
+    await expect(readJson(await GET())).resolves.toEqual({
+      status: 200,
+      body: { allowUnsafeSubscriptionSources: true },
+    });
+    expect(mocks.prisma.localAdmin.findUnique).toHaveBeenCalledWith({
+      where: { id: "admin-1" },
+      select: { allowUnsafeSubscriptionSources: true },
+    });
+  });
+
+  it("updates the setting with a boolean value", async () => {
+    mocks.prisma.localAdmin.update.mockResolvedValueOnce({
+      allowUnsafeSubscriptionSources: true,
+    });
+
+    await expect(
+      readJson(await PATCH(patchRequest(JSON.stringify({ allowUnsafeSubscriptionSources: true }))))
+    ).resolves.toEqual({
+      status: 200,
+      body: { allowUnsafeSubscriptionSources: true },
+    });
+    expect(mocks.prisma.localAdmin.update).toHaveBeenCalledWith({
+      where: { id: "admin-1" },
+      data: { allowUnsafeSubscriptionSources: true },
+      select: { allowUnsafeSubscriptionSources: true },
+    });
+  });
+
+  it("rejects malformed JSON and non-boolean values", async () => {
+    await expect(readJson(await PATCH(patchRequest("{")))).resolves.toEqual({
+      status: 400,
+      body: { error: "Invalid JSON body.", code: "BAD_REQUEST" },
+    });
+    await expect(
+      readJson(await PATCH(patchRequest(JSON.stringify({ allowUnsafeSubscriptionSources: "yes" }))))
+    ).resolves.toEqual({
+      status: 400,
+      body: {
+        error: "allowUnsafeSubscriptionSources must be a boolean.",
+        code: "VALIDATION_ERROR",
+      },
+    });
+    expect(mocks.prisma.localAdmin.update).not.toHaveBeenCalled();
+  });
+});
diff --git a/local/app/api/settings/source-import/route.ts b/local/app/api/settings/source-import/route.ts
new file mode 100644
index 0000000..02f571b
--- /dev/null
+++ b/local/app/api/settings/source-import/route.ts
@@ -0,0 +1,38 @@
+import { withCurrentAdmin } from "@local/lib/api-auth";
+import { apiError, json, readJsonBody } from "@local/lib/http";
+import { prisma } from "@local/lib/prisma";
+
+export async function GET() {
+  return withCurrentAdmin(async (admin) => {
+    const settings = await prisma.localAdmin.findUnique({
+      where: { id: admin.id },
+      select: { allowUnsafeSubscriptionSources: true },
+    });
+
+    if (!settings) return apiError("Local admin not found.", "NOT_FOUND", 404);
+    return json(settings);
+  });
+}
+
+export async function PATCH(request: Request) {
+  return withCurrentAdmin(async (admin) => {
+    const body = await readJsonBody(request);
+    if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+
+    const allowUnsafeSubscriptionSources =
+      typeof body === "object" && !Array.isArray(body)
+        ? (body as Record<string, unknown>).allowUnsafeSubscriptionSources
+        : undefined;
+    if (typeof allowUnsafeSubscriptionSources !== "boolean") {
+      return apiError("allowUnsafeSubscriptionSources must be a boolean.", "VALIDATION_ERROR", 400);
+    }
+
+    const settings = await prisma.localAdmin.update({
+      where: { id: admin.id },
+      data: { allowUnsafeSubscriptionSources },
+      select: { allowUnsafeSubscriptionSources: true },
+    });
+
+    return json(settings);
+  });
+}
diff --git a/local/app/dashboard/settings/page.tsx b/local/app/dashboard/settings/page.tsx
index fde0882..7880127 100644
--- a/local/app/dashboard/settings/page.tsx
+++ b/local/app/dashboard/settings/page.tsx
@@ -1,30 +1,93 @@
 "use client";
 
 import * as React from "react";
-import { LogOut, ServerCog, ShieldCheck } from "lucide-react";
+import { LogOut, Network, ServerCog, ShieldCheck } from "lucide-react";
 
 import { Button } from "@subboost/ui/components/ui/button";
 import { Card, CardContent, CardHeader, CardTitle } from "@subboost/ui/components/ui/card";
+import { Switch } from "@subboost/ui/components/ui/switch";
 import { useUserStore } from "@subboost/ui/store/user-store";
 
 export default function SettingsPage() {
   const { user, fetchUser, logout } = useUserStore();
+  const [allowUnsafeSubscriptionSources, setAllowUnsafeSubscriptionSources] = React.useState(false);
+  const [sourceImportLoading, setSourceImportLoading] = React.useState(true);
+  const [sourceImportSaving, setSourceImportSaving] = React.useState(false);
+  const [sourceImportError, setSourceImportError] = React.useState<string | null>(null);
 
   React.useEffect(() => {
     void fetchUser();
   }, [fetchUser]);
 
+  React.useEffect(() => {
+    let cancelled = false;
+    if (!user) {
+      setSourceImportLoading(false);
+      return () => {
+        cancelled = true;
+      };
+    }
+
+    setSourceImportLoading(true);
+    setSourceImportError(null);
+    void fetch("/api/settings/source-import", { cache: "no-store" })
+      .then(async (response) => {
+        if (!response.ok) throw new Error("Unable to load source import settings.");
+        const body = (await response.json()) as { allowUnsafeSubscriptionSources?: unknown };
+        if (typeof body.allowUnsafeSubscriptionSources !== "boolean") {
+          throw new Error("Invalid source import settings response.");
+        }
+        if (!cancelled) setAllowUnsafeSubscriptionSources(body.allowUnsafeSubscriptionSources);
+      })
+      .catch(() => {
+        if (!cancelled) setSourceImportError("加载失败，请刷新重试");
+      })
+      .finally(() => {
+        if (!cancelled) setSourceImportLoading(false);
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, [user]);
+
   const handleLogout = async () => {
     await logout();
     window.location.href = "/login";
   };
 
+  const handleUnsafeSourceToggle = async (checked: boolean) => {
+    const previousValue = allowUnsafeSubscriptionSources;
+    setAllowUnsafeSubscriptionSources(checked);
+    setSourceImportSaving(true);
+    setSourceImportError(null);
+
+    try {
+      const response = await fetch("/api/settings/source-import", {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ allowUnsafeSubscriptionSources: checked }),
+      });
+      if (!response.ok) throw new Error("Unable to save source import settings.");
+      const body = (await response.json()) as { allowUnsafeSubscriptionSources?: unknown };
+      if (typeof body.allowUnsafeSubscriptionSources !== "boolean") {
+        throw new Error("Invalid source import settings response.");
+      }
+      setAllowUnsafeSubscriptionSources(body.allowUnsafeSubscriptionSources);
+    } catch {
+      setAllowUnsafeSubscriptionSources(previousValue);
+      setSourceImportError("保存失败，请重试");
+    } finally {
+      setSourceImportSaving(false);
+    }
+  };
+
   return (
     <div className="container mx-auto px-4 py-8">
       <div className="mb-8 flex flex-col gap-4 sm:flex-row sm:items-end sm:justify-between">
         <div>
           <h1 className="text-2xl font-bold mb-1">账户设置</h1>
-          <p className="text-white/50">本地管理员、订阅容量和运行端点</p>
+          <p className="text-white/50">本地管理员、订阅源安全和运行端点</p>
         </div>
       </div>
 
@@ -52,6 +115,32 @@ export default function SettingsPage() {
           </CardContent>
         </Card>
 
+        <Card>
+          <CardHeader className="flex flex-row items-center gap-3 space-y-0">
+            <div className="rounded-lg bg-emerald-500/20 p-2 text-emerald-300">
+              <Network className="h-5 w-5" />
+            </div>
+            <CardTitle className="text-base">订阅源安全</CardTitle>
+          </CardHeader>
+          <CardContent>
+            <div className="flex items-start justify-between gap-4">
+              <div>
+                <p className="text-sm font-medium">允许本机和局域网订阅</p>
+                <p className="mt-1 text-xs leading-relaxed text-white/50">
+                  开启后，本机、局域网及其他保留地址都可作为订阅源。仅在信任来源时开启。
+                </p>
+                {sourceImportError && <p className="mt-2 text-xs text-red-300">{sourceImportError}</p>}
+              </div>
+              <Switch
+                aria-label="允许本机和局域网订阅"
+                checked={allowUnsafeSubscriptionSources}
+                disabled={!user || sourceImportLoading || sourceImportSaving}
+                onCheckedChange={(checked) => void handleUnsafeSourceToggle(checked)}
+              />
+            </div>
+          </CardContent>
+        </Card>
+
         <Card>
           <CardHeader className="flex flex-row items-center gap-3 space-y-0">
             <div className="rounded-lg bg-sky-500/20 p-2 text-sky-300">
diff --git a/local/app/local-pages.test.ts b/local/app/local-pages.test.ts
index 2201aea..fb686f0 100644
--- a/local/app/local-pages.test.ts
+++ b/local/app/local-pages.test.ts
@@ -8,6 +8,7 @@ const mocks = vi.hoisted(() => ({
   homeAdapter: null as any,
   readJsonResponse: vi.fn(),
   readSourceImportResponse: vi.fn(),
+  switches: [] as any[],
   templateAdapter: null as any,
   userState: {
     fetchUser: vi.fn(),
@@ -18,6 +19,7 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock("lucide-react", () => ({
   LogOut: () => React.createElement("span", null, "LogOut"),
+  Network: () => React.createElement("span", null, "Network"),
   ServerCog: () => React.createElement("span", null, "ServerCog"),
   ShieldCheck: () => React.createElement("span", null, "ShieldCheck"),
 }));
@@ -36,6 +38,13 @@ vi.mock("@subboost/ui/components/ui/card", () => ({
   CardTitle: (props: any) => React.createElement("h2", props, props.children),
 }));
 
+vi.mock("@subboost/ui/components/ui/switch", () => ({
+  Switch: (props: any) => {
+    mocks.switches.push(props);
+    return React.createElement("button", { disabled: props.disabled, role: "switch" });
+  },
+}));
+
 vi.mock("@subboost/ui/dashboard/subscription-dashboard-surface", () => ({
   SubscriptionDashboardSurface: (props: any) => {
     mocks.dashboardAdapter = props.adapter;
@@ -85,6 +94,7 @@ describe("local app pages and adapters", () => {
     mocks.homeAdapter = null;
     mocks.templateAdapter = null;
     mocks.buttons = [];
+    mocks.switches = [];
     mocks.userState = {
       fetchUser: vi.fn(),
       logout: vi.fn(),
@@ -217,13 +227,17 @@ describe("local app pages and adapters", () => {
   it("renders local settings for anonymous and authenticated states", async () => {
     let html = renderToStaticMarkup(React.createElement(SettingsPage));
     expect(html).toContain("未登录");
+    expect(html).toContain("允许本机和局域网订阅");
+    expect(html).toContain("本机、局域网及其他保留地址都可作为订阅源");
     expect(html).toContain("/api/health/live");
     expect(mocks.buttons.find((button: any) => button.variant === "destructive")).toMatchObject({
       disabled: true,
     });
+    expect(mocks.switches[0]).toMatchObject({ checked: false, disabled: true });
 
     vi.stubGlobal("window", { location: { href: "" } });
     mocks.buttons = [];
+    mocks.switches = [];
     mocks.userState = {
       fetchUser: vi.fn(),
       logout: vi.fn(),
@@ -234,6 +248,7 @@ describe("local app pages and adapters", () => {
     expect(html).toContain("2 / 9999");
     const logoutButton = mocks.buttons.find((button: any) => button.variant === "destructive");
     expect(logoutButton).toMatchObject({ disabled: false });
+    expect(mocks.switches[0]).toMatchObject({ checked: false, disabled: true });
     logoutButton.onClick();
     await Promise.resolve();
     await Promise.resolve();
diff --git a/local/prisma/migrations/20260714000000_allow_unsafe_subscription_sources/migration.sql b/local/prisma/migrations/20260714000000_allow_unsafe_subscription_sources/migration.sql
new file mode 100644
index 0000000..e3e487a
--- /dev/null
+++ b/local/prisma/migrations/20260714000000_allow_unsafe_subscription_sources/migration.sql
@@ -0,0 +1,2 @@
+ALTER TABLE "LocalAdmin"
+ADD COLUMN "allowUnsafeSubscriptionSources" BOOLEAN NOT NULL DEFAULT false;
diff --git a/local/prisma/schema.prisma b/local/prisma/schema.prisma
index a0e5bf1..431db62 100644
--- a/local/prisma/schema.prisma
+++ b/local/prisma/schema.prisma
@@ -14,6 +14,7 @@ model LocalAdmin {
   createdAt    DateTime  @default(now())
   updatedAt    DateTime  @updatedAt
   lastLoginAt  DateTime?
+  allowUnsafeSubscriptionSources Boolean @default(false)
 
   subscriptions Subscription[]
   templates      LocalTemplate[]
diff --git a/local/src/lib/source-import-settings.test.ts b/local/src/lib/source-import-settings.test.ts
new file mode 100644
index 0000000..a98f1e9
--- /dev/null
+++ b/local/src/lib/source-import-settings.test.ts
@@ -0,0 +1,34 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  findFirst: vi.fn(),
+}));
+
+vi.mock("@local/lib/prisma", () => ({
+  prisma: {
+    localAdmin: { findFirst: mocks.findFirst },
+  },
+}));
+
+import { getAllowUnsafeSubscriptionSources } from "./source-import-settings";
+
+describe("local source import settings", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("defaults to disabled when no local administrator exists", async () => {
+    mocks.findFirst.mockResolvedValueOnce(null);
+
+    await expect(getAllowUnsafeSubscriptionSources()).resolves.toBe(false);
+  });
+
+  it("reads the persisted local administrator setting", async () => {
+    mocks.findFirst.mockResolvedValueOnce({ allowUnsafeSubscriptionSources: true });
+
+    await expect(getAllowUnsafeSubscriptionSources()).resolves.toBe(true);
+    expect(mocks.findFirst).toHaveBeenCalledWith({
+      select: { allowUnsafeSubscriptionSources: true },
+    });
+  });
+});
diff --git a/local/src/lib/source-import-settings.ts b/local/src/lib/source-import-settings.ts
new file mode 100644
index 0000000..4ec4e8f
--- /dev/null
+++ b/local/src/lib/source-import-settings.ts
@@ -0,0 +1,9 @@
+import { prisma } from "@local/lib/prisma";
+
+export async function getAllowUnsafeSubscriptionSources(): Promise<boolean> {
+  const admin = await prisma.localAdmin.findFirst({
+    select: { allowUnsafeSubscriptionSources: true },
+  });
+
+  return admin?.allowUnsafeSubscriptionSources ?? false;
+}
diff --git a/local/src/lib/source-import.test.ts b/local/src/lib/source-import.test.ts
index e8db443..7dca277 100644
--- a/local/src/lib/source-import.test.ts
+++ b/local/src/lib/source-import.test.ts
@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import { fetchSourceUserInfoHeadersDirect, importSourceUrlDirect } from "./source-import";
 
 const mocks = vi.hoisted(() => ({
+  getAllowUnsafeSubscriptionSources: vi.fn(),
   lookup: vi.fn(),
   importSubscriptionFromUrl: vi.fn(),
 }));
@@ -10,6 +11,10 @@ vi.mock("node:dns/promises", () => ({
   lookup: mocks.lookup,
 }));
 
+vi.mock("@local/lib/source-import-settings", () => ({
+  getAllowUnsafeSubscriptionSources: mocks.getAllowUnsafeSubscriptionSources,
+}));
+
 vi.mock("@subboost/server-core/subscription", async (importOriginal) => {
   const actual = await importOriginal<typeof import("@subboost/server-core/subscription")>();
   return {
@@ -59,6 +64,7 @@ async function runTransport(url: string, overrides: Record<string, unknown> = {}
 describe("local source import transport", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(false);
     mocks.lookup.mockResolvedValue([{ address: "93.184.216.34" }]);
     globalThis.fetch = vi.fn();
   });
@@ -108,6 +114,38 @@ describe("local source import transport", () => {
     expect(globalThis.fetch).not.toHaveBeenCalled();
   });
 
+  it("allows all local and reserved address sources when the high-risk setting is enabled", async () => {
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(true);
+    const allowedUrls = [
+      "http://localhost:8080/sub",
+      "http://127.0.0.1/sub",
+      "http://[::1]/sub",
+      "http://router.local/sub",
+      "http://10.1.2.3/sub",
+      "http://169.254.169.254/latest/meta-data",
+      "http://100.64.0.1/sub",
+      "http://192.0.2.1/sub",
+      "http://198.18.0.1/sub",
+      "http://224.0.0.1/sub",
+      "http://[fc00::1]/sub",
+      "http://[fe80::1]/sub",
+      "http://[::ffff:192.168.0.1]/sub",
+    ];
+
+    for (const url of allowedUrls) {
+      vi.mocked(globalThis.fetch).mockResolvedValueOnce(response("ss://node", { status: 200 }));
+      await expect(runTransport(url)).resolves.toMatchObject({ ok: true, content: "ss://node" });
+    }
+    expect(mocks.lookup).not.toHaveBeenCalled();
+  });
+
+  it("keeps URL scheme and embedded-credential checks enabled for high-risk sources", async () => {
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(true);
+    await expect(runTransport("ftp://127.0.0.1/sub")).resolves.toMatchObject({ ok: false });
+    await expect(runTransport("http://user:pass@127.0.0.1/sub")).resolves.toMatchObject({ ok: false });
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
   it("rechecks fake-ip DNS answers with DoH before fetching the subscription", async () => {
     mocks.lookup.mockResolvedValueOnce([{ address: "198.18.3.6" }]);
     vi.mocked(globalThis.fetch)
@@ -151,6 +189,21 @@ describe("local source import transport", () => {
     expect(globalThis.fetch).toHaveBeenCalledTimes(2);
   });
 
+  it("lets the explicit high-risk setting bypass fake-ip DNS blocking", async () => {
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(true);
+    vi.mocked(globalThis.fetch).mockResolvedValueOnce(response("ss://node", { status: 200 }));
+
+    await expect(runTransport("https://fake-ip-private.example/sub")).resolves.toMatchObject({
+      ok: true,
+      content: "ss://node",
+    });
+    expect(mocks.lookup).not.toHaveBeenCalled();
+    expect(globalThis.fetch).toHaveBeenCalledWith(
+      "https://fake-ip-private.example/sub",
+      expect.objectContaining({ method: "GET", redirect: "manual" })
+    );
+  });
+
   it("rejects additional private IPv4 and IPv6 address ranges", async () => {
     const blockedUrls = [
       "http://0.0.0.0/sub",
@@ -303,6 +356,19 @@ describe("local source import transport", () => {
     });
   });
 
+  it("applies the enabled high-risk setting to redirect targets", async () => {
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(true);
+    vi.mocked(globalThis.fetch)
+      .mockResolvedValueOnce(response("", { status: 302, headers: { location: "http://127.0.0.1/sub" } }))
+      .mockResolvedValueOnce(response("ss://node", { status: 200 }));
+
+    await expect(runTransport("https://example.com/private-redirect")).resolves.toMatchObject({
+      ok: true,
+      content: "ss://node",
+    });
+    expect(mocks.getAllowUnsafeSubscriptionSources).toHaveBeenCalledTimes(1);
+  });
+
   it("returns userinfo headers with HEAD and skips when no userinfo URL is configured", async () => {
     await expect(fetchSourceUserInfoHeadersDirect({})).resolves.toBeUndefined();
 
@@ -338,5 +404,13 @@ describe("local source import transport", () => {
         headers: expect.objectContaining({ "User-Agent": expect.any(String) }),
       })
     );
+
+    mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(true);
+    vi.mocked(globalThis.fetch).mockResolvedValueOnce(
+      response("", { status: 200, headers: { "Subscription-Userinfo": "upload=2; total=4096" } })
+    );
+    await expect(fetchSourceUserInfoHeadersDirect({ userinfoUrl: "http://127.0.0.1/userinfo" })).resolves.toMatchObject({
+      "subscription-userinfo": "upload=2; total=4096",
+    });
   });
 });
diff --git a/local/src/lib/source-import.ts b/local/src/lib/source-import.ts
index 81a6667..d8c66db 100644
--- a/local/src/lib/source-import.ts
+++ b/local/src/lib/source-import.ts
@@ -19,6 +19,7 @@ import {
   selectDnsAddressesAfterFakeIpRecheck,
   shouldRecheckFakeIpDnsAnswers,
 } from "@subboost/server-core/subscription/ssrf-ip";
+import { getAllowUnsafeSubscriptionSources } from "@local/lib/source-import-settings";
 
 const DEFAULT_TIMEOUT_MS = 15000;
 const DEFAULT_MAX_BYTES = 10 * 1024 * 1024;
@@ -68,7 +69,10 @@ function normalizeHostname(hostname: string): string {
   return hostname.replace(/^\[|\]$/g, "").toLowerCase();
 }
 
-async function validatePublicFetchTarget(url: string): Promise<SourceImportTransportResult | null> {
+async function validatePublicFetchTarget(
+  url: string,
+  allowUnsafeSubscriptionSources: boolean
+): Promise<SourceImportTransportResult | null> {
   let parsed: URL;
   try {
     parsed = new URL(url);
@@ -84,6 +88,8 @@ async function validatePublicFetchTarget(url: string): Promise<SourceImportTrans
     return toSecurityFailure("订阅 URL 不允许包含用户名或密码");
   }
 
+  if (allowUnsafeSubscriptionSources) return null;
+
   const hostname = normalizeHostname(parsed.hostname);
   if (!hostname || hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local")) {
     return toSecurityFailure("禁止访问本机或内网地址");
@@ -109,7 +115,10 @@ async function validatePublicFetchTarget(url: string): Promise<SourceImportTrans
   return null;
 }
 
-async function fetchTextDirect(request: SourceImportTransportRequest): Promise<SourceImportTransportResult> {
+async function fetchTextDirect(
+  request: SourceImportTransportRequest,
+  allowUnsafeSubscriptionSources: boolean
+): Promise<SourceImportTransportResult> {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), request.timeoutMs);
 
@@ -117,7 +126,7 @@ async function fetchTextDirect(request: SourceImportTransportRequest): Promise<S
     let currentUrl = request.url;
     let response: Response | null = null;
     for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount += 1) {
-      const guardFailure = await validatePublicFetchTarget(currentUrl);
+      const guardFailure = await validatePublicFetchTarget(currentUrl, allowUnsafeSubscriptionSources);
       if (guardFailure) return guardFailure;
 
       response = await fetch(currentUrl, {
@@ -168,10 +177,11 @@ async function fetchTextDirect(request: SourceImportTransportRequest): Promise<S
 }
 
 export async function importSourceUrlDirect(request: SourceImportRequest): Promise<SourceImportResult> {
+  const allowUnsafeSubscriptionSources = await getAllowUnsafeSubscriptionSources();
   return importSubscriptionFromUrl(request, {
     timeoutMs: DEFAULT_TIMEOUT_MS,
     maxBytes: DEFAULT_MAX_BYTES,
-    fetchText: fetchTextDirect,
+    fetchText: (transportRequest) => fetchTextDirect(transportRequest, allowUnsafeSubscriptionSources),
   });
 }
 
@@ -180,12 +190,16 @@ export async function fetchSourceUserInfoHeadersDirect(source: {
   userinfoUserAgent?: string;
 }): Promise<Record<string, string> | undefined> {
   if (!source.userinfoUrl) return undefined;
-  const response = await fetchTextDirect({
-    url: source.userinfoUrl,
-    userAgent: source.userinfoUserAgent?.trim() || SUBSCRIPTION_IMPORT_USER_AGENTS[0],
-    purpose: "userinfo",
-    timeoutMs: USERINFO_TIMEOUT_MS,
-    maxBytes: USERINFO_MAX_BYTES,
-  });
+  const allowUnsafeSubscriptionSources = await getAllowUnsafeSubscriptionSources();
+  const response = await fetchTextDirect(
+    {
+      url: source.userinfoUrl,
+      userAgent: source.userinfoUserAgent?.trim() || SUBSCRIPTION_IMPORT_USER_AGENTS[0],
+      purpose: "userinfo",
+      timeoutMs: USERINFO_TIMEOUT_MS,
+      maxBytes: USERINFO_MAX_BYTES,
+    },
+    allowUnsafeSubscriptionSources
+  );
   return response.ok ? response.headers : undefined;
 }
diff --git a/local/test/source-import-guard.test.ts b/local/test/source-import-guard.test.ts
index 70860c7..dbdec80 100644
--- a/local/test/source-import-guard.test.ts
+++ b/local/test/source-import-guard.test.ts
@@ -1,4 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@local/lib/source-import-settings", () => ({
+  getAllowUnsafeSubscriptionSources: vi.fn(async () => false),
+}));
+
 import { importSourceUrlDirect } from "@local/lib/source-import";
 
 beforeEach(() => {
@@ -19,4 +24,3 @@ describe("local source import network guard", () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 });
-

From 12425da67c0a0255a3d1bfed9be831c768d56281 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Tue, 14 Jul 2026 05:52:19 +0800
Subject: [PATCH 11/36] fix(local): keep imports root-typecheck compatible

---
 local/src/lib/source-import-settings.test.ts | 2 +-
 local/src/lib/source-import-settings.ts      | 2 +-
 local/src/lib/source-import.ts               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/local/src/lib/source-import-settings.test.ts b/local/src/lib/source-import-settings.test.ts
index a98f1e9..a5031ad 100644
--- a/local/src/lib/source-import-settings.test.ts
+++ b/local/src/lib/source-import-settings.test.ts
@@ -4,7 +4,7 @@ const mocks = vi.hoisted(() => ({
   findFirst: vi.fn(),
 }));
 
-vi.mock("@local/lib/prisma", () => ({
+vi.mock("./prisma", () => ({
   prisma: {
     localAdmin: { findFirst: mocks.findFirst },
   },
diff --git a/local/src/lib/source-import-settings.ts b/local/src/lib/source-import-settings.ts
index 4ec4e8f..3f083c1 100644
--- a/local/src/lib/source-import-settings.ts
+++ b/local/src/lib/source-import-settings.ts
@@ -1,4 +1,4 @@
-import { prisma } from "@local/lib/prisma";
+import { prisma } from "./prisma";
 
 export async function getAllowUnsafeSubscriptionSources(): Promise<boolean> {
   const admin = await prisma.localAdmin.findFirst({
diff --git a/local/src/lib/source-import.ts b/local/src/lib/source-import.ts
index d8c66db..fcee75a 100644
--- a/local/src/lib/source-import.ts
+++ b/local/src/lib/source-import.ts
@@ -19,7 +19,7 @@ import {
   selectDnsAddressesAfterFakeIpRecheck,
   shouldRecheckFakeIpDnsAnswers,
 } from "@subboost/server-core/subscription/ssrf-ip";
-import { getAllowUnsafeSubscriptionSources } from "@local/lib/source-import-settings";
+import { getAllowUnsafeSubscriptionSources } from "./source-import-settings";
 
 const DEFAULT_TIMEOUT_MS = 15000;
 const DEFAULT_MAX_BYTES = 10 * 1024 * 1024;

From 295f96d44e635efb768061aae5407765f625c31b Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Tue, 14 Jul 2026 07:25:05 +0800
Subject: [PATCH 12/36] fix(local): preserve setup lock with prisma adapter

---
 local/app/api/setup/admin/route.test.ts | 2 +-
 local/app/api/setup/admin/route.ts      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/local/app/api/setup/admin/route.test.ts b/local/app/api/setup/admin/route.test.ts
index c1c9e8a..edff592 100644
--- a/local/app/api/setup/admin/route.test.ts
+++ b/local/app/api/setup/admin/route.test.ts
@@ -124,7 +124,7 @@ describe("local setup admin route", () => {
       body: { error: "已有管理员账号，请直接登录", code: "CONFLICT" },
     });
     expect(mocks.queryRaw).toHaveBeenCalledWith(
-      expect.arrayContaining(["SELECT pg_advisory_xact_lock(", ")"]),
+      expect.arrayContaining(["SELECT pg_advisory_xact_lock(", ') IS NULL AS "locked"']),
       1_397_704_283
     );
     expect(mocks.create).not.toHaveBeenCalled();
diff --git a/local/app/api/setup/admin/route.ts b/local/app/api/setup/admin/route.ts
index 5159ad4..2f2ef74 100644
--- a/local/app/api/setup/admin/route.ts
+++ b/local/app/api/setup/admin/route.ts
@@ -33,7 +33,7 @@ export async function POST(request: Request) {
 
   const passwordHash = await bcrypt.hash(password, 12);
   const admin = await prisma.$transaction(async (transaction) => {
-    await transaction.$queryRaw`SELECT pg_advisory_xact_lock(${1_397_704_283})`;
+    await transaction.$queryRaw`SELECT pg_advisory_xact_lock(${1_397_704_283}) IS NULL AS "locked"`;
     if (await transaction.localAdmin.count()) return null;
     return transaction.localAdmin.create({
       data: { username, passwordHash, lastLoginAt: new Date() },

From 89c652c1c05e3f31c42c7880e20b29cc3f22e455 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Thu, 16 Jul 2026 07:16:19 +0800
Subject: [PATCH 13/36] fix: stabilize subscription imports and validation

---
 .../core/src/parser/content-parsers.test.ts   |  9 ++
 packages/core/src/parser/content-parsers.ts   | 10 +-
 .../server-core/src/subscription/crud.test.ts | 28 ++++++
 packages/server-core/src/subscription/crud.ts | 32 +++++++
 .../src/subscription/ssrf-ip.test.ts          | 14 +++
 .../server-core/src/subscription/ssrf-ip.ts   | 94 ++++++++++++++++---
 .../source-actions-multiple.test.ts           | 45 +++++++++
 .../store/config-store/source-actions.test.ts | 71 ++++++++++++++
 .../src/store/config-store/source-actions.ts  | 49 +++++++++-
 .../config-store/source-import-operation.ts   | 90 ++++++++++++++++++
 10 files changed, 417 insertions(+), 25 deletions(-)
 create mode 100644 packages/ui/src/store/config-store/source-import-operation.ts

diff --git a/packages/core/src/parser/content-parsers.test.ts b/packages/core/src/parser/content-parsers.test.ts
index 81749a6..1f461e0 100644
--- a/packages/core/src/parser/content-parsers.test.ts
+++ b/packages/core/src/parser/content-parsers.test.ts
@@ -30,6 +30,15 @@ describe("content parser registry helpers", () => {
     expect(isClashYamlContent("proxy-providers: {}")).toBe(true);
     expect(isClashYamlContent("- type: hysteria2\n  server: hy2.example.com\n  ports: 10000-10100")).toBe(true);
     expect(isClashYamlContent("ss://not-yaml")).toBe(false);
+    expect(isClashYamlContent(ssLink("proxies:"))).toBe(false);
+  });
+
+  it("does not misclassify a link fragment as YAML and falls through zero-node YAML parsers", () => {
+    expect(parseSubscription(ssLink("proxies:")).nodes[0]).toMatchObject({ name: "proxies:", type: "ss" });
+
+    const mixed = parseSubscription(`proxy-providers: {}\n${ssLink("Link after YAML")}`);
+    expect(mixed.nodes[0]).toMatchObject({ name: "Link after YAML", type: "ss" });
+    expect(mixed.errors.length).toBeGreaterThan(0);
   });
 
   it("detects and parses top-level inline flow proxy arrays", () => {
diff --git a/packages/core/src/parser/content-parsers.ts b/packages/core/src/parser/content-parsers.ts
index c1a0432..578b493 100644
--- a/packages/core/src/parser/content-parsers.ts
+++ b/packages/core/src/parser/content-parsers.ts
@@ -80,11 +80,7 @@ function looksLikeInlineFlowProxyList(content: string): boolean {
 }
 
 export function isClashYamlContent(content: string): boolean {
-  if (
-    content.includes("proxies:") ||
-    content.includes("proxy-groups:") ||
-    content.includes("proxy-providers:")
-  ) {
+  if (/^(?:[ \t]*)(?:proxies|proxy-groups|proxy-providers)[ \t]*:/m.test(content)) {
     return true;
   }
 
@@ -188,7 +184,8 @@ export function parseSubscriptionContentByRegistry(content: string): ParseResult
       if (parser.name === "link-lines") {
         return buildParseResult(result.nodes, [...accumulatedErrors, ...result.errors]);
       }
-      return result;
+      if (result.nodes.length > 0) return result;
+      accumulatedErrors.push(...result.errors);
     } catch (error) {
       if (parser.name === "clash-yaml") {
         accumulatedErrors.push(`Clash YAML 解析失败: ${error instanceof Error ? error.message : "未知错误"}`);
@@ -201,4 +198,3 @@ export function parseSubscriptionContentByRegistry(content: string): ParseResult
   return buildParseResult([], accumulatedErrors);
 }
 
-
diff --git a/packages/server-core/src/subscription/crud.test.ts b/packages/server-core/src/subscription/crud.test.ts
index 7339f2a..8886582 100644
--- a/packages/server-core/src/subscription/crud.test.ts
+++ b/packages/server-core/src/subscription/crud.test.ts
@@ -8,6 +8,7 @@ import {
   normalizeSubscriptionUrlList,
   serializeSubscriptionDetailData,
   serializeSubscriptionSummaryData,
+  validateSubscriptionNodeList,
 } from "./crud";
 
 describe("subscription CRUD shared helpers", () => {
@@ -29,6 +30,33 @@ describe("subscription CRUD shared helpers", () => {
     expect(areSubscriptionUrlListsEquivalent(["a"], ["a", "b"])).toBe(false);
   });
 
+  it("strictly validates persisted node lists without blocking unknown forward-compatible types", () => {
+    expect(
+      validateSubscriptionNodeList([
+        { name: "Future", type: "future-protocol", server: "future.example.com", port: 443, "dialer-proxy": "x" },
+        { name: "Direct", type: "direct" },
+        { name: "DNS", type: "dns" },
+        { name: "Relay", type: "relay", proxies: ["Future"] },
+      ])
+    ).toEqual([
+      { name: "Future", type: "future-protocol", server: "future.example.com", port: 443 },
+      { name: "Direct", type: "direct" },
+      { name: "DNS", type: "dns" },
+      { name: "Relay", type: "relay", proxies: ["Future"] },
+    ]);
+
+    for (const [value, message] of [
+      ["bad", "节点列表必须是数组"],
+      [[null], "节点 #1 必须是对象"],
+      [[{ name: "", type: "ss", server: "x", port: 1 }], "节点 #1 缺少有效名称"],
+      [[{ name: "A", type: "ss", server: "", port: 1 }], "节点 #1 缺少有效服务器地址"],
+      [[{ name: "A", type: "ss", server: "x", port: 0 }], "节点 #1 的端口"],
+      [[{ name: "A", type: "relay", proxies: [""] }], "relay proxies"],
+    ] as const) {
+      expect(() => validateSubscriptionNodeList(value)).toThrow(message);
+    }
+  });
+
   it("normalizes config, sources, and smart node matching state", () => {
     expect(
       normalizeSubscriptionConfigForPersistence(
diff --git a/packages/server-core/src/subscription/crud.ts b/packages/server-core/src/subscription/crud.ts
index 142c19c..b4f339f 100644
--- a/packages/server-core/src/subscription/crud.ts
+++ b/packages/server-core/src/subscription/crud.ts
@@ -72,6 +72,38 @@ export function normalizeSubscriptionNodeList(value: unknown): ParsedNode[] {
   return Array.isArray(value) ? stripImportedNodeControlFieldsFromList(value as ParsedNode[]) : [];
 }
 
+export function validateSubscriptionNodeList(value: unknown): ParsedNode[] {
+  if (!Array.isArray(value)) throw new Error("节点列表必须是数组");
+
+  for (let index = 0; index < value.length; index += 1) {
+    const item = value[index];
+    if (!isRecord(item)) throw new Error(`节点 #${index + 1} 必须是对象`);
+
+    const name = typeof item.name === "string" ? item.name.trim() : "";
+    const type = typeof item.type === "string" ? item.type.trim().toLowerCase() : "";
+    if (!name) throw new Error(`节点 #${index + 1} 缺少有效名称`);
+    if (!type) throw new Error(`节点 #${index + 1} 缺少有效类型`);
+
+    if (type === "relay") {
+      if (!Array.isArray(item.proxies) || item.proxies.length === 0 || item.proxies.some((proxy) => typeof proxy !== "string" || !proxy.trim())) {
+        throw new Error(`节点 #${index + 1} 的 relay proxies 必须是非空字符串数组`);
+      }
+      continue;
+    }
+
+    if (type === "direct" || type === "dns") continue;
+
+    if (typeof item.server !== "string" || !item.server.trim()) {
+      throw new Error(`节点 #${index + 1} 缺少有效服务器地址`);
+    }
+    if (typeof item.port !== "number" || !Number.isInteger(item.port) || item.port < 1 || item.port > 65535) {
+      throw new Error(`节点 #${index + 1} 的端口必须是 1 到 65535 的整数`);
+    }
+  }
+
+  return stripImportedNodeControlFieldsFromList(value as ParsedNode[]);
+}
+
 export function normalizeSubscriptionInfoForPersistence(value: unknown): Record<string, unknown> | null {
   return normalizeSubscriptionResponseInfo(value);
 }
diff --git a/packages/server-core/src/subscription/ssrf-ip.test.ts b/packages/server-core/src/subscription/ssrf-ip.test.ts
index 80e2f30..ee0d7e8 100644
--- a/packages/server-core/src/subscription/ssrf-ip.test.ts
+++ b/packages/server-core/src/subscription/ssrf-ip.test.ts
@@ -44,11 +44,20 @@ describe("SSRF IP classification", () => {
       "ff00::1",
       "2001:db8::1",
       "2001:0db8::1",
+      "100::1",
+      "100:0:0:1::1",
+      "2001:2::1",
+      "3fff::1",
+      "5f00::1",
+      "4000::1",
       "::ffff:127.0.0.1",
       "::ffff:c0a8:1",
       "0:0:0:0:0:ffff:7f00:1",
       "0:0:0:0:0:ffff:c0a8:1",
       "::127.0.0.1",
+      "64:ff9b::127.0.0.1",
+      "64:ff9b:1:7f00:0:100::",
+      "2002:7f00:1::",
     ]) {
       expect(isPrivateOrReservedIp(ip), ip).toBe(true);
     }
@@ -56,6 +65,11 @@ describe("SSRF IP classification", () => {
     expect(isPrivateOrReservedIp("2001:db80::1")).toBe(false);
     expect(isPrivateOrReservedIp("::ffff:8.8.8.8")).toBe(false);
     expect(isPrivateOrReservedIp("::ffff:808:808")).toBe(false);
+    expect(isPrivateOrReservedIp("::8.8.8.8")).toBe(false);
+    expect(isPrivateOrReservedIp("64:ff9b::8.8.8.8")).toBe(false);
+    expect(isPrivateOrReservedIp("2002:0808:0808::")).toBe(false);
+    expect(isPrivateOrReservedIp("2001:3::1")).toBe(false);
+    expect(isPrivateOrReservedIp("2001:4:112::1")).toBe(false);
   });
 
   it("identifies the benchmark range commonly used by fake-ip DNS", () => {
diff --git a/packages/server-core/src/subscription/ssrf-ip.ts b/packages/server-core/src/subscription/ssrf-ip.ts
index 736bfb2..2ae5aa0 100644
--- a/packages/server-core/src/subscription/ssrf-ip.ts
+++ b/packages/server-core/src/subscription/ssrf-ip.ts
@@ -67,6 +67,37 @@ function ipv4FromHextets(high: number, low: number): string {
   ].join(".");
 }
 
+type Ipv6CidrRule = {
+  base: string;
+  mask: number;
+  unsafe: boolean;
+};
+
+// Ordered from the most-specific globally reachable exceptions to their
+// enclosing special-purpose ranges. Keep this table aligned with the IANA
+// IPv6 Special-Purpose Address Registry.
+const IPV6_SPECIAL_PURPOSE_RULES: readonly Ipv6CidrRule[] = [
+  { base: "2001:1::1", mask: 128, unsafe: false },
+  { base: "2001:1::2", mask: 128, unsafe: false },
+  { base: "2001:1::3", mask: 128, unsafe: false },
+  { base: "2001:3::", mask: 32, unsafe: false },
+  { base: "2001:4:112::", mask: 48, unsafe: false },
+  { base: "2001:20::", mask: 28, unsafe: false },
+  { base: "2001:30::", mask: 28, unsafe: false },
+  { base: "::", mask: 128, unsafe: true },
+  { base: "::1", mask: 128, unsafe: true },
+  { base: "64:ff9b:1::", mask: 48, unsafe: true },
+  { base: "100::", mask: 64, unsafe: true },
+  { base: "100:0:0:1::", mask: 64, unsafe: true },
+  { base: "2001::", mask: 23, unsafe: true },
+  { base: "2001:db8::", mask: 32, unsafe: true },
+  { base: "3fff::", mask: 20, unsafe: true },
+  { base: "5f00::", mask: 16, unsafe: true },
+  { base: "fc00::", mask: 7, unsafe: true },
+  { base: "fe80::", mask: 10, unsafe: true },
+  { base: "ff00::", mask: 8, unsafe: true },
+];
+
 function expandIpv6Hextets(ip: string): number[] | null {
   let normalized = ip.toLowerCase();
   if (normalized.includes(".")) {
@@ -99,25 +130,62 @@ function expandIpv6Hextets(ip: string): number[] | null {
   return hextets;
 }
 
-function isPrivateOrReservedIPv6(ip: string): boolean {
-  const hextets = expandIpv6Hextets(ip);
-  if (!hextets) return true;
+function ipv6InCidr(hextets: readonly number[], base: string, maskBits: number): boolean {
+  const baseHextets = expandIpv6Hextets(base);
+  if (!baseHextets) return false;
+  const fullHextets = Math.floor(maskBits / 16);
+  for (let index = 0; index < fullHextets; index += 1) {
+    if (hextets[index] !== baseHextets[index]) return false;
+  }
+  const remainingBits = maskBits % 16;
+  if (remainingBits === 0) return true;
+  const mask = (0xffff << (16 - remainingBits)) & 0xffff;
+  return (hextets[fullHextets] & mask) === (baseHextets[fullHextets] & mask);
+}
 
-  const [first, second] = hextets;
-  const allButLastZero = hextets.slice(0, 7).every((part) => part === 0);
-  if (hextets.every((part) => part === 0) || (allButLastZero && hextets[7] === 1)) return true;
-  if ((first & 0xfe00) === 0xfc00) return true;
-  if ((first & 0xffc0) === 0xfe80) return true;
-  if ((first & 0xff00) === 0xff00) return true;
-  if (first === 0x2001 && second === 0x0db8) return true;
+function classifySpecialPurposeIpv6(hextets: readonly number[]): boolean | null {
+  for (const rule of IPV6_SPECIAL_PURPOSE_RULES) {
+    if (ipv6InCidr(hextets, rule.base, rule.mask)) return rule.unsafe;
+  }
+  return null;
+}
 
+function extractEmbeddedIpv4(hextets: readonly number[]): string | null {
   const isIpv4Compatible = hextets.slice(0, 6).every((part) => part === 0);
   const isIpv4Mapped = hextets.slice(0, 5).every((part) => part === 0) && hextets[5] === 0xffff;
-  if (isIpv4Compatible || isIpv4Mapped) {
-    return isPrivateOrReservedIPv4(ipv4FromHextets(hextets[6], hextets[7]));
+  const isWellKnownNat64 = hextets[0] === 0x0064 && hextets[1] === 0xff9b && hextets[2] === 0;
+  if (isIpv4Compatible || isIpv4Mapped || isWellKnownNat64) {
+    return ipv4FromHextets(hextets[6], hextets[7]);
   }
 
-  return false;
+  // RFC 6052 /48 form: v4[0..15] occupies bits 48..63, the u octet
+  // at bits 64..71 is zero, and v4[16..31] occupies bits 72..87.
+  const isLocalUseNat64 = hextets[0] === 0x0064 && hextets[1] === 0xff9b && hextets[2] === 1;
+  if (isLocalUseNat64 && (hextets[4] >> 8) === 0) {
+    const low = ((hextets[4] & 0xff) << 8) | (hextets[5] >> 8);
+    return ipv4FromHextets(hextets[3], low);
+  }
+
+  if (hextets[0] === 0x2002) {
+    return ipv4FromHextets(hextets[1], hextets[2]);
+  }
+
+  return null;
+}
+
+function isPrivateOrReservedIPv6(ip: string): boolean {
+  const hextets = expandIpv6Hextets(ip);
+  if (!hextets) return true;
+
+  const specialPurpose = classifySpecialPurposeIpv6(hextets);
+  if (specialPurpose !== null) return specialPurpose;
+
+  const embeddedIpv4 = extractEmbeddedIpv4(hextets);
+  if (embeddedIpv4) return isPrivateOrReservedIPv4(embeddedIpv4);
+
+  // IANA currently assigns globally routable IPv6 unicast space from
+  // 2000::/3. Other unicast blocks are reserved and must not be SSRF targets.
+  return !ipv6InCidr(hextets, "2000::", 3);
 }
 
 export function isPrivateOrReservedIp(hostname: string): boolean {
diff --git a/packages/ui/src/store/config-store/source-actions-multiple.test.ts b/packages/ui/src/store/config-store/source-actions-multiple.test.ts
index 53c4c0c..8979cf7 100644
--- a/packages/ui/src/store/config-store/source-actions-multiple.test.ts
+++ b/packages/ui/src/store/config-store/source-actions-multiple.test.ts
@@ -13,6 +13,20 @@ import {
 
 const mocks = getSourceActionMocks();
 
+type DeferredFetchResult = {
+  content: string;
+  headers: Record<string, string>;
+  parseResult: ReturnType<typeof parseResult>;
+};
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((done) => {
+    resolve = done;
+  });
+  return { promise, resolve };
+}
+
 describe("createSourceActions parseMultipleSources", () => {
   beforeEach(resetSourceActionMocks);
 
@@ -358,4 +372,35 @@ describe("createSourceActions parseMultipleSources", () => {
       nodeCount: 3,
     });
   });
+
+  it("discards the entire batch when any source fingerprint changes before completion", async () => {
+    const first = deferred<DeferredFetchResult>();
+    const second = deferred<DeferredFetchResult>();
+    mocks.fetchUrlContentInBrowser.mockReturnValueOnce(first.promise).mockReturnValueOnce(second.promise);
+    const sources = [
+      source({ id: "s1", type: "url", content: "https://example.com/one" }),
+      source({ id: "s2", type: "url", content: "https://example.com/two" }),
+    ];
+    const { actions, getState } = createHarness({ sources, nodes: [node("Keep")] });
+
+    const running = actions.parseMultipleSources(sources);
+    actions.setSources(
+      getState().sources.map((item: SubscriptionSource) =>
+        item.id === "s2" ? { ...item, nameTemplate: "{name}-changed" } : item
+      )
+    );
+    first.resolve({ content: "one", headers: {}, parseResult: parseResult([node("One")]) });
+    await Promise.resolve();
+    second.resolve({ content: "two", headers: {}, parseResult: parseResult([node("Two")]) });
+    await running;
+
+    expect(getState().isLoading).toBe(false);
+    expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual(["Keep"]);
+    expect(getState().sources).toEqual([
+      expect.objectContaining({ id: "s1" }),
+      expect.objectContaining({ id: "s2", nameTemplate: "{name}-changed" }),
+    ]);
+    expect(getState().sources[0]).not.toHaveProperty("parsed");
+    expect(getState().sources[1]).not.toHaveProperty("parsed");
+  });
 });
diff --git a/packages/ui/src/store/config-store/source-actions.test.ts b/packages/ui/src/store/config-store/source-actions.test.ts
index c3baf95..afd0b7a 100644
--- a/packages/ui/src/store/config-store/source-actions.test.ts
+++ b/packages/ui/src/store/config-store/source-actions.test.ts
@@ -13,6 +13,20 @@ import {
 
 const mocks = getSourceActionMocks();
 
+type DeferredFetchResult = {
+  content: string;
+  headers: Record<string, string>;
+  parseResult: ReturnType<typeof parseResult>;
+};
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((done) => {
+    resolve = done;
+  });
+  return { promise, resolve };
+}
+
 describe("createSourceActions", () => {
   beforeEach(resetSourceActionMocks);
 
@@ -539,4 +553,61 @@ describe("createSourceActions", () => {
     ]);
   });
 
+  it("discards a pending single-source result after its input fingerprint changes", async () => {
+    const pending = deferred<DeferredFetchResult>();
+    mocks.fetchUrlContentInBrowser.mockReturnValueOnce(pending.promise);
+    const original = source({ id: "s1", type: "url", content: "https://example.com/old" });
+    const { actions, getState } = createHarness({ sources: [original] });
+
+    const running = actions.parseSingleSource("s1");
+    actions.setSources([
+      { ...getState().sources[0], content: "https://example.com/new", userinfoUserAgent: "new-agent" },
+    ]);
+    pending.resolve({ content: "old", headers: {}, parseResult: parseResult([node("Old")]) });
+    await running;
+
+    expect(getState().nodes).toEqual([]);
+    expect(getState().sources[0]).toMatchObject({
+      content: "https://example.com/new",
+      userinfoUserAgent: "new-agent",
+      parsing: false,
+    });
+    expect(getState().sources[0].parsed).not.toBe(true);
+  });
+
+  it("discards a pending single-source result after the source is deleted", async () => {
+    const pending = deferred<DeferredFetchResult>();
+    mocks.fetchUrlContentInBrowser.mockReturnValueOnce(pending.promise);
+    const { actions, getState } = createHarness({
+      sources: [source({ id: "s1", type: "url", content: "https://example.com/sub" })],
+    });
+
+    const running = actions.parseSingleSource("s1");
+    actions.setSources([]);
+    pending.resolve({ content: "old", headers: {}, parseResult: parseResult([node("Deleted")]) });
+    await running;
+
+    expect(getState().sources).toEqual([]);
+    expect(getState().nodes).toEqual([]);
+  });
+
+  it("keeps the newest result when two single-source imports finish in reverse order", async () => {
+    const first = deferred<DeferredFetchResult>();
+    const second = deferred<DeferredFetchResult>();
+    mocks.fetchUrlContentInBrowser.mockReturnValueOnce(first.promise).mockReturnValueOnce(second.promise);
+    const { actions, getState } = createHarness({
+      sources: [source({ id: "s1", type: "url", content: "https://example.com/sub" })],
+    });
+
+    const olderRun = actions.parseSingleSource("s1");
+    const newerRun = actions.parseSingleSource("s1");
+    second.resolve({ content: "new", headers: {}, parseResult: parseResult([node("New")]) });
+    await newerRun;
+    first.resolve({ content: "old", headers: {}, parseResult: parseResult([node("Old")]) });
+    await olderRun;
+
+    expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual(["New"]);
+    expect(getState().sources[0]).toMatchObject({ parsed: true, parsing: false, nodeCount: 1 });
+  });
+
 });
diff --git a/packages/ui/src/store/config-store/source-actions.ts b/packages/ui/src/store/config-store/source-actions.ts
index f58464b..4ecd5b9 100644
--- a/packages/ui/src/store/config-store/source-actions.ts
+++ b/packages/ui/src/store/config-store/source-actions.ts
@@ -33,6 +33,7 @@ import {
   withUniqueNodeNames,
 } from "./definitions";
 import type { GetState, SetAndGenerateConfig, SetState, StoreState } from "./store-types";
+import { SourceImportOperationGuard, type SingleSourceImportOperation } from "./source-import-operation";
 
 type SourceActions = Pick<
   ConfigActions,
@@ -75,6 +76,18 @@ function filterDialerProxyGroupsByAvailableNames(
 }
 
 export function createSourceActions(set: SetState, get: GetState, setAndGenerateConfig: SetAndGenerateConfig): SourceActions {
+  const importOperations = new SourceImportOperationGuard();
+  const discardStaleSingle = (operation: SingleSourceImportOperation): boolean => {
+    if (importOperations.isSingleCurrent(get().sources, operation)) return false;
+    if (importOperations.ownsSingle(operation)) {
+      set((state) => ({
+        sources: state.sources.map((source) => source.id === operation.sourceId ? { ...source, parsing: false } : source),
+      }));
+    }
+    importOperations.finishSingle(operation);
+    return true;
+  };
+
   return {
     // 设置订阅源
     setSources: (sources: SubscriptionSource[]) => {
@@ -116,7 +129,11 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
 
     // 解析订阅内容
     parseContent: (content: string) => {
-      set({ isLoading: true });
+      importOperations.cancelAll();
+      set((state) => ({
+        isLoading: true,
+        sources: state.sources.map((source) => (source.parsing ? { ...source, parsing: false } : source)),
+      }));
 
       try {
         const result: ParseResult = parseSubscription(content);
@@ -165,6 +182,7 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
       const { sources } = get();
       const source = sources.find((s) => s.id === sourceId);
       if (!source || !source.content.trim()) return;
+      const operation = importOperations.startSingle(source);
 
       const currentSourceContent =
         source.type === "url"
@@ -181,11 +199,12 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
       const lastNameTemplate = typeof source.lastParsedNameTemplate === "string" ? source.lastParsedNameTemplate.trim() : "";
 
       // 标记为解析中
-      set({
-        sources: sources.map((s) =>
+      set((state) => ({
+        isLoading: false,
+        sources: state.sources.map((s) =>
           s.id === sourceId ? { ...s, parsing: true, error: undefined, errorInfo: undefined } : s
         ),
-      });
+      }));
 
       try {
         let contentToParse = source.content;
@@ -204,6 +223,8 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
             throw new Error("只支持 HTTP/HTTPS url");
           }
 
+          if (discardStaleSingle(operation)) return;
+
           setAndGenerateConfig((state) => {
             const baseNodes = detachSourceNodesFromState(state.nodes, sourceId).nodes;
 
@@ -240,6 +261,7 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
               parseErrors: [],
             };
           });
+          importOperations.finishSingle(operation);
           return;
         }
 
@@ -279,6 +301,8 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
           currentNameTemplate,
         });
 
+        if (discardStaleSingle(operation)) return;
+
         // 刷新此订阅源解析出的节点：尽量保留用户顺序/手动改名，仅更新节点内容与来源归属。
         setAndGenerateConfig((state) => {
           const merged = mergeParsedSourceNodes(state.nodes, parsedNodes, state.deletedNodeNames, {
@@ -354,7 +378,9 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
             parseErrors: result.errors.map(sanitizePublicErrorText).filter((e) => e !== ""),
           };
         });
+        importOperations.finishSingle(operation);
       } catch (error) {
+        if (discardStaleSingle(operation)) return;
         const baseInfo = toSubscriptionImportErrorInfo(error);
         const shouldHintProxyProviders =
           source.type === "url" &&
@@ -383,12 +409,18 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
               : s
           ),
         }));
+        importOperations.finishSingle(operation);
       }
     },
 
     // 解析多个订阅源
     parseMultipleSources: async (sources: SubscriptionSource[]) => {
-      set({ isLoading: true, parseErrors: [] });
+      const operation = importOperations.startBatch(sources);
+      set((state) => ({
+        isLoading: true,
+        parseErrors: [],
+        sources: state.sources.map((source) => (source.parsing ? { ...source, parsing: false } : source)),
+      }));
 
       const allNodes: ParsedNode[] = [];
       const allErrors: string[] = [];
@@ -574,6 +606,12 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
       // 确保 name 全局唯一（Clash 要求 proxies.name 唯一）
       const uniqueNamedNodes = withUniqueNodeNames(uniqueNodes, new Set<string>());
 
+      if (!importOperations.isBatchCurrent(get().sources, operation)) {
+        if (importOperations.ownsBatch(operation)) set({ isLoading: false });
+        importOperations.finishBatch(operation);
+        return;
+      }
+
       setAndGenerateConfig((state) => {
         const deleted = new Set(state.deletedNodeNames);
         const normalizedCandidates = uniqueNamedNodes.map((node) => {
@@ -652,6 +690,7 @@ export function createSourceActions(set: SetState, get: GetState, setAndGenerate
           }),
         };
       });
+      importOperations.finishBatch(operation);
     },
   };
 }
diff --git a/packages/ui/src/store/config-store/source-import-operation.ts b/packages/ui/src/store/config-store/source-import-operation.ts
new file mode 100644
index 0000000..d5c40f0
--- /dev/null
+++ b/packages/ui/src/store/config-store/source-import-operation.ts
@@ -0,0 +1,90 @@
+import type { SubscriptionSource } from "./definitions";
+
+export type SingleSourceImportOperation = {
+  id: number;
+  sourceId: string;
+  fingerprint: string;
+};
+
+export type BatchSourceImportOperation = {
+  id: number;
+  sources: Array<{ sourceId: string; fingerprint: string }>;
+};
+
+export function buildSourceImportFingerprint(source: SubscriptionSource): string {
+  return JSON.stringify([
+    source.type,
+    source.content,
+    typeof source.tag === "string" ? source.tag : null,
+    typeof source.nameTemplate === "string" ? source.nameTemplate : null,
+    source.useProxyProviders === true,
+    typeof source.userinfoUrl === "string" ? source.userinfoUrl : null,
+    typeof source.userinfoUserAgent === "string" ? source.userinfoUserAgent : null,
+  ]);
+}
+
+export class SourceImportOperationGuard {
+  private sequence = 0;
+  private readonly singleOperations = new Map<string, number>();
+  private activeBatchId: number | null = null;
+
+  startSingle(source: SubscriptionSource): SingleSourceImportOperation {
+    this.activeBatchId = null;
+    const operation = {
+      id: ++this.sequence,
+      sourceId: source.id,
+      fingerprint: buildSourceImportFingerprint(source),
+    };
+    this.singleOperations.set(source.id, operation.id);
+    return operation;
+  }
+
+  startBatch(sources: readonly SubscriptionSource[]): BatchSourceImportOperation {
+    const operation = {
+      id: ++this.sequence,
+      sources: sources.map((source) => ({
+        sourceId: source.id,
+        fingerprint: buildSourceImportFingerprint(source),
+      })),
+    };
+    this.singleOperations.clear();
+    this.activeBatchId = operation.id;
+    return operation;
+  }
+
+  cancelAll(): void {
+    this.singleOperations.clear();
+    this.activeBatchId = null;
+  }
+
+  ownsSingle(operation: SingleSourceImportOperation): boolean {
+    return this.singleOperations.get(operation.sourceId) === operation.id;
+  }
+
+  isSingleCurrent(sources: readonly SubscriptionSource[], operation: SingleSourceImportOperation): boolean {
+    if (!this.ownsSingle(operation)) return false;
+    const current = sources.find((source) => source.id === operation.sourceId);
+    return Boolean(current && buildSourceImportFingerprint(current) === operation.fingerprint);
+  }
+
+  finishSingle(operation: SingleSourceImportOperation): void {
+    if (this.ownsSingle(operation)) this.singleOperations.delete(operation.sourceId);
+  }
+
+  ownsBatch(operation: BatchSourceImportOperation): boolean {
+    return this.activeBatchId === operation.id;
+  }
+
+  isBatchCurrent(sources: readonly SubscriptionSource[], operation: BatchSourceImportOperation): boolean {
+    if (!this.ownsBatch(operation)) return false;
+    const currentById = new Map(sources.map((source) => [source.id, source]));
+    return operation.sources.every(({ sourceId, fingerprint }) => {
+      const current = currentById.get(sourceId);
+      return Boolean(current && buildSourceImportFingerprint(current) === fingerprint);
+    });
+  }
+
+  finishBatch(operation: BatchSourceImportOperation): void {
+    if (this.ownsBatch(operation)) this.activeBatchId = null;
+  }
+}

From a11e2c670a4427ea2997dc04c2b9e608cd2123eb Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Thu, 16 Jul 2026 08:39:08 +0800
Subject: [PATCH 14/36] fix: harden local runtime boundaries

---
 local/app/api/auth/local-auth-routes.test.ts  |   9 ++
 local/app/api/auth/login/route.ts             |  23 +--
 .../api/cron/update-subscriptions/route.ts    |  41 +++++-
 .../api/settings/source-import/route.test.ts  |  12 ++
 local/app/api/settings/source-import/route.ts |   7 +-
 local/app/api/setup/admin/route.test.ts       |  59 ++++++--
 local/app/api/setup/admin/route.ts            |  33 +++--
 local/app/api/source-import/route.ts          |  10 +-
 .../[id]/config.yaml/route.test.ts            |  25 +++-
 .../subscriptions/[id]/config.yaml/route.ts   |  18 ++-
 local/app/api/templates/route.ts              |  11 +-
 .../migration.sql                             |  10 ++
 local/prisma/schema.prisma                    |   9 ++
 local/src/components/local-login.test.ts      |  48 +++++-
 local/src/components/local-login.tsx          |  20 ++-
 local/src/lib/auto-update-service.test.ts     |  32 +++-
 local/src/lib/auto-update-service.ts          | 107 ++++++++++----
 local/src/lib/http.ts                         |  57 +++++++-
 local/src/lib/job-lease.test.ts               |  56 +++++++
 local/src/lib/job-lease.ts                    |  99 +++++++++++++
 local/src/lib/local-helpers.test.ts           |  17 ++-
 local/src/lib/pinned-http.test.ts             |  55 +++++++
 local/src/lib/pinned-http.ts                  | 123 ++++++++++++++++
 local/src/lib/rate-limit.test.ts              |  24 +++
 local/src/lib/rate-limit.ts                   |  46 +++++-
 local/src/lib/setup-token.test.ts             |  27 ++++
 local/src/lib/setup-token.ts                  |  15 ++
 local/src/lib/source-import.test.ts           |  69 +++++++--
 local/src/lib/source-import.ts                | 138 +++++++++++++-----
 .../lib/subscription-route-handlers.test.ts   |  20 ++-
 local/src/lib/subscription-route-handlers.ts  |  12 +-
 local/src/lib/subscription-service.test.ts    |  52 ++++++-
 local/src/lib/subscription-service.ts         |  75 ++++++++--
 local/test/auto-update-service.test.ts        |  29 ++--
 local/test/cron-route-contract.test.ts        |  43 ++++++
 .../test/source-import-route-contract.test.ts |  13 ++
 .../test/subscription-route-contract.test.ts  |  14 ++
 local/test/template-route-contract.test.ts    |  13 ++
 38 files changed, 1276 insertions(+), 195 deletions(-)
 create mode 100644 local/prisma/migrations/20260716091000_job_lease_lock/migration.sql
 create mode 100644 local/src/lib/job-lease.test.ts
 create mode 100644 local/src/lib/job-lease.ts
 create mode 100644 local/src/lib/pinned-http.test.ts
 create mode 100644 local/src/lib/pinned-http.ts
 create mode 100644 local/src/lib/setup-token.test.ts
 create mode 100644 local/src/lib/setup-token.ts

diff --git a/local/app/api/auth/local-auth-routes.test.ts b/local/app/api/auth/local-auth-routes.test.ts
index e793ea2..908b4c0 100644
--- a/local/app/api/auth/local-auth-routes.test.ts
+++ b/local/app/api/auth/local-auth-routes.test.ts
@@ -103,6 +103,15 @@ describe("local auth and health routes", () => {
       status: 401,
       body: { error: "Invalid username or password.", code: "UNAUTHORIZED" },
     });
+
+    await expect(readJson(await POST(new Request("https://local.test/api/auth/login", {
+      method: "POST",
+      headers: { "content-length": String(64 * 1024 + 1) },
+      body: "{}",
+    })))).resolves.toEqual({
+      status: 413,
+      body: { error: "Request body is too large.", code: "PAYLOAD_TOO_LARGE" },
+    });
   });
 
   it("logs out by clearing the session cookie", async () => {
diff --git a/local/app/api/auth/login/route.ts b/local/app/api/auth/login/route.ts
index 7a59498..795c604 100644
--- a/local/app/api/auth/login/route.ts
+++ b/local/app/api/auth/login/route.ts
@@ -1,10 +1,11 @@
 import bcrypt from "bcryptjs";
 import { NextResponse } from "next/server";
-import { apiError, getStringField, readJsonBody } from "@local/lib/http";
+import { apiError, getStringField, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import { prisma } from "@local/lib/prisma";
 import { sessionCookieOptions, signSession, SESSION_COOKIE } from "@local/lib/session";
 import {
   consumeLocalRateLimit,
+  getTrustedClientRateLimitKey,
   hashLocalRateLimitKey,
   localRateLimitResponse,
   resetLocalRateLimit,
@@ -13,16 +14,20 @@ import {
 const LOGIN_WINDOW_MS = 15 * 60 * 1000;
 
 export async function POST(request: Request) {
-  const globalLimit = consumeLocalRateLimit("auth-login-global", "all", {
-    limit: 30,
-    windowMs: LOGIN_WINDOW_MS,
-  });
-  if (!globalLimit.allowed) {
-    return localRateLimitResponse("Too many login attempts. Try again later.", globalLimit.retryAfterSeconds);
+  const clientKey = getTrustedClientRateLimitKey(request);
+  if (clientKey) {
+    const clientLimit = consumeLocalRateLimit("auth-login-client", clientKey, {
+      limit: 30,
+      windowMs: LOGIN_WINDOW_MS,
+    });
+    if (!clientLimit.allowed) {
+      return localRateLimitResponse("Too many login attempts. Try again later.", clientLimit.retryAfterSeconds);
+    }
   }
 
-  const body = await readJsonBody(request);
-  if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+  const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.small);
+  if (!parsedBody.ok) return jsonBodyError(parsedBody);
+  const body = parsedBody.value;
 
   const username = getStringField(body, "username");
   const password = getStringField(body, "password");
diff --git a/local/app/api/cron/update-subscriptions/route.ts b/local/app/api/cron/update-subscriptions/route.ts
index 44cc195..f36242d 100644
--- a/local/app/api/cron/update-subscriptions/route.ts
+++ b/local/app/api/cron/update-subscriptions/route.ts
@@ -2,15 +2,44 @@ import { NextRequest } from "next/server";
 import { json } from "@local/lib/http";
 import { requireLocalCronAuth } from "@local/lib/cron-auth";
 import { runLocalSubscriptionAutoUpdateCron } from "@local/lib/auto-update-service";
+import {
+  acquireLocalJobLease,
+  JobLeaseLostError,
+  releaseLocalJobLease,
+  startLocalJobLeaseHeartbeat,
+  type LocalJobLease,
+} from "@local/lib/job-lease";
+
+const LEASE_NAME = "local-subscription-auto-update";
+const LEASE_MS = 5 * 60 * 1000;
+const HEARTBEAT_MS = 60 * 1000;
 
 export async function POST(request: NextRequest) {
   const authError = requireLocalCronAuth(request);
   if (authError) return authError;
 
-  const summary = await runLocalSubscriptionAutoUpdateCron();
-  return json({
-    success: true,
-    ...summary,
-    timestamp: new Date().toISOString(),
-  });
+  let lease: LocalJobLease | null = null;
+  let heartbeat: ReturnType<typeof startLocalJobLeaseHeartbeat> | null = null;
+  try {
+    lease = await acquireLocalJobLease({ name: LEASE_NAME, leaseMs: LEASE_MS });
+    if (!lease) return json({ success: true, skipped: true, reason: "already_running" });
+
+    heartbeat = startLocalJobLeaseHeartbeat({ lease, leaseMs: LEASE_MS, intervalMs: HEARTBEAT_MS });
+    const summary = await runLocalSubscriptionAutoUpdateCron(new Date(), {
+      assertLease: heartbeat.assertOwned,
+    });
+    return json({
+      success: true,
+      ...summary,
+      timestamp: new Date().toISOString(),
+    });
+  } catch (error) {
+    if (error instanceof JobLeaseLostError) {
+      return json({ error: "Local subscription update lease lost.", code: "JOB_LEASE_LOST" }, 503);
+    }
+    throw error;
+  } finally {
+    await heartbeat?.stop();
+    if (lease) await releaseLocalJobLease(lease).catch(() => undefined);
+  }
 }
diff --git a/local/app/api/settings/source-import/route.test.ts b/local/app/api/settings/source-import/route.test.ts
index 1a7dfda..9e42244 100644
--- a/local/app/api/settings/source-import/route.test.ts
+++ b/local/app/api/settings/source-import/route.test.ts
@@ -102,4 +102,16 @@ describe("local source import settings route", () => {
     });
     expect(mocks.prisma.localAdmin.update).not.toHaveBeenCalled();
   });
+
+  it("rejects settings bodies above 64 KiB", async () => {
+    const response = await PATCH(new Request("https://local.test/api/settings/source-import", {
+      method: "PATCH",
+      headers: { "content-length": String(64 * 1024 + 1) },
+      body: "{}",
+    }));
+    expect(await readJson(response)).toEqual({
+      status: 413,
+      body: { error: "Request body is too large.", code: "PAYLOAD_TOO_LARGE" },
+    });
+  });
 });
diff --git a/local/app/api/settings/source-import/route.ts b/local/app/api/settings/source-import/route.ts
index 02f571b..abcc298 100644
--- a/local/app/api/settings/source-import/route.ts
+++ b/local/app/api/settings/source-import/route.ts
@@ -1,5 +1,5 @@
 import { withCurrentAdmin } from "@local/lib/api-auth";
-import { apiError, json, readJsonBody } from "@local/lib/http";
+import { apiError, json, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import { prisma } from "@local/lib/prisma";
 
 export async function GET() {
@@ -16,8 +16,9 @@ export async function GET() {
 
 export async function PATCH(request: Request) {
   return withCurrentAdmin(async (admin) => {
-    const body = await readJsonBody(request);
-    if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.small);
+    if (!parsedBody.ok) return jsonBodyError(parsedBody);
+    const body = parsedBody.value;
 
     const allowUnsafeSubscriptionSources =
       typeof body === "object" && !Array.isArray(body)
diff --git a/local/app/api/setup/admin/route.test.ts b/local/app/api/setup/admin/route.test.ts
index edff592..a9a4198 100644
--- a/local/app/api/setup/admin/route.test.ts
+++ b/local/app/api/setup/admin/route.test.ts
@@ -3,6 +3,10 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 const mocks = vi.hoisted(() => ({
   hash: vi.fn(),
   readJsonBody: vi.fn(),
+  jsonBodyError: vi.fn((result: { reason: string }, message: string) => new Response(JSON.stringify({
+    error: result.reason === "too_large" ? "Request body is too large." : message,
+    code: result.reason === "too_large" ? "PAYLOAD_TOO_LARGE" : "BAD_REQUEST",
+  }), { status: result.reason === "too_large" ? 413 : 400 })),
   apiError: vi.fn((message: string, code: string, status: number) => new Response(JSON.stringify({ error: message, code }), { status })),
   getStringField: vi.fn((body: Record<string, unknown>, key: string) => (typeof body[key] === "string" ? String(body[key]).trim() : "")),
   count: vi.fn(),
@@ -17,6 +21,8 @@ vi.mock("bcryptjs", () => ({ default: { hash: mocks.hash } }));
 vi.mock("@local/lib/http", () => ({
   apiError: mocks.apiError,
   getStringField: mocks.getStringField,
+  jsonBodyError: mocks.jsonBodyError,
+  LOCAL_JSON_BODY_LIMITS: { small: 64 * 1024 },
   readJsonBody: mocks.readJsonBody,
 }));
 vi.mock("@local/lib/prisma", () => ({
@@ -41,10 +47,17 @@ async function readJson(response: Response) {
   return { status: response.status, body: await response.json(), headers: response.headers };
 }
 
+function setupRequest(token = "setup-secret") {
+  return new Request("https://local.test/api/setup/admin", {
+    headers: token ? { "X-SubBoost-Setup-Token": token } : {},
+  });
+}
+
 describe("local setup admin route", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     clearLocalRateLimitsForTests();
+    process.env.LOCAL_SETUP_TOKEN = "setup-secret";
     mocks.count.mockResolvedValue(0);
     mocks.hash.mockResolvedValue("hash");
     mocks.create.mockResolvedValue({ id: "admin-1", username: "ry" });
@@ -57,46 +70,46 @@ describe("local setup admin route", () => {
   });
 
   it("rejects invalid JSON, existing admins, and invalid credentials", async () => {
-    mocks.readJsonBody.mockResolvedValueOnce(null);
-    expect(await readJson(await POST(new Request("https://local.test/api/setup/admin")))).toMatchObject({
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: false, reason: "invalid_json" });
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
       status: 400,
       body: { error: "请求格式有误，请刷新页面后重试", code: "BAD_REQUEST" },
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ username: "ry", password: "long-password", passwordConfirm: "long-password" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { username: "ry", password: "long-password", passwordConfirm: "long-password" } });
     mocks.count.mockResolvedValueOnce(1);
-    expect(await readJson(await POST(new Request("https://local.test/api/setup/admin")))).toMatchObject({
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
       status: 409,
       body: { error: "已有管理员账号，请直接登录", code: "CONFLICT" },
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ username: "ry", password: "short", passwordConfirm: "short" });
-    expect(await readJson(await POST(new Request("https://local.test/api/setup/admin")))).toMatchObject({
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { username: "ry", password: "short", passwordConfirm: "short" } });
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
       status: 400,
       body: { error: "密码至少需要 10 个字符", code: "BAD_REQUEST" },
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ username: "", password: "long-password", passwordConfirm: "long-password" });
-    expect(await readJson(await POST(new Request("https://local.test/api/setup/admin")))).toMatchObject({
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { username: "", password: "long-password", passwordConfirm: "long-password" } });
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
       status: 400,
       body: { error: "请输入管理员账号", code: "BAD_REQUEST" },
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ username: "ry", password: "long-password", passwordConfirm: "different-password" });
-    expect(await readJson(await POST(new Request("https://local.test/api/setup/admin")))).toMatchObject({
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { username: "ry", password: "long-password", passwordConfirm: "different-password" } });
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
       status: 400,
       body: { error: "两次输入的密码不一致，请重新确认", code: "BAD_REQUEST" },
     });
   });
 
   it("creates the first local admin and sets the session cookie", async () => {
-    mocks.readJsonBody.mockResolvedValue({
+    mocks.readJsonBody.mockResolvedValue({ ok: true, value: {
       username: " ry ",
       password: "long-password",
       passwordConfirm: "long-password",
-    });
+    } });
 
-    const result = await readJson(await POST(new Request("https://local.test/api/setup/admin")));
+    const result = await readJson(await POST(setupRequest()));
 
     expect(result.status).toBe(200);
     expect(result.body).toEqual({ success: true, user: { id: "admin-1", username: "ry" } });
@@ -110,14 +123,14 @@ describe("local setup admin route", () => {
   });
 
   it("rechecks setup state under a database lock", async () => {
-    mocks.readJsonBody.mockResolvedValue({
+    mocks.readJsonBody.mockResolvedValue({ ok: true, value: {
       username: "ry",
       password: "long-password",
       passwordConfirm: "long-password",
-    });
+    } });
     mocks.count.mockResolvedValueOnce(0).mockResolvedValueOnce(1);
 
-    const result = await readJson(await POST(new Request("https://local.test/api/setup/admin")));
+    const result = await readJson(await POST(setupRequest()));
 
     expect(result).toMatchObject({
       status: 409,
@@ -129,4 +142,18 @@ describe("local setup admin route", () => {
     );
     expect(mocks.create).not.toHaveBeenCalled();
   });
+
+  it("fails closed when the setup token is missing or misconfigured", async () => {
+    expect(await readJson(await POST(setupRequest("wrong")))).toMatchObject({
+      status: 403,
+      body: { code: "FORBIDDEN" },
+    });
+
+    delete process.env.LOCAL_SETUP_TOKEN;
+    expect(await readJson(await POST(setupRequest()))).toMatchObject({
+      status: 503,
+      body: { code: "CONFIGURATION_ERROR" },
+    });
+    expect(mocks.readJsonBody).not.toHaveBeenCalled();
+  });
 });
diff --git a/local/app/api/setup/admin/route.ts b/local/app/api/setup/admin/route.ts
index 2f2ef74..cb0a87c 100644
--- a/local/app/api/setup/admin/route.ts
+++ b/local/app/api/setup/admin/route.ts
@@ -1,22 +1,35 @@
 import bcrypt from "bcryptjs";
 import { NextResponse } from "next/server";
 import { getLocalAdminSetupCredentialError, LOCAL_ADMIN_CREDENTIAL_MESSAGES } from "@local/lib/admin-credentials";
-import { apiError, getStringField, readJsonBody } from "@local/lib/http";
+import { apiError, getStringField, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import { prisma } from "@local/lib/prisma";
 import { sessionCookieOptions, signSession, SESSION_COOKIE } from "@local/lib/session";
-import { consumeLocalRateLimit, localRateLimitResponse } from "@local/lib/rate-limit";
+import { consumeLocalRateLimit, getTrustedClientRateLimitKey, localRateLimitResponse } from "@local/lib/rate-limit";
+import { validateLocalSetupToken } from "@local/lib/setup-token";
 
 export async function POST(request: Request) {
-  const setupLimit = consumeLocalRateLimit("admin-setup", "all", {
-    limit: 5,
-    windowMs: 15 * 60 * 1000,
-  });
-  if (!setupLimit.allowed) {
-    return localRateLimitResponse("Too many setup attempts. Try again later.", setupLimit.retryAfterSeconds);
+  const clientKey = getTrustedClientRateLimitKey(request);
+  if (clientKey) {
+    const setupLimit = consumeLocalRateLimit("admin-setup-client", clientKey, {
+      limit: 5,
+      windowMs: 15 * 60 * 1000,
+    });
+    if (!setupLimit.allowed) {
+      return localRateLimitResponse("Too many setup attempts. Try again later.", setupLimit.retryAfterSeconds);
+    }
+  }
+
+  const setupToken = validateLocalSetupToken(request);
+  if (setupToken === "missing_config") {
+    return apiError("LOCAL_SETUP_TOKEN is not configured.", "CONFIGURATION_ERROR", 503);
+  }
+  if (setupToken === "invalid") {
+    return apiError("Invalid setup token.", "FORBIDDEN", 403);
   }
 
-  const body = await readJsonBody(request);
-  if (!body) return apiError(LOCAL_ADMIN_CREDENTIAL_MESSAGES.invalidJson, "BAD_REQUEST", 400);
+  const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.small);
+  if (!parsedBody.ok) return jsonBodyError(parsedBody, LOCAL_ADMIN_CREDENTIAL_MESSAGES.invalidJson);
+  const body = parsedBody.value;
 
   const existingCount = await prisma.localAdmin.count();
   if (existingCount > 0) {
diff --git a/local/app/api/source-import/route.ts b/local/app/api/source-import/route.ts
index 0b62232..38bca35 100644
--- a/local/app/api/source-import/route.ts
+++ b/local/app/api/source-import/route.ts
@@ -1,5 +1,5 @@
 import { withCurrentAdmin } from "@local/lib/api-auth";
-import { apiError, json, readJsonBody } from "@local/lib/http";
+import { apiError, json, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import { importSourceUrlDirect } from "@local/lib/source-import";
 import { buildSourceImportParseResult } from "@subboost/server-core/subscription";
 
@@ -11,8 +11,12 @@ function getStringField(body: unknown, key: string): string {
 
 export async function POST(request: Request) {
   return withCurrentAdmin(async () => {
-    const body = await readJsonBody(request);
-    if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.small);
+    if (!parsedBody.ok) return jsonBodyError(parsedBody);
+    const body = parsedBody.value;
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    }
 
     const result = await importSourceUrlDirect({
       url: getStringField(body, "url"),
diff --git a/local/app/api/subscriptions/[id]/config.yaml/route.test.ts b/local/app/api/subscriptions/[id]/config.yaml/route.test.ts
index 6008a39..7506310 100644
--- a/local/app/api/subscriptions/[id]/config.yaml/route.test.ts
+++ b/local/app/api/subscriptions/[id]/config.yaml/route.test.ts
@@ -3,6 +3,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 const mocks = vi.hoisted(() => ({
   consumeLocalRateLimit: vi.fn(),
   generateSubscriptionYaml: vi.fn(),
+  getTrustedClientRateLimitKey: vi.fn(),
   hashLocalRateLimitKey: vi.fn(() => "token-hash"),
   localRateLimitResponse: vi.fn(
     () => new Response(JSON.stringify({ error: "limited", code: "RATE_LIMITED" }), { status: 429 })
@@ -11,6 +12,7 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock("@local/lib/rate-limit", () => ({
   consumeLocalRateLimit: mocks.consumeLocalRateLimit,
+  getTrustedClientRateLimitKey: mocks.getTrustedClientRateLimitKey,
   hashLocalRateLimitKey: mocks.hashLocalRateLimitKey,
   localRateLimitResponse: mocks.localRateLimitResponse,
 }));
@@ -24,6 +26,7 @@ describe("local subscription YAML route", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mocks.consumeLocalRateLimit.mockReturnValue({ allowed: true, retryAfterSeconds: 0 });
+    mocks.getTrustedClientRateLimitKey.mockReturnValue("client-hash");
     mocks.generateSubscriptionYaml.mockResolvedValue({
       yaml: "mixed-port: 7890\n",
       name: "Test",
@@ -34,7 +37,7 @@ describe("local subscription YAML route", () => {
     });
   });
 
-  it("applies global and per-token limits before generating YAML", async () => {
+  it("applies available client and per-token limits before generating YAML", async () => {
     const response = await GET(new Request("https://local.test/config.yaml"), {
       params: Promise.resolve({ id: "secret-token" }),
     });
@@ -43,8 +46,8 @@ describe("local subscription YAML route", () => {
     expect(mocks.hashLocalRateLimitKey).toHaveBeenCalledWith("secret-token");
     expect(mocks.consumeLocalRateLimit).toHaveBeenNthCalledWith(
       1,
-      "subscription-yaml-global",
-      "all",
+      "subscription-yaml-client",
+      "client-hash",
       { limit: 600, windowMs: 60_000 }
     );
     expect(mocks.consumeLocalRateLimit).toHaveBeenNthCalledWith(
@@ -70,4 +73,20 @@ describe("local subscription YAML route", () => {
     );
     expect(mocks.generateSubscriptionYaml).not.toHaveBeenCalled();
   });
+
+  it("skips the client bucket when no trustworthy client key is available", async () => {
+    mocks.getTrustedClientRateLimitKey.mockReturnValueOnce(null);
+
+    const response = await GET(new Request("https://local.test/config.yaml"), {
+      params: Promise.resolve({ id: "secret-token" }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(mocks.consumeLocalRateLimit).toHaveBeenCalledTimes(1);
+    expect(mocks.consumeLocalRateLimit).toHaveBeenCalledWith(
+      "subscription-yaml-token",
+      "token-hash",
+      { limit: 120, windowMs: 60_000 }
+    );
+  });
 });
diff --git a/local/app/api/subscriptions/[id]/config.yaml/route.ts b/local/app/api/subscriptions/[id]/config.yaml/route.ts
index 0a7d255..a5cf32e 100644
--- a/local/app/api/subscriptions/[id]/config.yaml/route.ts
+++ b/local/app/api/subscriptions/[id]/config.yaml/route.ts
@@ -3,6 +3,7 @@ import { generateSubscriptionYaml } from "@local/lib/subscription-service";
 import { buildSubscriptionResponseHeaders } from "@subboost/server-core/subscription";
 import {
   consumeLocalRateLimit,
+  getTrustedClientRateLimitKey,
   hashLocalRateLimitKey,
   localRateLimitResponse,
 } from "@local/lib/rate-limit";
@@ -11,14 +12,17 @@ type RouteContext = {
   params: Promise<{ id: string }>;
 };
 
-export async function GET(_request: Request, { params }: RouteContext) {
+export async function GET(request: Request, { params }: RouteContext) {
   const { id: token } = await params;
-  const globalLimit = consumeLocalRateLimit("subscription-yaml-global", "all", {
-    limit: 600,
-    windowMs: 60_000,
-  });
-  if (!globalLimit.allowed) {
-    return localRateLimitResponse("Too many subscription requests. Try again later.", globalLimit.retryAfterSeconds);
+  const clientKey = getTrustedClientRateLimitKey(request);
+  if (clientKey) {
+    const clientLimit = consumeLocalRateLimit("subscription-yaml-client", clientKey, {
+      limit: 600,
+      windowMs: 60_000,
+    });
+    if (!clientLimit.allowed) {
+      return localRateLimitResponse("Too many subscription requests. Try again later.", clientLimit.retryAfterSeconds);
+    }
   }
   const tokenLimit = consumeLocalRateLimit("subscription-yaml-token", hashLocalRateLimitKey(token), {
     limit: 120,
diff --git a/local/app/api/templates/route.ts b/local/app/api/templates/route.ts
index 8df3943..a755a53 100644
--- a/local/app/api/templates/route.ts
+++ b/local/app/api/templates/route.ts
@@ -1,5 +1,5 @@
 import { getOptionalCurrentAdmin, localAdminRequiredResponse, withCurrentAdmin } from "@local/lib/api-auth";
-import { apiError, json, readJsonBody } from "@local/lib/http";
+import { apiError, json, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import {
   createTemplate,
   deleteTemplate,
@@ -51,11 +51,14 @@ export async function GET(request: Request) {
 
 export async function POST(request: Request) {
   return withCurrentAdmin(async (admin) => {
-    const body = await readJsonBody(request);
-    if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.template);
+    if (!parsedBody.ok) return jsonBodyError(parsedBody);
+    if (!parsedBody.value || typeof parsedBody.value !== "object" || Array.isArray(parsedBody.value)) {
+      return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    }
 
     try {
-      const template = await createTemplate(admin.id, body);
+      const template = await createTemplate(admin.id, parsedBody.value);
       return json({ template }, 201);
     } catch (error) {
       return apiError(error instanceof Error ? error.message : "Unable to create template.", "BAD_REQUEST", 400);
diff --git a/local/prisma/migrations/20260716091000_job_lease_lock/migration.sql b/local/prisma/migrations/20260716091000_job_lease_lock/migration.sql
new file mode 100644
index 0000000..f40f6c8
--- /dev/null
+++ b/local/prisma/migrations/20260716091000_job_lease_lock/migration.sql
@@ -0,0 +1,10 @@
+CREATE TABLE "JobLeaseLock" (
+    "name" TEXT NOT NULL,
+    "ownerToken" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "JobLeaseLock_pkey" PRIMARY KEY ("name")
+);
+
+CREATE INDEX "JobLeaseLock_expiresAt_idx" ON "JobLeaseLock"("expiresAt");
diff --git a/local/prisma/schema.prisma b/local/prisma/schema.prisma
index 431db62..d21427c 100644
--- a/local/prisma/schema.prisma
+++ b/local/prisma/schema.prisma
@@ -73,3 +73,12 @@ model SubscriptionAutoUpdateState {
 
   subscription Subscription @relation(fields: [subscriptionId], references: [id], onDelete: Cascade)
 }
+
+model JobLeaseLock {
+  name       String   @id
+  ownerToken String
+  expiresAt  DateTime
+  updatedAt  DateTime @updatedAt
+
+  @@index([expiresAt])
+}
diff --git a/local/src/components/local-login.test.ts b/local/src/components/local-login.test.ts
index e422829..d7e3525 100644
--- a/local/src/components/local-login.test.ts
+++ b/local/src/components/local-login.test.ts
@@ -93,12 +93,19 @@ function response(body: unknown, ok = true) {
   } as unknown as Response;
 }
 
-function installWindow() {
+function installWindow(hash = "") {
+  const replaceState = vi.fn();
   Object.defineProperty(globalThis, "window", {
-    value: { location: { href: "" } },
+    value: {
+      location: { href: "", hash, pathname: "/login", search: "" },
+      history: { replaceState },
+    },
     configurable: true,
   });
-  return (globalThis as any).window as { location: { href: string } };
+  return (globalThis as any).window as {
+    location: { href: string; hash: string; pathname: string; search: string };
+    history: { replaceState: ReturnType<typeof vi.fn> };
+  };
 }
 
 function renderLogin(overrides: Record<number, unknown> = {}, runEffects = false) {
@@ -233,6 +240,7 @@ describe("local login component", () => {
       2: "long-secret",
       3: "long-secret",
       4: true,
+      7: "setup-secret",
     });
 
     expect(mocks.inputs.find((input) => input.placeholder === "密码").type).toBe("text");
@@ -244,6 +252,10 @@ describe("local login component", () => {
       "/api/setup/admin",
       expect.objectContaining({
         method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-SubBoost-Setup-Token": "setup-secret",
+        },
         body: JSON.stringify({ username: "admin", password: "long-secret", passwordConfirm: "long-secret" }),
       }),
     );
@@ -257,4 +269,34 @@ describe("local login component", () => {
     await flushPromises();
     expect(load.setters[6]).toHaveBeenCalledWith("加载失败");
   });
+
+  it("requires the installer fragment and clears it after successful setup", async () => {
+    const missingWindow = installWindow();
+    (globalThis as any).fetch = vi.fn();
+    const missing = renderLogin({
+      0: { setupRequired: true, authenticated: false },
+      1: "admin",
+      2: "long-secret",
+      3: "long-secret",
+    });
+    expect(missing.html).toContain("安装器输出的初始化链接");
+    await mocks.forms[0].onSubmit({ preventDefault: vi.fn() });
+    expect(missing.setters[6]).toHaveBeenCalledWith("缺少初始化令牌，请使用安装器输出的初始化链接");
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+
+    const win = installWindow("#setup-token=setup-secret");
+    (globalThis as any).fetch = vi.fn(async () => response({ success: true }));
+    const setup = renderLogin({
+      0: { setupRequired: true, authenticated: false },
+      1: "admin",
+      2: "long-secret",
+      3: "long-secret",
+      7: "setup-secret",
+    });
+    await mocks.forms[0].onSubmit({ preventDefault: vi.fn() });
+
+    expect(win.history.replaceState).toHaveBeenCalledWith(null, "", "/login");
+    expect(win.location.href).toBe("/dashboard");
+    expect(missingWindow.history.replaceState).not.toHaveBeenCalled();
+  });
 });
diff --git a/local/src/components/local-login.tsx b/local/src/components/local-login.tsx
index b800f95..b44e43b 100644
--- a/local/src/components/local-login.tsx
+++ b/local/src/components/local-login.tsx
@@ -29,9 +29,12 @@ export function LocalLogin() {
   const [showPassword, setShowPassword] = React.useState(false);
   const [loading, setLoading] = React.useState(false);
   const [error, setError] = React.useState("");
+  const [setupToken, setSetupToken] = React.useState("");
 
   React.useEffect(() => {
     let cancelled = false;
+    const fragment = new URLSearchParams(window.location.hash.replace(/^#/, ""));
+    setSetupToken(fragment.get("setup-token")?.trim() || "");
     void fetch("/api/auth/me", { cache: "no-store" })
       .then((response) => readJson<AuthState>(response))
       .then((nextAuth) => {
@@ -60,16 +63,26 @@ export function LocalLogin() {
       setError(credentialError);
       return;
     }
+    if (setupRequired && !setupToken) {
+      setError("缺少初始化令牌，请使用安装器输出的初始化链接");
+      return;
+    }
 
     setLoading(true);
     try {
       const response = await fetch(setupRequired ? "/api/setup/admin" : "/api/auth/login", {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          "Content-Type": "application/json",
+          ...(setupRequired ? { "X-SubBoost-Setup-Token": setupToken } : {}),
+        },
         body: JSON.stringify({ username, password, passwordConfirm }),
       });
       const data = await readJson<{ error?: string }>(response);
       if (!response.ok) throw new Error(data.error || "登录失败");
+      if (setupRequired) {
+        window.history.replaceState(null, "", `${window.location.pathname}${window.location.search}`);
+      }
       window.location.href = getPostLoginHref();
     } catch (submitError) {
       setError(submitError instanceof Error ? submitError.message : "登录失败，请重试");
@@ -123,6 +136,11 @@ export function LocalLogin() {
                   至少 {LOCAL_ADMIN_PASSWORD_MIN_LENGTH} 个字符
                 </p>
               ) : null}
+              {setupRequired && !setupToken ? (
+                <p className="text-amber-300/80 text-xs">
+                  请从安装器输出的初始化链接进入本页面。
+                </p>
+              ) : null}
               {setupRequired ? (
                 <input
                   type={showPassword ? "text" : "password"}
diff --git a/local/src/lib/auto-update-service.test.ts b/local/src/lib/auto-update-service.test.ts
index bd55ec6..27fba41 100644
--- a/local/src/lib/auto-update-service.test.ts
+++ b/local/src/lib/auto-update-service.test.ts
@@ -14,7 +14,7 @@ const mocks = vi.hoisted(() => ({
     $transaction: vi.fn(),
     subscription: {
       findMany: vi.fn(),
-      update: vi.fn(),
+      updateMany: vi.fn(),
     },
     subscriptionAutoUpdateState: {
       upsert: vi.fn(),
@@ -63,6 +63,7 @@ const subscription = {
   createdAt: new Date("2026-06-05T00:00:00.000Z"),
   lastUpdatedAt: null,
   autoUpdateState: null,
+  updatedAt: new Date("2026-06-05T00:00:00.000Z"),
 };
 
 function accumulator(total: number) {
@@ -85,9 +86,12 @@ describe("local subscription auto update service", () => {
     });
     mocks.finalizeCronUpdateSummary.mockImplementation((acc, options) => ({ ...acc, options }));
     mocks.prisma.subscription.findMany.mockResolvedValue([subscription]);
-    mocks.prisma.subscription.update.mockReturnValue({ update: true });
-    mocks.prisma.subscriptionAutoUpdateState.upsert.mockReturnValue({ upsert: true });
-    mocks.prisma.$transaction.mockResolvedValue([]);
+    mocks.prisma.subscription.updateMany.mockResolvedValue({ count: 1 });
+    mocks.prisma.subscriptionAutoUpdateState.upsert.mockResolvedValue({ upsert: true });
+    mocks.prisma.$transaction.mockImplementation(async (callback) => callback({
+      subscription: { updateMany: mocks.prisma.subscription.updateMany },
+      subscriptionAutoUpdateState: { upsert: mocks.prisma.subscriptionAutoUpdateState.upsert },
+    }));
     mocks.resolveSubscriptionAutoUpdateState.mockReturnValue({ lastAttemptedAt: null, externalFailureCount: 0 });
     mocks.resolveAutoUpdateScheduleState.mockReturnValue({ due: true });
     mocks.readSubscriptionSecrets.mockReturnValue({ config: { rules: [] }, urls: ["https://airport.example/sub"], nodes: [] });
@@ -150,9 +154,9 @@ describe("local subscription auto update service", () => {
         storedNodes: [],
       })
     );
-    expect(mocks.prisma.subscription.update).toHaveBeenCalledWith(
+    expect(mocks.prisma.subscription.updateMany).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { id: "sub-1" },
+        where: { id: "sub-1", updatedAt: subscription.updatedAt },
         data: expect.objectContaining({
           encryptedNodes: { encrypted: [{ name: "A" }] },
           encryptedConfig: { encrypted: { rules: [], sources: [{ url: "https://airport.example/sub" }] } },
@@ -180,7 +184,7 @@ describe("local subscription auto update service", () => {
       expect.objectContaining({ outcomes: [{ kind: "disabled", subscriptionId: "sub-1" }] })
     );
 
-    expect(mocks.prisma.subscription.update).toHaveBeenCalledWith(
+    expect(mocks.prisma.subscription.updateMany).toHaveBeenCalledWith(
       expect.objectContaining({
         data: expect.objectContaining({ autoUpdateInterval: null }),
       })
@@ -235,4 +239,18 @@ describe("local subscription auto update service", () => {
       expect.objectContaining({ subscriptionId: "sub-1", message: "unexpected" })
     );
   });
+
+  it("treats a CAS miss as a stale skip without publishing success", async () => {
+    mocks.prisma.subscription.updateMany.mockResolvedValueOnce({ count: 0 });
+
+    await runLocalSubscriptionAutoUpdateCron(now);
+
+    expect(mocks.prisma.subscriptionAutoUpdateState.upsert).not.toHaveBeenCalled();
+    expect(mocks.applyCronUpdateOutcome).toHaveBeenCalledWith(expect.anything(), {
+      status: "skipped",
+      requestedHosts: ["airport.example"],
+      recordHosts: false,
+    });
+    expect(console.info).not.toHaveBeenCalled();
+  });
 });
diff --git a/local/src/lib/auto-update-service.ts b/local/src/lib/auto-update-service.ts
index e3ed3ff..db45c7a 100644
--- a/local/src/lib/auto-update-service.ts
+++ b/local/src/lib/auto-update-service.ts
@@ -28,6 +28,7 @@ import {
   type SubscriptionRow,
 } from "./subscription-service";
 import { LOCAL_AUTO_UPDATE_MIN_SECONDS } from "./auto-update-policy";
+import { JobLeaseLostError } from "./job-lease";
 
 type AutoUpdateSubscriptionRow = SubscriptionRow & {
   owner: {
@@ -56,20 +57,29 @@ function toCompletionTarget(subscription: AutoUpdateSubscriptionRow): AutomaticR
 
 async function writeAutoUpdateState(
   subscriptionId: string,
+  expectedUpdatedAt: Date,
   state: SubscriptionAutoUpdateStateFields,
-  extraSubscriptionData: Record<string, unknown> = {}
-) {
-  await prisma.$transaction([
-    prisma.subscription.update({
-      where: { id: subscriptionId },
-      data: extraSubscriptionData,
-    }),
-    prisma.subscriptionAutoUpdateState.upsert({
+  extraSubscriptionData: Record<string, unknown> = {},
+  assertLease?: () => Promise<void>
+): Promise<boolean> {
+  await assertLease?.();
+  return prisma.$transaction(async (tx) => {
+    const updated = await tx.subscription.updateMany({
+      where: { id: subscriptionId, updatedAt: expectedUpdatedAt },
+      data: { ...extraSubscriptionData, updatedAt: new Date() },
+    });
+    if (updated.count !== 1) return false;
+    await tx.subscriptionAutoUpdateState.upsert({
       where: { subscriptionId },
       create: { subscriptionId, ...state },
       update: state,
-    }),
-  ]);
+    });
+    return true;
+  });
+}
+
+function staleOutcome(requestedHosts: string[]): CronUpdateOutcome {
+  return { status: "skipped", requestedHosts, recordHosts: false };
 }
 
 async function prepareLocalRefresh(
@@ -110,10 +120,16 @@ async function completeAllSourcesFailed(params: {
   subscription: AutoUpdateSubscriptionRow;
   prepared: PreparedLocalRefresh;
   decision: Extract<ReturnType<typeof resolveAutomaticRefreshCompletionDecision>, { kind: "all_sources_failed" }>;
+  assertLease?: () => Promise<void>;
 }): Promise<CronUpdateOutcome> {
-  await writeAutoUpdateState(params.subscription.id, params.decision.nextAutoUpdateState.state, {
-    ...(params.decision.nextAutoUpdateState.shouldDisableAutoUpdate ? { autoUpdateInterval: null } : {}),
-  });
+  const persisted = await writeAutoUpdateState(
+    params.subscription.id,
+    params.subscription.updatedAt,
+    params.decision.nextAutoUpdateState.state,
+    { ...(params.decision.nextAutoUpdateState.shouldDisableAutoUpdate ? { autoUpdateInterval: null } : {}) },
+    params.assertLease
+  );
+  if (!persisted) return staleOutcome(params.prepared.requestedHosts);
 
   if (params.decision.nextAutoUpdateState.shouldDisableAutoUpdate) {
     console.warn("[local-subscription-cron] auto update disabled", {
@@ -130,6 +146,7 @@ async function completeSuccess(params: {
   prepared: PreparedLocalRefresh;
   attemptedAt: Date;
   intervalSeconds: number;
+  assertLease?: () => Promise<void>;
 }): Promise<CronUpdateOutcome> {
   const refreshResult = params.prepared.refreshResult;
   if (!refreshResult.ok) throw new Error(`Unexpected refresh failure reason: ${refreshResult.reason}`);
@@ -146,14 +163,21 @@ async function completeSuccess(params: {
   if (decision.kind !== "success") throw new Error(`Unexpected refresh completion decision: ${decision.kind}`);
   const config = { ...params.prepared.config, sources: params.prepared.snapshot.savedSources };
 
-  await writeAutoUpdateState(params.subscription.id, decision.nextAutoUpdateState.state, {
-    encryptedNodes: encryptJson(refreshResult.cacheEntry.nodes),
-    encryptedConfig: encryptJson(config),
-    encryptedSubscriptionInfo: encryptJson(refreshResult.cacheEntry.subscriptionInfo),
-    lastUpdatedAt: cachedAt,
-    cacheExpiresAt: buildSubscriptionCacheExpiry(cachedAt),
-    ...(decision.nextAutoUpdateState.shouldDisableAutoUpdate ? { autoUpdateInterval: null } : {}),
-  });
+  const persisted = await writeAutoUpdateState(
+    params.subscription.id,
+    params.subscription.updatedAt,
+    decision.nextAutoUpdateState.state,
+    {
+      encryptedNodes: encryptJson(refreshResult.cacheEntry.nodes),
+      encryptedConfig: encryptJson(config),
+      encryptedSubscriptionInfo: encryptJson(refreshResult.cacheEntry.subscriptionInfo),
+      lastUpdatedAt: cachedAt,
+      cacheExpiresAt: buildSubscriptionCacheExpiry(cachedAt),
+      ...(decision.nextAutoUpdateState.shouldDisableAutoUpdate ? { autoUpdateInterval: null } : {}),
+    },
+    params.assertLease
+  );
+  if (!persisted) return staleOutcome(params.prepared.requestedHosts);
 
   console.info("[local-subscription-cron] updated", {
     subscriptionId: params.subscription.id,
@@ -172,6 +196,7 @@ async function completeLocalRefresh(params: {
   prepared: PreparedLocalRefresh;
   attemptedAt: Date;
   intervalSeconds: number;
+  assertLease?: () => Promise<void>;
 }): Promise<CronUpdateOutcome> {
   const refreshResult = params.prepared.refreshResult;
 
@@ -189,7 +214,14 @@ async function completeLocalRefresh(params: {
     }
     if (decision.kind === "success") throw new Error("Unexpected successful completion decision");
 
-    await writeAutoUpdateState(params.subscription.id, decision.attemptedState);
+    const persisted = await writeAutoUpdateState(
+      params.subscription.id,
+      params.subscription.updatedAt,
+      decision.attemptedState,
+      {},
+      params.assertLease
+    );
+    if (!persisted) return staleOutcome(params.prepared.requestedHosts);
     return decision.outcome;
   }
 
@@ -201,6 +233,7 @@ async function recordUnexpectedFailure(params: {
   requestedHosts: string[];
   error: unknown;
   attemptStartedAt: Date | null;
+  assertLease?: () => Promise<void>;
 }): Promise<CronUpdateOutcome> {
   const completion = resolveAutomaticRefreshUnexpectedFailureCompletion({
     target: toCompletionTarget(params.subscription),
@@ -209,7 +242,17 @@ async function recordUnexpectedFailure(params: {
     attemptStartedAt: params.attemptStartedAt,
   });
   if (completion.attemptedState) {
-    await writeAutoUpdateState(params.subscription.id, completion.attemptedState).catch(() => undefined);
+    const persisted = await writeAutoUpdateState(
+      params.subscription.id,
+      params.subscription.updatedAt,
+      completion.attemptedState,
+      {},
+      params.assertLease
+    ).catch((error) => {
+      if (error instanceof JobLeaseLostError) throw error;
+      return null;
+    });
+    if (persisted === false) return staleOutcome(params.requestedHosts);
   }
 
   console.error("[local-subscription-cron] failed", {
@@ -220,7 +263,11 @@ async function recordUnexpectedFailure(params: {
   return completion.outcome;
 }
 
-export async function runLocalSubscriptionAutoUpdateCron(now = new Date()): Promise<FinalCronUpdateSummary> {
+export async function runLocalSubscriptionAutoUpdateCron(
+  now = new Date(),
+  options: { assertLease?: () => Promise<void> } = {}
+): Promise<FinalCronUpdateSummary> {
+  await options.assertLease?.();
   const subscriptions = (await prisma.subscription.findMany({
     where: { autoUpdateInterval: { not: null } },
     include: { owner: { select: { username: true } }, autoUpdateState: true },
@@ -228,6 +275,7 @@ export async function runLocalSubscriptionAutoUpdateCron(now = new Date()): Prom
 
   const accumulator = createCronUpdateAccumulator(subscriptions.length);
   for (const subscription of subscriptions) {
+    await options.assertLease?.();
     let requestedHosts: string[] = [];
     let attemptStartedAt: Date | null = null;
     try {
@@ -258,15 +306,24 @@ export async function runLocalSubscriptionAutoUpdateCron(now = new Date()): Prom
         prepared,
         attemptedAt: attemptStartedAt,
         intervalSeconds,
+        assertLease: options.assertLease,
       });
       applyCronUpdateOutcome(accumulator, outcome);
     } catch (error) {
+      if (error instanceof JobLeaseLostError) throw error;
       applyCronUpdateOutcome(
         accumulator,
-        await recordUnexpectedFailure({ subscription, requestedHosts, error, attemptStartedAt })
+        await recordUnexpectedFailure({
+          subscription,
+          requestedHosts,
+          error,
+          attemptStartedAt,
+          assertLease: options.assertLease,
+        })
       );
     }
   }
 
+  await options.assertLease?.();
   return finalizeCronUpdateSummary(accumulator, { maxTopHosts: 50, maxTopUsers: 50 });
 }
diff --git a/local/src/lib/http.ts b/local/src/lib/http.ts
index 40eb3c2..36af9dd 100644
--- a/local/src/lib/http.ts
+++ b/local/src/lib/http.ts
@@ -9,9 +9,20 @@ export type LocalApiErrorCode =
   | "NOT_FOUND"
   | "CONFLICT"
   | "RATE_LIMITED"
+  | "PAYLOAD_TOO_LARGE"
   | "CONFIGURATION_ERROR"
   | "INTERNAL_ERROR";
 
+export const LOCAL_JSON_BODY_LIMITS = {
+  small: 64 * 1024,
+  subscription: 16 * 1024 * 1024,
+  template: 4 * 1024 * 1024,
+} as const;
+
+export type ReadJsonBodyResult =
+  | { ok: true; value: unknown }
+  | { ok: false; reason: "invalid_json" | "too_large" };
+
 export function json(data: unknown, status = 200): NextResponse {
   return NextResponse.json(data, { status });
 }
@@ -20,16 +31,52 @@ export function apiError(error: string, code: LocalApiErrorCode, status: number)
   return NextResponse.json(buildApiErrorBody(error, code), { status });
 }
 
-export async function readJsonBody(request: Request): Promise<unknown> {
-  const text = await request.text();
-  if (!text.trim()) return {};
+export async function readJsonBody(request: Request, maxBytes: number): Promise<ReadJsonBodyResult> {
+  const limit = Math.max(1, Math.floor(maxBytes));
+  const declaredLength = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > limit) {
+    return { ok: false, reason: "too_large" };
+  }
+
+  if (!request.body) return { ok: true, value: {} };
+  const reader = request.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let totalBytes = 0;
   try {
-    return JSON.parse(text);
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      totalBytes += value.byteLength;
+      if (totalBytes > limit) {
+        await reader.cancel("payload too large").catch(() => undefined);
+        return { ok: false, reason: "too_large" };
+      }
+      chunks.push(value);
+    }
+
+    const bytes = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    if (!text.trim()) return { ok: true, value: {} };
+    return { ok: true, value: JSON.parse(text) };
   } catch {
-    return null;
+    return { ok: false, reason: "invalid_json" };
   }
 }
 
+export function jsonBodyError(
+  result: Extract<ReadJsonBodyResult, { ok: false }>,
+  invalidJsonMessage = "Invalid JSON body."
+): NextResponse {
+  return result.reason === "too_large"
+    ? apiError("Request body is too large.", "PAYLOAD_TOO_LARGE", 413)
+    : apiError(invalidJsonMessage, "BAD_REQUEST", 400);
+}
+
 export function getStringField(body: unknown, key: string): string {
   if (!body || typeof body !== "object" || Array.isArray(body)) return "";
   const value = (body as Record<string, unknown>)[key];
diff --git a/local/src/lib/job-lease.test.ts b/local/src/lib/job-lease.test.ts
new file mode 100644
index 0000000..a3a1513
--- /dev/null
+++ b/local/src/lib/job-lease.test.ts
@@ -0,0 +1,56 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  prisma: {
+    $queryRaw: vi.fn(),
+    $executeRaw: vi.fn(),
+  },
+}));
+
+vi.mock("./prisma", () => ({ prisma: mocks.prisma }));
+
+import {
+  acquireLocalJobLease,
+  releaseLocalJobLease,
+  renewLocalJobLease,
+  startLocalJobLeaseHeartbeat,
+} from "./job-lease";
+
+describe("local job lease", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-07-16T00:00:00.000Z"));
+  });
+
+  afterEach(() => vi.useRealTimers());
+
+  it("acquires only when the conditional database upsert returns a row", async () => {
+    mocks.prisma.$queryRaw
+      .mockResolvedValueOnce([{ name: "local-cron", ownerToken: "owner", expiresAt: new Date() }])
+      .mockResolvedValueOnce([]);
+
+    await expect(acquireLocalJobLease({ name: "local-cron", leaseMs: 300_000 })).resolves.toMatchObject({
+      name: "local-cron",
+    });
+    await expect(acquireLocalJobLease({ name: "local-cron", leaseMs: 300_000 })).resolves.toBeNull();
+  });
+
+  it("renews and releases only the current owner", async () => {
+    const lease = { name: "local-cron", ownerToken: "owner", expiresAt: new Date() };
+    mocks.prisma.$executeRaw.mockResolvedValueOnce(1).mockResolvedValueOnce(1);
+
+    await expect(renewLocalJobLease(lease, 300_000)).resolves.toBe(true);
+    await expect(releaseLocalJobLease(lease)).resolves.toBeUndefined();
+    expect(mocks.prisma.$executeRaw).toHaveBeenCalledTimes(2);
+  });
+
+  it("fails closed when heartbeat renewal loses ownership", async () => {
+    const lease = { name: "local-cron", ownerToken: "owner", expiresAt: new Date() };
+    mocks.prisma.$executeRaw.mockResolvedValueOnce(0);
+    const heartbeat = startLocalJobLeaseHeartbeat({ lease, leaseMs: 300_000, intervalMs: 60_000 });
+
+    await expect(heartbeat.assertOwned()).rejects.toThrow("Local job lease lost");
+    await heartbeat.stop();
+  });
+});
diff --git a/local/src/lib/job-lease.ts b/local/src/lib/job-lease.ts
new file mode 100644
index 0000000..859d209
--- /dev/null
+++ b/local/src/lib/job-lease.ts
@@ -0,0 +1,99 @@
+import { randomUUID } from "node:crypto";
+import { prisma } from "./prisma";
+
+export type LocalJobLease = {
+  name: string;
+  ownerToken: string;
+  expiresAt: Date;
+};
+
+export class JobLeaseLostError extends Error {
+  constructor(name: string) {
+    super(`Local job lease lost: ${name}`);
+    this.name = "JobLeaseLostError";
+  }
+}
+
+export async function acquireLocalJobLease(params: {
+  name: string;
+  leaseMs: number;
+  now?: Date;
+}): Promise<LocalJobLease | null> {
+  const now = params.now ?? new Date();
+  const ownerToken = randomUUID();
+  const expiresAt = new Date(now.getTime() + params.leaseMs);
+  const rows = await prisma.$queryRaw<LocalJobLease[]>`
+    INSERT INTO "JobLeaseLock" ("name", "ownerToken", "expiresAt", "updatedAt")
+    VALUES (${params.name}, ${ownerToken}, ${expiresAt}, ${now})
+    ON CONFLICT ("name") DO UPDATE
+    SET "ownerToken" = EXCLUDED."ownerToken",
+        "expiresAt" = EXCLUDED."expiresAt",
+        "updatedAt" = EXCLUDED."updatedAt"
+    WHERE "JobLeaseLock"."expiresAt" <= ${now}
+    RETURNING "name", "ownerToken", "expiresAt"
+  `;
+  return rows[0] ?? null;
+}
+
+export async function renewLocalJobLease(
+  lease: LocalJobLease,
+  leaseMs: number,
+  now = new Date()
+): Promise<boolean> {
+  const expiresAt = new Date(now.getTime() + leaseMs);
+  const count = await prisma.$executeRaw`
+    UPDATE "JobLeaseLock"
+    SET "expiresAt" = ${expiresAt}, "updatedAt" = ${now}
+    WHERE "name" = ${lease.name}
+      AND "ownerToken" = ${lease.ownerToken}
+      AND "expiresAt" > ${now}
+  `;
+  if (count === 1) lease.expiresAt = expiresAt;
+  return count === 1;
+}
+
+export async function releaseLocalJobLease(lease: LocalJobLease): Promise<void> {
+  await prisma.$executeRaw`
+    DELETE FROM "JobLeaseLock"
+    WHERE "name" = ${lease.name} AND "ownerToken" = ${lease.ownerToken}
+  `;
+}
+
+export function startLocalJobLeaseHeartbeat(params: {
+  lease: LocalJobLease;
+  leaseMs: number;
+  intervalMs: number;
+}): { assertOwned: () => Promise<void>; stop: () => Promise<void> } {
+  let stopped = false;
+  let lost = false;
+  let pending: Promise<void> = Promise.resolve();
+
+  const renew = async () => {
+    if (stopped) return;
+    if (lost || !(await renewLocalJobLease(params.lease, params.leaseMs))) {
+      lost = true;
+      throw new JobLeaseLostError(params.lease.name);
+    }
+  };
+  const enqueue = () => {
+    const next = pending.then(renew);
+    pending = next.catch(() => undefined);
+    return next;
+  };
+  const timer = setInterval(() => {
+    void enqueue().catch(() => undefined);
+  }, params.intervalMs);
+  timer.unref?.();
+
+  return {
+    assertOwned: async () => {
+      if (stopped || lost) throw new JobLeaseLostError(params.lease.name);
+      await enqueue();
+    },
+    stop: async () => {
+      stopped = true;
+      clearInterval(timer);
+      await pending;
+    },
+  };
+}
diff --git a/local/src/lib/local-helpers.test.ts b/local/src/lib/local-helpers.test.ts
index 085a0c4..42080ce 100644
--- a/local/src/lib/local-helpers.test.ts
+++ b/local/src/lib/local-helpers.test.ts
@@ -164,9 +164,20 @@ describe("local lib helpers", () => {
       status: 400,
       body: { error: "bad", code: "BAD_REQUEST" },
     });
-    await expect(readJsonBody(new Request("https://local.test", { method: "POST", body: "" }))).resolves.toEqual({});
-    await expect(readJsonBody(new Request("https://local.test", { method: "POST", body: "{bad" }))).resolves.toBeNull();
-    await expect(readJsonBody(new Request("https://local.test", { method: "POST", body: '{"name":" Ry "}' }))).resolves.toEqual({ name: " Ry " });
+    await expect(readJsonBody(new Request("https://local.test", { method: "POST", body: "" }), 1024)).resolves.toEqual({
+      ok: true,
+      value: {},
+    });
+    await expect(readJsonBody(new Request("https://local.test", { method: "POST", body: "{bad" }), 1024)).resolves.toEqual({
+      ok: false,
+      reason: "invalid_json",
+    });
+    await expect(
+      readJsonBody(new Request("https://local.test", { method: "POST", body: '{"name":" Ry "}' }), 1024)
+    ).resolves.toEqual({ ok: true, value: { name: " Ry " } });
+    await expect(
+      readJsonBody(new Request("https://local.test", { method: "POST", body: '{"too":"large"}' }), 4)
+    ).resolves.toEqual({ ok: false, reason: "too_large" });
     expect(getStringField({ name: " Ry " }, "name")).toBe("Ry");
     expect(getStringField({ name: 1 }, "name")).toBe("");
     expect(getStringField(null, "name")).toBe("");
diff --git a/local/src/lib/pinned-http.test.ts b/local/src/lib/pinned-http.test.ts
new file mode 100644
index 0000000..15174ba
--- /dev/null
+++ b/local/src/lib/pinned-http.test.ts
@@ -0,0 +1,55 @@
+import { createServer, type Server } from "node:http";
+import { gzipSync } from "node:zlib";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { requestPinnedText, ResponseTooLargeError } from "./pinned-http";
+
+describe("pinned local HTTP transport", () => {
+  let server: Server;
+  let port = 0;
+  let observedHost = "";
+
+  beforeAll(async () => {
+    server = createServer((request, response) => {
+      observedHost = request.headers.host || "";
+      const body = request.url === "/large" ? "x".repeat(2048) : "ss://node";
+      response.writeHead(200, {
+        "Content-Type": "text/plain",
+        "Content-Encoding": "gzip",
+      });
+      response.end(gzipSync(body));
+    });
+    await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    if (!address || typeof address === "string") throw new Error("Expected TCP test server address");
+    port = address.port;
+  });
+
+  afterAll(async () => {
+    await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+  });
+
+  it("connects only to the validated address while preserving the original Host header", async () => {
+    const response = await requestPinnedText({
+      url: `http://example.test:${port}/ok`,
+      addresses: ["127.0.0.1"],
+      method: "GET",
+      userAgent: "SubBoost Test",
+      maxBytes: 1024,
+      signal: new AbortController().signal,
+    });
+
+    expect(response).toMatchObject({ status: 200, content: "ss://node" });
+    expect(observedHost).toBe(`example.test:${port}`);
+  });
+
+  it("enforces the limit after response decompression", async () => {
+    await expect(requestPinnedText({
+      url: `http://example.test:${port}/large`,
+      addresses: ["127.0.0.1"],
+      method: "GET",
+      userAgent: "SubBoost Test",
+      maxBytes: 128,
+      signal: new AbortController().signal,
+    })).rejects.toBeInstanceOf(ResponseTooLargeError);
+  });
+});
diff --git a/local/src/lib/pinned-http.ts b/local/src/lib/pinned-http.ts
new file mode 100644
index 0000000..59d03fd
--- /dev/null
+++ b/local/src/lib/pinned-http.ts
@@ -0,0 +1,123 @@
+import { isIP } from "node:net";
+import { request as httpRequest, type IncomingHttpHeaders, type IncomingMessage } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { createBrotliDecompress, createGunzip, createInflate } from "node:zlib";
+
+export class ResponseTooLargeError extends Error {
+  constructor() {
+    super("Subscription response exceeds the configured byte limit");
+    this.name = "ResponseTooLargeError";
+  }
+}
+
+export type DirectHttpResponse = {
+  status: number;
+  headers: Record<string, string>;
+  content: string;
+};
+
+function normalizeHeaders(headers: IncomingHttpHeaders): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (value === undefined) continue;
+    out[key.toLowerCase()] = Array.isArray(value) ? value.join(", ") : String(value);
+  }
+  return out;
+}
+
+async function readLimitedBody(response: IncomingMessage, maxBytes: number): Promise<string> {
+  const encoding = String(response.headers["content-encoding"] || "").trim().toLowerCase();
+  const decoded = encoding === "gzip" || encoding === "x-gzip"
+    ? response.pipe(createGunzip())
+    : encoding === "deflate"
+      ? response.pipe(createInflate())
+      : encoding === "br"
+        ? response.pipe(createBrotliDecompress())
+        : response;
+
+  const chunks: Buffer[] = [];
+  let total = 0;
+  try {
+    for await (const raw of decoded) {
+      const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+      total += chunk.byteLength;
+      if (total > maxBytes) throw new ResponseTooLargeError();
+      chunks.push(chunk);
+    }
+  } catch (error) {
+    response.destroy();
+    if (decoded !== response) decoded.destroy();
+    throw error;
+  }
+  return Buffer.concat(chunks, total).toString("utf8");
+}
+
+function openPinnedRequest(params: {
+  parsed: URL;
+  address: string;
+  method: "GET" | "HEAD";
+  userAgent: string;
+  signal: AbortSignal;
+}): Promise<IncomingMessage> {
+  const requestImpl = params.parsed.protocol === "https:" ? httpsRequest : httpRequest;
+  return new Promise((resolve, reject) => {
+    const request = requestImpl({
+      protocol: params.parsed.protocol,
+      hostname: params.address,
+      family: isIP(params.address) || undefined,
+      port: params.parsed.port || undefined,
+      path: `${params.parsed.pathname}${params.parsed.search}`,
+      method: params.method,
+      headers: {
+        Host: params.parsed.host,
+        "User-Agent": params.userAgent,
+        Accept: "text/plain, application/yaml, application/x-yaml, */*;q=0.8",
+        "Accept-Encoding": "gzip, deflate, br",
+        "Cache-Control": "no-cache",
+      },
+      signal: params.signal,
+      ...(params.parsed.protocol === "https:" && !isIP(params.parsed.hostname)
+        ? { servername: params.parsed.hostname }
+        : {}),
+    }, resolve);
+    request.once("error", reject);
+    request.end();
+  });
+}
+
+export async function requestPinnedText(params: {
+  url: string;
+  addresses: readonly string[];
+  method: "GET" | "HEAD";
+  userAgent: string;
+  maxBytes: number;
+  signal: AbortSignal;
+}): Promise<DirectHttpResponse> {
+  const parsed = new URL(params.url);
+  let lastError: unknown = new Error("No validated address is available");
+  let response: IncomingMessage | null = null;
+  for (const address of params.addresses) {
+    try {
+      response = await openPinnedRequest({ ...params, parsed, address });
+      break;
+    } catch (error) {
+      lastError = error;
+      if (params.signal.aborted) throw error;
+    }
+  }
+  if (!response) throw lastError;
+
+  const headers = normalizeHeaders(response.headers);
+  if ((response.statusCode || 0) >= 300 && (response.statusCode || 0) < 400) {
+    response.destroy();
+    return { status: response.statusCode || 0, headers, content: "" };
+  }
+  const contentLength = Number(headers["content-length"] || "0");
+  if (Number.isFinite(contentLength) && contentLength > params.maxBytes) {
+    response.destroy();
+    throw new ResponseTooLargeError();
+  }
+  const content = params.method === "HEAD" ? "" : await readLimitedBody(response, params.maxBytes);
+  if (params.method === "HEAD") response.resume();
+  return { status: response.statusCode || 0, headers, content };
+}
diff --git a/local/src/lib/rate-limit.test.ts b/local/src/lib/rate-limit.test.ts
index 7022479..52a32d4 100644
--- a/local/src/lib/rate-limit.test.ts
+++ b/local/src/lib/rate-limit.test.ts
@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, it } from "vitest";
 import {
   clearLocalRateLimitsForTests,
   consumeLocalRateLimit,
+  getTrustedClientRateLimitKey,
   hashLocalRateLimitKey,
   localRateLimitResponse,
   resetLocalRateLimit,
@@ -36,4 +37,27 @@ describe("local rate limits", () => {
     expect(response.headers.get("Retry-After")).toBe("7");
     await expect(response.json()).resolves.toEqual({ error: "slow down", code: "RATE_LIMITED" });
   });
+
+  it("uses only runtime or explicitly trusted proxy client addresses", () => {
+    const direct = new Request("https://local.test");
+    expect(getTrustedClientRateLimitKey(direct)).toBeNull();
+
+    const runtime = Object.assign(new Request("https://local.test"), { ip: "203.0.113.10" });
+    expect(getTrustedClientRateLimitKey(runtime)).toBe(hashLocalRateLimitKey("203.0.113.10"));
+
+    process.env.TRUST_PROXY_HEADERS = "true";
+    const proxied = new Request("https://local.test", { headers: { "x-forwarded-for": "198.51.100.2, 10.0.0.1" } });
+    expect(getTrustedClientRateLimitKey(proxied)).toBe(hashLocalRateLimitKey("198.51.100.2"));
+    delete process.env.TRUST_PROXY_HEADERS;
+  });
+
+  it("caps in-memory buckets at 10,000 by evicting the earliest expiry", () => {
+    for (let index = 0; index < 10_000; index += 1) {
+      consumeLocalRateLimit("bounded", String(index), { limit: 1, windowMs: 60_000, now: 1_000 });
+    }
+    consumeLocalRateLimit("bounded", "overflow", { limit: 1, windowMs: 60_000, now: 1_000 });
+
+    expect(consumeLocalRateLimit("bounded", "0", { limit: 1, windowMs: 60_000, now: 1_001 }).allowed).toBe(true);
+    expect(consumeLocalRateLimit("bounded", "9999", { limit: 1, windowMs: 60_000, now: 1_001 }).allowed).toBe(false);
+  });
 });
diff --git a/local/src/lib/rate-limit.ts b/local/src/lib/rate-limit.ts
index f1d11cf..4edbc2e 100644
--- a/local/src/lib/rate-limit.ts
+++ b/local/src/lib/rate-limit.ts
@@ -12,12 +12,30 @@ export type LocalRateLimitResult = {
 };
 
 const buckets = new Map<string, RateLimitBucket>();
+const MAX_BUCKETS = 10_000;
+let nextCleanupAt = 0;
 
-function cleanupExpiredBuckets(now: number): void {
-  if (buckets.size < 1024) return;
+function cleanupExpiredBuckets(now: number, force = false): void {
+  if (!force && (buckets.size < 1024 || now < nextCleanupAt)) return;
   for (const [key, bucket] of buckets) {
     if (bucket.resetAt <= now) buckets.delete(key);
   }
+  nextCleanupAt = now + 60_000;
+}
+
+function makeRoomForBucket(): void {
+  while (buckets.size >= MAX_BUCKETS) {
+    let earliestKey: string | null = null;
+    let earliestResetAt = Number.POSITIVE_INFINITY;
+    for (const [key, bucket] of buckets) {
+      if (bucket.resetAt < earliestResetAt) {
+        earliestKey = key;
+        earliestResetAt = bucket.resetAt;
+      }
+    }
+    if (!earliestKey) return;
+    buckets.delete(earliestKey);
+  }
 }
 
 export function hashLocalRateLimitKey(value: string): string {
@@ -37,6 +55,10 @@ export function consumeLocalRateLimit(
   const bucketKey = `${scope}:${key}`;
   const current = buckets.get(bucketKey);
   if (!current || current.resetAt <= now) {
+    if (!current && buckets.size >= MAX_BUCKETS) {
+      cleanupExpiredBuckets(now, true);
+      makeRoomForBucket();
+    }
     buckets.set(bucketKey, { count: 1, resetAt: now + windowMs });
     return { allowed: true, retryAfterSeconds: 0 };
   }
@@ -49,6 +71,21 @@ export function consumeLocalRateLimit(
   };
 }
 
+export function getTrustedClientRateLimitKey(request: Request): string | null {
+  const runtimeIp = (request as Request & { ip?: unknown }).ip;
+  if (typeof runtimeIp === "string" && runtimeIp.trim()) {
+    return hashLocalRateLimitKey(runtimeIp.trim());
+  }
+  if (process.env.TRUST_PROXY_HEADERS !== "true") return null;
+
+  const forwarded = request.headers.get("cf-connecting-ip")
+    || request.headers.get("x-real-ip")
+    || request.headers.get("x-forwarded-for")?.split(",")[0]
+    || "";
+  const normalized = forwarded.trim();
+  return normalized ? hashLocalRateLimitKey(normalized) : null;
+}
+
 export function resetLocalRateLimit(scope: string, key: string): void {
   buckets.delete(`${scope}:${key}`);
 }
@@ -60,5 +97,8 @@ export function localRateLimitResponse(message: string, retryAfterSeconds: numbe
 }
 
 export function clearLocalRateLimitsForTests(): void {
-  if (process.env.NODE_ENV === "test") buckets.clear();
+  if (process.env.NODE_ENV === "test") {
+    buckets.clear();
+    nextCleanupAt = 0;
+  }
 }
diff --git a/local/src/lib/setup-token.test.ts b/local/src/lib/setup-token.test.ts
new file mode 100644
index 0000000..fda81b5
--- /dev/null
+++ b/local/src/lib/setup-token.test.ts
@@ -0,0 +1,27 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { LOCAL_SETUP_TOKEN_HEADER, validateLocalSetupToken } from "./setup-token";
+
+describe("local setup token", () => {
+  const original = process.env.LOCAL_SETUP_TOKEN;
+
+  afterEach(() => {
+    if (original === undefined) delete process.env.LOCAL_SETUP_TOKEN;
+    else process.env.LOCAL_SETUP_TOKEN = original;
+  });
+
+  it("fails closed when the operator token is missing", () => {
+    delete process.env.LOCAL_SETUP_TOKEN;
+    expect(validateLocalSetupToken(new Request("https://local.test"))).toBe("missing_config");
+  });
+
+  it("accepts only an exact setup token supplied through the dedicated header", () => {
+    process.env.LOCAL_SETUP_TOKEN = "expected-secret";
+    expect(validateLocalSetupToken(new Request("https://local.test"))).toBe("invalid");
+    expect(validateLocalSetupToken(new Request("https://local.test", {
+      headers: { [LOCAL_SETUP_TOKEN_HEADER]: "wrong-secret" },
+    }))).toBe("invalid");
+    expect(validateLocalSetupToken(new Request("https://local.test", {
+      headers: { [LOCAL_SETUP_TOKEN_HEADER]: "expected-secret" },
+    }))).toBe("valid");
+  });
+});
diff --git a/local/src/lib/setup-token.ts b/local/src/lib/setup-token.ts
new file mode 100644
index 0000000..5e65661
--- /dev/null
+++ b/local/src/lib/setup-token.ts
@@ -0,0 +1,15 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+
+export const LOCAL_SETUP_TOKEN_HEADER = "x-subboost-setup-token";
+
+export function validateLocalSetupToken(request: Request): "valid" | "invalid" | "missing_config" {
+  const expected = process.env.LOCAL_SETUP_TOKEN;
+  if (!expected) return "missing_config";
+
+  const supplied = request.headers.get(LOCAL_SETUP_TOKEN_HEADER);
+  if (!supplied) return "invalid";
+
+  const expectedDigest = createHash("sha256").update(expected).digest();
+  const suppliedDigest = createHash("sha256").update(supplied).digest();
+  return timingSafeEqual(expectedDigest, suppliedDigest) ? "valid" : "invalid";
+}
diff --git a/local/src/lib/source-import.test.ts b/local/src/lib/source-import.test.ts
index 7dca277..783a889 100644
--- a/local/src/lib/source-import.test.ts
+++ b/local/src/lib/source-import.test.ts
@@ -5,6 +5,7 @@ const mocks = vi.hoisted(() => ({
   getAllowUnsafeSubscriptionSources: vi.fn(),
   lookup: vi.fn(),
   importSubscriptionFromUrl: vi.fn(),
+  requestPinnedText: vi.fn(),
 }));
 
 vi.mock("node:dns/promises", () => ({
@@ -15,6 +16,11 @@ vi.mock("@local/lib/source-import-settings", () => ({
   getAllowUnsafeSubscriptionSources: mocks.getAllowUnsafeSubscriptionSources,
 }));
 
+vi.mock("./pinned-http", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./pinned-http")>();
+  return { ...actual, requestPinnedText: mocks.requestPinnedText };
+});
+
 vi.mock("@subboost/server-core/subscription", async (importOriginal) => {
   const actual = await importOriginal<typeof import("@subboost/server-core/subscription")>();
   return {
@@ -65,7 +71,8 @@ describe("local source import transport", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mocks.getAllowUnsafeSubscriptionSources.mockResolvedValue(false);
-    mocks.lookup.mockResolvedValue([{ address: "93.184.216.34" }]);
+    mocks.lookup.mockRejectedValue(new Error("dns unavailable"));
+    mocks.requestPinnedText.mockResolvedValue({ status: 200, headers: {}, content: "ss://node" });
     globalThis.fetch = vi.fn();
   });
 
@@ -150,8 +157,7 @@ describe("local source import transport", () => {
     mocks.lookup.mockResolvedValueOnce([{ address: "198.18.3.6" }]);
     vi.mocked(globalThis.fetch)
       .mockResolvedValueOnce(dnsResponse(["93.184.216.34"]))
-      .mockResolvedValueOnce(dnsResponse([]))
-      .mockResolvedValueOnce(response("ss://node", { status: 200 }));
+      .mockResolvedValueOnce(dnsResponse([]));
 
     await expect(runTransport("https://api.dler.io/sub")).resolves.toMatchObject({
       ok: true,
@@ -169,11 +175,54 @@ describe("local source import transport", () => {
         body: expect.any(ArrayBuffer),
       })
     );
-    expect(globalThis.fetch).toHaveBeenNthCalledWith(
-      3,
-      "https://api.dler.io/sub",
-      expect.objectContaining({ method: "GET", redirect: "manual" })
-    );
+    expect(mocks.requestPinnedText).toHaveBeenCalledWith(expect.objectContaining({
+      url: "https://api.dler.io/sub",
+      addresses: ["93.184.216.34"],
+      method: "GET",
+    }));
+  });
+
+  it("pins ordinary successful DNS validation results into the connection", async () => {
+    mocks.lookup.mockResolvedValueOnce([{ address: "93.184.216.34" }]);
+
+    await expect(runTransport("https://example.com/sub")).resolves.toMatchObject({
+      ok: true,
+      content: "ss://node",
+    });
+
+    expect(mocks.requestPinnedText).toHaveBeenCalledWith(expect.objectContaining({
+      url: "https://example.com/sub",
+      addresses: ["93.184.216.34"],
+      maxBytes: 1024,
+    }));
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("revalidates and pins every redirect target independently", async () => {
+    mocks.lookup
+      .mockResolvedValueOnce([{ address: "93.184.216.34" }])
+      .mockResolvedValueOnce([{ address: "1.1.1.1" }]);
+    mocks.requestPinnedText
+      .mockResolvedValueOnce({
+        status: 302,
+        headers: { location: "https://cdn.example.net/sub" },
+        content: "",
+      })
+      .mockResolvedValueOnce({ status: 200, headers: {}, content: "ss://node" });
+
+    await expect(runTransport("https://example.com/sub")).resolves.toMatchObject({
+      ok: true,
+      content: "ss://node",
+    });
+
+    expect(mocks.requestPinnedText).toHaveBeenNthCalledWith(1, expect.objectContaining({
+      url: "https://example.com/sub",
+      addresses: ["93.184.216.34"],
+    }));
+    expect(mocks.requestPinnedText).toHaveBeenNthCalledWith(2, expect.objectContaining({
+      url: "https://cdn.example.net/sub",
+      addresses: ["1.1.1.1"],
+    }));
   });
 
   it("keeps blocking fake-ip DNS answers when DoH confirms an unsafe target", async () => {
@@ -327,7 +376,9 @@ describe("local source import transport", () => {
   });
 
   it("handles redirect loops, missing locations, and thrown fetch errors", async () => {
-    vi.mocked(globalThis.fetch).mockResolvedValue(response("", { status: 302, headers: { location: "/next" } }));
+    vi.mocked(globalThis.fetch).mockImplementation(async () => (
+      response("", { status: 302, headers: { location: "/next" } })
+    ));
     await expect(runTransport("https://example.com/loop")).resolves.toMatchObject({
       ok: false,
       publicReason: "HTTP 310",
diff --git a/local/src/lib/source-import.ts b/local/src/lib/source-import.ts
index fcee75a..f4e7abb 100644
--- a/local/src/lib/source-import.ts
+++ b/local/src/lib/source-import.ts
@@ -1,4 +1,5 @@
 import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
 import {
   createSubscriptionImportErrorInfo,
   inferSubscriptionImportErrorCategory,
@@ -20,6 +21,7 @@ import {
   shouldRecheckFakeIpDnsAnswers,
 } from "@subboost/server-core/subscription/ssrf-ip";
 import { getAllowUnsafeSubscriptionSources } from "./source-import-settings";
+import { requestPinnedText, ResponseTooLargeError, type DirectHttpResponse } from "./pinned-http";
 
 const DEFAULT_TIMEOUT_MS = 15000;
 const DEFAULT_MAX_BYTES = 10 * 1024 * 1024;
@@ -72,34 +74,44 @@ function normalizeHostname(hostname: string): string {
 async function validatePublicFetchTarget(
   url: string,
   allowUnsafeSubscriptionSources: boolean
-): Promise<SourceImportTransportResult | null> {
+): Promise<
+  | { ok: true; addresses: string[] | null }
+  | { ok: false; failure: SourceImportTransportResult }
+> {
   let parsed: URL;
   try {
     parsed = new URL(url);
   } catch {
-    return toSecurityFailure("无效的订阅 URL");
+    return { ok: false, failure: toSecurityFailure("无效的订阅 URL") };
   }
 
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    return toSecurityFailure("只支持 HTTP 或 HTTPS 订阅 URL");
+    return { ok: false, failure: toSecurityFailure("只支持 HTTP 或 HTTPS 订阅 URL") };
   }
 
   if (parsed.username || parsed.password) {
-    return toSecurityFailure("订阅 URL 不允许包含用户名或密码");
+    return { ok: false, failure: toSecurityFailure("订阅 URL 不允许包含用户名或密码") };
   }
 
-  if (allowUnsafeSubscriptionSources) return null;
+  if (allowUnsafeSubscriptionSources) return { ok: true, addresses: null };
 
   const hostname = normalizeHostname(parsed.hostname);
   if (!hostname || hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local")) {
-    return toSecurityFailure("禁止访问本机或内网地址");
+    return { ok: false, failure: toSecurityFailure("禁止访问本机或内网地址") };
   }
 
   if (isPrivateOrReservedIp(hostname)) {
-    return toSecurityFailure("禁止访问本机或内网地址");
+    return { ok: false, failure: toSecurityFailure("禁止访问本机或内网地址") };
   }
 
-  const records = await lookup(hostname, { all: true, verbatim: true }).catch(() => []);
+  if (isIP(hostname)) return { ok: true, addresses: [hostname] };
+
+  const records = await lookup(hostname, { all: true, verbatim: true }).catch(() => null);
+  if (!records || records.length === 0) {
+    // Compatibility fallback documented for local: if DNS validation cannot
+    // obtain any address, let the runtime resolver make the connection.
+    return { ok: true, addresses: null };
+  }
   const addresses = normalizeResolvedIpAddresses(records.map((record) => record.address));
   const finalAddresses = shouldRecheckFakeIpDnsAnswers(addresses)
     ? selectDnsAddressesAfterFakeIpRecheck(
@@ -109,10 +121,65 @@ async function validatePublicFetchTarget(
     : addresses;
   const addressesToCheck = finalAddresses.length > 0 ? finalAddresses : addresses;
   if (addressesToCheck.some((address) => isPrivateOrReservedIp(address))) {
-    return toSecurityFailure("禁止访问本机或内网地址");
+    return { ok: false, failure: toSecurityFailure("禁止访问本机或内网地址") };
   }
 
-  return null;
+  return { ok: true, addresses: addressesToCheck.length > 0 ? addressesToCheck : null };
+}
+
+async function readFetchBodyLimited(response: Response, maxBytes: number): Promise<string> {
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel("response too large").catch(() => undefined);
+      throw new ResponseTooLargeError();
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(bytes);
+}
+
+async function requestUnpinnedText(params: {
+  url: string;
+  method: "GET" | "HEAD";
+  userAgent: string;
+  maxBytes: number;
+  signal: AbortSignal;
+}): Promise<DirectHttpResponse> {
+  const response = await fetch(params.url, {
+    method: params.method,
+    headers: {
+      "User-Agent": params.userAgent,
+      Accept: "text/plain, application/yaml, application/x-yaml, */*;q=0.8",
+      "Cache-Control": "no-cache",
+    },
+    redirect: "manual",
+    signal: params.signal,
+  });
+  const headers = headersToRecord(response.headers);
+  if (response.status >= 300 && response.status < 400) {
+    await response.body?.cancel("redirect response is not consumed").catch(() => undefined);
+    return { status: response.status, headers, content: "" };
+  }
+  const contentLength = Number(headers["content-length"] || "0");
+  if (Number.isFinite(contentLength) && contentLength > params.maxBytes) {
+    await response.body?.cancel().catch(() => undefined);
+    throw new ResponseTooLargeError();
+  }
+  const content = params.method === "HEAD" ? "" : await readFetchBodyLimited(response, params.maxBytes);
+  return { status: response.status, headers, content };
 }
 
 async function fetchTextDirect(
@@ -124,41 +191,39 @@ async function fetchTextDirect(
 
   try {
     let currentUrl = request.url;
-    let response: Response | null = null;
+    let response: DirectHttpResponse | null = null;
     for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount += 1) {
-      const guardFailure = await validatePublicFetchTarget(currentUrl, allowUnsafeSubscriptionSources);
-      if (guardFailure) return guardFailure;
-
-      response = await fetch(currentUrl, {
-        method: request.purpose === "userinfo" ? "HEAD" : "GET",
-        headers: {
-          "User-Agent": request.userAgent,
-          Accept: "text/plain, application/yaml, application/x-yaml, */*;q=0.8",
-          "Cache-Control": "no-cache",
-        },
-        redirect: "manual",
-        signal: controller.signal,
-      });
+      const validation = await validatePublicFetchTarget(currentUrl, allowUnsafeSubscriptionSources);
+      if (!validation.ok) return validation.failure;
+
+      const method = request.purpose === "userinfo" ? "HEAD" : "GET";
+      response = validation.addresses
+        ? await requestPinnedText({
+            url: currentUrl,
+            addresses: validation.addresses,
+            method,
+            userAgent: request.userAgent,
+            maxBytes: request.maxBytes,
+            signal: controller.signal,
+          })
+        : await requestUnpinnedText({
+            url: currentUrl,
+            method,
+            userAgent: request.userAgent,
+            maxBytes: request.maxBytes,
+            signal: controller.signal,
+          });
 
       if (response.status < 300 || response.status >= 400) break;
-      const location = response.headers.get("location");
+      const location = response.headers.location;
       if (!location) break;
       currentUrl = new URL(location, currentUrl).toString();
       response = null;
     }
 
     if (!response) return toFailure("订阅重定向次数过多", 310);
-    const headers = headersToRecord(response.headers);
-    const contentLength = Number(headers["content-length"] || "0");
-    if (Number.isFinite(contentLength) && contentLength > request.maxBytes) {
-      return toFailure("订阅响应过大", 413);
-    }
-
-    const content = request.purpose === "userinfo" ? "" : await response.text();
-    if (new TextEncoder().encode(content).length > request.maxBytes) {
-      return toFailure("订阅响应过大", 413);
-    }
-    if (!response.ok) {
+    const { headers, content } = response;
+    if (response.status < 200 || response.status >= 300) {
       return toFailure(`HTTP ${response.status}`, response.status);
     }
 
@@ -169,6 +234,7 @@ async function fetchTextDirect(
       responseStatus: response.status,
     };
   } catch (error) {
+    if (error instanceof ResponseTooLargeError) return toFailure("订阅响应过大", 413);
     const message = error instanceof Error ? error.message : String(error);
     return toFailure(message);
   } finally {
diff --git a/local/src/lib/subscription-route-handlers.test.ts b/local/src/lib/subscription-route-handlers.test.ts
index a5d0663..bfe88c7 100644
--- a/local/src/lib/subscription-route-handlers.test.ts
+++ b/local/src/lib/subscription-route-handlers.test.ts
@@ -15,6 +15,7 @@ const mocks = vi.hoisted(() => ({
   deleteSubscription: vi.fn(),
   getSubscription: vi.fn(),
   json: vi.fn(),
+  jsonBodyError: vi.fn(),
   listSubscriptions: vi.fn(),
   readJsonBody: vi.fn(),
   refreshSubscription: vi.fn(),
@@ -26,6 +27,8 @@ vi.mock("@local/lib/api-auth", () => ({ withCurrentAdmin: mocks.withCurrentAdmin
 vi.mock("@local/lib/http", () => ({
   apiError: mocks.apiError,
   json: mocks.json,
+  jsonBodyError: mocks.jsonBodyError,
+  LOCAL_JSON_BODY_LIMITS: { subscription: 16 * 1024 * 1024 },
   readJsonBody: mocks.readJsonBody,
 }));
 vi.mock("@local/lib/subscription-service", () => ({
@@ -47,6 +50,7 @@ describe("local subscription route handlers", () => {
     );
     mocks.json.mockImplementation((body: unknown, status = 200) => ({ body, status }));
     mocks.apiError.mockImplementation((message: string, code: string, status: number) => ({ message, code, status }));
+    mocks.jsonBodyError.mockImplementation(() => ({ message: "Invalid JSON body.", code: "BAD_REQUEST", status: 400 }));
   });
 
   it("extracts subscription ids from query strings", () => {
@@ -71,14 +75,14 @@ describe("local subscription route handlers", () => {
   });
 
   it("creates subscriptions and reports bad input", async () => {
-    mocks.readJsonBody.mockResolvedValueOnce(null);
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: false, reason: "invalid_json" });
     await expect(createSubscriptionResponse(request)).resolves.toEqual({
       message: "Invalid JSON body.",
       code: "BAD_REQUEST",
       status: 400,
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "A" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "A" } });
     mocks.createSubscription.mockResolvedValueOnce({ id: "sub-1" });
     await expect(createSubscriptionResponse(request)).resolves.toEqual({
       body: { subscription: { id: "sub-1" } },
@@ -86,7 +90,7 @@ describe("local subscription route handlers", () => {
     });
     expect(mocks.createSubscription).toHaveBeenCalledWith("admin-1", { name: "A" });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "" } });
     mocks.createSubscription.mockRejectedValueOnce(new Error("Name required"));
     await expect(createSubscriptionResponse(request)).resolves.toEqual({
       message: "Name required",
@@ -94,7 +98,7 @@ describe("local subscription route handlers", () => {
       status: 400,
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "" } });
     mocks.createSubscription.mockRejectedValueOnce("bad");
     await expect(createSubscriptionResponse(request)).resolves.toEqual({
       message: "Unable to create subscription.",
@@ -104,21 +108,21 @@ describe("local subscription route handlers", () => {
   });
 
   it("updates subscriptions and validates JSON body shape", async () => {
-    mocks.readJsonBody.mockResolvedValueOnce([]);
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: [] });
     await expect(updateSubscriptionResponse(request, "sub-1")).resolves.toEqual({
       message: "Invalid JSON body.",
       code: "BAD_REQUEST",
       status: 400,
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "B" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "B" } });
     mocks.updateSubscription.mockResolvedValueOnce({ id: "sub-1", name: "B" });
     await expect(updateSubscriptionResponse(request, "sub-1")).resolves.toEqual({
       body: { subscription: { id: "sub-1", name: "B" } },
       status: 200,
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "B" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "B" } });
     mocks.updateSubscription.mockResolvedValueOnce(null);
     await expect(updateSubscriptionResponse(request, "missing")).resolves.toEqual({
       message: "Subscription not found.",
@@ -126,7 +130,7 @@ describe("local subscription route handlers", () => {
       status: 404,
     });
 
-    mocks.readJsonBody.mockResolvedValueOnce({ name: "" });
+    mocks.readJsonBody.mockResolvedValueOnce({ ok: true, value: { name: "" } });
     mocks.updateSubscription.mockRejectedValueOnce("bad");
     await expect(updateSubscriptionResponse(request, "sub-1")).resolves.toEqual({
       message: "Unable to update subscription.",
diff --git a/local/src/lib/subscription-route-handlers.ts b/local/src/lib/subscription-route-handlers.ts
index 5957b95..fa5d076 100644
--- a/local/src/lib/subscription-route-handlers.ts
+++ b/local/src/lib/subscription-route-handlers.ts
@@ -1,5 +1,5 @@
 import { withCurrentAdmin } from "@local/lib/api-auth";
-import { apiError, json, readJsonBody } from "@local/lib/http";
+import { apiError, json, jsonBodyError, LOCAL_JSON_BODY_LIMITS, readJsonBody } from "@local/lib/http";
 import {
   createSubscription,
   deleteSubscription,
@@ -19,11 +19,11 @@ export async function listSubscriptionsResponse() {
 
 export async function createSubscriptionResponse(request: Request) {
   return withCurrentAdmin(async (admin) => {
-    const body = await readJsonBody(request);
-    if (!body) return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
+    const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.subscription);
+    if (!parsedBody.ok) return jsonBodyError(parsedBody);
 
     try {
-      const subscription = await createSubscription(admin.id, body);
+      const subscription = await createSubscription(admin.id, parsedBody.value);
       return json({ subscription }, 201);
     } catch (error) {
       return apiError(error instanceof Error ? error.message : "Unable to create subscription.", "BAD_REQUEST", 400);
@@ -41,7 +41,9 @@ export async function getSubscriptionResponse(id: string) {
 
 export async function updateSubscriptionResponse(request: Request, id: string) {
   return withCurrentAdmin(async (admin) => {
-    const body = await readJsonBody(request);
+    const parsedBody = await readJsonBody(request, LOCAL_JSON_BODY_LIMITS.subscription);
+    if (!parsedBody.ok) return jsonBodyError(parsedBody);
+    const body = parsedBody.value;
     if (!body || typeof body !== "object" || Array.isArray(body)) {
       return apiError("Invalid JSON body.", "BAD_REQUEST", 400);
     }
diff --git a/local/src/lib/subscription-service.test.ts b/local/src/lib/subscription-service.test.ts
index aca6030..15457ac 100644
--- a/local/src/lib/subscription-service.test.ts
+++ b/local/src/lib/subscription-service.test.ts
@@ -33,8 +33,10 @@ const mocks = vi.hoisted(() => ({
       findFirst: vi.fn(),
       findUnique: vi.fn(),
       update: vi.fn(),
+      updateMany: vi.fn(),
       delete: vi.fn(),
     },
+    subscriptionAutoUpdateState: { upsert: vi.fn() },
     $transaction: vi.fn(),
   },
 }));
@@ -164,13 +166,16 @@ describe("local subscription service", () => {
     mocks.prisma.subscription.findFirst.mockResolvedValue(row());
     mocks.prisma.subscription.findUnique.mockResolvedValue(row());
     mocks.prisma.subscription.update.mockResolvedValue(row({ name: "Updated" }));
+    mocks.prisma.subscription.updateMany.mockResolvedValue({ count: 1 });
+    mocks.prisma.subscriptionAutoUpdateState.upsert.mockResolvedValue({});
     mocks.prisma.subscription.delete.mockResolvedValue(row());
-    mocks.prisma.$transaction.mockImplementation(async (callback) =>
-      callback({
-        subscription: { update: vi.fn() },
-        subscriptionAutoUpdateState: { upsert: vi.fn() },
-      })
-    );
+    mocks.prisma.$transaction.mockImplementation(async (callback) => callback({
+      subscription: {
+        update: mocks.prisma.subscription.update,
+        updateMany: mocks.prisma.subscription.updateMany,
+      },
+      subscriptionAutoUpdateState: { upsert: mocks.prisma.subscriptionAutoUpdateState.upsert },
+    }));
     mocks.importSourceUrlDirect.mockResolvedValue({
       ok: true,
       parsedNodes: [node("Imported")],
@@ -336,6 +341,13 @@ describe("local subscription service", () => {
         autoUpdateInterval: 359,
       })
     ).rejects.toThrow("自动更新最小间隔为 0.1 小时");
+
+    await expect(createSubscription("owner-1", { name: "Bad", nodes: [null] })).rejects.toThrow(
+      "节点 #1 必须是对象"
+    );
+    await expect(
+      createSubscription("owner-1", { name: "Too many", nodes: Array.from({ length: 10_001 }, () => null) })
+    ).rejects.toThrow("Node count cannot exceed 10000");
   });
 
   it("updates subscriptions and preserves existing values when fields are omitted", async () => {
@@ -388,6 +400,22 @@ describe("local subscription service", () => {
       }),
       include: { autoUpdateState: true },
     });
+
+    mocks.prisma.subscription.findFirst.mockResolvedValueOnce(row({ autoUpdateInterval: null }));
+    await updateSubscription("owner-1", "sub-1", { autoUpdateInterval: 7200 });
+    expect(mocks.prisma.subscriptionAutoUpdateState.upsert).toHaveBeenCalledWith({
+      where: { subscriptionId: "sub-1" },
+      create: { subscriptionId: "sub-1" },
+      update: {
+        externalFailureCount: 0,
+        failureSourceState: null,
+        lastFailedAt: null,
+        lastAttemptedAt: null,
+        disabledAt: null,
+        disabledReason: null,
+        disabledPreviousInterval: null,
+      },
+    });
   });
 
   it("replaces submitted config instead of retaining omitted stale fields", async () => {
@@ -478,6 +506,18 @@ describe("local subscription service", () => {
     });
     expect(mocks.prisma.$transaction).toHaveBeenCalled();
 
+    mocks.prisma.subscription.updateMany.mockResolvedValueOnce({ count: 0 });
+    await expect(refreshSubscription("owner-1", "sub-1")).resolves.toEqual({
+      ok: false,
+      response: {
+        body: {
+          error: "Subscription changed while refresh was in progress.",
+          code: "SUBSCRIPTION_CHANGED",
+        },
+        status: 409,
+      },
+    });
+
     mocks.prepareRefreshCacheResult.mockReturnValueOnce({ ok: false, reason: "too_many_nodes" });
     await expect(refreshSubscription("owner-1", "sub-1")).resolves.toEqual({
       ok: false,
diff --git a/local/src/lib/subscription-service.ts b/local/src/lib/subscription-service.ts
index c5e3911..f76e31e 100644
--- a/local/src/lib/subscription-service.ts
+++ b/local/src/lib/subscription-service.ts
@@ -10,12 +10,12 @@ import {
   normalizeSubscriptionConfigForPersistence,
   normalizeSubscriptionInfoForPersistence,
   normalizeSubscriptionName,
-  normalizeSubscriptionNodeList,
   normalizeSubscriptionUrlList,
   prepareRefreshCacheResult,
   refreshNodeSnapshot,
   serializeSubscriptionDetailData,
   serializeSubscriptionSummaryData,
+  validateSubscriptionNodeList,
   type SavedSource,
   type RefreshNodeSnapshotResult,
 } from "@subboost/server-core/subscription";
@@ -101,6 +101,14 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
+function validateLocalSubscriptionNodes(value: unknown): ParsedNode[] {
+  if (value === undefined || value === null) return [];
+  if (Array.isArray(value) && value.length > MAX_NODES_PER_SUBSCRIPTION) {
+    throw new Error(`Node count cannot exceed ${MAX_NODES_PER_SUBSCRIPTION}.`);
+  }
+  return validateSubscriptionNodeList(value);
+}
+
 function buildLocalSubscriptionUrl(token: string): string {
   return `${getAppUrl()}/api/subscriptions/${token}/config.yaml`;
 }
@@ -181,7 +189,7 @@ export async function createSubscription(ownerId: string, body: unknown): Promis
   if (!name) throw new Error("Subscription name is required.");
 
   const urls = normalizeSubscriptionUrlList(body.urls);
-  const nodes = normalizeSubscriptionNodeList(body.nodes);
+  const nodes = validateLocalSubscriptionNodes(body.nodes);
   if (urls.length === 0 && nodes.length === 0) throw new Error("At least one URL or node is required.");
 
   const config = buildLocalSubscriptionConfig(body);
@@ -215,12 +223,13 @@ export async function updateSubscription(ownerId: string, id: string, body: unkn
   const hasUrls = "urls" in body;
   const hasNodes = "nodes" in body;
   const hasConfig = "config" in body || "smartNodeMatchingEnabled" in body;
+  const nextNodes = hasNodes ? validateLocalSubscriptionNodes(body.nodes) : currentSecrets.nodes;
 
   if (hasUrls) {
     data.encryptedUrls = encryptJson(normalizeSubscriptionUrlList(body.urls));
   }
   if (hasNodes) {
-    data.encryptedNodes = encryptJson(normalizeSubscriptionNodeList(body.nodes));
+    data.encryptedNodes = encryptJson(nextNodes);
   }
   if (hasConfig) {
     const config = buildLocalSubscriptionConfig(body, currentSecrets.config);
@@ -232,20 +241,39 @@ export async function updateSubscription(ownerId: string, id: string, body: unkn
 
   if (hasUrls || hasNodes || hasConfig) {
     const nextUrls = hasUrls ? normalizeSubscriptionUrlList(body.urls) : currentSecrets.urls;
-    const nextNodes = hasNodes ? normalizeSubscriptionNodeList(body.nodes) : currentSecrets.nodes;
     if (nextUrls.length === 0 && nextNodes.length === 0) {
       throw new Error("At least one URL or node is required.");
     }
   }
 
+  let resetAutoUpdateState = false;
   if ("autoUpdateInterval" in body) {
-    data.autoUpdateInterval = normalizeLocalAutoUpdateIntervalSeconds(body.autoUpdateInterval);
+    const nextAutoUpdateInterval = normalizeLocalAutoUpdateIntervalSeconds(body.autoUpdateInterval);
+    data.autoUpdateInterval = nextAutoUpdateInterval;
+    resetAutoUpdateState = current.autoUpdateInterval === null && nextAutoUpdateInterval !== null;
   }
 
-  const row = await prisma.subscription.update({
-    where: { id: current.id },
-    data,
-    include: { autoUpdateState: true },
+  const row = await prisma.$transaction(async (tx) => {
+    if (resetAutoUpdateState) {
+      await tx.subscriptionAutoUpdateState.upsert({
+        where: { subscriptionId: current.id },
+        create: { subscriptionId: current.id },
+        update: {
+          externalFailureCount: 0,
+          failureSourceState: null,
+          lastFailedAt: null,
+          lastAttemptedAt: null,
+          disabledAt: null,
+          disabledReason: null,
+          disabledPreviousInterval: null,
+        },
+      });
+    }
+    return tx.subscription.update({
+      where: { id: current.id },
+      data,
+      include: { autoUpdateState: true },
+    });
   });
   return formatSubscription(row);
 }
@@ -302,21 +330,24 @@ export function buildSubscriptionCacheExpiry(from: Date): Date {
 
 async function persistRefreshSuccess(params: {
   subscriptionId: string;
+  expectedUpdatedAt: Date;
   snapshot: RefreshNodeSnapshotResult;
   config: Record<string, unknown>;
   cachedAt: Date;
-}) {
-  await prisma.$transaction(async (tx) => {
-    await tx.subscription.update({
-      where: { id: params.subscriptionId },
+}): Promise<boolean> {
+  return prisma.$transaction(async (tx) => {
+    const updated = await tx.subscription.updateMany({
+      where: { id: params.subscriptionId, updatedAt: params.expectedUpdatedAt },
       data: {
         encryptedNodes: encryptJson(params.snapshot.nodes),
         encryptedConfig: encryptJson({ ...params.config, sources: params.snapshot.savedSources }),
         encryptedSubscriptionInfo: encryptJson(params.snapshot.subscriptionInfo),
         lastUpdatedAt: params.cachedAt,
         cacheExpiresAt: buildSubscriptionCacheExpiry(params.cachedAt),
+        updatedAt: params.cachedAt,
       },
     });
+    if (updated.count !== 1) return false;
     await tx.subscriptionAutoUpdateState.upsert({
       where: { subscriptionId: params.subscriptionId },
       create: { subscriptionId: params.subscriptionId },
@@ -330,6 +361,7 @@ async function persistRefreshSuccess(params: {
         disabledPreviousInterval: null,
       },
     });
+    return true;
   });
 }
 
@@ -361,7 +393,22 @@ export async function refreshSubscription(ownerId: string, id: string) {
   }
 
   const cachedAt = new Date();
-  await persistRefreshSuccess({ subscriptionId: row.id, snapshot, config: secrets.config, cachedAt });
+  const persisted = await persistRefreshSuccess({
+    subscriptionId: row.id,
+    expectedUpdatedAt: row.updatedAt,
+    snapshot,
+    config: secrets.config,
+    cachedAt,
+  });
+  if (!persisted) {
+    return {
+      ok: false as const,
+      response: {
+        body: { error: "Subscription changed while refresh was in progress.", code: "SUBSCRIPTION_CHANGED" },
+        status: 409,
+      },
+    };
+  }
   return {
     ok: true as const,
     body: buildManualRefreshSuccessResponseBody({
diff --git a/local/test/auto-update-service.test.ts b/local/test/auto-update-service.test.ts
index 00cca57..6a7d3fe 100644
--- a/local/test/auto-update-service.test.ts
+++ b/local/test/auto-update-service.test.ts
@@ -3,6 +3,13 @@ import { refreshNodeSnapshot } from "@subboost/server-core/subscription";
 import { prisma } from "@local/lib/prisma";
 import { runLocalSubscriptionAutoUpdateCron } from "@local/lib/auto-update-service";
 
+const dbMocks = vi.hoisted(() => ({
+  findMany: vi.fn(),
+  updateMany: vi.fn(async () => ({ count: 1 })),
+  upsert: vi.fn(async (args) => args),
+  transaction: vi.fn(),
+}));
+
 vi.mock("@local/lib/crypto", () => ({
   decryptJson: vi.fn((ciphertext: string | null | undefined, fallback: unknown) =>
     ciphertext ? JSON.parse(ciphertext.replace(/^json:/, "")) : fallback
@@ -16,13 +23,13 @@ vi.mock("@local/lib/crypto", () => ({
 vi.mock("@local/lib/prisma", () => ({
   prisma: {
     subscription: {
-      findMany: vi.fn(),
-      update: vi.fn(async (args) => args),
+      findMany: dbMocks.findMany,
+      updateMany: dbMocks.updateMany,
     },
     subscriptionAutoUpdateState: {
-      upsert: vi.fn(async (args) => args),
+      upsert: dbMocks.upsert,
     },
-    $transaction: vi.fn(async (operations: Array<Promise<unknown>>) => Promise.all(operations)),
+    $transaction: dbMocks.transaction,
   },
 }));
 
@@ -67,9 +74,14 @@ function subscription(overrides: Record<string, unknown> = {}) {
 
 beforeEach(() => {
   vi.mocked(prisma.subscription.findMany).mockReset();
-  vi.mocked(prisma.subscription.update).mockClear();
+  vi.mocked(prisma.subscription.updateMany).mockClear();
   vi.mocked(prisma.subscriptionAutoUpdateState.upsert).mockClear();
   vi.mocked(prisma.$transaction).mockClear();
+  dbMocks.updateMany.mockResolvedValue({ count: 1 });
+  dbMocks.transaction.mockImplementation(async (callback) => callback({
+    subscription: { updateMany: dbMocks.updateMany },
+    subscriptionAutoUpdateState: { upsert: dbMocks.upsert },
+  }));
   vi.mocked(refreshNodeSnapshot).mockReset();
 });
 
@@ -82,7 +94,7 @@ describe("local subscription auto-update service", () => {
     const summary = await runLocalSubscriptionAutoUpdateCron(new Date("2026-06-02T00:30:00.000Z"));
     expect(summary.results).toMatchObject({ total: 1, updated: 0, skipped: 1, failed: 0 });
     expect(refreshNodeSnapshot).not.toHaveBeenCalled();
-    expect(prisma.subscription.update).not.toHaveBeenCalled();
+    expect(prisma.subscription.updateMany).not.toHaveBeenCalled();
   });
 
   it("refreshes due subscriptions and persists the refreshed cache", async () => {
@@ -110,9 +122,9 @@ describe("local subscription auto-update service", () => {
         storedNodes: [],
       })
     );
-    expect(prisma.subscription.update).toHaveBeenCalledWith(
+    expect(prisma.subscription.updateMany).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { id: "sub-1" },
+        where: { id: "sub-1", updatedAt: new Date("2026-06-01T00:00:00.000Z") },
         data: expect.objectContaining({
           encryptedNodes: expect.stringContaining("node-a"),
           encryptedConfig: expect.stringContaining("src-1"),
@@ -132,4 +144,3 @@ describe("local subscription auto-update service", () => {
     );
   });
 });
-
diff --git a/local/test/cron-route-contract.test.ts b/local/test/cron-route-contract.test.ts
index 817d2ad..9fc89f7 100644
--- a/local/test/cron-route-contract.test.ts
+++ b/local/test/cron-route-contract.test.ts
@@ -5,6 +5,14 @@ import { refreshRuleIndex } from "@local/lib/rule-catalog";
 import * as updateSubscriptionsRoute from "../app/api/cron/update-subscriptions/route";
 import * as updateRuleIndexRoute from "../app/api/cron/update-rule-index/route";
 
+const leaseMocks = vi.hoisted(() => ({
+  acquire: vi.fn(),
+  assertOwned: vi.fn(),
+  release: vi.fn(),
+  stop: vi.fn(),
+  JobLeaseLostError: class JobLeaseLostError extends Error {},
+}));
+
 vi.mock("@local/lib/auto-update-service", () => ({
   runLocalSubscriptionAutoUpdateCron: vi.fn(),
 }));
@@ -13,6 +21,16 @@ vi.mock("@local/lib/rule-catalog", () => ({
   refreshRuleIndex: vi.fn(),
 }));
 
+vi.mock("@local/lib/job-lease", () => ({
+  acquireLocalJobLease: leaseMocks.acquire,
+  releaseLocalJobLease: leaseMocks.release,
+  startLocalJobLeaseHeartbeat: vi.fn(() => ({
+    assertOwned: leaseMocks.assertOwned,
+    stop: leaseMocks.stop,
+  })),
+  JobLeaseLostError: leaseMocks.JobLeaseLostError,
+}));
+
 function cronRequest(secret?: string): Request {
   return new Request("http://local.test/api/cron/update-subscriptions", {
     method: "POST",
@@ -35,6 +53,14 @@ beforeEach(() => {
   vi.clearAllMocks();
   vi.stubEnv("NODE_ENV", "production");
   vi.stubEnv("CRON_SECRET", "secret-1");
+  leaseMocks.acquire.mockResolvedValue({
+    name: "local-subscription-auto-update",
+    ownerToken: "owner",
+    expiresAt: new Date("2026-07-16T00:05:00.000Z"),
+  });
+  leaseMocks.assertOwned.mockResolvedValue(undefined);
+  leaseMocks.release.mockResolvedValue(undefined);
+  leaseMocks.stop.mockResolvedValue(undefined);
   vi.mocked(runLocalSubscriptionAutoUpdateCron).mockResolvedValue({
     results: { total: 0, updated: 0, skipped: 0, failed: 0, errors: [] },
     updatedSubscriptions: [],
@@ -108,6 +134,23 @@ describe("local cron routes", () => {
     expect((await readJson(response)).success).toBe(true);
   });
 
+  it("skips an overlapping run and fails closed after lease loss", async () => {
+    leaseMocks.acquire.mockResolvedValueOnce(null);
+    let response = await updateSubscriptionsRoute.POST(cronRequest("secret-1"));
+    expect(response.status).toBe(200);
+    expect(await readJson(response)).toMatchObject({ skipped: true, reason: "already_running" });
+    expect(runLocalSubscriptionAutoUpdateCron).not.toHaveBeenCalled();
+
+    vi.mocked(runLocalSubscriptionAutoUpdateCron).mockRejectedValueOnce(new leaseMocks.JobLeaseLostError());
+    response = await updateSubscriptionsRoute.POST(cronRequest("secret-1"));
+    expect(response.status).toBe(503);
+    expect(await readJson(response)).toEqual({
+      error: "Local subscription update lease lost.",
+      code: "JOB_LEASE_LOST",
+    });
+    expect(leaseMocks.release).toHaveBeenCalled();
+  });
+
   it("runs the rule index refresh cron when authorized", async () => {
     const response = await updateRuleIndexRoute.POST(
       new Request("http://local.test/api/cron/update-rule-index", {
diff --git a/local/test/source-import-route-contract.test.ts b/local/test/source-import-route-contract.test.ts
index 9045d18..5044298 100644
--- a/local/test/source-import-route-contract.test.ts
+++ b/local/test/source-import-route-contract.test.ts
@@ -80,6 +80,19 @@ describe("local source import route", () => {
     expect(importSourceUrlDirect).not.toHaveBeenCalled();
   });
 
+  it("rejects source import bodies above 64 KiB", async () => {
+    const response = await route.POST(new Request("http://local.test/api/source-import", {
+      method: "POST",
+      headers: { "content-length": String(64 * 1024 + 1) },
+      body: "{}",
+    }));
+    expect(response.status).toBe(413);
+    await expect(response.json()).resolves.toEqual({
+      error: "Request body is too large.",
+      code: "PAYLOAD_TOO_LARGE",
+    });
+  });
+
   it("normalizes optional userinfo fields and forwards import errors", async () => {
     let response = await route.POST(jsonRequest({
       url: " https://example.com/sub.yaml ",
diff --git a/local/test/subscription-route-contract.test.ts b/local/test/subscription-route-contract.test.ts
index 0ef551e..cd9edb3 100644
--- a/local/test/subscription-route-contract.test.ts
+++ b/local/test/subscription-route-contract.test.ts
@@ -125,6 +125,20 @@ describe("local subscription routes", () => {
     expect(createSubscription).toHaveBeenCalledWith("admin-1", fullConfigPayload);
   });
 
+  it("rejects subscription bodies above 16 MiB", async () => {
+    const response = await pluralCollectionRoute.POST(new Request("http://local.test/api/subscriptions", {
+      method: "POST",
+      headers: { "content-length": String(16 * 1024 * 1024 + 1) },
+      body: "{}",
+    }));
+    expect(response.status).toBe(413);
+    await expect(response.json()).resolves.toEqual({
+      error: "Request body is too large.",
+      code: "PAYLOAD_TOO_LARGE",
+    });
+    expect(createSubscription).not.toHaveBeenCalled();
+  });
+
   it("uses plural item and refresh routes with path ids", async () => {
     const params = { params: Promise.resolve({ id: "sub-1" }) };
 
diff --git a/local/test/template-route-contract.test.ts b/local/test/template-route-contract.test.ts
index 38d5477..815c7c8 100644
--- a/local/test/template-route-contract.test.ts
+++ b/local/test/template-route-contract.test.ts
@@ -94,6 +94,19 @@ describe("local template routes", () => {
     expect(deleteTemplate).toHaveBeenCalledWith("admin-1", "tpl-1");
   });
 
+  it("rejects template bodies above 4 MiB", async () => {
+    const response = await collectionRoute.POST(new Request("http://local.test/api/templates", {
+      method: "POST",
+      headers: { "content-length": String(4 * 1024 * 1024 + 1) },
+      body: "{}",
+    }));
+    expect(response.status).toBe(413);
+    await expect(response.json()).resolves.toEqual({
+      error: "Request body is too large.",
+      code: "PAYLOAD_TOO_LARGE",
+    });
+  });
+
   it("reports local template collection errors", async () => {
     vi.mocked(listTemplates).mockRejectedValueOnce(new Error("Bad filters"));
     let response = await collectionRoute.GET(new Request("http://local.test/api/templates?type=default"));

From 91afc93cd1e511a12567b3aafab85bba9462f95b Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Thu, 16 Jul 2026 08:39:16 +0800
Subject: [PATCH 15/36] fix: make local updates recoverable

---
 local/docker-compose.image.yml                |   4 +-
 local/docker-compose.yml                      |   4 +-
 local/local.env.example                       |   3 +
 local/scripts/install.sh                      | 132 +++++----
 .../scripts/selfhost-lifecycle-shell.test.ts  | 149 ++++++++++
 local/scripts/selfhost-shell.test.ts          |  35 ++-
 local/scripts/subboost.sh                     | 262 +++++++++++++++---
 7 files changed, 488 insertions(+), 101 deletions(-)
 create mode 100644 local/scripts/selfhost-lifecycle-shell.test.ts

diff --git a/local/docker-compose.image.yml b/local/docker-compose.image.yml
index d46684a..f582ac5 100644
--- a/local/docker-compose.image.yml
+++ b/local/docker-compose.image.yml
@@ -27,6 +27,8 @@ services:
       ENCRYPTION_KEY: ${ENCRYPTION_KEY:?set ENCRYPTION_KEY}
       JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET}
       CRON_SECRET: ${CRON_SECRET:?set CRON_SECRET}
+      LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:?set LOCAL_SETUP_TOKEN}
+      TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
       APP_URL: ${APP_URL:-http://localhost:3000}
 
   cron:
@@ -41,7 +43,7 @@ services:
       [
         "sh",
         "-c",
-        "i=0; while true; do if [ $$i -le 0 ]; then echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-rule-index\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-rule-index || true; i=10; fi; echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-subscriptions\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-subscriptions || true; i=$$((i - 1)); sleep 360; done"
+        "i=0; while true; do failed=0; if [ $$i -le 0 ]; then echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-rule-index\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-rule-index || failed=1; i=10; fi; echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-subscriptions\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-subscriptions || failed=1; i=$$((i - 1)); if [ $$failed -ne 0 ]; then echo \"[local-cron] one or more endpoints failed; restarting after delay\" >&2; sleep 30; exit 1; fi; sleep 360; done"
       ]
 
 volumes:
diff --git a/local/docker-compose.yml b/local/docker-compose.yml
index 656e220..01584a0 100644
--- a/local/docker-compose.yml
+++ b/local/docker-compose.yml
@@ -34,6 +34,8 @@ services:
       ENCRYPTION_KEY: ${ENCRYPTION_KEY:?set ENCRYPTION_KEY}
       JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET}
       CRON_SECRET: ${CRON_SECRET:?set CRON_SECRET}
+      LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:?set LOCAL_SETUP_TOKEN}
+      TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
       APP_URL: ${APP_URL:-http://localhost:3000}
       APP_RELEASE_VERSION: ${APP_RELEASE_VERSION:-}
       APP_BUILD_SHA: ${APP_BUILD_SHA:-}
@@ -52,7 +54,7 @@ services:
       [
         "sh",
         "-c",
-        "i=0; while true; do if [ $$i -le 0 ]; then echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-rule-index\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-rule-index || true; i=10; fi; echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-subscriptions\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-subscriptions || true; i=$$((i - 1)); sleep 360; done"
+        "i=0; while true; do failed=0; if [ $$i -le 0 ]; then echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-rule-index\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-rule-index || failed=1; i=10; fi; echo \"[local-cron] $(date -Iseconds) POST /api/cron/update-subscriptions\"; curl -fsS -X POST -H \"Authorization: Bearer $${CRON_SECRET}\" http://app:3000/api/cron/update-subscriptions || failed=1; i=$$((i - 1)); if [ $$failed -ne 0 ]; then echo \"[local-cron] one or more endpoints failed; restarting after delay\" >&2; sleep 30; exit 1; fi; sleep 360; done"
       ]
 
 volumes:
diff --git a/local/local.env.example b/local/local.env.example
index 3463519..77ef2f9 100644
--- a/local/local.env.example
+++ b/local/local.env.example
@@ -5,7 +5,10 @@ DATABASE_URL=<postgres-connection-string>
 ENCRYPTION_KEY=<generate-a-random-key>
 JWT_SECRET=<generate-a-random-key>
 CRON_SECRET=<generate-a-random-key>
+LOCAL_SETUP_TOKEN=<generate-a-32-byte-random-token>
 # 仅开发/测试可显式开启；生产环境即使设置也不会绕过 CRON_SECRET。
 ALLOW_UNAUTHENTICATED_CRON=false
+# 只有反向代理会清洗并重写 X-Forwarded-For / X-Real-IP 时才设为 true。
+TRUST_PROXY_HEADERS=false
 APP_URL=http://localhost:3000
 SUBBOOST_PORT=3000
diff --git a/local/scripts/install.sh b/local/scripts/install.sh
index c4c58a6..ec1607a 100644
--- a/local/scripts/install.sh
+++ b/local/scripts/install.sh
@@ -120,15 +120,6 @@ download_to_temp() {
   esac
 }
 
-install_file_from_url() {
-  local url="$1"
-  local destination="$2"
-  local mode="$3"
-  local tmp="$TMP_DIR/download"
-  download_to_temp "$url" "$tmp"
-  run_root install -m "$mode" "$tmp" "$destination"
-}
-
 json_get() {
   local key="$1"
   local file="$2"
@@ -445,7 +436,7 @@ docker_login_if_needed() {
 }
 
 compose() {
-  (cd "$SUBBOOST_HOME" && docker_cmd compose --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@")
+  (cd "$SUBBOOST_HOME" && docker_cmd compose --project-directory "$SUBBOOST_HOME" --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@")
 }
 
 subboost_app_container_id() {
@@ -507,20 +498,6 @@ prompt_for_port() {
   done
 }
 
-select_existing_or_random_port() {
-  local current_port selected_port
-  current_port="$(port_number "${1:-}")"
-  if port_can_be_used "$current_port"; then
-    printf '%s\n' "$current_port"
-    return 0
-  fi
-  selected_port="$(random_free_port)"
-  if [ -n "$current_port" ]; then
-    warn "已有配置端口 $current_port 被其它服务占用，已自动改用随机空闲端口 $selected_port。"
-  fi
-  printf '%s\n' "$selected_port"
-}
-
 wait_for_health() {
   local port="$1"
   local base="http://127.0.0.1:$(port_number "$port")"
@@ -541,9 +518,42 @@ wait_for_health() {
   return 1
 }
 
+cleanup_failed_install() {
+  local volumes_before="$1"
+  local project_name
+  project_name="$(basename "$SUBBOOST_HOME")"
+  compose down --remove-orphans >/dev/null 2>&1 || true
+  while IFS= read -r volume; do
+    [ -n "$volume" ] || continue
+    if ! grep -Fxq "$volume" "$volumes_before"; then
+      docker_cmd volume rm "$volume" >/dev/null 2>&1 || true
+    fi
+  done < <(docker_cmd volume ls -q --filter "label=com.docker.compose.project=$project_name" 2>/dev/null || true)
+}
+
+commit_candidate_install() {
+  local candidate_env="$1" candidate_compose="$2" candidate_manager="$3"
+  local live_env="$4" live_compose="$5"
+  local staged_env="${live_env}.candidate.$$"
+  local staged_compose="${live_compose}.candidate.$$"
+  local staged_manager="${SUBBOOST_BIN}.candidate.$$"
+  run_root install -m 600 "$candidate_env" "$staged_env" || return 1
+  if ! is_root; then run_root chown "$(id -u):$(id -g)" "$staged_env" || return 1; fi
+  run_root install -m 644 "$candidate_compose" "$staged_compose" || return 1
+  run_root install -m 755 "$candidate_manager" "$staged_manager" || return 1
+  run_root mv -f "$staged_env" "$live_env" || return 1
+  run_root mv -f "$staged_compose" "$live_compose" || return 1
+  run_root mv -f "$staged_manager" "$SUBBOOST_BIN" || return 1
+}
+
 main() {
   require_linux
   require_curl
+  local live_env="$ENV_FILE"
+  local live_compose="$COMPOSE_FILE"
+  if [ -e "$live_env" ] || [ -e "$live_compose" ]; then
+    die "Existing installation metadata was found. Use 'subboost update' or inspect the incomplete installation before retrying."
+  fi
   fetch_release_manifest
 
   local manifest_image manifest_compose manifest_manager manifest_version
@@ -556,6 +566,7 @@ main() {
   image="${SUBBOOST_IMAGE:-${manifest_image:-$DEFAULT_IMAGE}}"
   compose_url="${SUBBOOST_COMPOSE_URL:-$(resolve_url "$SUBBOOST_RELEASE_URL" "${manifest_compose:-$DEFAULT_COMPOSE_URL}")}"
   manager_url="${SUBBOOST_MANAGER_URL:-$(resolve_url "$SUBBOOST_RELEASE_URL" "${manifest_manager:-$DEFAULT_MANAGER_URL}")}"
+  [ -n "$image" ] && [ -n "$compose_url" ] && [ -n "$manager_url" ] || die "Release metadata is missing image, composeUrl, or managerUrl."
 
   say "Installing SubBoost."
   say "Install directory: $SUBBOOST_HOME"
@@ -572,11 +583,16 @@ main() {
   ensure_docker
   docker_login_if_needed
   run_root mkdir -p "$SUBBOOST_HOME" "$SUBBOOST_HOME/backups" "$(dirname "$SUBBOOST_BIN")"
-  install_file_from_url "$compose_url" "$COMPOSE_FILE" 644
-  install_file_from_url "$manager_url" "$SUBBOOST_BIN" 755
-
-  local existing_env="0"
-  if [ -f "$ENV_FILE" ]; then existing_env="1"; fi
+  ENV_FILE="$TMP_DIR/candidate.env"
+  COMPOSE_FILE="$TMP_DIR/candidate-compose.yml"
+  local candidate_manager="$TMP_DIR/candidate-manager"
+  local volumes_before="$TMP_DIR/volumes.before"
+  umask 077
+  : > "$ENV_FILE"
+  download_to_temp "$compose_url" "$COMPOSE_FILE"
+  download_to_temp "$manager_url" "$candidate_manager"
+  [ -s "$COMPOSE_FILE" ] || die "Candidate Compose file is empty."
+  [ -s "$candidate_manager" ] && bash -n "$candidate_manager" || die "Candidate manager is invalid."
 
   set_env_value SUBBOOST_IMAGE "$image"
   set_env_value SUBBOOST_RELEASE_URL "$SUBBOOST_UPDATE_RELEASE_URL"
@@ -588,6 +604,7 @@ main() {
   ensure_env_value ENCRYPTION_KEY "$(random_hex 32)"
   ensure_env_value JWT_SECRET "$(random_hex 32)"
   ensure_env_value CRON_SECRET "$(random_hex 32)"
+  ensure_env_value LOCAL_SETUP_TOKEN "$(random_hex 32)"
 
   local db_name db_user db_pass database_url current_url current_port default_host default_url input_url selected_port final_url recommended_port
   db_name="$(env_value POSTGRES_DB)"
@@ -599,37 +616,46 @@ main() {
   current_port="${SUBBOOST_PORT:-$(env_value SUBBOOST_PORT || true)}"
   current_url="${APP_URL:-$(env_value APP_URL || true)}"
 
-  if [ "$existing_env" = "0" ] || [ -z "$current_url" ]; then
-    default_host="$(detect_public_host)"
-    if [ -n "$current_url" ]; then
-      default_url="$(url_without_port "$current_url")"
-    else
-      default_url="http://$default_host"
-    fi
-    recommended_port="$(recommended_port_from "$current_port")"
-    input_url="$(prompt "请输入 SubBoost 访问地址，直接回车会自动填入服务器 ip [$default_url]: " "$default_url")"
-    selected_port="$(prompt_for_port "$recommended_port")"
-    final_url="$(normalize_app_url "$(url_without_port "$input_url")" "$selected_port")"
-    set_env_value SUBBOOST_PORT "$selected_port"
-    set_env_value APP_URL "$final_url"
+  default_host="$(detect_public_host)"
+  if [ -n "$current_url" ]; then
+    default_url="$(url_without_port "$current_url")"
   else
-    selected_port="$(select_existing_or_random_port "$current_port")"
-    final_url="$(normalize_app_url "$(url_without_port "$current_url")" "$selected_port")"
-    set_env_value SUBBOOST_PORT "$selected_port"
-    set_env_value APP_URL "$final_url"
-  fi
-
-  say "Pulling SubBoost image..."
+    default_url="http://$default_host"
+  fi
+  recommended_port="$(recommended_port_from "$current_port")"
+  input_url="$(prompt "请输入 SubBoost 访问地址，直接回车会自动填入服务器 ip [$default_url]: " "$default_url")"
+  selected_port="$(prompt_for_port "$recommended_port")"
+  final_url="$(normalize_app_url "$(url_without_port "$input_url")" "$selected_port")"
+  set_env_value SUBBOOST_PORT "$selected_port"
+  set_env_value APP_URL "$final_url"
+
+  compose config >/dev/null
+  local services
+  services="$(compose config --services)"
+  for service in app db cron; do
+    printf '%s\n' "$services" | grep -Fxq "$service" || die "Candidate Compose is missing service: $service"
+  done
+  docker_cmd volume ls -q > "$volumes_before"
+  say "Pulling SubBoost image before creating containers..."
   compose pull
   say "Starting SubBoost..."
-  compose up -d --remove-orphans
-  compose up -d --no-deps --force-recreate app
-  wait_for_health "$(env_value SUBBOOST_PORT)"
+  if ! compose up -d db app || ! wait_for_health "$(env_value SUBBOOST_PORT)" || ! compose up -d cron; then
+    cleanup_failed_install "$volumes_before"
+    die "New installation failed; only resources created by this run were cleaned up."
+  fi
+  if ! commit_candidate_install "$ENV_FILE" "$COMPOSE_FILE" "$candidate_manager" "$live_env" "$live_compose"; then
+    cleanup_failed_install "$volumes_before"
+    run_root rm -f "$live_env" "$live_compose" "${live_env}.candidate.$$" "${live_compose}.candidate.$$" "${SUBBOOST_BIN}.candidate.$$"
+    die "Failed to atomically install candidate metadata."
+  fi
+  ENV_FILE="$live_env"
+  COMPOSE_FILE="$live_compose"
 
   say ""
   say "SubBoost 已启动。"
   say "访问地址: $(env_value APP_URL)"
-  say "第一次打开网页时，请创建管理员账号。"
+  say "首次初始化链接: $(env_value APP_URL)/login#setup-token=$(env_value LOCAL_SETUP_TOKEN)"
+  say "请通过上面的链接创建第一个管理员；初始化成功后页面会清除令牌片段。"
   say "管理命令: subboost"
   say "重要提醒: 请把 $ENV_FILE 和数据库备份一起保存好。"
 }
diff --git a/local/scripts/selfhost-lifecycle-shell.test.ts b/local/scripts/selfhost-lifecycle-shell.test.ts
new file mode 100644
index 0000000..b47fcc3
--- /dev/null
+++ b/local/scripts/selfhost-lifecycle-shell.test.ts
@@ -0,0 +1,149 @@
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+const publicRoot = path.resolve(__dirname, "../..");
+
+function runRollbackScenario(restoreFails: boolean) {
+  const script = `
+    set -Eeuo pipefail
+    home="$(mktemp -d)"
+    trap 'rm -rf "$home"' EXIT
+    mkdir -p "$home/release" "$home/bin"
+    cat > "$home/release/release.json" <<'JSON'
+{"image":"new-image","composeUrl":"compose.yml","managerUrl":"manager"}
+JSON
+    printf 'services:\n  app: {}\n  db: {}\n  cron: {}\n' > "$home/release/compose.yml"
+    printf '#!/usr/bin/env bash\nexit 0\n' > "$home/release/manager"
+    cat > "$home/.env" <<ENV
+SUBBOOST_RELEASE_URL=file://$home/release/release.json
+SUBBOOST_IMAGE=old-image
+POSTGRES_DB=subboost
+POSTGRES_USER=subboost
+POSTGRES_PASSWORD=password
+DATABASE_URL=postgresql://subboost:password@db:5432/subboost?schema=public
+ENCRYPTION_KEY=key
+JWT_SECRET=jwt
+CRON_SECRET=cron
+APP_URL=http://127.0.0.1:31000
+SUBBOOST_PORT=31000
+ENV
+    : > "$home/docker-compose.yml"
+    export SUBBOOST_SCRIPT_SOURCE_ONLY=1
+    export SUBBOOST_HOME="$home"
+    export SUBBOOST_BIN="$home/bin/subboost"
+    export SUBBOOST_DOCTOR_HEALTH_ATTEMPTS=1
+    export SUBBOOST_DOCTOR_HEALTH_INTERVAL_SECONDS=0
+    source local/scripts/subboost.sh
+    sudo_do() { "$@"; }
+    read_env_file() { cat "$ENV_FILE"; }
+    log="$home/docker.log"
+    state="$home/state"
+    : > "$log"
+    printf 'old\n' > "$state"
+    docker() {
+      printf '%s\n' "$*" >> "$log"
+      if [ "$1" = "compose" ]; then
+        case "$*" in
+          *" config --services") printf 'app\ndb\ncron\n'; return 0 ;;
+          *" config") return 0 ;;
+          *" ps -q app") printf 'app-id\n'; return 0 ;;
+          *"pg_dump -Fc"*) printf 'custom-dump'; return 0 ;;
+          *"pg_restore --list"*) cat >/dev/null; return 0 ;;
+          *"pg_restore --clean"*) cat >/dev/null; [ "${restoreFails ? "1" : "0"}" = "0" ]; return $? ;;
+          *"candidate-compose.yml"*" up -d --no-deps app") printf 'candidate\n' > "$state"; return 0 ;;
+          *"old-compose.yml"*" up -d app") printf 'old\n' > "$state"; return 0 ;;
+        esac
+        return 0
+      fi
+      if [ "$1" = "inspect" ]; then printf 'sha256:old-image\n'; return 0; fi
+      return 0
+    }
+    curl() { [ "$(cat "$state")" = "old" ]; }
+    set +e
+    output="$(update_cmd 2>&1)"
+    status=$?
+    set -e
+    printf 'status=%s\n%s\n' "$status" "$output"
+    cat "$log"
+    [ "$status" -ne 0 ]
+  `;
+  return spawnSync("bash", ["-lc", "exec \"$BASH\" -s"], {
+    cwd: publicRoot,
+    encoding: "utf8",
+    input: script,
+    timeout: 30_000,
+    env: { ...process.env, LC_ALL: "C.UTF-8" },
+  });
+}
+
+describe("self-host update rollback lifecycle", () => {
+  it("restores the verified dump and old image after candidate health failure", () => {
+    const result = runRollbackScenario(false);
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain("Candidate update failed: candidate health check failed");
+    expect(result.stdout).toContain("pg_restore --clean --if-exists --exit-on-error");
+    expect(result.stdout).toContain("tag subboost-rollback:update-");
+    expect(result.stdout).toContain("old-image");
+    expect(result.stdout).toContain("Previous version restored successfully.");
+  });
+
+  it("keeps writers stopped and preserves the dump when database restore fails", () => {
+    const result = runRollbackScenario(true);
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain("Automatic rollback stopped: database restore failed");
+    expect(result.stdout).toContain("Keep app and cron stopped");
+    expect(result.stdout).toMatch(/old-compose\.yml.* stop cron app/);
+    expect(result.stdout).not.toMatch(/old-compose\.yml.* up -d app/);
+  });
+
+  it("never deletes a volume that existed before a failed installation", () => {
+    const result = spawnSync("bash", ["-lc", "exec \"$BASH\" -s"], {
+      cwd: publicRoot,
+      encoding: "utf8",
+      input: `
+        set -Eeuo pipefail
+        home="$(mktemp -d)"
+        trap 'rm -rf "$home"' EXIT
+        : > "$home/env"
+        : > "$home/compose.yml"
+        printf 'existing-volume\n' > "$home/volumes.before"
+        export SUBBOOST_SCRIPT_SOURCE_ONLY=1 SUBBOOST_HOME="$home"
+        source local/scripts/install.sh
+        ENV_FILE="$home/env" COMPOSE_FILE="$home/compose.yml" DOCKER_RUNNER=docker
+        docker() {
+          case "$*" in
+            "volume ls -q"*) printf 'existing-volume\nnew-volume\n' ;;
+            "volume rm"*) printf 'removed=%s\n' "$3" >> "$home/removed" ;;
+          esac
+        }
+        cleanup_failed_install "$home/volumes.before"
+        cat "$home/removed"
+      `,
+      timeout: 30_000,
+      env: { ...process.env, LC_ALL: "C.UTF-8" },
+    });
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain("removed=new-volume");
+    expect(result.stdout).not.toContain("removed=existing-volume");
+  });
+
+  it("persists a setup token and prints only the fragment bootstrap link", () => {
+    const installer = readFileSync(path.join(publicRoot, "local/scripts/install.sh"), "utf8");
+    expect(installer).toContain('ensure_env_value LOCAL_SETUP_TOKEN "$(random_hex 32)"');
+    expect(installer).toContain("/login#setup-token=$(env_value LOCAL_SETUP_TOKEN)");
+    expect(installer).not.toContain("?setup-token=");
+  });
+
+  it("propagates cron endpoint failures to the container restart policy", () => {
+    for (const file of ["local/docker-compose.yml", "local/docker-compose.image.yml"]) {
+      const compose = readFileSync(path.join(publicRoot, file), "utf8");
+      expect(compose).toContain("LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:?set LOCAL_SETUP_TOKEN}");
+      expect(compose).toContain("curl -fsS");
+      expect(compose).toContain("failed=1");
+      expect(compose).toContain("exit 1");
+      expect(compose).not.toContain("|| true");
+    }
+  });
+});
diff --git a/local/scripts/selfhost-shell.test.ts b/local/scripts/selfhost-shell.test.ts
index dd0b9f2..d6a7e14 100644
--- a/local/scripts/selfhost-shell.test.ts
+++ b/local/scripts/selfhost-shell.test.ts
@@ -238,13 +238,17 @@ ENV
       export SUBBOOST_DOCTOR_HEALTH_ATTEMPTS=3
       export SUBBOOST_DOCTOR_HEALTH_INTERVAL_SECONDS=0
       source local/scripts/subboost.sh
+      sudo_do() { "$@"; }
       docker() {
         if [ "$1" = "info" ]; then return 0; fi
         if [ "$1" = "compose" ]; then
           case "$*" in
             "compose version"*) return 0 ;;
+            *" config --services") printf 'app\\ndb\\ncron\\n'; return 0 ;;
             *" config") return 0 ;;
             *" pull") return 0 ;;
+            *"pg_dump -Fc"*) printf 'custom-dump'; return 0 ;;
+            *"pg_restore --list"*) cat >/dev/null; return 0 ;;
             *" up -d --remove-orphans") return 0 ;;
             *" up -d --no-deps --force-recreate app") return 0 ;;
             *" ps -q app") printf 'app-id\\n'; return 0 ;;
@@ -254,6 +258,7 @@ ENV
         fi
         if [ "$1" = "inspect" ]; then
           case "$*" in
+            *"{{.Image}}"*) printf 'sha256:old-image\\n'; return 0 ;;
             *".State.Status"*) printf 'running\\n'; return 0 ;;
             *".State.Health"*) printf 'healthy\\n'; return 0 ;;
           esac
@@ -324,15 +329,19 @@ ENV
       docker_log="$home/docker-log"
       : > "$docker_log"
       docker() {
+        printf 'command=%s\n' "$*" >> "$docker_log"
         if [ "$1" = "info" ]; then return 0; fi
         if [ "$1" = "compose" ]; then
           case "$*" in
             "compose version"*) return 0 ;;
+            *" config --services") printf 'app\\ndb\\ncron\\n'; return 0 ;;
             *" config") return 0 ;;
             *" pull")
               printf 'pull_image=%s\\n' "\${SUBBOOST_IMAGE:-}" >> "$docker_log"
               return 0
               ;;
+            *"pg_dump -Fc"*) printf 'custom-dump'; return 0 ;;
+            *"pg_restore --list"*) cat >/dev/null; return 0 ;;
             *" up -d --remove-orphans") return 0 ;;
             *" up -d --no-deps --force-recreate app") return 0 ;;
             *" ps -q app") printf 'app-id\\n'; return 0 ;;
@@ -342,6 +351,7 @@ ENV
         fi
         if [ "$1" = "inspect" ]; then
           case "$*" in
+            *"{{.Image}}"*) printf 'sha256:old-image\\n'; return 0 ;;
             *".State.Status"*) printf 'running\\n'; return 0 ;;
             *".State.Health"*) printf 'healthy\\n'; return 0 ;;
           esac
@@ -361,6 +371,14 @@ ENV
     expect(result.stdout).toContain("SUBBOOST_IMAGE=new-image");
     expect(result.stdout).toContain("SUBBOOST_COMPOSE_URL=file://");
     expect(result.stdout).toContain("SUBBOOST_MANAGER_URL=file://");
+    const pullIndex = result.stdout.search(/^command=compose.* pull$/m);
+    const pauseIndex = result.stdout.indexOf(" stop cron app");
+    const dumpIndex = result.stdout.indexOf("pg_dump -Fc");
+    const candidateStartIndex = result.stdout.indexOf("candidate-compose.yml", dumpIndex);
+    expect(pullIndex).toBeGreaterThanOrEqual(0);
+    expect(pauseIndex).toBeGreaterThan(pullIndex);
+    expect(dumpIndex).toBeGreaterThan(pauseIndex);
+    expect(candidateStartIndex).toBeGreaterThan(dumpIndex);
   }, 10_000);
 
   it("migrates old fixed official update sources to stable latest", () => {
@@ -414,11 +432,14 @@ JSON
         if [ "$1" = "compose" ]; then
           case "$*" in
             "compose version"*) return 0 ;;
+            *" config --services") printf 'app\\ndb\\ncron\\n'; return 0 ;;
             *" config") return 0 ;;
             *" pull")
               printf 'pull_image=%s\\n' "\${SUBBOOST_IMAGE:-}" >> "$docker_log"
               return 0
               ;;
+            *"pg_dump -Fc"*) printf 'custom-dump'; return 0 ;;
+            *"pg_restore --list"*) cat >/dev/null; return 0 ;;
             *" up -d --remove-orphans") return 0 ;;
             *" up -d --no-deps --force-recreate app") return 0 ;;
             *" ps -q app") printf 'app-id\\n'; return 0 ;;
@@ -428,6 +449,7 @@ JSON
         fi
         if [ "$1" = "inspect" ]; then
           case "$*" in
+            *"{{.Image}}"*) printf 'sha256:old-image\\n'; return 0 ;;
             *".State.Status"*) printf 'running\\n'; return 0 ;;
             *".State.Health"*) printf 'healthy\\n'; return 0 ;;
           esac
@@ -495,22 +517,27 @@ ENV
       source local/scripts/subboost.sh
       sudo_do() { "$@"; }
       load_env() { :; }
-      compose() { printf 'dump'; }
+      compose() {
+        case "$*" in
+          *"pg_dump -Fc"*) printf 'custom-dump' ;;
+          *"pg_restore --list"*) cat >/dev/null ;;
+        esac
+      }
       cat > "$ENV_FILE" <<'ENV'
 POSTGRES_DB=subboost
 POSTGRES_USER=subboost
 ENV
       for i in $(seq -w 1 12); do
-        : > "$BACKUP_DIR/subboost-20240101T0000\${i}Z.sql.gz"
+        : > "$BACKUP_DIR/subboost-20240101T0000\${i}Z.dump"
         : > "$BACKUP_DIR/subboost-20240101T0000\${i}Z.env"
       done
       backup_cmd >/dev/null
-      sql_count="$(find "$BACKUP_DIR" -maxdepth 1 -type f -name 'subboost-*.sql.gz' | wc -l | tr -d '[:space:]')"
+      sql_count="$(find "$BACKUP_DIR" -maxdepth 1 -type f -name 'subboost-*.dump' | wc -l | tr -d '[:space:]')"
       env_count="$(find "$BACKUP_DIR" -maxdepth 1 -type f -name 'subboost-*.env' | wc -l | tr -d '[:space:]')"
       printf 'sql=%s env=%s\\n' "$sql_count" "$env_count"
       [ "$sql_count" = "10" ]
       [ "$env_count" = "10" ]
-      [ ! -e "$BACKUP_DIR/subboost-20240101T000001Z.sql.gz" ]
+      [ ! -e "$BACKUP_DIR/subboost-20240101T000001Z.dump" ]
       [ ! -e "$BACKUP_DIR/subboost-20240101T000001Z.env" ]
     `;
 
diff --git a/local/scripts/subboost.sh b/local/scripts/subboost.sh
index c564fd7..a221ff1 100644
--- a/local/scripts/subboost.sh
+++ b/local/scripts/subboost.sh
@@ -60,9 +60,16 @@ docker_cmd() {
 }
 
 compose() {
-  [ -f "$COMPOSE_FILE" ] || die "Missing $COMPOSE_FILE"
-  [ -f "$ENV_FILE" ] || die "Missing $ENV_FILE"
-  (cd "$SUBBOOST_HOME" && docker_cmd compose --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@")
+  compose_files "$ENV_FILE" "$COMPOSE_FILE" "$@"
+}
+
+compose_files() {
+  local env_file="$1"
+  local compose_file="$2"
+  shift 2
+  [ -f "$compose_file" ] || die "Missing $compose_file"
+  [ -f "$env_file" ] || die "Missing $env_file"
+  (cd "$SUBBOOST_HOME" && docker_cmd compose --project-directory "$SUBBOOST_HOME" --env-file "$env_file" -f "$compose_file" "$@")
 }
 
 load_env() {
@@ -147,11 +154,47 @@ is_official_fixed_release_url() {
   esac
 }
 
-migrate_update_release_url() {
-  local release_url="$1"
-  is_official_fixed_release_url "$release_url" || return 1
-  say "Detected old fixed release update source; switching updates to stable latest."
-  write_runtime_env_value SUBBOOST_RELEASE_URL "$DEFAULT_STABLE_RELEASE_URL"
+random_hex() {
+  local bytes="$1"
+  if command -v openssl >/dev/null 2>&1; then
+    openssl rand -hex "$bytes"
+  else
+    dd if=/dev/urandom bs="$bytes" count=1 2>/dev/null | od -An -tx1 | tr -d ' \n'
+  fi
+}
+
+set_file_env_value() {
+  local file="$1"
+  local key="$2"
+  local value="$3"
+  local tmp="$TMP_DIR/env.$key"
+  awk -F= -v key="$key" '$1 != key { print }' "$file" > "$tmp"
+  printf '%s=%s\n' "$key" "$value" >> "$tmp"
+  mv "$tmp" "$file"
+}
+
+atomic_install_file() {
+  local source="$1"
+  local destination="$2"
+  local mode="$3"
+  stage_install_file "$source" "$destination" "$mode"
+  activate_staged_file "$destination"
+}
+
+stage_install_file() {
+  local source="$1"
+  local destination="$2"
+  local mode="$3"
+  local staged="${destination}.candidate.$$"
+  sudo_do install -m "$mode" "$source" "$staged" || return 1
+  if [ "$mode" = "600" ] && ! is_root; then
+    sudo_do chown "$(id -u):$(id -g)" "$staged" || return 1
+  fi
+}
+
+activate_staged_file() {
+  local destination="$1"
+  sudo_do mv -f "${destination}.candidate.$$" "$destination"
 }
 
 install_file_from_url() {
@@ -164,6 +207,32 @@ install_file_from_url() {
   sudo_do install -m "$mode" "$tmp" "$destination"
 }
 
+create_verified_dump() {
+  local output="$1"
+  local partial="${output}.partial"
+  local -a dump_status verify_status
+  sudo_do mkdir -p "$(dirname "$output")"
+  set +e
+  compose exec -T db pg_dump -Fc -U "${POSTGRES_USER:-subboost}" -d "${POSTGRES_DB:-subboost}" | sudo_do tee "$partial" >/dev/null
+  dump_status=("${PIPESTATUS[@]}")
+  set -e
+  if (( dump_status[0] != 0 || dump_status[1] != 0 )) || [ ! -s "$partial" ]; then
+    sudo_do rm -f -- "$partial"
+    say "Backup failed: pg_dump=${dump_status[0]} write=${dump_status[1]}"
+    return 1
+  fi
+  set +e
+  sudo_do cat "$partial" | compose exec -T db pg_restore --list >/dev/null
+  verify_status=("${PIPESTATUS[@]}")
+  set -e
+  if (( verify_status[0] != 0 || verify_status[1] != 0 )); then
+    sudo_do rm -f -- "$partial"
+    say "Backup verification failed: read=${verify_status[0]} pg_restore=${verify_status[1]}"
+    return 1
+  fi
+  sudo_do mv "$partial" "$output"
+}
+
 port_number() {
   local value="$1"
   case "$value" in
@@ -304,36 +373,156 @@ update_cmd() {
   load_env
   local release_url="${SUBBOOST_RELEASE_URL:-}"
   local release_file="$TMP_DIR/release.json"
-  local image compose_url manager_url
+  local candidate_env="$TMP_DIR/candidate.env"
+  local candidate_compose="$TMP_DIR/candidate-compose.yml"
+  local candidate_manager="$TMP_DIR/candidate-manager"
+  local old_env="$TMP_DIR/old.env"
+  local old_compose="$TMP_DIR/old-compose.yml"
+  local old_manager="$TMP_DIR/old-manager"
+  local rollback_dump="$BACKUP_DIR/update-rollback-$(date -u +%Y%m%dT%H%M%SZ).dump"
+  local image="${SUBBOOST_IMAGE:-}" compose_url="" manager_url="" services=""
+  local app_id old_image_id rollback_tag old_image_ref update_error restore_error db_ready
+  local manager_present=0 old_manager_present=0
+  local -a restore_status
   mkdir -p "$TMP_DIR"
-  if migrate_update_release_url "$release_url"; then
+  if is_official_fixed_release_url "$release_url"; then
+    say "Detected old fixed release update source; switching updates to stable latest."
     release_url="$DEFAULT_STABLE_RELEASE_URL"
   fi
   if [ -n "$release_url" ] && download_to_temp "$release_url" "$release_file" 2>/dev/null; then
     image="$(json_get image "$release_file" || true)"
     compose_url="$(resolve_url "$release_url" "$(json_get composeUrl "$release_file" || true)")"
     manager_url="$(resolve_url "$release_url" "$(json_get managerUrl "$release_file" || true)")"
-    if [ -n "$image" ]; then write_runtime_env_value SUBBOOST_IMAGE "$image"; fi
-    if [ -n "$compose_url" ]; then
-      install_file_from_url "$compose_url" "$COMPOSE_FILE" 644
-      write_runtime_env_value SUBBOOST_COMPOSE_URL "$compose_url"
-    fi
-    if [ -n "$manager_url" ]; then
-      install_file_from_url "$manager_url" "${SUBBOOST_BIN:-/usr/local/bin/subboost}" 755
-      write_runtime_env_value SUBBOOST_MANAGER_URL "$manager_url"
-    fi
+    [ -n "$image" ] && [ -n "$compose_url" ] && [ -n "$manager_url" ] || die "Release manifest is missing image, composeUrl, or managerUrl."
+    download_to_temp "$compose_url" "$candidate_compose"
+    download_to_temp "$manager_url" "$candidate_manager"
+    [ -s "$candidate_manager" ] && bash -n "$candidate_manager" || die "Candidate manager is invalid."
   else
     say "Release manifest unavailable; updating current image and compose only."
+    cp "$COMPOSE_FILE" "$candidate_compose"
+    if [ -f "${SUBBOOST_BIN:-/usr/local/bin/subboost}" ]; then
+      sudo_do cp "${SUBBOOST_BIN:-/usr/local/bin/subboost}" "$candidate_manager"
+      manager_present=1
+    fi
   fi
-  compose pull
-  compose up -d --remove-orphans
-  compose up -d --no-deps --force-recreate app
-  if ! wait_for_health; then
-    local health_status
-    health_status="$(health_status_code)"
-    status_cmd
-    die "$(doctor_health_failure_message "$health_status")"
+  [ -n "$manager_url" ] && manager_present=1
+  [ -n "$image" ] || die "SUBBOOST_IMAGE is missing."
+  read_env_file > "$candidate_env"
+  cp "$candidate_env" "$old_env"
+  cp "$COMPOSE_FILE" "$old_compose"
+  if [ -f "${SUBBOOST_BIN:-/usr/local/bin/subboost}" ]; then
+    sudo_do cp "${SUBBOOST_BIN:-/usr/local/bin/subboost}" "$old_manager"
+    old_manager_present=1
+  fi
+  set_file_env_value "$candidate_env" SUBBOOST_IMAGE "$image"
+  set_file_env_value "$candidate_env" SUBBOOST_RELEASE_URL "$release_url"
+  [ -n "$compose_url" ] && set_file_env_value "$candidate_env" SUBBOOST_COMPOSE_URL "$compose_url"
+  [ -n "$manager_url" ] && set_file_env_value "$candidate_env" SUBBOOST_MANAGER_URL "$manager_url"
+  if ! grep -q '^LOCAL_SETUP_TOKEN=.' "$candidate_env"; then
+    set_file_env_value "$candidate_env" LOCAL_SETUP_TOKEN "$(random_hex 32)"
+  fi
+  compose_files "$candidate_env" "$candidate_compose" config >/dev/null
+  services="$(compose_files "$candidate_env" "$candidate_compose" config --services)"
+  for service in app db cron; do
+    printf '%s\n' "$services" | grep -Fxq "$service" || die "Candidate Compose is missing service: $service"
+  done
+  say "Pulling candidate image before the maintenance window..."
+  SUBBOOST_IMAGE="$image" compose_files "$candidate_env" "$candidate_compose" pull
+
+  app_id="$(service_container_id app)"
+  [ -n "$app_id" ] || die "Cannot identify the current app container for rollback."
+  old_image_id="$(docker_cmd inspect -f '{{.Image}}' "$app_id" 2>/dev/null || true)"
+  [ -n "$old_image_id" ] || die "Cannot identify the current app image for rollback."
+  old_image_ref="${SUBBOOST_IMAGE:-}"
+  rollback_tag="subboost-rollback:update-$$"
+  if ! stage_install_file "$candidate_env" "$ENV_FILE" 600 \
+    || ! stage_install_file "$candidate_compose" "$COMPOSE_FILE" 644 \
+    || { [ "$manager_present" = "1" ] && ! stage_install_file "$candidate_manager" "${SUBBOOST_BIN:-/usr/local/bin/subboost}" 755; }; then
+    sudo_do rm -f "${ENV_FILE}.candidate.$$" "${COMPOSE_FILE}.candidate.$$" "${SUBBOOST_BIN:-/usr/local/bin/subboost}.candidate.$$"
+    die "Candidate metadata could not be staged safely."
+  fi
+  if ! docker_cmd tag "$old_image_id" "$rollback_tag"; then
+    sudo_do rm -f "${ENV_FILE}.candidate.$$" "${COMPOSE_FILE}.candidate.$$" "${SUBBOOST_BIN:-/usr/local/bin/subboost}.candidate.$$"
+    die "Could not create the rollback image tag."
+  fi
+
+  say "Pausing app and cron for a stable database snapshot..."
+  if ! compose stop cron app; then
+    sudo_do rm -f "${ENV_FILE}.candidate.$$" "${COMPOSE_FILE}.candidate.$$" "${SUBBOOST_BIN:-/usr/local/bin/subboost}.candidate.$$"
+    docker_cmd image rm "$rollback_tag" >/dev/null 2>&1 || true
+    die "Update aborted because app and cron could not be paused safely."
+  fi
+  if ! create_verified_dump "$rollback_dump"; then
+    compose up -d app cron || true
+    wait_for_health || true
+    sudo_do rm -f "${ENV_FILE}.candidate.$$" "${COMPOSE_FILE}.candidate.$$" "${SUBBOOST_BIN:-/usr/local/bin/subboost}.candidate.$$"
+    docker_cmd image rm "$rollback_tag" >/dev/null 2>&1 || true
+    die "Update aborted because a verified rollback dump could not be created."
+  fi
+
+  update_error=""
+  compose_files "$candidate_env" "$candidate_compose" up -d db || update_error="candidate database startup failed"
+  if [ -z "$update_error" ]; then
+    compose_files "$candidate_env" "$candidate_compose" up -d --no-deps app || update_error="candidate app startup or migration failed"
+  fi
+  if [ -z "$update_error" ] && ! wait_for_health; then
+    update_error="candidate health check failed"
   fi
+  if [ -z "$update_error" ]; then
+    activate_staged_file "$ENV_FILE" || update_error="candidate environment activation failed"
+  fi
+  if [ -z "$update_error" ]; then
+    activate_staged_file "$COMPOSE_FILE" || update_error="candidate Compose activation failed"
+  fi
+  if [ -z "$update_error" ] && [ "$manager_present" = "1" ]; then
+    activate_staged_file "${SUBBOOST_BIN:-/usr/local/bin/subboost}" || update_error="candidate manager activation failed"
+  fi
+  if [ -z "$update_error" ]; then
+    compose_files "$candidate_env" "$candidate_compose" up -d cron || update_error="candidate cron startup failed"
+  fi
+
+  if [ -n "$update_error" ]; then
+    say "Candidate update failed: $update_error"
+    compose_files "$candidate_env" "$candidate_compose" stop cron app >/dev/null 2>&1 || true
+    docker_cmd tag "$rollback_tag" "$old_image_ref" || true
+    sudo_do rm -f "${ENV_FILE}.candidate.$$" "${COMPOSE_FILE}.candidate.$$" "${SUBBOOST_BIN:-/usr/local/bin/subboost}.candidate.$$"
+    restore_error=""
+    atomic_install_file "$old_env" "$ENV_FILE" 600 || restore_error="old environment metadata restore failed"
+    atomic_install_file "$old_compose" "$COMPOSE_FILE" 644 || restore_error="old Compose metadata restore failed"
+    if [ "$old_manager_present" = "1" ]; then
+      atomic_install_file "$old_manager" "${SUBBOOST_BIN:-/usr/local/bin/subboost}" 755 || restore_error="old manager metadata restore failed"
+    fi
+    db_ready=1
+    compose_files "$old_env" "$old_compose" up -d db || { restore_error="old database container did not start"; db_ready=0; }
+    if [ "$db_ready" = "1" ]; then
+      set +e
+      sudo_do cat "$rollback_dump" | compose_files "$old_env" "$old_compose" exec -T db pg_restore --clean --if-exists --exit-on-error --no-owner --no-privileges -U "${POSTGRES_USER:-subboost}" -d "${POSTGRES_DB:-subboost}"
+      restore_status=("${PIPESTATUS[@]}")
+      set -e
+      if (( restore_status[0] != 0 || restore_status[1] != 0 )); then restore_error="database restore failed"; fi
+    fi
+    if [ -n "$restore_error" ]; then
+      compose_files "$old_env" "$old_compose" stop cron app >/dev/null 2>&1 || true
+      say "Automatic rollback stopped: $restore_error"
+      say "Rollback dump preserved at: $rollback_dump"
+      say "Keep app and cron stopped. Restore manually with pg_restore before restarting them."
+      return 1
+    fi
+    compose_files "$old_env" "$old_compose" up -d app
+    if ! wait_for_health; then
+      compose_files "$old_env" "$old_compose" stop cron app >/dev/null 2>&1 || true
+      say "Database and old image were restored, but the old app did not become healthy."
+      say "Rollback dump preserved at: $rollback_dump"
+      return 1
+    fi
+    compose_files "$old_env" "$old_compose" up -d cron
+    docker_cmd image rm "$rollback_tag" >/dev/null 2>&1 || true
+    say "Previous version restored successfully."
+    return 1
+  fi
+
+  docker_cmd image rm "$rollback_tag" >/dev/null 2>&1 || true
+  load_env
   status_cmd
 }
 
@@ -344,32 +533,21 @@ logs_cmd() {
 backup_cmd() {
   load_env
   sudo_do mkdir -p "$BACKUP_DIR"
-  local stamp db_tmp db_out env_out
+  local stamp db_out env_out
   local -a sql_backups env_backups
-  local -a backup_status
   local i backup_retention_count
   backup_retention_count="${SUBBOOST_BACKUP_RETENTION_COUNT:-$DEFAULT_BACKUP_RETENTION_COUNT}"
   if ! [[ "$backup_retention_count" =~ ^[0-9]+$ ]] || (( backup_retention_count < 1 )); then
     die "SUBBOOST_BACKUP_RETENTION_COUNT must be a positive integer"
   fi
   stamp="$(date -u +%Y%m%dT%H%M%SZ)"
-  db_tmp="$BACKUP_DIR/subboost-$stamp.sql.gz.partial"
-  db_out="$BACKUP_DIR/subboost-$stamp.sql.gz"
+  db_out="$BACKUP_DIR/subboost-$stamp.dump"
   env_out="$BACKUP_DIR/subboost-$stamp.env"
-  set +e
-  compose exec -T db pg_dump -U "${POSTGRES_USER:-subboost}" -d "${POSTGRES_DB:-subboost}" | gzip -c | sudo_do tee "$db_tmp" >/dev/null
-  backup_status=("${PIPESTATUS[@]}")
-  set -e
-  if (( backup_status[0] != 0 || backup_status[1] != 0 || backup_status[2] != 0 )); then
-    sudo_do rm -f -- "$db_tmp"
-    say "Backup failed: pg_dump=${backup_status[0]} gzip=${backup_status[1]} write=${backup_status[2]}"
-    return 1
-  fi
-  sudo_do mv "$db_tmp" "$db_out"
+  create_verified_dump "$db_out"
   sudo_do install -m 600 "$ENV_FILE" "$env_out"
 
   shopt -s nullglob
-  sql_backups=("$BACKUP_DIR"/subboost-*.sql.gz)
+  sql_backups=("$BACKUP_DIR"/subboost-*.dump)
   env_backups=("$BACKUP_DIR"/subboost-*.env)
   shopt -u nullglob
 

From 0846a94412f7c26d9d1b3ff6bf1bd57daf7e238e Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Thu, 16 Jul 2026 08:53:18 +0800
Subject: [PATCH 16/36] docs: document safe setup and update recovery

---
 README-CN.md | 6 ++++++
 README.md    | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/README-CN.md b/README-CN.md
index dfe967a..8f1a9ba 100644
--- a/README-CN.md
+++ b/README-CN.md
@@ -39,6 +39,12 @@
 - 部署文档：[高级部署 - 编译源码构建，速度慢配置要求高](https://docs.subboost.org/deploy/advanced)
 - 配置教程：[草履虫也能学会的 Clash 配置：UI 界面一键配置精确分流、链式代理](https://ryanvan.com/t/topic/59?u=ryan)
 
+### 一键部署后的初始化与更新
+
+- 新安装成功后，安装器会打印形如 `/login#setup-token=...` 的首次初始化链接。该令牌只用于创建第一个管理员，请像密码一样保管；页面通过请求头提交并在成功后清理地址栏 fragment。
+- `subboost update` 会先校验候选配置并拉取镜像，再暂停旧实例、创建并验证 PostgreSQL 备份，候选健康后才切换正式文件。候选失败会恢复旧文件、旧镜像和数据库。
+- 如果数据库恢复本身失败，应用和定时任务会保持停止，备份不会删除。此时不要强制重启，请按命令输出的恢复路径处理；可先运行 `subboost doctor` 和 `subboost logs` 收集状态。
+
 ## 开发说明
 
 开发者可以从源码启动本地开发环境：
diff --git a/README.md b/README.md
index caa58fa..1be627c 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,12 @@
 - Deployment docs: [Advanced deployment - compiles from source, slower with higher requirements](https://docs.subboost.org/deploy/advanced)
 - Configuration guide: [Clash configuration simple enough for a paramecium: configure precise routing and chained proxies from the UI in one click](https://ryanvan.com/t/topic/59?u=ryan)
 
+### First-Run Setup and Updates
+
+- After a fresh installation succeeds, the installer prints a first-run URL such as `/login#setup-token=...`. This token creates the first administrator, so protect it like a password. The page sends it in a request header and removes the fragment after setup succeeds.
+- `subboost update` validates the candidate configuration and pulls its image before pausing the old instance. It then creates and verifies a PostgreSQL backup, and activates formal files only after candidate health passes. Candidate failures restore the old files, image, and database.
+- If database restoration itself fails, the application and scheduled jobs remain stopped and the backup is preserved. Do not force a restart; follow the recovery path printed by the command. Run `subboost doctor` and `subboost logs` first to collect status.
+
 ## Development Notes
 
 Developers can start a local development environment from source:

From 0b8333a644643548a1fe4787a7b3968362e81148 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Thu, 16 Jul 2026 12:14:27 +0800
Subject: [PATCH 17/36] fix: isolate installer registry credentials

---
 local/scripts/install.sh             |  6 +++++-
 local/scripts/selfhost-shell.test.ts | 17 +++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/local/scripts/install.sh b/local/scripts/install.sh
index ec1607a..af73362 100644
--- a/local/scripts/install.sh
+++ b/local/scripts/install.sh
@@ -407,7 +407,11 @@ docker_runner() {
 
 docker_cmd() {
   if [ "$DOCKER_RUNNER" = "sudo docker" ]; then
-    sudo docker "$@"
+    if [ -n "${DOCKER_CONFIG:-}" ]; then
+      sudo env "DOCKER_CONFIG=$DOCKER_CONFIG" docker "$@"
+    else
+      sudo docker "$@"
+    fi
   else
     docker "$@"
   fi
diff --git a/local/scripts/selfhost-shell.test.ts b/local/scripts/selfhost-shell.test.ts
index d6a7e14..6540f9d 100644
--- a/local/scripts/selfhost-shell.test.ts
+++ b/local/scripts/selfhost-shell.test.ts
@@ -20,6 +20,23 @@ function runBash(script: string) {
 }
 
 describe("self-host shell scripts", () => {
+  it("preserves an explicit Docker config when Docker requires sudo", () => {
+    const result = runBash(`
+      set -Eeuo pipefail
+      export SUBBOOST_SCRIPT_SOURCE_ONLY=1
+      source local/scripts/install.sh
+      export DOCKER_CONFIG=/tmp/subboost-isolated-docker-config
+      DOCKER_RUNNER="sudo docker"
+      sudo() { printf 'sudo-call=%s\\n' "$*"; }
+      docker_cmd info
+    `);
+
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain(
+      "sudo-call=env DOCKER_CONFIG=/tmp/subboost-isolated-docker-config docker info",
+    );
+  });
+
   it("uses prompt defaults without /dev/tty errors in non-interactive mode", () => {
     const result = runBash(`
       set -Eeuo pipefail

From 6bb05976d32f4b2a350d9acdd568ee672fd2716b Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Thu, 16 Jul 2026 14:33:41 +0800
Subject: [PATCH 18/36] fix: protect self-hosted backups

---
 README.md                                      |  1 +
 local/scripts/install.sh                       | 11 ++++++++++-
 local/scripts/selfhost-lifecycle-shell.test.ts |  2 ++
 local/scripts/selfhost-shell.test.ts           |  7 ++++++-
 local/scripts/subboost.sh                      | 15 +++++++++++++--
 5 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 1be627c..f0f85dc 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,7 @@
 ### First-Run Setup and Updates
 
 - After a fresh installation succeeds, the installer prints a first-run URL such as `/login#setup-token=...`. This token creates the first administrator, so protect it like a password. The page sends it in a request header and removes the fragment after setup succeeds.
+- The installer keeps its home and backup directories private (`700`) and writes database/environment backups as owner-only files (`600`). Running `subboost backup` also repairs permissions on retained backups created by an older manager.
 - `subboost update` validates the candidate configuration and pulls its image before pausing the old instance. It then creates and verifies a PostgreSQL backup, and activates formal files only after candidate health passes. Candidate failures restore the old files, image, and database.
 - If database restoration itself fails, the application and scheduled jobs remain stopped and the backup is preserved. Do not force a restart; follow the recovery path printed by the command. Run `subboost doctor` and `subboost logs` first to collect status.
 
diff --git a/local/scripts/install.sh b/local/scripts/install.sh
index af73362..53f640a 100644
--- a/local/scripts/install.sh
+++ b/local/scripts/install.sh
@@ -57,6 +57,13 @@ run_root() {
   sudo_do "$@"
 }
 
+prepare_private_directory() {
+  local directory="$1"
+  run_root mkdir -p "$directory"
+  run_root chmod 700 "$directory"
+  if ! is_root; then run_root chown "$(id -u):$(id -g)" "$directory"; fi
+}
+
 install_secret_file() {
   local source="$1"
   local destination="$2"
@@ -586,7 +593,9 @@ main() {
 
   ensure_docker
   docker_login_if_needed
-  run_root mkdir -p "$SUBBOOST_HOME" "$SUBBOOST_HOME/backups" "$(dirname "$SUBBOOST_BIN")"
+  prepare_private_directory "$SUBBOOST_HOME"
+  prepare_private_directory "$SUBBOOST_HOME/backups"
+  run_root mkdir -p "$(dirname "$SUBBOOST_BIN")"
   ENV_FILE="$TMP_DIR/candidate.env"
   COMPOSE_FILE="$TMP_DIR/candidate-compose.yml"
   local candidate_manager="$TMP_DIR/candidate-manager"
diff --git a/local/scripts/selfhost-lifecycle-shell.test.ts b/local/scripts/selfhost-lifecycle-shell.test.ts
index b47fcc3..b6bb1c8 100644
--- a/local/scripts/selfhost-lifecycle-shell.test.ts
+++ b/local/scripts/selfhost-lifecycle-shell.test.ts
@@ -132,6 +132,8 @@ describe("self-host update rollback lifecycle", () => {
   it("persists a setup token and prints only the fragment bootstrap link", () => {
     const installer = readFileSync(path.join(publicRoot, "local/scripts/install.sh"), "utf8");
     expect(installer).toContain('ensure_env_value LOCAL_SETUP_TOKEN "$(random_hex 32)"');
+    expect(installer).toContain('prepare_private_directory "$SUBBOOST_HOME"');
+    expect(installer).toContain('prepare_private_directory "$SUBBOOST_HOME/backups"');
     expect(installer).toContain("/login#setup-token=$(env_value LOCAL_SETUP_TOKEN)");
     expect(installer).not.toContain("?setup-token=");
   });
diff --git a/local/scripts/selfhost-shell.test.ts b/local/scripts/selfhost-shell.test.ts
index 6540f9d..c62bd1b 100644
--- a/local/scripts/selfhost-shell.test.ts
+++ b/local/scripts/selfhost-shell.test.ts
@@ -551,9 +551,13 @@ ENV
       backup_cmd >/dev/null
       sql_count="$(find "$BACKUP_DIR" -maxdepth 1 -type f -name 'subboost-*.dump' | wc -l | tr -d '[:space:]')"
       env_count="$(find "$BACKUP_DIR" -maxdepth 1 -type f -name 'subboost-*.env' | wc -l | tr -d '[:space:]')"
-      printf 'sql=%s env=%s\\n' "$sql_count" "$env_count"
+      unsafe_files="$(find "$BACKUP_DIR" -maxdepth 1 -type f ! -perm 600 | wc -l | tr -d '[:space:]')"
+      unsafe_dirs="$(find "$BACKUP_DIR" -maxdepth 0 -type d ! -perm 700 | wc -l | tr -d '[:space:]')"
+      printf 'sql=%s env=%s unsafe_files=%s unsafe_dirs=%s\\n' "$sql_count" "$env_count" "$unsafe_files" "$unsafe_dirs"
       [ "$sql_count" = "10" ]
       [ "$env_count" = "10" ]
+      [ "$unsafe_files" = "0" ]
+      [ "$unsafe_dirs" = "0" ]
       [ ! -e "$BACKUP_DIR/subboost-20240101T000001Z.dump" ]
       [ ! -e "$BACKUP_DIR/subboost-20240101T000001Z.env" ]
     `;
@@ -562,5 +566,6 @@ ENV
 
     expect(result.status).toBe(0);
     expect(result.stdout).toContain("sql=10 env=10");
+    expect(result.stdout).toContain("unsafe_files=0 unsafe_dirs=0");
   });
 });
diff --git a/local/scripts/subboost.sh b/local/scripts/subboost.sh
index a221ff1..ee69334 100644
--- a/local/scripts/subboost.sh
+++ b/local/scripts/subboost.sh
@@ -27,6 +27,13 @@ sudo_do() {
   if is_root; then "$@"; else sudo "$@"; fi
 }
 
+prepare_private_directory() {
+  local directory="$1"
+  sudo_do mkdir -p "$directory"
+  sudo_do chmod 700 "$directory"
+  if ! is_root; then sudo_do chown "$(id -u):$(id -g)" "$directory"; fi
+}
+
 install_secret_file() {
   local source="$1"
   local destination="$2"
@@ -211,7 +218,8 @@ create_verified_dump() {
   local output="$1"
   local partial="${output}.partial"
   local -a dump_status verify_status
-  sudo_do mkdir -p "$(dirname "$output")"
+  prepare_private_directory "$(dirname "$output")"
+  sudo_do install -m 600 /dev/null "$partial"
   set +e
   compose exec -T db pg_dump -Fc -U "${POSTGRES_USER:-subboost}" -d "${POSTGRES_DB:-subboost}" | sudo_do tee "$partial" >/dev/null
   dump_status=("${PIPESTATUS[@]}")
@@ -532,7 +540,7 @@ logs_cmd() {
 
 backup_cmd() {
   load_env
-  sudo_do mkdir -p "$BACKUP_DIR"
+  prepare_private_directory "$BACKUP_DIR"
   local stamp db_out env_out
   local -a sql_backups env_backups
   local i backup_retention_count
@@ -551,6 +559,9 @@ backup_cmd() {
   env_backups=("$BACKUP_DIR"/subboost-*.env)
   shopt -u nullglob
 
+  if ((${#sql_backups[@]} > 0)); then sudo_do chmod 600 "${sql_backups[@]}"; fi
+  if ((${#env_backups[@]} > 0)); then sudo_do chmod 600 "${env_backups[@]}"; fi
+
   for ((i = 0; i < ${#sql_backups[@]} - backup_retention_count; i++)); do
     sudo_do rm -f -- "${sql_backups[$i]}"
   done

From ed76554060ee38fbb9508efbc9dc225657c8bcf1 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Thu, 16 Jul 2026 17:00:22 +0800
Subject: [PATCH 19/36] test: preserve jsx runtime semantics

---
 .../converter/quick-mode/sources-section.test.ts    | 13 +++++++++----
 .../converter/quick-mode/templates-section.test.ts  | 13 +++++++++----
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/packages/ui/src/product/converter/quick-mode/sources-section.test.ts b/packages/ui/src/product/converter/quick-mode/sources-section.test.ts
index 1f59b3a..94668d3 100644
--- a/packages/ui/src/product/converter/quick-mode/sources-section.test.ts
+++ b/packages/ui/src/product/converter/quick-mode/sources-section.test.ts
@@ -51,17 +51,22 @@ vi.mock("react", async (importOriginal) => {
 
 vi.mock("react/jsx-runtime", async (importOriginal) => {
   const actual = await importOriginal<typeof import("react/jsx-runtime")>();
-  const capture = (type: any, props: any, key?: any) => {
+  const capture = (type: any, props: any) => {
     if (type === "button") {
       mocks.captures.rawButtons ||= [];
       mocks.captures.rawButtons.push(props || {});
     }
-    return actual.jsx(type, props, key);
   };
   return {
     ...actual,
-    jsx: capture,
-    jsxs: capture,
+    jsx: (type: any, props: any, key?: any) => {
+      capture(type, props);
+      return actual.jsx(type, props, key);
+    },
+    jsxs: (type: any, props: any, key?: any) => {
+      capture(type, props);
+      return actual.jsxs(type, props, key);
+    },
   };
 });
 
diff --git a/packages/ui/src/product/converter/quick-mode/templates-section.test.ts b/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
index 44bbdf4..e04a4f7 100644
--- a/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
+++ b/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
@@ -59,17 +59,22 @@ vi.mock("react", async (importOriginal) => {
 
 vi.mock("react/jsx-runtime", async (importOriginal) => {
   const actual = await importOriginal<typeof import("react/jsx-runtime")>();
-  const capture = (type: any, props: any, key?: any) => {
+  const capture = (type: any, props: any) => {
     if (type === "button") {
       mocks.captures.rawButtons ||= [];
       mocks.captures.rawButtons.push(props || {});
     }
-    return actual.jsx(type, props, key);
   };
   return {
     ...actual,
-    jsx: capture,
-    jsxs: capture,
+    jsx: (type: any, props: any, key?: any) => {
+      capture(type, props);
+      return actual.jsx(type, props, key);
+    },
+    jsxs: (type: any, props: any, key?: any) => {
+      capture(type, props);
+      return actual.jsxs(type, props, key);
+    },
   };
 });
 

From 46ca2d68135191e1f8951de596170aa6a7733c8b Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Fri, 17 Jul 2026 07:03:09 +0800
Subject: [PATCH 20/36] docs: keep the project overview concise

---
 README-CN.md | 6 ------
 README.md    | 7 -------
 2 files changed, 13 deletions(-)

diff --git a/README-CN.md b/README-CN.md
index 8f1a9ba..dfe967a 100644
--- a/README-CN.md
+++ b/README-CN.md
@@ -39,12 +39,6 @@
 - 部署文档：[高级部署 - 编译源码构建，速度慢配置要求高](https://docs.subboost.org/deploy/advanced)
 - 配置教程：[草履虫也能学会的 Clash 配置：UI 界面一键配置精确分流、链式代理](https://ryanvan.com/t/topic/59?u=ryan)
 
-### 一键部署后的初始化与更新
-
-- 新安装成功后，安装器会打印形如 `/login#setup-token=...` 的首次初始化链接。该令牌只用于创建第一个管理员，请像密码一样保管；页面通过请求头提交并在成功后清理地址栏 fragment。
-- `subboost update` 会先校验候选配置并拉取镜像，再暂停旧实例、创建并验证 PostgreSQL 备份，候选健康后才切换正式文件。候选失败会恢复旧文件、旧镜像和数据库。
-- 如果数据库恢复本身失败，应用和定时任务会保持停止，备份不会删除。此时不要强制重启，请按命令输出的恢复路径处理；可先运行 `subboost doctor` 和 `subboost logs` 收集状态。
-
 ## 开发说明
 
 开发者可以从源码启动本地开发环境：
diff --git a/README.md b/README.md
index f0f85dc..caa58fa 100644
--- a/README.md
+++ b/README.md
@@ -39,13 +39,6 @@
 - Deployment docs: [Advanced deployment - compiles from source, slower with higher requirements](https://docs.subboost.org/deploy/advanced)
 - Configuration guide: [Clash configuration simple enough for a paramecium: configure precise routing and chained proxies from the UI in one click](https://ryanvan.com/t/topic/59?u=ryan)
 
-### First-Run Setup and Updates
-
-- After a fresh installation succeeds, the installer prints a first-run URL such as `/login#setup-token=...`. This token creates the first administrator, so protect it like a password. The page sends it in a request header and removes the fragment after setup succeeds.
-- The installer keeps its home and backup directories private (`700`) and writes database/environment backups as owner-only files (`600`). Running `subboost backup` also repairs permissions on retained backups created by an older manager.
-- `subboost update` validates the candidate configuration and pulls its image before pausing the old instance. It then creates and verifies a PostgreSQL backup, and activates formal files only after candidate health passes. Candidate failures restore the old files, image, and database.
-- If database restoration itself fails, the application and scheduled jobs remain stopped and the backup is preserved. Do not force a restart; follow the recovery path printed by the command. Run `subboost doctor` and `subboost logs` first to collect status.
-
 ## Development Notes
 
 Developers can start a local development environment from source:

From f39b8f34d85dda7b8223984564b9e9007283364c Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Fri, 17 Jul 2026 07:03:26 +0800
Subject: [PATCH 21/36] fix: label compact navigation controls

---
 packages/ui/src/components/auth/user-menu.test.ts         | 8 ++++++++
 packages/ui/src/components/auth/user-menu.tsx             | 4 ++++
 packages/ui/src/components/layout/header.tsx              | 6 +++++-
 .../ui/src/components/layout/layout-components.test.ts    | 3 +++
 4 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/packages/ui/src/components/auth/user-menu.test.ts b/packages/ui/src/components/auth/user-menu.test.ts
index 7c7e2d8..c5ccd8e 100644
--- a/packages/ui/src/components/auth/user-menu.test.ts
+++ b/packages/ui/src/components/auth/user-menu.test.ts
@@ -177,6 +177,14 @@ describe("UserMenu", () => {
     expect(html).toContain("我的订阅");
     expect(html).toContain("账户设置");
     expect(html).toContain("退出登录");
+    const toggle = findIntrinsic(
+      "button",
+      (props) => typeof props.className === "string" && props.className.includes("px-2 py-1.5")
+    );
+    expect(toggle.type).toBe("button");
+    expect(toggle["aria-label"]).toBe("用户菜单");
+    expect(toggle["aria-haspopup"]).toBe("menu");
+    expect(toggle["aria-expanded"]).toBe(true);
   });
 
   it("closes the menu from document, toggle, overlay, links, and logout actions", async () => {
diff --git a/packages/ui/src/components/auth/user-menu.tsx b/packages/ui/src/components/auth/user-menu.tsx
index f013ddf..7a428b4 100644
--- a/packages/ui/src/components/auth/user-menu.tsx
+++ b/packages/ui/src/components/auth/user-menu.tsx
@@ -71,6 +71,10 @@ export function UserMenu({ privilegedMenuItem }: { privilegedMenuItem?: AccountM
   return (
     <div className="relative" ref={menuRef}>
       <button
+        type="button"
+        aria-label="用户菜单"
+        aria-haspopup="menu"
+        aria-expanded={isOpen}
         onClick={() => setIsOpen(!isOpen)}
         className="flex items-center gap-2 px-2 py-1.5 rounded-lg hover:bg-white/5 transition-colors"
       >
diff --git a/packages/ui/src/components/layout/header.tsx b/packages/ui/src/components/layout/header.tsx
index c4a2b5a..ba0bda1 100644
--- a/packages/ui/src/components/layout/header.tsx
+++ b/packages/ui/src/components/layout/header.tsx
@@ -190,6 +190,10 @@ export function Header({
 
             {/* Mobile Menu Button */}
             <button
+              type="button"
+              aria-label={mobileMenuOpen ? "关闭导航菜单" : "打开导航菜单"}
+              aria-expanded={mobileMenuOpen}
+              aria-controls="subboost-mobile-navigation"
               className="md:hidden p-2 rounded-lg hover:bg-white/5 transition-colors"
               onClick={() => setMobileMenuOpen(!mobileMenuOpen)}
             >
@@ -204,7 +208,7 @@ export function Header({
 
         {/* Mobile Navigation */}
         {mobileMenuOpen && (
-          <div className="md:hidden border-t border-white/10 py-4">
+          <div id="subboost-mobile-navigation" className="md:hidden border-t border-white/10 py-4">
             <nav className="flex flex-col gap-1">
               {visibleNavItems.map((item) => {
                 const isActive = isNavItemActive(pathname, item.href);
diff --git a/packages/ui/src/components/layout/layout-components.test.ts b/packages/ui/src/components/layout/layout-components.test.ts
index 9a8730d..5a41949 100644
--- a/packages/ui/src/components/layout/layout-components.test.ts
+++ b/packages/ui/src/components/layout/layout-components.test.ts
@@ -80,6 +80,9 @@ describe("shared layout components", () => {
     expect(html).toContain("FAQ");
     expect(html).not.toContain("我的订阅");
     expect(html).toContain("UserMenu:none");
+    expect(html).toContain('aria-label="打开导航菜单"');
+    expect(html).toContain('aria-expanded="false"');
+    expect(html).toContain('aria-controls="subboost-mobile-navigation"');
   });
 
   it("renders local mode header links and privileged menu item", () => {

From d510212c6b7caadfab44b8898d6732875a0ff1f2 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Fri, 17 Jul 2026 07:03:55 +0800
Subject: [PATCH 22/36] test: assert expected component failure logs

---
 .../smart-node-matching-help.test.ts          |  2 +-
 .../ui/select-dropdown-wrappers.test.ts       |  7 ++++--
 packages/ui/src/components/ui/toaster.test.ts |  9 +++++---
 .../subscription-dashboard-surface.test.ts    | 23 +++++++++++++++++++
 .../input-source-editor-dialog.test.ts        |  2 +-
 .../sections/proxy-group-type-menu.test.ts    |  6 +++--
 .../proxy-groups-module-rules-help.test.ts    |  2 +-
 .../proxy-groups-module-rules-panel.test.ts   |  2 +-
 .../quick-mode/templates-section.test.ts      |  8 ++++++-
 9 files changed, 49 insertions(+), 12 deletions(-)

diff --git a/packages/ui/src/components/subscription/smart-node-matching-help.test.ts b/packages/ui/src/components/subscription/smart-node-matching-help.test.ts
index 73b677b..1741a81 100644
--- a/packages/ui/src/components/subscription/smart-node-matching-help.test.ts
+++ b/packages/ui/src/components/subscription/smart-node-matching-help.test.ts
@@ -6,7 +6,7 @@ vi.mock("@radix-ui/react-popover", () => ({
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("span", null, props.children),
   Portal: (props: any) => React.createElement("div", null, props.children),
-  Content: (props: any) => React.createElement("div", props, props.children),
+  Content: ({ children, sideOffset: _sideOffset, ...props }: any) => React.createElement("div", props, children),
   Arrow: (props: any) => React.createElement("span", props),
 }));
 
diff --git a/packages/ui/src/components/ui/select-dropdown-wrappers.test.ts b/packages/ui/src/components/ui/select-dropdown-wrappers.test.ts
index a0acff9..8ecbb9b 100644
--- a/packages/ui/src/components/ui/select-dropdown-wrappers.test.ts
+++ b/packages/ui/src/components/ui/select-dropdown-wrappers.test.ts
@@ -3,8 +3,11 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it, vi } from "vitest";
 
 function mockPrimitive(tag: keyof React.JSX.IntrinsicElements, displayName: string) {
-  const Component = React.forwardRef<HTMLElement, React.HTMLAttributes<HTMLElement>>(
-    ({ children, ...props }, ref) => React.createElement(tag, { ...props, ref }, children)
+  const Component = React.forwardRef<
+    HTMLElement,
+    React.HTMLAttributes<HTMLElement> & { sideOffset?: number }
+  >(
+    ({ children, sideOffset: _sideOffset, ...props }, ref) => React.createElement(tag, { ...props, ref }, children)
   );
   Component.displayName = displayName;
   return Component;
diff --git a/packages/ui/src/components/ui/toaster.test.ts b/packages/ui/src/components/ui/toaster.test.ts
index 41b0b6c..00cab65 100644
--- a/packages/ui/src/components/ui/toaster.test.ts
+++ b/packages/ui/src/components/ui/toaster.test.ts
@@ -16,10 +16,13 @@ vi.mock("@radix-ui/react-toast", async () => {
   const createPrimitive = (
     tag: keyof React.JSX.IntrinsicElements,
     displayName: string,
-    capture?: (props: React.HTMLAttributes<HTMLElement>) => void,
+    capture?: (props: React.HTMLAttributes<HTMLElement> & { altText?: string }) => void,
   ) => {
-    const Component = React.forwardRef<HTMLElement, React.HTMLAttributes<HTMLElement>>(
-      ({ children, ...props }, ref) => {
+    const Component = React.forwardRef<
+      HTMLElement,
+      React.HTMLAttributes<HTMLElement> & { altText?: string }
+    >(
+      ({ children, altText: _altText, ...props }, ref) => {
         capture?.(props);
         return React.createElement(tag, { ...props, ref }, children);
       }
diff --git a/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts b/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
index 592db21..ffd5c7f 100644
--- a/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
+++ b/packages/ui/src/dashboard/subscription-dashboard-surface.test.ts
@@ -248,6 +248,7 @@ describe("SubscriptionDashboardSurface", () => {
   });
 
   afterEach(() => {
+    vi.restoreAllMocks();
     vi.unstubAllGlobals();
   });
 
@@ -271,6 +272,7 @@ describe("SubscriptionDashboardSurface", () => {
   });
 
   it("runs mount effects, handles fetch failures, and shows disabled auto-update notices", async () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     const adapter = createAdapter({ fetchSubscriptions: vi.fn(async () => [subscription]) });
     const mounted = renderSurface(adapter, {}, { runEffects: true });
     await flushPromises();
@@ -282,6 +284,7 @@ describe("SubscriptionDashboardSurface", () => {
     const failed = renderSurface(failingAdapter, {}, { runEffects: true });
     await flushPromises();
     expect(failed.setters[0]).toHaveBeenCalledWith([]);
+    expect(errorSpy).toHaveBeenCalledWith("Failed to fetch subscriptions:", expect.objectContaining({ message: "offline" }));
 
     renderSurface(adapter, { 0: [disabledSubscription], 1: false }, { runEffects: true });
     await flushPromises();
@@ -374,6 +377,7 @@ describe("SubscriptionDashboardSurface", () => {
   });
 
   it("reports download failures without opening the subscription URL", async () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     const dom = stubDocumentActions();
     vi.stubGlobal("fetch", vi.fn(async () => {
       throw new Error("cors");
@@ -388,6 +392,10 @@ describe("SubscriptionDashboardSurface", () => {
       title: "下载失败",
       variant: "destructive",
     }));
+    expect(errorSpy).toHaveBeenCalledWith(
+      "Failed to fetch subscription YAML for download:",
+      expect.objectContaining({ message: "cors" })
+    );
   });
 
   it("uses the adapter download URL resolver before fetching subscription YAML", async () => {
@@ -420,6 +428,7 @@ describe("SubscriptionDashboardSurface", () => {
   });
 
   it("guards cancelled delete and in-flight refresh failures", async () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     const adapter = createAdapter({ refreshSubscription: vi.fn(async () => { throw new Error("refresh failed"); }) });
     renderSurface(adapter, { 0: [subscription], 1: false, 2: null, 3: "sub-1" });
     mocks.captures.buttons.find((props: any) => props.title === "重新生成配置并刷新缓存").onClick();
@@ -447,9 +456,19 @@ describe("SubscriptionDashboardSurface", () => {
     mocks.captures.buttons.find((props: any) => props.className?.includes("text-red-400")).onClick();
     await flushPromises();
     expect(mocks.toast).toHaveBeenCalledWith(expect.objectContaining({ title: "删除失败，请稍后重试", variant: "destructive" }));
+    expect(errorSpy).toHaveBeenCalledWith(
+      "Failed to refresh subscription:",
+      expect.objectContaining({ message: "refresh failed" })
+    );
+    expect(errorSpy).toHaveBeenCalledWith("Failed to refresh subscription:", "bad");
+    expect(errorSpy).toHaveBeenCalledWith(
+      "Failed to delete subscription:",
+      expect.objectContaining({ message: "delete failed" })
+    );
   });
 
   it("validates and saves subscription settings", async () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     const adapter = createAdapter();
     renderSurface(adapter, { 0: [subscription], 1: false, 4: true, 5: subscription, 6: "  ", 7: true, 8: true, 9: 24, 10: false });
     await mocks.captures.settingsDialog.onSave();
@@ -496,5 +515,9 @@ describe("SubscriptionDashboardSurface", () => {
     renderSurface(failingAdapter, { 0: [subscription], 1: false, 4: true, 5: subscription, 6: "Renamed", 7: true, 8: false, 9: 24, 10: false });
     await mocks.captures.settingsDialog.onSave();
     expect(mocks.toast).toHaveBeenCalledWith(expect.objectContaining({ title: "save failed", variant: "destructive" }));
+    expect(errorSpy).toHaveBeenCalledWith(
+      "Failed to save subscription settings:",
+      expect.objectContaining({ message: "save failed" })
+    );
   });
 });
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts
index 534b03c..a3233e0 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts
@@ -12,7 +12,7 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock("@radix-ui/react-popover", () => ({
   Arrow: () => React.createElement("span", null, "arrow"),
-  Content: (props: any) => React.createElement("div", props, props.children),
+  Content: ({ children, sideOffset: _sideOffset, ...props }: any) => React.createElement("div", props, children),
   Portal: (props: any) => React.createElement("div", null, props.children),
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("div", null, props.children),
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-type-menu.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-type-menu.test.ts
index a30fab3..9d7d14a 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-type-menu.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-type-menu.test.ts
@@ -26,7 +26,8 @@ vi.mock("@subboost/ui/components/ui/dropdown-menu", () => ({
   DropdownMenu: (props: any) => React.createElement("div", null, props.children),
   DropdownMenuContent: (props: any) => {
     captures.contents.push(props);
-    return React.createElement("div", props, props.children);
+    const { children, sideOffset: _sideOffset, ...domProps } = props;
+    return React.createElement("div", domProps, children);
   },
   DropdownMenuItem: (props: any) => {
     captures.items.push(props);
@@ -35,7 +36,8 @@ vi.mock("@subboost/ui/components/ui/dropdown-menu", () => ({
   DropdownMenuSub: (props: any) => React.createElement("div", null, props.children),
   DropdownMenuSubContent: (props: any) => {
     captures.subContents.push(props);
-    return React.createElement("div", props, props.children);
+    const { children, sideOffset: _sideOffset, ...domProps } = props;
+    return React.createElement("div", domProps, children);
   },
   DropdownMenuSubTrigger: (props: any) => {
     captures.subTriggers.push(props);
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts
index d7d8c63..78f81de 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts
@@ -4,7 +4,7 @@ import { describe, expect, it, vi } from "vitest";
 
 vi.mock("@radix-ui/react-popover", () => ({
   Arrow: () => React.createElement("span", null, "arrow"),
-  Content: (props: any) => React.createElement("div", props, props.children),
+  Content: ({ children, sideOffset: _sideOffset, ...props }: any) => React.createElement("div", props, children),
   Portal: (props: any) => React.createElement("div", null, props.children),
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("div", null, props.children),
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
index d00a97b..b6e8227 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
@@ -51,7 +51,7 @@ vi.mock("@radix-ui/react-popover", () => ({
   Root: (props: any) => React.createElement(React.Fragment, null, props.children),
   Trigger: (props: any) => React.createElement(React.Fragment, null, props.children),
   Portal: (props: any) => React.createElement(React.Fragment, null, props.children),
-  Content: (props: any) => React.createElement("div", props, props.children),
+  Content: ({ children, sideOffset: _sideOffset, ...props }: any) => React.createElement("div", props, children),
   Arrow: () => null,
 }));
 vi.mock("lucide-react", () => ({
diff --git a/packages/ui/src/product/converter/quick-mode/templates-section.test.ts b/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
index e04a4f7..08d3535 100644
--- a/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
+++ b/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
@@ -1,6 +1,6 @@
 import * as React from "react";
 import { renderToStaticMarkup } from "react-dom/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
   captures: {} as Record<string, any>,
@@ -200,6 +200,10 @@ describe("quick mode TemplatesSection", () => {
     };
   });
 
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
   it("selects built-in templates and opens the catalog", () => {
     const { setters } = renderSection();
 
@@ -278,11 +282,13 @@ describe("quick mode TemplatesSection", () => {
   });
 
   it("reports runtime failures and hides optional catalog features when disabled", async () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     mocks.productApi.templates.loadTemplateDetail.mockRejectedValue(new Error("network"));
     renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
     mocks.captures.buttons[0].onClick();
     await flushPromises();
     expect(mocks.toast).toHaveBeenCalledWith(expect.objectContaining({ title: "应用模板失败，请稍后重试", variant: "destructive" }));
+    expect(errorSpy).toHaveBeenCalledWith(expect.objectContaining({ message: "network" }));
 
     mocks.productApi.templates.catalogEnabled = false;
     mocks.productApi.templates.builtinEngagementEnabled = false;

From 90fba5c655cafe9cd62b6036d86fbfa3f8f57500 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Fri, 17 Jul 2026 08:59:59 +0800
Subject: [PATCH 23/36] build: retry transient dependency downloads

---
 local/Dockerfile | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/local/Dockerfile b/local/Dockerfile
index 21c5173..40b7b6f 100644
--- a/local/Dockerfile
+++ b/local/Dockerfile
@@ -9,7 +9,19 @@ COPY packages/ui packages/ui
 COPY packages/config packages/config
 COPY local/package.json local/package.json
 
-RUN npm ci
+RUN set -eu; \
+    attempt=1; \
+    max_attempts=3; \
+    until npm ci; do \
+      if [ "$attempt" -ge "$max_attempts" ]; then \
+        echo "npm ci failed after ${max_attempts} attempts" >&2; \
+        exit 1; \
+      fi; \
+      delay=$((attempt * 10)); \
+      echo "npm ci attempt ${attempt} failed; retrying in ${delay}s" >&2; \
+      sleep "$delay"; \
+      attempt=$((attempt + 1)); \
+    done
 
 FROM node:22-alpine AS builder
 WORKDIR /package

From 427fb43934634ba57c588311fad399618154c695 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Fri, 17 Jul 2026 09:14:08 +0800
Subject: [PATCH 24/36] build: cache verified dependency downloads

---
 local/Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/local/Dockerfile b/local/Dockerfile
index 40b7b6f..9a859ff 100644
--- a/local/Dockerfile
+++ b/local/Dockerfile
@@ -9,7 +9,8 @@ COPY packages/ui packages/ui
 COPY packages/config packages/config
 COPY local/package.json local/package.json
 
-RUN set -eu; \
+RUN --mount=type=cache,target=/root/.npm,sharing=locked \
+    set -eu; \
     attempt=1; \
     max_attempts=3; \
     until npm ci; do \

From 9f299cba1ce1e7fb419a5b07ffc1407ae3d09884 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Fri, 17 Jul 2026 15:56:39 +0800
Subject: [PATCH 25/36] fix: keep shell validation portable

---
 local/scripts/selfhost-shell.test.ts | 12 +++++++++---
 local/scripts/subboost.sh            |  2 +-
 test/setup-runtime.ts                | 20 ++++++++++++++++++++
 vitest.config.ts                     |  1 +
 4 files changed, 31 insertions(+), 4 deletions(-)
 create mode 100644 test/setup-runtime.ts

diff --git a/local/scripts/selfhost-shell.test.ts b/local/scripts/selfhost-shell.test.ts
index c62bd1b..2596f2e 100644
--- a/local/scripts/selfhost-shell.test.ts
+++ b/local/scripts/selfhost-shell.test.ts
@@ -4,6 +4,11 @@ import { describe, expect, it } from "vitest";
 
 const publicRoot = path.resolve(__dirname, "../..");
 const BASH_NON_INTERACTIVE_COMMAND = "exec \"$BASH\" -s";
+const POSIX_BACKUP_MODE_ASSERTIONS = process.platform === "win32"
+  ? ": # NTFS permissions are verified by Windows ACL checks, not POSIX mode bits"
+  : `
+      [ "$unsafe_files" = "0" ]
+      [ "$unsafe_dirs" = "0" ]`;
 
 function runBash(script: string) {
   return spawnSync("bash", ["-lc", BASH_NON_INTERACTIVE_COMMAND], {
@@ -556,8 +561,7 @@ ENV
       printf 'sql=%s env=%s unsafe_files=%s unsafe_dirs=%s\\n' "$sql_count" "$env_count" "$unsafe_files" "$unsafe_dirs"
       [ "$sql_count" = "10" ]
       [ "$env_count" = "10" ]
-      [ "$unsafe_files" = "0" ]
-      [ "$unsafe_dirs" = "0" ]
+      ${POSIX_BACKUP_MODE_ASSERTIONS}
       [ ! -e "$BACKUP_DIR/subboost-20240101T000001Z.dump" ]
       [ ! -e "$BACKUP_DIR/subboost-20240101T000001Z.env" ]
     `;
@@ -566,6 +570,8 @@ ENV
 
     expect(result.status).toBe(0);
     expect(result.stdout).toContain("sql=10 env=10");
-    expect(result.stdout).toContain("unsafe_files=0 unsafe_dirs=0");
+    if (process.platform !== "win32") {
+      expect(result.stdout).toContain("unsafe_files=0 unsafe_dirs=0");
+    }
   });
 });
diff --git a/local/scripts/subboost.sh b/local/scripts/subboost.sh
index ee69334..b4189c3 100644
--- a/local/scripts/subboost.sh
+++ b/local/scripts/subboost.sh
@@ -134,7 +134,7 @@ resolve_url() {
 }
 
 read_env_file() {
-  if is_root; then cat "$ENV_FILE"; else sudo cat "$ENV_FILE"; fi
+  sudo_do cat "$ENV_FILE"
 }
 
 write_env_value() {
diff --git a/test/setup-runtime.ts b/test/setup-runtime.ts
new file mode 100644
index 0000000..598ad4d
--- /dev/null
+++ b/test/setup-runtime.ts
@@ -0,0 +1,20 @@
+import { existsSync } from "node:fs";
+import { delimiter, join } from "node:path";
+
+function findGitBashBin(): string | null {
+  const candidates = [
+    process.env.ProgramFiles && join(process.env.ProgramFiles, "Git", "bin"),
+    process.env["ProgramFiles(x86)"] && join(process.env["ProgramFiles(x86)"], "Git", "bin"),
+    process.env.LOCALAPPDATA && join(process.env.LOCALAPPDATA, "Programs", "Git", "bin"),
+    process.env.USERPROFILE && join(process.env.USERPROFILE, "scoop", "apps", "git", "current", "bin"),
+  ].filter((value): value is string => Boolean(value));
+  return candidates.find((directory) => existsSync(join(directory, "bash.exe"))) || null;
+}
+
+if (process.platform === "win32") {
+  const gitBashBin = findGitBashBin();
+  if (!gitBashBin) {
+    throw new Error("Git for Windows Bash is required to run SubBoost shell-script tests on Windows.");
+  }
+  process.env.PATH = `${gitBashBin}${delimiter}${process.env.PATH || ""}`;
+}
diff --git a/vitest.config.ts b/vitest.config.ts
index fd7b986..c785aea 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -25,6 +25,7 @@ export default defineConfig({
   plugins: [tsxTransformPlugin()],
   test: {
     environment: "node",
+    setupFiles: ["./test/setup-runtime.ts"],
     include: [
       "packages/core/src/**/*.test.ts",
       "packages/server-core/src/**/*.test.ts",

From 78c952a92027d9ae93398f4766b98cd65066cc99 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sat, 18 Jul 2026 15:43:08 +0800
Subject: [PATCH 26/36] feat(ui): add accessible form control primitives

---
 .../ui/src/components/ui/choice-group.tsx     |  50 +++++++
 packages/ui/src/components/ui/dialog.tsx      |   2 +-
 .../src/components/ui/form-controls.test.ts   | 136 ++++++++++++++++++
 packages/ui/src/components/ui/form-field.tsx  |  75 ++++++++++
 packages/ui/src/components/ui/icon-button.tsx |  24 ++++
 .../ui/src/components/ui/password-field.tsx   |  72 ++++++++++
 packages/ui/src/components/ui/popover.tsx     |  96 +++++++++++++
 .../src/components/ui/radix-wrappers.test.ts  |   1 +
 .../ui/src/components/ui/switch-field.tsx     |  67 +++++++++
 packages/ui/src/components/ui/table.tsx       |  79 ++++++++++
 10 files changed, 601 insertions(+), 1 deletion(-)
 create mode 100644 packages/ui/src/components/ui/choice-group.tsx
 create mode 100644 packages/ui/src/components/ui/form-controls.test.ts
 create mode 100644 packages/ui/src/components/ui/form-field.tsx
 create mode 100644 packages/ui/src/components/ui/icon-button.tsx
 create mode 100644 packages/ui/src/components/ui/password-field.tsx
 create mode 100644 packages/ui/src/components/ui/popover.tsx
 create mode 100644 packages/ui/src/components/ui/switch-field.tsx
 create mode 100644 packages/ui/src/components/ui/table.tsx

diff --git a/packages/ui/src/components/ui/choice-group.tsx b/packages/ui/src/components/ui/choice-group.tsx
new file mode 100644
index 0000000..994cc4a
--- /dev/null
+++ b/packages/ui/src/components/ui/choice-group.tsx
@@ -0,0 +1,50 @@
+"use client";
+
+import * as React from "react";
+import { cn } from "@subboost/ui/lib/utils";
+
+export interface ChoiceGroupProps extends React.HTMLAttributes<HTMLDivElement> {
+  label: string;
+}
+
+const ChoiceGroup = React.forwardRef<HTMLDivElement, ChoiceGroupProps>(
+  ({ label, className, ...props }, ref) => (
+    <div
+      ref={ref}
+      role="group"
+      aria-label={label}
+      className={cn("flex flex-wrap items-center gap-2", className)}
+      {...props}
+    />
+  )
+);
+ChoiceGroup.displayName = "ChoiceGroup";
+
+export interface ChoiceChipProps
+  extends Omit<React.ButtonHTMLAttributes<HTMLButtonElement>, "aria-pressed"> {
+  label: React.ReactNode;
+  selected: boolean;
+}
+
+const ChoiceChip = React.forwardRef<HTMLButtonElement, ChoiceChipProps>(
+  ({ label, selected, className, type = "button", ...props }, ref) => (
+    <button
+      ref={ref}
+      type={type}
+      aria-pressed={selected}
+      className={cn(
+        "inline-flex min-h-9 items-center justify-center gap-2 rounded-xl border px-3 py-2 text-sm font-medium transition-all focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 disabled:cursor-not-allowed disabled:opacity-50",
+        selected
+          ? "border-primary-500/50 bg-primary-500/20 text-white"
+          : "border-white/15 bg-white/5 text-white/60 hover:bg-white/10 hover:text-white",
+        className
+      )}
+      {...props}
+    >
+      {label}
+    </button>
+  )
+);
+ChoiceChip.displayName = "ChoiceChip";
+
+export { ChoiceGroup, ChoiceChip };
diff --git a/packages/ui/src/components/ui/dialog.tsx b/packages/ui/src/components/ui/dialog.tsx
index ded4e9b..5c88637 100644
--- a/packages/ui/src/components/ui/dialog.tsx
+++ b/packages/ui/src/components/ui/dialog.tsx
@@ -45,7 +45,7 @@ const DialogContent = React.forwardRef<
       {children}
       <DialogPrimitive.Close className="absolute right-4 top-4 rounded-lg p-1 opacity-70 transition-all hover:opacity-100 hover:bg-white/5 focus:outline-none focus:ring-2 focus:ring-indigo-500/50 disabled:pointer-events-none">
         <X className="h-4 w-4 text-white/60" />
-        <span className="sr-only">Close</span>
+        <span className="sr-only">关闭</span>
       </DialogPrimitive.Close>
     </DialogPrimitive.Content>
   </DialogPortal>
diff --git a/packages/ui/src/components/ui/form-controls.test.ts b/packages/ui/src/components/ui/form-controls.test.ts
new file mode 100644
index 0000000..f8a7681
--- /dev/null
+++ b/packages/ui/src/components/ui/form-controls.test.ts
@@ -0,0 +1,136 @@
+import * as React from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, expectTypeOf, it, vi } from "vitest";
+import { ChoiceChip, ChoiceGroup } from "./choice-group";
+import { FormField } from "./form-field";
+import { IconButton, type IconButtonProps } from "./icon-button";
+import { Input } from "./input";
+import { PasswordField } from "./password-field";
+import { SwitchField } from "./switch-field";
+import {
+  Table,
+  TableBody,
+  TableCaption,
+  TableCell,
+  TableContainer,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "./table";
+
+describe("composed form controls", () => {
+  it("associates labels, descriptions, errors, required state, and existing IDs", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(
+        FormField,
+        {
+          id: "account-name",
+          label: "账号",
+          description: "用于登录",
+          error: "不能为空",
+          required: true,
+        },
+        React.createElement(Input, { "aria-describedby": "external-help" })
+      )
+    );
+
+    expect(html).toContain('for="account-name"');
+    expect(html).toContain('id="account-name"');
+    expect(html).toContain('aria-describedby="external-help account-name-description account-name-error"');
+    expect(html).toContain('aria-invalid="true"');
+    expect(html).toContain('aria-required="true"');
+    expect(html).toContain('role="alert"');
+  });
+
+  it("renders a disabled, labelled switch with its description", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(SwitchField, {
+        label: "监听端口",
+        description: "允许局域网访问",
+        checked: true,
+        disabled: true,
+        density: "compact",
+        onCheckedChange: vi.fn(),
+      })
+    );
+
+    expect(html).toContain("监听端口");
+    expect(html).toContain("允许局域网访问");
+    expect(html).toContain('aria-labelledby="switch-field-');
+    expect(html).toContain('aria-describedby="switch-field-');
+    expect(html).toContain('disabled=""');
+  });
+
+  it("requires a label and gives icon links one accessible focus target", () => {
+    expectTypeOf<IconButtonProps>().toHaveProperty("label");
+
+    const html = renderToStaticMarkup(
+      React.createElement(
+        IconButton,
+        { label: "返回首页", asChild: true, variant: "ghost" },
+        React.createElement("a", { href: "/" }, React.createElement("svg"))
+      )
+    );
+
+    expect(html.match(/<a /g)).toHaveLength(1);
+    expect(html).not.toContain("<button");
+    expect(html).toContain('aria-label="返回首页"');
+    expect(html).toContain('title="返回首页"');
+  });
+
+  it("renders password reveal state with an associated field label", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(PasswordField, {
+        id: "password",
+        label: "密码",
+        description: "至少八位",
+        autoComplete: "current-password",
+        value: "secret123",
+        readOnly: true,
+      })
+    );
+
+    expect(html).toContain('for="password"');
+    expect(html).toContain('type="password"');
+    expect(html).toContain('aria-label="显示密码"');
+    expect(html).toContain('aria-describedby="password-description"');
+  });
+
+  it("exposes selected choice state and group naming", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(
+        ChoiceGroup,
+        { label: "源类型" },
+        React.createElement(ChoiceChip, { label: "订阅链接", selected: true }),
+        React.createElement(ChoiceChip, { label: "文件", selected: false, disabled: true })
+      )
+    );
+
+    expect(html).toContain('role="group"');
+    expect(html).toContain('aria-label="源类型"');
+    expect(html).toContain('aria-pressed="true"');
+    expect(html).toContain('aria-pressed="false"');
+  });
+
+  it("renders the thin table elements inside a horizontal scroll container", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(
+        TableContainer,
+        null,
+        React.createElement(
+          Table,
+          null,
+          React.createElement(TableCaption, null, "用户列表"),
+          React.createElement(TableHeader, null, React.createElement(TableRow, null, React.createElement(TableHead, null, "用户"))),
+          React.createElement(TableBody, null, React.createElement(TableRow, null, React.createElement(TableCell, null, "Ry")))
+        )
+      )
+    );
+
+    expect(html).toContain("overflow-x-auto");
+    expect(html).toContain("<table");
+    expect(html).toContain("<thead");
+    expect(html).toContain("<tbody");
+    expect(html).toContain("<caption");
+  });
+});
diff --git a/packages/ui/src/components/ui/form-field.tsx b/packages/ui/src/components/ui/form-field.tsx
new file mode 100644
index 0000000..92a071b
--- /dev/null
+++ b/packages/ui/src/components/ui/form-field.tsx
@@ -0,0 +1,75 @@
+"use client";
+
+import * as React from "react";
+import { Label } from "@subboost/ui/components/ui/label";
+import { cn } from "@subboost/ui/lib/utils";
+
+type FormFieldControlProps = {
+  id?: string;
+  "aria-describedby"?: string;
+  "aria-invalid"?: boolean;
+  "aria-required"?: boolean;
+};
+
+export interface FormFieldProps {
+  id?: string;
+  label: React.ReactNode;
+  description?: React.ReactNode;
+  error?: React.ReactNode;
+  required?: boolean;
+  className?: string;
+  children: React.ReactElement<FormFieldControlProps>;
+}
+
+function mergeIds(...values: Array<string | undefined>) {
+  return values.filter(Boolean).join(" ") || undefined;
+}
+
+function FormField({
+  id,
+  label,
+  description,
+  error,
+  required = false,
+  className,
+  children,
+}: FormFieldProps) {
+  const generatedId = React.useId();
+  const controlId = id ?? `form-field-${generatedId.replaceAll(":", "")}`;
+  const descriptionId = description ? `${controlId}-description` : undefined;
+  const errorId = error ? `${controlId}-error` : undefined;
+  const describedBy = mergeIds(
+    children.props["aria-describedby"],
+    descriptionId,
+    errorId
+  );
+
+  const control = React.cloneElement(children, {
+    id: children.props.id ?? controlId,
+    "aria-describedby": describedBy,
+    "aria-invalid": error ? true : children.props["aria-invalid"],
+    "aria-required": required || children.props["aria-required"] || undefined,
+  });
+
+  return (
+    <div className={cn("space-y-2", className)}>
+      <Label htmlFor={children.props.id ?? controlId}>
+        {label}
+        {required ? <span aria-hidden="true" className="ml-1 text-red-400">*</span> : null}
+      </Label>
+      {control}
+      {description ? (
+        <p id={descriptionId} className="text-xs leading-relaxed text-white/45">
+          {description}
+        </p>
+      ) : null}
+      {error ? (
+        <p id={errorId} className="text-xs leading-relaxed text-red-400" role="alert">
+          {error}
+        </p>
+      ) : null}
+    </div>
+  );
+}
+
+export { FormField };
diff --git a/packages/ui/src/components/ui/icon-button.tsx b/packages/ui/src/components/ui/icon-button.tsx
new file mode 100644
index 0000000..b726df9
--- /dev/null
+++ b/packages/ui/src/components/ui/icon-button.tsx
@@ -0,0 +1,24 @@
+"use client";
+
+import * as React from "react";
+import { Button, type ButtonProps } from "@subboost/ui/components/ui/button";
+
+export interface IconButtonProps extends Omit<ButtonProps, "aria-label" | "size"> {
+  label: string;
+}
+
+const IconButton = React.forwardRef<HTMLButtonElement, IconButtonProps>(
+  ({ label, title, type = "button", ...props }, ref) => (
+    <Button
+      ref={ref}
+      size="icon"
+      type={type}
+      aria-label={label}
+      title={title ?? label}
+      {...props}
+    />
+  )
+);
+IconButton.displayName = "IconButton";
+
+export { IconButton };
diff --git a/packages/ui/src/components/ui/password-field.tsx b/packages/ui/src/components/ui/password-field.tsx
new file mode 100644
index 0000000..c6ca81d
--- /dev/null
+++ b/packages/ui/src/components/ui/password-field.tsx
@@ -0,0 +1,72 @@
+"use client";
+
+import * as React from "react";
+import { Eye, EyeOff } from "lucide-react";
+import { FormField } from "@subboost/ui/components/ui/form-field";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
+import { Input, type InputProps } from "@subboost/ui/components/ui/input";
+import { cn } from "@subboost/ui/lib/utils";
+
+interface PasswordControlProps extends Omit<InputProps, "type"> {
+  visible: boolean;
+  onVisibleChange: () => void;
+}
+
+const PasswordControl = React.forwardRef<HTMLInputElement, PasswordControlProps>(
+  ({ visible, onVisibleChange, className, disabled, ...props }, ref) => (
+    <span className="relative block">
+      <Input
+        ref={ref}
+        type={visible ? "text" : "password"}
+        className={cn("pr-12", className)}
+        disabled={disabled}
+        {...props}
+      />
+      <IconButton
+        label={visible ? "隐藏密码" : "显示密码"}
+        variant="ghost"
+        disabled={disabled}
+        onClick={onVisibleChange}
+        className="absolute right-1 top-1/2 h-8 w-8 -translate-y-1/2 rounded-lg text-white/50 hover:text-white"
+      >
+        {visible ? <EyeOff aria-hidden="true" /> : <Eye aria-hidden="true" />}
+      </IconButton>
+    </span>
+  )
+);
+PasswordControl.displayName = "PasswordControl";
+
+export interface PasswordFieldProps extends Omit<InputProps, "type"> {
+  label: React.ReactNode;
+  description?: React.ReactNode;
+  error?: React.ReactNode;
+  required?: boolean;
+  fieldClassName?: string;
+}
+
+const PasswordField = React.forwardRef<HTMLInputElement, PasswordFieldProps>(
+  ({ label, description, error, required, fieldClassName, id, ...props }, ref) => {
+    const [visible, setVisible] = React.useState(false);
+
+    return (
+      <FormField
+        id={id}
+        label={label}
+        description={description}
+        error={error}
+        required={required}
+        className={fieldClassName}
+      >
+        <PasswordControl
+          ref={ref}
+          visible={visible}
+          onVisibleChange={() => setVisible((current) => !current)}
+          {...props}
+        />
+      </FormField>
+    );
+  }
+);
+PasswordField.displayName = "PasswordField";
+
+export { PasswordField };
diff --git a/packages/ui/src/components/ui/popover.tsx b/packages/ui/src/components/ui/popover.tsx
new file mode 100644
index 0000000..b1f7635
--- /dev/null
+++ b/packages/ui/src/components/ui/popover.tsx
@@ -0,0 +1,96 @@
+"use client";
+
+import * as React from "react";
+import * as PopoverPrimitive from "@radix-ui/react-popover";
+import { CircleHelp } from "lucide-react";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
+import { cn } from "@subboost/ui/lib/utils";
+
+const Popover = PopoverPrimitive.Root;
+const PopoverTrigger = PopoverPrimitive.Trigger;
+const PopoverAnchor = PopoverPrimitive.Anchor;
+const PopoverClose = PopoverPrimitive.Close;
+const PopoverPortal = PopoverPrimitive.Portal;
+
+const PopoverContent = React.forwardRef<
+  React.ElementRef<typeof PopoverPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Content>
+>(({ className, align = "center", sideOffset = 8, children, ...props }, ref) => (
+  <PopoverPortal>
+    <PopoverPrimitive.Content
+      ref={ref}
+      align={align}
+      sideOffset={sideOffset}
+      collisionPadding={12}
+      className={cn(
+        "z-50 w-72 rounded-xl border border-white/15 bg-zinc-950/95 p-4 text-sm text-white/70 shadow-2xl shadow-black/40 outline-none backdrop-blur-xl",
+        className
+      )}
+      {...props}
+    >
+      {children}
+    </PopoverPrimitive.Content>
+  </PopoverPortal>
+));
+PopoverContent.displayName = PopoverPrimitive.Content.displayName;
+
+const PopoverArrow = React.forwardRef<
+  React.ElementRef<typeof PopoverPrimitive.Arrow>,
+  React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Arrow>
+>(({ className, ...props }, ref) => (
+  <PopoverPrimitive.Arrow
+    ref={ref}
+    className={cn("fill-zinc-950 stroke-white/15", className)}
+    {...props}
+  />
+));
+PopoverArrow.displayName = PopoverPrimitive.Arrow.displayName;
+
+export interface HelpPopoverProps {
+  label: string;
+  children: React.ReactNode;
+  className?: string;
+  contentClassName?: string;
+  side?: React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Content>["side"];
+  align?: React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Content>["align"];
+  sideOffset?: React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Content>["sideOffset"];
+}
+
+function HelpPopover({
+  label,
+  children,
+  className,
+  contentClassName,
+  side,
+  align,
+  sideOffset,
+}: HelpPopoverProps) {
+  return (
+    <Popover>
+      <PopoverTrigger asChild>
+        <IconButton
+          label={label}
+          variant="ghost"
+          className={cn("h-6 w-6 rounded-md text-white/40 hover:text-white/80", className)}
+        >
+          <CircleHelp aria-hidden="true" />
+        </IconButton>
+      </PopoverTrigger>
+      <PopoverContent side={side} align={align} sideOffset={sideOffset} className={contentClassName}>
+        {children}
+        <PopoverArrow />
+      </PopoverContent>
+    </Popover>
+  );
+}
+
+export {
+  HelpPopover,
+  Popover,
+  PopoverAnchor,
+  PopoverArrow,
+  PopoverClose,
+  PopoverContent,
+  PopoverPortal,
+  PopoverTrigger,
+};
diff --git a/packages/ui/src/components/ui/radix-wrappers.test.ts b/packages/ui/src/components/ui/radix-wrappers.test.ts
index 5404e92..2e15ce9 100644
--- a/packages/ui/src/components/ui/radix-wrappers.test.ts
+++ b/packages/ui/src/components/ui/radix-wrappers.test.ts
@@ -77,6 +77,7 @@ describe("Radix UI wrappers", () => {
     expect(html).toContain("avatar-extra");
     expect(html).toContain("fallback-extra");
     expect(html).toContain("dialog-extra");
+    expect(html).toContain("关闭");
     expect(html).toContain("header-extra");
     expect(html).toContain("footer-extra");
     expect(html).toContain("switch-extra");
diff --git a/packages/ui/src/components/ui/switch-field.tsx b/packages/ui/src/components/ui/switch-field.tsx
new file mode 100644
index 0000000..4c583b7
--- /dev/null
+++ b/packages/ui/src/components/ui/switch-field.tsx
@@ -0,0 +1,67 @@
+"use client";
+
+import * as React from "react";
+import { Label } from "@subboost/ui/components/ui/label";
+import { Switch } from "@subboost/ui/components/ui/switch";
+import { cn } from "@subboost/ui/lib/utils";
+
+export interface SwitchFieldProps {
+  label: React.ReactNode;
+  description?: React.ReactNode;
+  checked: boolean;
+  onCheckedChange: (checked: boolean) => void;
+  disabled?: boolean;
+  density?: "default" | "compact";
+}
+
+function SwitchField({
+  label,
+  description,
+  checked,
+  onCheckedChange,
+  disabled = false,
+  density = "default",
+}: SwitchFieldProps) {
+  const generatedId = React.useId().replaceAll(":", "");
+  const controlId = `switch-field-${generatedId}`;
+  const labelId = `${controlId}-label`;
+  const descriptionId = description ? `${controlId}-description` : undefined;
+
+  return (
+    <Label
+      htmlFor={controlId}
+      className={cn(
+        "flex w-full items-center justify-between rounded-xl border border-white/10 bg-white/5 transition-colors hover:bg-white/[0.07]",
+        density === "compact" ? "gap-2 rounded-md px-2 py-1" : "gap-4 px-4 py-3",
+        disabled && "cursor-not-allowed opacity-60"
+      )}
+    >
+      <span className="min-w-0 space-y-1">
+        <span
+          id={labelId}
+          className={cn(
+            "block font-medium leading-snug text-white/80",
+            density === "compact" ? "text-xs" : "text-sm"
+          )}
+        >
+          {label}
+        </span>
+        {description ? (
+          <span id={descriptionId} className="block text-xs font-normal leading-relaxed text-white/45">
+            {description}
+          </span>
+        ) : null}
+      </span>
+      <Switch
+        id={controlId}
+        checked={checked}
+        onCheckedChange={onCheckedChange}
+        disabled={disabled}
+        aria-labelledby={labelId}
+        aria-describedby={descriptionId}
+      />
+    </Label>
+  );
+}
+
+export { SwitchField };
diff --git a/packages/ui/src/components/ui/table.tsx b/packages/ui/src/components/ui/table.tsx
new file mode 100644
index 0000000..17c71c9
--- /dev/null
+++ b/packages/ui/src/components/ui/table.tsx
@@ -0,0 +1,79 @@
+"use client";
+
+import * as React from "react";
+import { cn } from "@subboost/ui/lib/utils";
+
+const TableContainer = React.forwardRef<HTMLDivElement, React.HTMLAttributes<HTMLDivElement>>(
+  ({ className, ...props }, ref) => (
+    <div ref={ref} className={cn("relative w-full overflow-x-auto", className)} {...props} />
+  )
+);
+TableContainer.displayName = "TableContainer";
+
+const Table = React.forwardRef<HTMLTableElement, React.TableHTMLAttributes<HTMLTableElement>>(
+  ({ className, ...props }, ref) => (
+    <table ref={ref} className={cn("w-full caption-bottom text-sm", className)} {...props} />
+  )
+);
+Table.displayName = "Table";
+
+const TableHeader = React.forwardRef<HTMLTableSectionElement, React.HTMLAttributes<HTMLTableSectionElement>>(
+  ({ className, ...props }, ref) => (
+    <thead ref={ref} className={cn("[&_tr]:border-b [&_tr]:border-white/10", className)} {...props} />
+  )
+);
+TableHeader.displayName = "TableHeader";
+
+const TableBody = React.forwardRef<HTMLTableSectionElement, React.HTMLAttributes<HTMLTableSectionElement>>(
+  ({ className, ...props }, ref) => (
+    <tbody ref={ref} className={cn("[&_tr:last-child]:border-0", className)} {...props} />
+  )
+);
+TableBody.displayName = "TableBody";
+
+const TableHead = React.forwardRef<HTMLTableCellElement, React.ThHTMLAttributes<HTMLTableCellElement>>(
+  ({ className, ...props }, ref) => (
+    <th
+      ref={ref}
+      className={cn("h-11 px-4 text-left align-middle text-xs font-medium text-white/50", className)}
+      {...props}
+    />
+  )
+);
+TableHead.displayName = "TableHead";
+
+const TableRow = React.forwardRef<HTMLTableRowElement, React.HTMLAttributes<HTMLTableRowElement>>(
+  ({ className, ...props }, ref) => (
+    <tr
+      ref={ref}
+      className={cn("border-b border-white/10 transition-colors hover:bg-white/[0.03]", className)}
+      {...props}
+    />
+  )
+);
+TableRow.displayName = "TableRow";
+
+const TableCell = React.forwardRef<HTMLTableCellElement, React.TdHTMLAttributes<HTMLTableCellElement>>(
+  ({ className, ...props }, ref) => (
+    <td ref={ref} className={cn("p-4 align-middle text-white/70", className)} {...props} />
+  )
+);
+TableCell.displayName = "TableCell";
+
+const TableCaption = React.forwardRef<HTMLTableCaptionElement, React.HTMLAttributes<HTMLTableCaptionElement>>(
+  ({ className, ...props }, ref) => (
+    <caption ref={ref} className={cn("mt-4 text-sm text-white/45", className)} {...props} />
+  )
+);
+TableCaption.displayName = "TableCaption";
+
+export {
+  Table,
+  TableBody,
+  TableCaption,
+  TableCell,
+  TableContainer,
+  TableHead,
+  TableHeader,
+  TableRow,
+};

From 6b983d1c44349744f857de88b00a79e2d9f0bbb4 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sat, 18 Jul 2026 15:43:45 +0800
Subject: [PATCH 27/36] refactor(ui): unify public and local interactions

---
 eslint.config.mjs                             |  20 +-
 local/app/dashboard/settings/page.tsx         |  27 +-
 local/src/components/local-login.test.ts      |  24 +-
 local/src/components/local-login.tsx          |  58 ++-
 package.json                                  |   3 +-
 .../ui/src/components/auth/user-menu.test.ts  |  57 +--
 packages/ui/src/components/auth/user-menu.tsx | 137 ++++----
 packages/ui/src/components/layout/header.tsx  |  11 +-
 .../smart-node-matching-help.test.ts          |   3 +
 .../subscription/smart-node-matching-help.tsx |  51 +--
 packages/ui/src/components/ui/page-pager.tsx  |  16 +-
 .../subscription-dashboard-surface.tsx        |  30 +-
 .../subscription-settings-dialog.tsx          |  32 +-
 .../converter/advanced-mode/constants.ts      |  21 +-
 .../dialer-proxy-groups-section.test.ts       |  40 ++-
 .../sections/dialer-proxy-groups-section.tsx  | 118 ++++---
 .../sections/input-section.test.ts            |  87 +++--
 .../advanced-mode/sections/input-section.tsx  | 166 +++------
 .../input-source-editor-dialog.test.ts        |   6 +
 .../sections/input-source-editor-dialog.tsx   | 187 +---------
 .../sections/node-management-section.tsx      |  17 +-
 .../node-management/bulk-edit-dialog.tsx      |  24 +-
 .../node-management/node-list.test.ts         |  20 +-
 .../sections/node-management/node-list.tsx    |  69 ++--
 ...-group-advanced-panel-interactions.test.ts |  11 +-
 .../sections/proxy-group-advanced-panel.tsx   |  48 +--
 .../sections/proxy-groups-added-rule-sets.tsx |  16 +-
 .../sections/proxy-groups-categories.test.ts  |   7 +-
 .../sections/proxy-groups-categories.tsx      |  35 +-
 .../proxy-groups-custom-routing-rules.tsx     |   2 +-
 .../sections/proxy-groups-custom-rules.tsx    |  17 +-
 .../sections/proxy-groups-module-card.test.ts |   2 +
 .../sections/proxy-groups-module-card.tsx     |  61 ++--
 .../proxy-groups-module-rules-help.test.ts    |   3 +
 .../proxy-groups-module-rules-help.tsx        |  61 +---
 .../proxy-groups-module-rules-panel.test.ts   |   3 +
 .../proxy-groups-module-rules-panel.tsx       |  59 ++--
 .../proxy-groups-rules-library.test.ts        |  12 +-
 .../sections/proxy-groups-rules-library.tsx   |  16 +-
 .../sections/rules-management-section.test.ts |   8 +-
 .../sections/rules-management-section.tsx     |  16 +-
 .../product/converter/quick-mode/constants.ts |  28 +-
 .../quick-mode/sources-section.test.ts        | 140 ++++----
 .../converter/quick-mode/sources-section.tsx  | 329 +++---------------
 .../quick-mode/templates-section.test.ts      |  26 +-
 .../quick-mode/templates-section.tsx          |  93 ++---
 .../src/product/converter/source-controls.tsx | 155 +++++++++
 .../converter/source-editor-dialog.tsx        | 155 +++++++++
 .../src/product/converter/source-type-info.ts |  31 ++
 .../subscription-import-error.test.ts         |   7 +
 .../converter/subscription-import-error.tsx   |  25 +-
 packages/ui/src/product/home/home-layout.tsx  |  11 +-
 .../product/home/subscription-link-dialog.tsx |  46 +--
 .../product/preview/diff-highlight.test.ts    |   3 +-
 .../ui/src/product/preview/diff-highlight.tsx |  17 +-
 .../visual-graph/proxy-groups-preview.test.ts |  48 +--
 .../visual-graph/proxy-groups-preview.tsx     |  41 ++-
 .../ui/src/templates/template-card.test.ts    |  12 +-
 packages/ui/src/templates/template-card.tsx   |  17 +-
 .../templates/template-upload-dialog.test.ts  |  31 +-
 .../src/templates/template-upload-dialog.tsx  | 124 +++----
 scripts/check-ui-consistency.cjs              | 139 ++++++++
 62 files changed, 1552 insertions(+), 1527 deletions(-)
 create mode 100644 packages/ui/src/product/converter/source-controls.tsx
 create mode 100644 packages/ui/src/product/converter/source-editor-dialog.tsx
 create mode 100644 packages/ui/src/product/converter/source-type-info.ts
 create mode 100644 scripts/check-ui-consistency.cjs

diff --git a/eslint.config.mjs b/eslint.config.mjs
index 4d2ab02..2113e97 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -2,8 +2,26 @@ import { defineConfig, globalIgnores } from "eslint/config";
 import nextVitals from "eslint-config-next/core-web-vitals";
 import nextTypescript from "eslint-config-next/typescript";
 
+const accessibilityRules = {
+  "jsx-a11y/click-events-have-key-events": "error",
+  "jsx-a11y/label-has-associated-control": "error",
+  "jsx-a11y/no-static-element-interactions": "error",
+};
+
+const nextVitalsWithAccessibility = nextVitals.map((config) =>
+  config.name === "next"
+    ? {
+        ...config,
+        rules: {
+          ...config.rules,
+          ...accessibilityRules,
+        },
+      }
+    : config
+);
+
 export default defineConfig([
-  ...nextVitals,
+  ...nextVitalsWithAccessibility,
   ...nextTypescript,
   {
     linterOptions: {
diff --git a/local/app/dashboard/settings/page.tsx b/local/app/dashboard/settings/page.tsx
index 7880127..439e987 100644
--- a/local/app/dashboard/settings/page.tsx
+++ b/local/app/dashboard/settings/page.tsx
@@ -5,7 +5,7 @@ import { LogOut, Network, ServerCog, ShieldCheck } from "lucide-react";
 
 import { Button } from "@subboost/ui/components/ui/button";
 import { Card, CardContent, CardHeader, CardTitle } from "@subboost/ui/components/ui/card";
-import { Switch } from "@subboost/ui/components/ui/switch";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { useUserStore } from "@subboost/ui/store/user-store";
 
 export default function SettingsPage() {
@@ -122,22 +122,15 @@ export default function SettingsPage() {
             </div>
             <CardTitle className="text-base">订阅源安全</CardTitle>
           </CardHeader>
-          <CardContent>
-            <div className="flex items-start justify-between gap-4">
-              <div>
-                <p className="text-sm font-medium">允许本机和局域网订阅</p>
-                <p className="mt-1 text-xs leading-relaxed text-white/50">
-                  开启后，本机、局域网及其他保留地址都可作为订阅源。仅在信任来源时开启。
-                </p>
-                {sourceImportError && <p className="mt-2 text-xs text-red-300">{sourceImportError}</p>}
-              </div>
-              <Switch
-                aria-label="允许本机和局域网订阅"
-                checked={allowUnsafeSubscriptionSources}
-                disabled={!user || sourceImportLoading || sourceImportSaving}
-                onCheckedChange={(checked) => void handleUnsafeSourceToggle(checked)}
-              />
-            </div>
+          <CardContent className="space-y-2">
+            <SwitchField
+              label="允许本机和局域网订阅"
+              description="开启后，本机、局域网及其他保留地址都可作为订阅源。仅在信任来源时开启。"
+              checked={allowUnsafeSubscriptionSources}
+              disabled={!user || sourceImportLoading || sourceImportSaving}
+              onCheckedChange={(checked) => void handleUnsafeSourceToggle(checked)}
+            />
+            {sourceImportError && <p className="text-xs text-red-300">{sourceImportError}</p>}
           </CardContent>
         </Card>
 
diff --git a/local/src/components/local-login.test.ts b/local/src/components/local-login.test.ts
index d7e3525..b5a895a 100644
--- a/local/src/components/local-login.test.ts
+++ b/local/src/components/local-login.test.ts
@@ -181,7 +181,7 @@ describe("local login component", () => {
 
     await mocks.forms[0].onSubmit({ preventDefault: vi.fn() });
 
-    expect(setters[6]).toHaveBeenCalledWith("密码至少需要 10 个字符");
+    expect(setters[5]).toHaveBeenCalledWith("密码至少需要 10 个字符");
     expect(globalThis.fetch).not.toHaveBeenCalled();
   });
 
@@ -197,7 +197,7 @@ describe("local login component", () => {
 
     await mocks.forms[0].onSubmit({ preventDefault: vi.fn() });
 
-    expect(setters[6]).toHaveBeenCalledWith("两次输入的密码不一致，请重新确认");
+    expect(setters[5]).toHaveBeenCalledWith("两次输入的密码不一致，请重新确认");
     expect(globalThis.fetch).not.toHaveBeenCalled();
   });
 
@@ -208,7 +208,6 @@ describe("local login component", () => {
       0: { setupRequired: false, authenticated: false },
       1: "admin",
       2: "secret",
-      4: false,
     });
 
     mocks.inputs.find((input) => input.placeholder === "管理员账号").onChange({ target: { value: "root" } });
@@ -218,8 +217,8 @@ describe("local login component", () => {
 
     expect(setters[1]).toHaveBeenCalledWith("root");
     expect(setters[2]).toHaveBeenCalledWith("next");
+    expect((setters[7] as any).lastValue).toBe(true);
     expect(setters[4]).toHaveBeenCalledWith(true);
-    expect(setters[5]).toHaveBeenCalledWith(true);
     expect(globalThis.fetch).toHaveBeenCalledWith(
       "/api/auth/login",
       expect.objectContaining({
@@ -228,7 +227,7 @@ describe("local login component", () => {
       }),
     );
     expect(win.location.href).toBe("/dashboard");
-    expect(setters[5]).toHaveBeenLastCalledWith(false);
+    expect(setters[4]).toHaveBeenLastCalledWith(false);
   });
 
   it("submits setup requests and reports server or load errors", async () => {
@@ -239,8 +238,9 @@ describe("local login component", () => {
       1: "admin",
       2: "long-secret",
       3: "long-secret",
-      4: true,
-      7: "setup-secret",
+      6: "setup-secret",
+      7: true,
+      8: true,
     });
 
     expect(mocks.inputs.find((input) => input.placeholder === "密码").type).toBe("text");
@@ -259,15 +259,15 @@ describe("local login component", () => {
         body: JSON.stringify({ username: "admin", password: "long-secret", passwordConfirm: "long-secret" }),
       }),
     );
-    expect(setters[6]).toHaveBeenCalledWith("用户名已存在");
-    expect(setters[5]).toHaveBeenLastCalledWith(false);
+    expect(setters[5]).toHaveBeenCalledWith("用户名已存在");
+    expect(setters[4]).toHaveBeenLastCalledWith(false);
 
     (globalThis as any).fetch = vi.fn(async () => {
       throw new Error("加载失败");
     });
     const load = renderLogin({}, true);
     await flushPromises();
-    expect(load.setters[6]).toHaveBeenCalledWith("加载失败");
+    expect(load.setters[5]).toHaveBeenCalledWith("加载失败");
   });
 
   it("requires the installer fragment and clears it after successful setup", async () => {
@@ -281,7 +281,7 @@ describe("local login component", () => {
     });
     expect(missing.html).toContain("安装器输出的初始化链接");
     await mocks.forms[0].onSubmit({ preventDefault: vi.fn() });
-    expect(missing.setters[6]).toHaveBeenCalledWith("缺少初始化令牌，请使用安装器输出的初始化链接");
+    expect(missing.setters[5]).toHaveBeenCalledWith("缺少初始化令牌，请使用安装器输出的初始化链接");
     expect(globalThis.fetch).not.toHaveBeenCalled();
 
     const win = installWindow("#setup-token=setup-secret");
@@ -291,7 +291,7 @@ describe("local login component", () => {
       1: "admin",
       2: "long-secret",
       3: "long-secret",
-      7: "setup-secret",
+      6: "setup-secret",
     });
     await mocks.forms[0].onSubmit({ preventDefault: vi.fn() });
 
diff --git a/local/src/components/local-login.tsx b/local/src/components/local-login.tsx
index b44e43b..16a0b93 100644
--- a/local/src/components/local-login.tsx
+++ b/local/src/components/local-login.tsx
@@ -3,8 +3,12 @@
 import * as React from "react";
 import Image from "next/image";
 import Link from "next/link";
-import { Eye, EyeOff, Loader2 } from "lucide-react";
+import { Loader2 } from "lucide-react";
 import { getLocalAdminSetupCredentialError, LOCAL_ADMIN_PASSWORD_MIN_LENGTH } from "@local/lib/admin-credentials";
+import { Button } from "@subboost/ui/components/ui/button";
+import { FormField } from "@subboost/ui/components/ui/form-field";
+import { Input } from "@subboost/ui/components/ui/input";
+import { PasswordField } from "@subboost/ui/components/ui/password-field";
 import { hasAuthConfigHandoff } from "@subboost/ui/store/config-store/auth-handoff";
 
 type AuthState = {
@@ -26,7 +30,6 @@ export function LocalLogin() {
   const [username, setUsername] = React.useState("");
   const [password, setPassword] = React.useState("");
   const [passwordConfirm, setPasswordConfirm] = React.useState("");
-  const [showPassword, setShowPassword] = React.useState(false);
   const [loading, setLoading] = React.useState(false);
   const [error, setError] = React.useState("");
   const [setupToken, setSetupToken] = React.useState("");
@@ -105,50 +108,37 @@ export function LocalLogin() {
         <div className="bg-white/5 backdrop-blur-sm border border-white/10 rounded-2xl p-6 space-y-4">
           {auth ? (
             <form onSubmit={handleSubmit} className="space-y-3">
-              <input
-                type="text"
+              <FormField label="管理员账号">
+                <Input
                 autoComplete="username"
                 placeholder="管理员账号"
                 value={username}
                 onChange={(e) => setUsername(e.target.value)}
-                className="w-full px-4 py-3 bg-white/5 border border-white/10 rounded-xl text-white placeholder-white/30 focus:outline-none focus:border-indigo-500/50 transition-colors"
-              />
-              <div className="relative">
-                <input
-                  type={showPassword ? "text" : "password"}
-                  autoComplete={setupRequired ? "new-password" : "current-password"}
-                  aria-describedby={setupRequired ? "local-admin-password-help" : undefined}
-                  placeholder="密码"
-                  value={password}
-                  onChange={(e) => setPassword(e.target.value)}
-                  className="w-full px-4 py-3 bg-white/5 border border-white/10 rounded-xl text-white placeholder-white/30 focus:outline-none focus:border-indigo-500/50 transition-colors pr-12"
+                className="h-12"
                 />
-                <button
-                  type="button"
-                  onClick={() => setShowPassword(!showPassword)}
-                  className="absolute right-3 top-1/2 -translate-y-1/2 text-white/40 hover:text-white/60"
-                >
-                  {showPassword ? <EyeOff className="w-5 h-5" /> : <Eye className="w-5 h-5" />}
-                </button>
-              </div>
-              {setupRequired ? (
-                <p id="local-admin-password-help" className="-mt-1 text-xs text-white/45">
-                  至少 {LOCAL_ADMIN_PASSWORD_MIN_LENGTH} 个字符
-                </p>
-              ) : null}
+              </FormField>
+              <PasswordField
+                label="密码"
+                autoComplete={setupRequired ? "new-password" : "current-password"}
+                description={setupRequired ? `至少 ${LOCAL_ADMIN_PASSWORD_MIN_LENGTH} 个字符` : undefined}
+                placeholder="密码"
+                value={password}
+                onChange={(e) => setPassword(e.target.value)}
+                className="h-12"
+              />
               {setupRequired && !setupToken ? (
                 <p className="text-amber-300/80 text-xs">
                   请从安装器输出的初始化链接进入本页面。
                 </p>
               ) : null}
               {setupRequired ? (
-                <input
-                  type={showPassword ? "text" : "password"}
+                <PasswordField
+                  label="确认密码"
                   autoComplete="new-password"
                   placeholder="确认密码"
                   value={passwordConfirm}
                   onChange={(e) => setPasswordConfirm(e.target.value)}
-                  className="w-full px-4 py-3 bg-white/5 border border-white/10 rounded-xl text-white placeholder-white/30 focus:outline-none focus:border-indigo-500/50 transition-colors"
+                  className="h-12"
                 />
               ) : null}
 
@@ -158,14 +148,14 @@ export function LocalLogin() {
                 </p>
               ) : null}
 
-              <button
+              <Button
                 type="submit"
                 disabled={loading || !username || !password || (setupRequired && !passwordConfirm)}
-                className="w-full flex items-center justify-center gap-2 px-4 py-3 btn-primary"
+                className="h-12 w-full"
               >
                 {loading && <Loader2 className="w-4 h-4 animate-spin" />}
                 {setupRequired ? "创建管理员" : "登录"}
-              </button>
+              </Button>
             </form>
           ) : (
             <div className="h-36 animate-pulse rounded-xl bg-white/5" />
diff --git a/package.json b/package.json
index a421add..cbc7e62 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,8 @@
     "build": "npm --workspace @subboost/local run build",
     "test:unit": "vitest run",
     "test:core": "vitest run --config vitest.core.config.ts",
-    "lint": "eslint local packages --max-warnings=0",
+    "lint": "eslint local packages --max-warnings=0 && npm run check:ui-consistency",
+    "check:ui-consistency": "node scripts/check-ui-consistency.cjs packages local",
     "check:local-app": "npm --prefix local run check",
     "local:db:generate": "npm --prefix local run db:generate",
     "local:lint": "npm --prefix local run lint",
diff --git a/packages/ui/src/components/auth/user-menu.test.ts b/packages/ui/src/components/auth/user-menu.test.ts
index c5ccd8e..9a38d5b 100644
--- a/packages/ui/src/components/auth/user-menu.test.ts
+++ b/packages/ui/src/components/auth/user-menu.test.ts
@@ -5,6 +5,8 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 const mocks = vi.hoisted(() => ({
   captureAuthConfigHandoff: vi.fn(),
   documentHandlers: {} as Record<string, (event: any) => void>,
+  dropdownRoots: [] as any[],
+  dropdownItems: [] as any[],
   fetchUser: vi.fn(),
   intrinsics: [] as any[],
   links: [] as any[],
@@ -71,7 +73,24 @@ vi.mock("lucide-react", () => ({
 }));
 
 vi.mock("@subboost/ui/components/ui/button", () => ({
-  Button: (props: any) => React.createElement("button", props, props.children),
+  Button: ({ asChild: _asChild, ...props }: any) => React.createElement("button", props, props.children),
+}));
+
+vi.mock("@subboost/ui/components/ui/dropdown-menu", () => ({
+  DropdownMenu: (props: any) => {
+    mocks.dropdownRoots.push(props);
+    return React.createElement("div", null, props.children);
+  },
+  DropdownMenuContent: (props: any) => React.createElement("div", props, props.children),
+  DropdownMenuItem: ({ asChild, children, onSelect, ...props }: any) => {
+    mocks.dropdownItems.push({ asChild, children, onSelect, ...props });
+    return asChild
+      ? React.createElement(React.Fragment, null, children)
+      : React.createElement("button", { ...props, onClick: () => onSelect?.() }, children);
+  },
+  DropdownMenuLabel: (props: any) => React.createElement("div", props, props.children),
+  DropdownMenuSeparator: (props: any) => React.createElement("hr", props),
+  DropdownMenuTrigger: (props: any) => React.createElement(React.Fragment, null, props.children),
 }));
 
 vi.mock("@subboost/ui/components/ui/safe-image", () => ({
@@ -109,6 +128,8 @@ describe("UserMenu", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mocks.documentHandlers = {};
+    mocks.dropdownRoots = [];
+    mocks.dropdownItems = [];
     mocks.intrinsics = [];
     mocks.refContains.mockReturnValue(false);
     vi.stubGlobal("document", {
@@ -177,17 +198,11 @@ describe("UserMenu", () => {
     expect(html).toContain("我的订阅");
     expect(html).toContain("账户设置");
     expect(html).toContain("退出登录");
-    const toggle = findIntrinsic(
-      "button",
-      (props) => typeof props.className === "string" && props.className.includes("px-2 py-1.5")
-    );
-    expect(toggle.type).toBe("button");
-    expect(toggle["aria-label"]).toBe("用户菜单");
-    expect(toggle["aria-haspopup"]).toBe("menu");
-    expect(toggle["aria-expanded"]).toBe(true);
+    expect(html).toContain('aria-label="用户菜单"');
+    expect(mocks.dropdownRoots[0].open).toBe(true);
   });
 
-  it("closes the menu from document, toggle, overlay, links, and logout actions", async () => {
+  it("delegates close behavior to DropdownMenu and logs out", async () => {
     mocks.stateOverride = true;
     mocks.userState = {
       fetchUser: mocks.fetchUser,
@@ -207,26 +222,12 @@ describe("UserMenu", () => {
 
     renderToStaticMarkup(React.createElement(UserMenu, { privilegedMenuItem: { href: "/ops", label: "Privileged" } }));
 
-    mocks.documentHandlers.mousedown({ target: {} });
-    expect(mocks.stateSetter).toHaveBeenCalledWith(false);
-
-    mocks.stateSetter.mockClear();
-    mocks.refContains.mockReturnValueOnce(true);
-    mocks.documentHandlers.mousedown({ target: {} });
-    expect(mocks.stateSetter).not.toHaveBeenCalled();
-
-    findIntrinsic("button", (props) => typeof props.className === "string" && props.className.includes("px-2 py-1.5")).onClick();
-    expect(mocks.stateSetter).toHaveBeenCalledWith(false);
-
-    findIntrinsic("div", (props) => typeof props.className === "string" && props.className.includes("fixed inset-0")).onClick();
-    expect(mocks.stateSetter).toHaveBeenCalledWith(false);
-
-    for (const link of mocks.links) {
-      link.onClick?.();
-    }
+    mocks.dropdownRoots[0].onOpenChange(false);
     expect(mocks.stateSetter).toHaveBeenCalledWith(false);
 
-    await findIntrinsic("button", (props) => textOf(props.children).includes("退出登录")).onClick();
+    const logoutItem = mocks.dropdownItems.find((item) => textOf(item.children).includes("退出登录"));
+    expect(logoutItem).toBeTruthy();
+    await logoutItem.onSelect();
     expect(mocks.logout).toHaveBeenCalled();
     expect(mocks.stateSetter).toHaveBeenCalledWith(false);
     expect(window.location.href).toBe("/");
diff --git a/packages/ui/src/components/auth/user-menu.tsx b/packages/ui/src/components/auth/user-menu.tsx
index 7a428b4..1341dcc 100644
--- a/packages/ui/src/components/auth/user-menu.tsx
+++ b/packages/ui/src/components/auth/user-menu.tsx
@@ -3,6 +3,14 @@
 import * as React from "react";
 import Link from "next/link";
 import { Button } from "@subboost/ui/components/ui/button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@subboost/ui/components/ui/dropdown-menu";
 import { SafeImage } from "@subboost/ui/components/ui/safe-image";
 import { captureAuthConfigHandoff } from "@subboost/ui/store/config-store/auth-handoff";
 import { useConfigStore } from "@subboost/ui/store/config-store";
@@ -25,23 +33,11 @@ export type AccountMenuItem = {
 export function UserMenu({ privilegedMenuItem }: { privilegedMenuItem?: AccountMenuItem }) {
   const { user, isLoading: userLoading, fetchUser, logout: userLogout } = useUserStore();
   const [isOpen, setIsOpen] = React.useState(false);
-  const menuRef = React.useRef<HTMLDivElement>(null);
 
   React.useEffect(() => {
     fetchUser();
   }, [fetchUser]);
 
-  React.useEffect(() => {
-    const handleClickOutside = (event: MouseEvent) => {
-      if (menuRef.current && !menuRef.current.contains(event.target as Node)) {
-        setIsOpen(false);
-      }
-    };
-
-    document.addEventListener("mousedown", handleClickOutside);
-    return () => document.removeEventListener("mousedown", handleClickOutside);
-  }, []);
-
   const handleLogout = async () => {
     if (user) await userLogout();
     setIsOpen(false);
@@ -59,57 +55,48 @@ export function UserMenu({ privilegedMenuItem }: { privilegedMenuItem?: AccountM
   // 未登录
   if (!user) {
     return (
-      <Link href="/login" onClick={() => captureAuthConfigHandoff(useConfigStore.getState())}>
-        <Button size="sm" className="gap-2">
+      <Button asChild size="sm" className="gap-2">
+        <Link href="/login" onClick={() => captureAuthConfigHandoff(useConfigStore.getState())}>
           <LogIn className="h-4 w-4" />
           登录
-        </Button>
-      </Link>
+        </Link>
+      </Button>
     );
   }
 
   return (
-    <div className="relative" ref={menuRef}>
-      <button
-        type="button"
-        aria-label="用户菜单"
-        aria-haspopup="menu"
-        aria-expanded={isOpen}
-        onClick={() => setIsOpen(!isOpen)}
-        className="flex items-center gap-2 px-2 py-1.5 rounded-lg hover:bg-white/5 transition-colors"
-      >
-        <SafeImage
-          src={user.avatarUrl}
-          alt={user.name || user.username}
-          className="h-8 w-8 rounded-full border border-white/20"
-          fallback={
-            <div className="h-8 w-8 rounded-full bg-gradient-to-br from-indigo-500 to-purple-600 flex items-center justify-center">
-              <UserIcon className="h-4 w-4 text-white" />
-            </div>
-          }
-        />
-        <span className="text-sm font-medium hidden sm:block">{user.name || user.username}</span>
-        <ChevronDown className={`h-4 w-4 text-white/50 transition-transform ${isOpen ? "rotate-180" : ""}`} />
-      </button>
-
-      {isOpen && (
-        <>
-          <div 
-            className="fixed inset-0 z-40" 
-            onClick={() => setIsOpen(false)}
+    <DropdownMenu open={isOpen} onOpenChange={setIsOpen}>
+      <DropdownMenuTrigger asChild>
+        <Button
+          variant="ghost"
+          aria-label="用户菜单"
+          className="h-auto gap-2 px-2 py-1.5"
+        >
+          <SafeImage
+            src={user.avatarUrl}
+            alt={user.name || user.username}
+            className="h-8 w-8 rounded-full border border-white/20"
+            fallback={
+              <span className="flex h-8 w-8 items-center justify-center rounded-full bg-gradient-to-br from-indigo-500 to-purple-600">
+                <UserIcon className="h-4 w-4 text-white" />
+              </span>
+            }
           />
-          <div className="absolute right-0 mt-2 w-64 rounded-2xl bg-[#1a1a1a] border border-white/10 shadow-xl py-2 z-50">
-            {/* User Info Header */}
-            <div className="px-4 py-3 border-b border-white/10">
+          <span className="hidden text-sm font-medium sm:block">{user.name || user.username}</span>
+          <ChevronDown className={`h-4 w-4 text-white/50 transition-transform ${isOpen ? "rotate-180" : ""}`} />
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end" className="w-64 border-white/10 bg-[#1a1a1a] p-0 text-white">
+        <DropdownMenuLabel className="border-b border-white/10 px-4 py-3 font-normal text-white">
               <div className="flex items-center gap-3">
                 <SafeImage
                   src={user.avatarUrl}
                   alt={user.name || user.username}
                   className="h-12 w-12 rounded-full border border-white/20"
                   fallback={
-                    <div className="h-12 w-12 rounded-full bg-gradient-to-br from-indigo-500 to-purple-600 flex items-center justify-center">
+                    <span className="flex h-12 w-12 items-center justify-center rounded-full bg-gradient-to-br from-indigo-500 to-purple-600">
                       <UserIcon className="h-6 w-6 text-white" />
-                    </div>
+                    </span>
                   }
                 />
                 <div className="flex-1 min-w-0">
@@ -132,51 +119,47 @@ export function UserMenu({ privilegedMenuItem }: { privilegedMenuItem?: AccountM
                   {user.subscriptionCount}/{user.quota.maxSubscriptions} 订阅
                 </div>
               </div>
-            </div>
-
-            {/* Menu Items */}
-            <div className="py-1">
-              {privilegedMenuItem && user.isAdmin && !user.isBanned && (
+        </DropdownMenuLabel>
+        <div className="py-1">
+          {privilegedMenuItem && user.isAdmin && !user.isBanned && (
+            <DropdownMenuItem asChild className="rounded-none px-4 py-2 text-indigo-400/80 focus:bg-white/5 focus:text-indigo-400">
                 <Link
                   href={privilegedMenuItem.href}
-                  onClick={() => setIsOpen(false)}
-                  className="flex items-center gap-3 px-4 py-2 text-sm text-indigo-400/80 hover:bg-white/5 hover:text-indigo-400 transition-colors"
+                  className="flex items-center gap-3 text-sm"
                 >
                   <Settings className="h-4 w-4" />
                   {privilegedMenuItem.label}
                 </Link>
-              )}
+            </DropdownMenuItem>
+          )}
+          <DropdownMenuItem asChild className="rounded-none px-4 py-2 text-white/60 focus:bg-white/5 focus:text-white">
               <Link
                 href="/dashboard"
-                onClick={() => setIsOpen(false)}
-                className="flex items-center gap-3 px-4 py-2 text-sm text-white/60 hover:bg-white/5 hover:text-white transition-colors"
+                className="flex items-center gap-3 text-sm"
               >
                 <LayoutDashboard className="h-4 w-4" />
                 我的订阅
               </Link>
+          </DropdownMenuItem>
+          <DropdownMenuItem asChild className="rounded-none px-4 py-2 text-white/60 focus:bg-white/5 focus:text-white">
               <Link
                 href="/dashboard/settings"
-                onClick={() => setIsOpen(false)}
-                className="flex items-center gap-3 px-4 py-2 text-sm text-white/60 hover:bg-white/5 hover:text-white transition-colors"
+                className="flex items-center gap-3 text-sm"
               >
                 <Settings className="h-4 w-4" />
                 账户设置
               </Link>
-            </div>
-
-            {/* Logout */}
-            <div className="border-t border-white/10 pt-1">
-              <button
-                onClick={handleLogout}
-                className="flex items-center gap-3 w-full px-4 py-2 text-sm text-red-400 hover:bg-white/5 hover:text-red-300 transition-colors"
-              >
-                <LogOut className="h-4 w-4" />
-                退出登录
-              </button>
-            </div>
-          </div>
-        </>
-      )}
-    </div>
+          </DropdownMenuItem>
+        </div>
+        <DropdownMenuSeparator className="m-0 bg-white/10" />
+        <DropdownMenuItem
+          onSelect={() => void handleLogout()}
+          className="rounded-none px-4 py-2 text-red-400 focus:bg-white/5 focus:text-red-300"
+        >
+          <LogOut className="h-4 w-4" />
+          退出登录
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
   );
 }
diff --git a/packages/ui/src/components/layout/header.tsx b/packages/ui/src/components/layout/header.tsx
index ba0bda1..d7c75e5 100644
--- a/packages/ui/src/components/layout/header.tsx
+++ b/packages/ui/src/components/layout/header.tsx
@@ -16,6 +16,7 @@ import {
   type LucideIcon,
 } from "lucide-react";
 import { cn } from "@subboost/ui/lib/utils";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { UserMenu, type AccountMenuItem } from "@subboost/ui/components/auth/user-menu";
 import { captureAuthConfigHandoff } from "@subboost/ui/store/config-store/auth-handoff";
 import { useConfigStore } from "@subboost/ui/store/config-store";
@@ -189,12 +190,12 @@ export function Header({
             <UserMenu privilegedMenuItem={privilegedMenuItem} />
 
             {/* Mobile Menu Button */}
-            <button
-              type="button"
-              aria-label={mobileMenuOpen ? "关闭导航菜单" : "打开导航菜单"}
+            <IconButton
+              label={mobileMenuOpen ? "关闭导航菜单" : "打开导航菜单"}
+              variant="ghost"
               aria-expanded={mobileMenuOpen}
               aria-controls="subboost-mobile-navigation"
-              className="md:hidden p-2 rounded-lg hover:bg-white/5 transition-colors"
+              className="rounded-lg p-2 transition-colors hover:bg-white/5 md:hidden"
               onClick={() => setMobileMenuOpen(!mobileMenuOpen)}
             >
               {mobileMenuOpen ? (
@@ -202,7 +203,7 @@ export function Header({
               ) : (
                 <Menu className="w-5 h-5 text-white/60" />
               )}
-            </button>
+            </IconButton>
           </div>
         </div>
 
diff --git a/packages/ui/src/components/subscription/smart-node-matching-help.test.ts b/packages/ui/src/components/subscription/smart-node-matching-help.test.ts
index 1741a81..3556d48 100644
--- a/packages/ui/src/components/subscription/smart-node-matching-help.test.ts
+++ b/packages/ui/src/components/subscription/smart-node-matching-help.test.ts
@@ -3,6 +3,8 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it, vi } from "vitest";
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => React.createElement("span", null, props.children),
+  Close: (props: any) => React.createElement("button", null, props.children),
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("span", null, props.children),
   Portal: (props: any) => React.createElement("div", null, props.children),
@@ -11,6 +13,7 @@ vi.mock("@radix-ui/react-popover", () => ({
 }));
 
 vi.mock("lucide-react", () => ({
+  CircleHelp: () => React.createElement("span", null, "circle-help-icon"),
   HelpCircle: () => React.createElement("span", null, "help-icon"),
 }));
 
diff --git a/packages/ui/src/components/subscription/smart-node-matching-help.tsx b/packages/ui/src/components/subscription/smart-node-matching-help.tsx
index ac914ea..cee4432 100644
--- a/packages/ui/src/components/subscription/smart-node-matching-help.tsx
+++ b/packages/ui/src/components/subscription/smart-node-matching-help.tsx
@@ -1,7 +1,7 @@
 "use client";
 
-import * as Popover from "@radix-ui/react-popover";
 import { HelpCircle } from "lucide-react";
+import { HelpPopover } from "@subboost/ui/components/ui/popover";
 
 type Props = {
   enabled: boolean;
@@ -15,37 +15,22 @@ const SUMMARY_DESCRIPTION = "智能匹配可减少订阅换地址后配置丢失
 
 export function SmartNodeMatchingHelp({ enabled }: Props) {
   return (
-    <Popover.Root>
-      <Popover.Trigger asChild>
-        <button
-          type="button"
-          className="inline-flex h-6 w-6 shrink-0 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-          aria-label="更新时智能匹配节点说明"
-          title="更新时智能匹配节点说明"
-        >
-          <HelpCircle className="h-3.5 w-3.5" />
-        </button>
-      </Popover.Trigger>
-      <Popover.Portal>
-        <Popover.Content
-          side="bottom"
-          align="start"
-          sideOffset={8}
-          className="z-50 w-[340px] max-w-[calc(100vw-2rem)] rounded-xl border border-white/10 bg-black/90 p-3 shadow-2xl backdrop-blur-md"
-        >
-          <div className="space-y-2 text-xs">
-            <div className="flex items-center gap-2">
-              <HelpCircle className="h-4 w-4 text-amber-300" />
-              <div className="font-medium text-white">更新时智能匹配节点</div>
-            </div>
-            <div className="leading-relaxed text-white/60">
-              {enabled ? ENABLED_DESCRIPTION : DISABLED_DESCRIPTION}
-            </div>
-            <div className="leading-relaxed text-white/50">{SUMMARY_DESCRIPTION}</div>
-          </div>
-          <Popover.Arrow className="fill-white/10" />
-        </Popover.Content>
-      </Popover.Portal>
-    </Popover.Root>
+    <HelpPopover
+      label="更新时智能匹配节点说明"
+      side="bottom"
+      align="start"
+      contentClassName="w-[340px] max-w-[calc(100vw-2rem)] bg-black/90 p-3"
+    >
+      <div className="space-y-2 text-xs">
+        <div className="flex items-center gap-2">
+          <HelpCircle className="h-4 w-4 text-amber-300" aria-hidden="true" />
+          <p className="font-medium text-white">更新时智能匹配节点</p>
+        </div>
+        <p className="leading-relaxed text-white/60">
+          {enabled ? ENABLED_DESCRIPTION : DISABLED_DESCRIPTION}
+        </p>
+        <p className="leading-relaxed text-white/50">{SUMMARY_DESCRIPTION}</p>
+      </div>
+    </HelpPopover>
   );
 }
diff --git a/packages/ui/src/components/ui/page-pager.tsx b/packages/ui/src/components/ui/page-pager.tsx
index feccfb5..ec7c52c 100644
--- a/packages/ui/src/components/ui/page-pager.tsx
+++ b/packages/ui/src/components/ui/page-pager.tsx
@@ -2,7 +2,7 @@
 
 import * as React from "react";
 import { ChevronLeft, ChevronRight } from "lucide-react";
-import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
 import { cn } from "@subboost/ui/lib/utils";
 
@@ -26,16 +26,15 @@ export function PagePager({ page, totalPages, onPageChange, className, disabled
 
   return (
     <div className={cn("flex items-center gap-2", className)}>
-      <Button
+      <IconButton
+        label="上一页"
         variant="outline"
-        size="icon"
         className="h-10 w-10 rounded-xl bg-white/5 hover:bg-white/10"
         onClick={() => goToPage(page - 1)}
         disabled={disabled || page <= 1 || isSinglePage}
-        aria-label="上一页"
       >
         <ChevronLeft className="h-4 w-4" />
-      </Button>
+      </IconButton>
 
       <div className="flex items-center gap-1">
         <Input
@@ -58,16 +57,15 @@ export function PagePager({ page, totalPages, onPageChange, className, disabled
         <span className="text-sm text-white/60 whitespace-nowrap">/ {safeTotalPages}</span>
       </div>
 
-      <Button
+      <IconButton
+        label="下一页"
         variant="outline"
-        size="icon"
         className="h-10 w-10 rounded-xl bg-white/5 hover:bg-white/10"
         onClick={() => goToPage(page + 1)}
         disabled={disabled || page >= safeTotalPages || isSinglePage}
-        aria-label="下一页"
       >
         <ChevronRight className="h-4 w-4" />
-      </Button>
+      </IconButton>
     </div>
   );
 }
diff --git a/packages/ui/src/dashboard/subscription-dashboard-surface.tsx b/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
index 5326baf..b8e8bc6 100644
--- a/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
+++ b/packages/ui/src/dashboard/subscription-dashboard-surface.tsx
@@ -354,12 +354,12 @@ export function SubscriptionDashboardSurface({ adapter }: Props) {
         </div>
         <div className="flex items-center gap-2">
           {adapter.renderHeaderActions?.({ user })}
-          <Link href={newSubscriptionHref}>
-            <Button className="gap-2">
+          <Button asChild className="gap-2">
+            <Link href={newSubscriptionHref}>
               <Plus className="h-4 w-4" />
               新建订阅
-            </Button>
-          </Link>
+            </Link>
+          </Button>
         </div>
       </div>
 
@@ -383,12 +383,12 @@ export function SubscriptionDashboardSurface({ adapter }: Props) {
               <FileCode className="h-12 w-12 mx-auto text-white/40 mb-4" />
               <h3 className="text-lg font-medium mb-2">暂无订阅</h3>
               <p className="text-white/50 mb-4">创建您的第一个订阅配置</p>
-              <Link href={newSubscriptionHref}>
-                <Button>
+              <Button asChild>
+                <Link href={newSubscriptionHref}>
                   <Plus className="mr-2 h-4 w-4" />
                   新建订阅
-                </Button>
-              </Link>
+                </Link>
+              </Button>
             </div>
           ) : (
             <div className="space-y-4">
@@ -478,9 +478,9 @@ function LoginPrompt({ loginHref }: { loginHref: string }) {
         <Shield className="h-16 w-16 mx-auto text-white/50" />
         <h1 className="text-2xl font-bold">请先登录</h1>
         <p className="text-white/50">登录后可以管理您的订阅和模板</p>
-        <Link href={loginHref}>
-          <Button size="lg">登录</Button>
-        </Link>
+        <Button asChild size="lg">
+          <Link href={loginHref}>登录</Link>
+        </Button>
       </div>
     </div>
   );
@@ -543,12 +543,12 @@ function SubscriptionRow({
       </div>
 
       <div className="flex flex-wrap items-center gap-2 sm:shrink-0 sm:justify-end">
-        <Link href={editHref}>
-          <Button variant="ghost" size="sm" className="gap-0 sm:gap-2" title="回到首页编辑该订阅（更新后链接不变）">
+        <Button asChild variant="ghost" size="sm" className="gap-0 sm:gap-2" title="回到首页编辑该订阅（更新后链接不变）">
+          <Link href={editHref}>
             <Settings className="h-4 w-4" />
             <span className="hidden sm:inline">编辑</span>
-          </Button>
-        </Link>
+          </Link>
+        </Button>
         <Button
           variant="ghost"
           size="sm"
diff --git a/packages/ui/src/dashboard/subscription-settings-dialog.tsx b/packages/ui/src/dashboard/subscription-settings-dialog.tsx
index 932bde7..f3f7b9b 100644
--- a/packages/ui/src/dashboard/subscription-settings-dialog.tsx
+++ b/packages/ui/src/dashboard/subscription-settings-dialog.tsx
@@ -10,8 +10,9 @@ import {
   DialogTitle,
 } from "@subboost/ui/components/ui/dialog";
 import { Input } from "@subboost/ui/components/ui/input";
-import { Label } from "@subboost/ui/components/ui/label";
+import { FormField } from "@subboost/ui/components/ui/form-field";
 import { Switch } from "@subboost/ui/components/ui/switch";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { SmartNodeMatchingHelp } from "@subboost/ui/components/subscription/smart-node-matching-help";
 import {
   getAutoUpdateIntervalPolicyMinLabel,
@@ -67,15 +68,14 @@ export function SubscriptionSettingsDialog({
         </DialogHeader>
 
         <div className="space-y-4 py-2">
-          <div className="space-y-2">
-            <Label>订阅名称</Label>
+          <FormField label="订阅名称">
             <Input
               value={settingsName}
               onChange={(e) => setSettingsName(e.target.value)}
               maxLength={100}
               placeholder="例如：我的配置"
             />
-          </div>
+          </FormField>
 
           <div className="flex items-center justify-between gap-4">
             <div className="min-w-0">
@@ -84,16 +84,19 @@ export function SubscriptionSettingsDialog({
                 <SmartNodeMatchingHelp enabled={smartNodeMatchingEnabled} />
               </div>
             </div>
-            <Switch checked={smartNodeMatchingEnabled} onCheckedChange={setSmartNodeMatchingEnabled} />
+            <Switch
+              checked={smartNodeMatchingEnabled}
+              onCheckedChange={setSmartNodeMatchingEnabled}
+              aria-label="更新时智能匹配节点"
+            />
           </div>
 
-          <div className="flex items-center justify-between gap-4">
-            <div className="min-w-0">
-              <p className="text-sm text-white/70">启用自动更新</p>
-              <p className="text-xs text-white/40 mt-1">开启后服务器会按间隔刷新缓存</p>
-            </div>
-            <Switch checked={autoUpdateEnabled} onCheckedChange={setAutoUpdateEnabled} />
-          </div>
+          <SwitchField
+            label="启用自动更新"
+            description="开启后服务器会按间隔刷新缓存"
+            checked={autoUpdateEnabled}
+            onCheckedChange={setAutoUpdateEnabled}
+          />
 
           {!autoUpdateEnabled && subscription?.autoUpdateState.disabledAt && subscription.autoUpdateState.disabledReason && (
             <div className="rounded-md border border-amber-400/25 bg-amber-500/10 px-3 py-2 text-xs leading-relaxed text-amber-100">
@@ -102,8 +105,7 @@ export function SubscriptionSettingsDialog({
           )}
 
           {autoUpdateEnabled && (
-            <div className="space-y-2">
-              <Label>自动更新间隔（小时）</Label>
+            <FormField label="自动更新间隔（小时）">
               <Input
                 type="number"
                 min={policy.minHours}
@@ -111,7 +113,7 @@ export function SubscriptionSettingsDialog({
                 value={autoUpdateHours}
                 onChange={(e) => setAutoUpdateHours(Number(e.target.value))}
               />
-            </div>
+            </FormField>
           )}
         </div>
 
diff --git a/packages/ui/src/product/converter/advanced-mode/constants.ts b/packages/ui/src/product/converter/advanced-mode/constants.ts
index 9514aa0..adf713e 100644
--- a/packages/ui/src/product/converter/advanced-mode/constants.ts
+++ b/packages/ui/src/product/converter/advanced-mode/constants.ts
@@ -1,20 +1 @@
-import { FileCode, Link2, Server } from "lucide-react";
-import type { SourceType } from "@subboost/ui/store/config-store";
-
-export const sourceTypeInfo: Record<
-  SourceType,
-  {
-    label: string;
-    icon: typeof Link2;
-    placeholder: string;
-  }
-> = {
-  url: { label: "订阅链接", icon: Link2, placeholder: "https://example.com/sub?token=xxx" },
-  yaml: { label: "YAML 配置", icon: FileCode, placeholder: "proxies:\n  - name: 节点名称\n    type: vmess\n    ..." },
-  nodes: {
-    label: "节点链接",
-    icon: Server,
-    placeholder:
-      "ss://...\nssr://...\nvmess://...\nvless://...\ntrojan://...\nanytls://...\nhysteria2://... / hy2://...\ntuic://...\n(socks5://... / socks4://...)",
-  },
-};
+export { sourceTypeInfo } from "@subboost/ui/product/converter/source-type-info";
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
index fadddcf..b4e7b32 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
@@ -77,8 +77,17 @@ vi.mock("@subboost/ui/components/ui/button", () => ({
     return null;
   },
 }));
+vi.mock("@subboost/ui/components/ui/icon-button", () => ({
+  IconButton: (props: any) => {
+    mocks.captures.iconButtons.push(props);
+    return null;
+  },
+}));
 vi.mock("@subboost/ui/components/ui/dropdown-menu", () => ({
-  DropdownMenu: (props: any) => props.children,
+  DropdownMenu: (props: any) => {
+    mocks.captures.dropdownRoots.push(props);
+    return props.children;
+  },
   DropdownMenuTrigger: (props: any) => props.children,
   DropdownMenuContent: (props: any) => {
     mocks.captures.dropdownContents.push(props);
@@ -94,6 +103,8 @@ vi.mock("@subboost/ui/components/ui/dropdown-menu", () => ({
     mocks.captures.menuItems.push(props);
     return props.children;
   },
+  DropdownMenuLabel: (props: any) => props.children,
+  DropdownMenuSeparator: () => null,
 }));
 vi.mock("@subboost/ui/components/ui/input", () => ({
   Input: (props: any) => {
@@ -170,9 +181,11 @@ function renderSection(overrides: Record<number, unknown> = {}, props = { isExpa
   stateMock.setters = [];
   mocks.captures.buttons = [];
   mocks.captures.inputs = [];
+  mocks.captures.iconButtons = [];
   mocks.captures.switches = [];
   mocks.captures.menuItems = [];
   mocks.captures.dropdownContents = [];
+  mocks.captures.dropdownRoots = [];
   mocks.captures.intrinsics = [];
   try {
     const html = renderToStaticMarkup(React.createElement(DialerProxyGroupsSection, props));
@@ -204,7 +217,7 @@ function findIntrinsics(type: string, predicate: (props: any) => boolean) {
 describe("DialerProxyGroupsSection", () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    mocks.captures = { buttons: [], dropdownContents: [], inputs: [], menuItems: [], switches: [], intrinsics: [] };
+    mocks.captures = { buttons: [], dropdownContents: [], dropdownRoots: [], iconButtons: [], inputs: [], menuItems: [], switches: [], intrinsics: [] };
     mocks.store = {
       nodes,
       dialerProxyGroups: [groupA, groupB],
@@ -227,7 +240,7 @@ describe("DialerProxyGroupsSection", () => {
     mocks.store.dialerProxyGroups = [];
     renderSection();
     expect(mocks.captures.header).toEqual(expect.objectContaining({ title: "中转代理组", isExpanded: true }));
-    expect(mocks.captures.buttons.at(-1)).toEqual(expect.objectContaining({ className: expect.stringContaining("border-dashed") }));
+    expect(mocks.captures.buttons.find((props: any) => String(props.className).includes("border-dashed"))).toBeTruthy();
 
     mocks.store.nodes = nodes;
     mocks.store.dialerProxyGroups = [groupA, groupB];
@@ -292,12 +305,11 @@ describe("DialerProxyGroupsSection", () => {
   it("opens the add menu and creates preset dialer groups", () => {
     const { setters } = renderSection();
 
-    const addMenuButton = mocks.captures.buttons.find((props: any) => textOf(props.children).includes("添加中转组"));
-    addMenuButton.onClick();
+    mocks.captures.dropdownRoots.find((props: any) => typeof props.onOpenChange === "function").onOpenChange(true);
     expect((setters[1] as any).lastValue).toBe(true);
 
     renderSection({ 1: true });
-    findIntrinsic("button", (props) => textOf(props.children).includes("香港中转")).onClick();
+    mocks.captures.menuItems.find((props: any) => textOf(props.children).includes("香港中转")).onSelect();
     expect(mocks.store.addDialerProxyGroup).toHaveBeenCalledWith({
       name: "香港中转",
       enabled: true,
@@ -373,7 +385,7 @@ describe("DialerProxyGroupsSection", () => {
       })
     );
 
-    findIntrinsic("button", (props) => props.title === "删除").onClick({ stopPropagation: vi.fn() });
+    mocks.captures.iconButtons.find((props: any) => props.label === "删除 Group A 中转组").onClick({ stopPropagation: vi.fn() });
     expect(mocks.store.removeDialerProxyGroup).toHaveBeenCalledWith("g-a");
   });
 
@@ -434,25 +446,25 @@ describe("DialerProxyGroupsSection", () => {
 
   it("toggles expansion and relay or target membership from native rows", () => {
     let result = renderSection();
-    findIntrinsic("div", (props) => typeof props.className === "string" && props.className.includes("cursor-pointer")).onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "展开 Group A").onClick();
     expect((result.setters[0] as any).lastValue).toEqual(new Set(["g-a"]));
 
     result = renderSection({ 0: new Set(["g-a"]) });
-    findIntrinsic("div", (props) => typeof props.className === "string" && props.className.includes("cursor-pointer")).onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "收起 Group A").onClick();
     expect((result.setters[0] as any).lastValue).toEqual(new Set());
 
     renderSection({ 0: new Set(["g-a"]) });
-    findIntrinsic("div", (props) => textOf(props.children).includes("Alpha")).onClick();
+    findIntrinsic("button", (props) => textOf(props.children).includes("Alpha") && props["aria-pressed"] === true).onClick();
     expect(mocks.store.removeNodeFromDialerGroup).toHaveBeenCalledWith("g-a", "Alpha", true);
 
-    findIntrinsic("div", (props) => textOf(props.children).includes("DIRECT（直连）")).onClick();
+    findIntrinsic("button", (props) => textOf(props.children).includes("DIRECT（直连）")).onClick();
     expect(mocks.store.addNodeToDialerGroup).toHaveBeenCalledWith("g-a", "DIRECT", true);
 
-    findIntrinsic("div", (props) => textOf(props.children).includes("Beta")).onClick();
+    findIntrinsic("button", (props) => textOf(props.children).includes("Beta") && props["aria-pressed"] === true).onClick();
     expect(mocks.store.removeNodeFromDialerGroup).toHaveBeenCalledWith("g-a", "Beta", false);
 
     const gammaTargetRow = findIntrinsics(
-      "div",
+      "button",
       (props) => textOf(props.children).includes("Gamma") && typeof props.onClick === "function"
     ).at(-1);
     expect(gammaTargetRow).toBeTruthy();
@@ -466,7 +478,7 @@ describe("DialerProxyGroupsSection", () => {
     mocks.store.addNodeToDialerGroup.mockClear();
     renderSection({ 0: new Set(["g-a"]) });
     const blockedGammaTargetRow = findIntrinsics(
-      "div",
+      "button",
       (props) => textOf(props.children).includes("Gamma") && typeof props.onClick === "function"
     ).at(-1);
     expect(blockedGammaTargetRow).toBeTruthy();
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
index 1e74f58..3011f88 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
@@ -4,6 +4,15 @@ import * as React from "react";
 import { Check, ChevronDown, ChevronRight, Link as LinkIcon, Pencil, Plus, Search, SlidersHorizontal, Trash2, X } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@subboost/ui/components/ui/dropdown-menu";
 import { Input } from "@subboost/ui/components/ui/input";
 import { Switch } from "@subboost/ui/components/ui/switch";
 import { toast } from "@subboost/ui/components/ui/toaster";
@@ -236,17 +245,22 @@ export function DialerProxyGroupsSection({
               <div key={group.id} className="bg-white/5 rounded-lg border border-white/10">
               {/* 组标题 */}
               <div
-                className="flex items-center gap-2 px-3 py-2 cursor-pointer hover:bg-white/5"
-                onClick={() => {
-                  if (isEditing) return;
-                  toggleDialerGroupExpand(group.id);
-                }}
+                className="flex items-center gap-2 px-3 py-2 hover:bg-white/[0.03]"
               >
-                {expandedDialerGroups.has(group.id) ? (
-                  <ChevronDown className="h-4 w-4 text-white/50" />
-                ) : (
-                  <ChevronRight className="h-4 w-4 text-white/50" />
-                )}
+                <IconButton
+                  label={expandedDialerGroups.has(group.id) ? `收起 ${group.name}` : `展开 ${group.name}`}
+                  variant="ghost"
+                  className="h-6 w-6 rounded-md text-white/50"
+                  aria-expanded={expandedDialerGroups.has(group.id)}
+                  disabled={isEditing}
+                  onClick={() => toggleDialerGroupExpand(group.id)}
+                >
+                  {expandedDialerGroups.has(group.id) ? (
+                    <ChevronDown className="h-4 w-4" aria-hidden="true" />
+                  ) : (
+                    <ChevronRight className="h-4 w-4" aria-hidden="true" />
+                  )}
+                </IconButton>
 
                 {isEditing ? (
                   <ProxyGroupNameEditor
@@ -280,7 +294,7 @@ export function DialerProxyGroupsSection({
                 )}
 
                 {isEditing ? (
-                  <div className="flex items-center gap-1" onClick={(e) => e.stopPropagation()}>
+                  <div className="flex items-center gap-1">
                     <Button variant="ghost" size="sm" className="h-7 px-2" onClick={commitRename} title="保存">
                       <Check className="h-3.5 w-3.5" />
                     </Button>
@@ -299,6 +313,7 @@ export function DialerProxyGroupsSection({
                       ]}
                     />
                     <Switch
+                      aria-label={`启用 ${group.name} 中转组`}
                       checked={isEnabled}
                       onCheckedChange={(checked) => {
                         const nextEnabled = Boolean(checked);
@@ -379,16 +394,17 @@ export function DialerProxyGroupsSection({
                         </Button>
                       }
                     />
-                    <button
+                    <IconButton
+                      label={`删除 ${group.name} 中转组`}
+                      variant="ghost"
                       onClick={(e) => {
                         e.stopPropagation();
                         removeDialerProxyGroup(group.id);
                       }}
-                      className="p-1 text-white/30 hover:text-red-400"
-                      title="删除"
+                      className="h-7 w-7 p-1 text-white/30 hover:text-red-400"
                     >
                       <Trash2 className="h-3.5 w-3.5" />
-                    </button>
+                    </IconButton>
                   </>
                 )}
               </div>
@@ -399,7 +415,7 @@ export function DialerProxyGroupsSection({
                   {/* 中转节点选择 */}
                   <div className="mt-3">
                     <div className="mb-1 flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
-                      <label className="text-xs text-white/50">中转节点（流量入口）</label>
+                      <p className="text-xs text-white/50">中转节点（流量入口）</p>
                       <div className="relative w-full sm:max-w-[220px]">
                         <Search className="absolute left-2 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-white/30" />
                         <Input
@@ -419,7 +435,9 @@ export function DialerProxyGroupsSection({
                         const isSelected = group.relayNodes.includes(node.name);
                         const displayName = node.name === "DIRECT" ? "DIRECT（直连）" : node.name;
                         return (
-                          <div
+                          <button
+                            type="button"
+                            aria-pressed={isSelected}
                             key={node.name}
                             className={cn(
                               "flex items-center gap-2 px-2 py-1 rounded text-xs cursor-pointer transition-colors",
@@ -447,7 +465,7 @@ export function DialerProxyGroupsSection({
                               {node.type}
                             </Badge>
                             <span className="truncate">{displayName}</span>
-                          </div>
+                          </button>
                         );
                       })}
                       {availableRelayNodes.length === 0 ? (
@@ -461,7 +479,7 @@ export function DialerProxyGroupsSection({
                   {/* 目标节点选择 */}
                   <div>
                     <div className="mb-1 flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
-                      <label className="text-xs text-white/50">落地节点（流量出口）</label>
+                      <p className="text-xs text-white/50">落地节点（流量出口）</p>
                       <div className="relative w-full sm:max-w-[220px]">
                         <Search className="absolute left-2 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-white/30" />
                         <Input
@@ -484,8 +502,11 @@ export function DialerProxyGroupsSection({
                             (g) => g.id !== group.id && g.enabled !== false && g.targetNodes.includes(node.name)
                           );
                           return (
-                            <div
+                            <button
+                              type="button"
+                              aria-pressed={isSelected}
                               key={node.name}
+                              disabled={usedByOther}
                               className={cn(
                                 "flex items-center gap-2 px-2 py-1 rounded text-xs transition-colors",
                                 usedByOther ? "opacity-40 cursor-not-allowed" : "cursor-pointer",
@@ -519,7 +540,7 @@ export function DialerProxyGroupsSection({
                               {usedByOther && (
                                 <span className="text-[10px] text-white/30 ml-auto">已被其他组使用</span>
                               )}
-                            </div>
+                            </button>
                           );
                         })}
                       {availableTargetNodes.length === 0 ? (
@@ -540,31 +561,29 @@ export function DialerProxyGroupsSection({
           )}
 
           {/* 添加中转组按钮 */}
-          <div className="relative">
-            <Button
-              variant="outline"
-              size="sm"
-              className="w-full h-7 text-xs border-dashed border-white/20 text-white/50 hover:text-white/70 hover:border-white/30"
-              onClick={() => setShowDialerMenu(!showDialerMenu)}
-            >
-              <Plus className="h-3.5 w-3.5 mr-1" />
-              添加中转组
-            </Button>
-
-            {showDialerMenu && (
-              <div className="absolute top-full left-0 right-0 mt-1 bg-[#1a1a1a] border border-white/10 rounded-lg shadow-xl z-10 overflow-hidden">
-                {/* 预设地区选项 */}
-                {PRESET_RELAY_NAMES.map((name) => (
-                  <button
-                    key={name}
-                    onClick={() => handleAddDialerGroup(name)}
-                    className="w-full flex items-center gap-3 px-3 py-2 text-left hover:bg-white/5 transition-colors text-sm text-white/70 hover:text-white"
-                  >
-                    <span>{name}</span>
-                  </button>
-                ))}
-                {/* 自定义选项 */}
-                <div className="border-t border-white/10 p-2">
+          <DropdownMenu open={showDialerMenu} onOpenChange={setShowDialerMenu}>
+            <DropdownMenuTrigger asChild>
+              <Button
+                variant="outline"
+                size="sm"
+                className="h-7 w-full border-dashed border-white/20 text-xs text-white/50 hover:border-white/30 hover:text-white/70"
+              >
+                <Plus className="h-3.5 w-3.5" />
+                添加中转组
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="start" className="w-[var(--radix-dropdown-menu-trigger-width)] border-white/10 bg-[#1a1a1a] text-white">
+              {PRESET_RELAY_NAMES.map((name) => (
+                <DropdownMenuItem
+                  key={name}
+                  onSelect={() => handleAddDialerGroup(name)}
+                  className="text-white/70 focus:bg-white/5 focus:text-white"
+                >
+                  {name}
+                </DropdownMenuItem>
+              ))}
+              <DropdownMenuSeparator className="bg-white/10" />
+              <DropdownMenuLabel className="p-2 font-normal text-white">
                   <div className="flex gap-2">
                     <ProxyGroupNameEditor
                       value={customDialerDraft}
@@ -587,10 +606,9 @@ export function DialerProxyGroupsSection({
                       <Plus className="h-3.5 w-3.5" />
                     </Button>
                   </div>
-                </div>
-              </div>
-            )}
-          </div>
+              </DropdownMenuLabel>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </div>
       )}
     </div>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/input-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/input-section.test.ts
index 8ed3683..23263b4 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/input-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/input-section.test.ts
@@ -77,6 +77,8 @@ vi.mock("react/jsx-runtime", async (importOriginal) => {
 });
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => props.children,
+  Close: (props: any) => props.children,
   Root: (props: any) => props.children,
   Trigger: (props: any) => props.children,
   Portal: (props: any) => props.children,
@@ -88,8 +90,11 @@ vi.mock("lucide-react", () => ({
   Check: () => null,
   ChevronDown: () => null,
   ChevronUp: () => null,
+  CircleHelp: () => null,
+  FileCode: () => null,
   HelpCircle: () => null,
   Loader2: () => null,
+  Link2: () => null,
   Maximize2: () => null,
   Menu: () => null,
   Plus: () => null,
@@ -123,6 +128,12 @@ vi.mock("@subboost/core/node-name-template", () => ({
   DEFAULT_NODE_NAME_TEMPLATE: "[{tag}] {name}",
   formatNodeNameFromTemplate: ({ originName, tag, template }: any) => `${template || "{name}"}:${tag || ""}:${originName}`,
 }));
+vi.mock("@subboost/ui/components/ui/icon-button", () => ({
+  IconButton: (props: any) => {
+    mocks.captures.iconButtons.push(props);
+    return null;
+  },
+}));
 vi.mock("@subboost/ui/lib/utils", () => ({ cn: (...parts: unknown[]) => parts.filter(Boolean).join(" ") }));
 vi.mock("@subboost/ui/store/config-store", () => {
   const useConfigStore = () => mocks.store;
@@ -143,6 +154,20 @@ vi.mock("@subboost/ui/product/subscription/source-order", () => ({ moveSubscript
 vi.mock("@subboost/ui/product/converter/source-display-label", () => ({
   buildSourceDisplayLabel: ({ typeLabel, order, total, tag }: any) => `${typeLabel} ${order}/${total}${tag ? ` ${tag}` : ""}`,
 }));
+vi.mock("@subboost/ui/product/converter/source-controls", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@subboost/ui/product/converter/source-controls")>();
+  return {
+    ...actual,
+    AddSourceMenu: (props: any) => {
+      mocks.captures.addSourceMenus.push(props);
+      return null;
+    },
+    SourceTypeChoices: (props: any) => {
+      mocks.captures.sourceTypeChoices.push(props);
+      return null;
+    },
+  };
+});
 vi.mock("@subboost/ui/product/interactions", () => ({ useProductInteractionAdapter: () => mocks.interactions }));
 vi.mock("../constants", () => ({
   sourceTypeInfo: {
@@ -202,7 +227,10 @@ function renderSection(overrides: Record<number, unknown> = {}, props = { isExpa
   stateMock.setters = [];
   mocks.captures.buttons = [];
   mocks.captures.inputs = [];
+  mocks.captures.iconButtons = [];
+  mocks.captures.addSourceMenus = [];
   mocks.captures.rawButtons = [];
+  mocks.captures.sourceTypeChoices = [];
   mocks.captures.textareas = [];
   try {
     const html = renderToStaticMarkup(React.createElement(InputSection, props));
@@ -212,17 +240,18 @@ function renderSection(overrides: Record<number, unknown> = {}, props = { isExpa
   }
 }
 
-function findRawButton(match: (props: any) => boolean): any {
-  const button = mocks.captures.rawButtons.find(match);
-  expect(button).toBeTruthy();
-  return button;
-}
-
 describe("advanced mode InputSection", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     stateMock.runEffects = false;
-    mocks.captures = { buttons: [], inputs: [], textareas: [] };
+    mocks.captures = {
+      addSourceMenus: [],
+      buttons: [],
+      iconButtons: [],
+      inputs: [],
+      sourceTypeChoices: [],
+      textareas: [],
+    };
     mocks.userInfoDisplay = { traffic: "1 GB", expire: "2026-01-01" };
     mocks.markSourceAsPendingImport.mockImplementation((source) => ({ ...source, pendingImport: true }));
     mocks.moveSubscriptionSource.mockImplementation((sources) => sources.slice().reverse());
@@ -252,7 +281,7 @@ describe("advanced mode InputSection", () => {
     );
     expect(mocks.captures.inputs.some((props: any) => props.value === "https://example.com/sub")).toBe(true);
     expect(mocks.captures.textareas.some((props: any) => props.value === "ss://node")).toBe(true);
-    expect(mocks.captures.buttons.at(-1)).toEqual(expect.objectContaining({ variant: "outline", size: "sm" }));
+    expect(mocks.captures.addSourceMenus[0]).toEqual(expect.objectContaining({ open: true, compact: true }));
   });
 
   it("updates source content and metadata through captured fields", () => {
@@ -371,10 +400,7 @@ describe("advanced mode InputSection", () => {
     const now = vi.spyOn(Date, "now").mockReturnValue(123456);
     try {
       renderSection({ 0: true });
-      const addYamlButton = mocks.captures.rawButtons.filter((props: any) =>
-        String(props.className).includes("w-full flex items-center")
-      )[1];
-      addYamlButton.onClick();
+      mocks.captures.addSourceMenus[0].onAdd("yaml");
 
       expect(mocks.store.setSources).toHaveBeenCalledWith([
         urlSource,
@@ -391,15 +417,12 @@ describe("advanced mode InputSection", () => {
       mocks.store.setSources.mockClear();
       mocks.interactions.sourceAdded.mockClear();
       renderSection({ 0: true });
-      const addUrlButton = mocks.captures.rawButtons.filter((props: any) =>
-        String(props.className).includes("w-full flex items-center")
-      )[0];
-      addUrlButton.onClick();
+      mocks.captures.addSourceMenus[0].onAdd("url");
       expect(mocks.toast).not.toHaveBeenCalled();
 
       mocks.userStore = { user: { isAdmin: false, quota: { maxImportSourcesPerType: 1 } } };
       renderSection({ 0: true });
-      findRawButton((props) => String(props.className).includes("w-full flex items-center")).onClick();
+      mocks.captures.addSourceMenus[0].onAdd("url");
       expect(mocks.toast).toHaveBeenCalledWith({ title: "每种导入方式最多 1 个", variant: "warning" });
 
       mocks.toast.mockClear();
@@ -409,7 +432,7 @@ describe("advanced mode InputSection", () => {
         { ...urlSource, id: "s2" },
       ];
       renderSection({ 0: true });
-      findRawButton((props) => String(props.className).includes("w-full flex items-center")).onClick();
+      mocks.captures.addSourceMenus[0].onAdd("url");
       expect(mocks.toast).toHaveBeenCalledWith({
         title: "未登录用户每种导入方式最多 2 个（登录后可提升）",
         variant: "warning",
@@ -419,7 +442,7 @@ describe("advanced mode InputSection", () => {
       mocks.userStore = { user: { isAdmin: false, quota: { maxImportSourcesPerType: "bad" } } };
       mocks.store.sources = Array.from({ length: 5 }, (_, index) => ({ ...urlSource, id: `url-${index}` }));
       renderSection({ 0: true });
-      findRawButton((props) => String(props.className).includes("w-full flex items-center")).onClick();
+      mocks.captures.addSourceMenus[0].onAdd("url");
       expect(mocks.toast).toHaveBeenCalledWith({ title: "每种导入方式最多 5 个", variant: "warning" });
     } finally {
       now.mockRestore();
@@ -429,7 +452,7 @@ describe("advanced mode InputSection", () => {
   it("switches source types, moves sources, and removes sources", () => {
     renderSection();
 
-    findRawButton((props) => props.title === "YAML 配置").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("yaml");
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(
       expect.objectContaining({
         content: "",
@@ -445,7 +468,7 @@ describe("advanced mode InputSection", () => {
     expect(mocks.store.setSources).toHaveBeenCalledWith(expect.any(Array));
 
     mocks.store.setSources.mockClear();
-    findRawButton((props) => props.title === "订阅链接").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("url");
     expect(mocks.store.setSources).not.toHaveBeenCalled();
 
     mocks.store.sources = [
@@ -459,7 +482,7 @@ describe("advanced mode InputSection", () => {
       },
     ];
     renderSection();
-    findRawButton((props) => props.title === "订阅链接").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "yaml").onChange("url");
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(
       expect.objectContaining({
         type: "url",
@@ -471,19 +494,19 @@ describe("advanced mode InputSection", () => {
 
     mocks.store.sources = [urlSource, nodesSource];
     renderSection();
-    findRawButton((props) => props["aria-label"] === "下移" && !props.disabled).onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "下移" && !props.disabled).onClick();
     expect(mocks.moveSubscriptionSource).toHaveBeenCalledWith(mocks.store.sources, "s1", "down");
     expect(mocks.store.setSources).toHaveBeenCalledWith([nodesSource, urlSource]);
 
     mocks.store.setSources.mockClear();
-    findRawButton((props) => props["aria-label"] === "上移" && !props.disabled).onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "上移" && !props.disabled).onClick();
     expect(mocks.moveSubscriptionSource).toHaveBeenCalledWith(mocks.store.sources, "s2", "up");
 
-    findRawButton((props) => props.title === "高级编辑").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "高级编辑").onClick();
     expect(stateMock.setters[1]).toHaveBeenCalledWith(expect.any(String));
 
     mocks.store.setSources.mockClear();
-    findRawButton((props) => props.title === "删除").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "删除导入源").onClick();
     expect(mocks.store.setSources).toHaveBeenCalledWith([nodesSource]);
   });
 
@@ -491,7 +514,7 @@ describe("advanced mode InputSection", () => {
     mocks.userStore = { user: { isAdmin: false, quota: { maxImportSourcesPerType: 1 } } };
     renderSection();
 
-    findRawButton((props) => props.title === "节点链接").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("nodes");
 
     expect(mocks.toast).toHaveBeenCalledWith({ title: "每种导入方式最多 1 个", variant: "warning" });
     expect(mocks.store.setSources).not.toHaveBeenCalled();
@@ -499,7 +522,7 @@ describe("advanced mode InputSection", () => {
 
   it("imports sources and reports success, runtime, and validation outcomes", async () => {
     renderSection();
-    findRawButton((props) => props.title === "重新导入").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "重新导入").onClick();
     await Promise.resolve();
     await Promise.resolve();
     expect(mocks.store.parseSingleSource).toHaveBeenCalledWith("s1");
@@ -516,7 +539,7 @@ describe("advanced mode InputSection", () => {
     mocks.store.parseSingleSource.mockClear();
     mocks.store.sources = [{ ...urlSource, parsed: false, error: "failed", nodeCount: 0 }];
     renderSection();
-    findRawButton((props) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     await Promise.resolve();
     expect(mocks.interactions.sourceImported).toHaveBeenCalledWith(expect.objectContaining({ result: "runtimeError" }));
@@ -524,7 +547,7 @@ describe("advanced mode InputSection", () => {
     mocks.interactions.sourceImported.mockClear();
     mocks.store.sources = [{ ...urlSource, parsed: false, error: undefined, errorInfo: undefined, nodeCount: undefined }];
     renderSection();
-    findRawButton((props) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     await Promise.resolve();
     expect(mocks.interactions.sourceImported).toHaveBeenCalledWith(expect.objectContaining({ result: "validationError" }));
@@ -535,7 +558,7 @@ describe("advanced mode InputSection", () => {
       mocks.store.sources = [];
     });
     renderSection();
-    findRawButton((props) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     await Promise.resolve();
     expect(mocks.interactions.sourceImported).toHaveBeenCalledWith(expect.objectContaining({ result: "runtimeError" }));
@@ -553,7 +576,7 @@ describe("advanced mode InputSection", () => {
     const { setters } = renderSection();
     expect(mocks.captures.editor).toEqual(expect.objectContaining({ source: null }));
 
-    mocks.captures.buttons.at(-1).onClick();
+    mocks.captures.addSourceMenus[0].onOpenChange(true);
     expect(setters[0]).toHaveBeenCalledWith(true);
 
     mocks.userInfoDisplay = { traffic: "", expire: "" };
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/input-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/input-section.tsx
index e769332..a8b551e 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/input-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/input-section.tsx
@@ -1,15 +1,13 @@
 "use client";
 
-import * as Popover from "@radix-ui/react-popover";
-import { AlertCircle, Check, HelpCircle, Loader2, Maximize2, Plus, Server, X, Menu, ChevronUp, ChevronDown } from "lucide-react";
+import { AlertCircle, Check, Loader2, Maximize2, Server, X, ChevronUp, ChevronDown } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
-import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
 import { Textarea } from "@subboost/ui/components/ui/textarea";
 import { cn } from "@subboost/ui/lib/utils";
-import type { SourceType } from "@subboost/ui/store/config-store";
-import { getSubscriptionUserInfoDisplay } from "@subboost/ui/product/subscription/subscription-userinfo-display";
 import { buildSourceDisplayLabel } from "@subboost/ui/product/converter/source-display-label";
+import { AddSourceMenu, SourceStatusPopover, SourceTypeChoices } from "@subboost/ui/product/converter/source-controls";
 import { useSubscriptionSourcesController } from "@subboost/ui/product/converter/use-subscription-sources-controller";
 import { sourceTypeInfo } from "../constants";
 import { SectionHeader } from "../section-header";
@@ -70,113 +68,59 @@ export function InputSection({
               total: sources.length,
             });
             const sourceNodes = nodesBySourceId.get(source.id) ?? [];
-            const userInfoDisplay = getSubscriptionUserInfoDisplay(source.subscriptionUserInfo, sourceNodes);
-            const hasUserInfoDisplay = Boolean(userInfoDisplay && (userInfoDisplay.traffic || userInfoDisplay.expire));
             return (
               <div key={source.id} className="space-y-1">
                 <div className="flex items-center justify-between">
                   <div className="flex items-center gap-2">
-                    <div className="flex gap-0.5">
-                      {(Object.keys(sourceTypeInfo) as SourceType[]).map((type) => {
-                        const info = sourceTypeInfo[type];
-                        const Icon = info.icon;
-                        return (
-                          <button
-                            key={type}
-                            onClick={() => updateSourceType(source.id, type)}
-                            className={cn(
-                              "p-1 rounded transition-colors",
-                              source.type === type
-                                ? "bg-indigo-500/20 text-indigo-400"
-                                : "text-white/30 hover:text-white/50 hover:bg-white/5"
-                            )}
-                            title={info.label}
-                          >
-                            <Icon className="h-3.5 w-3.5" />
-                          </button>
-                        );
-                      })}
-                    </div>
+                    <SourceTypeChoices
+                      value={source.type}
+                      onChange={(type) => updateSourceType(source.id, type)}
+                      compact
+                    />
                     <span className="text-xs text-white/50">
                       {sourceDisplayLabel}
                     </span>
-                    {source.parsed && source.nodeCount !== undefined && (
-                      <Popover.Root>
-                        <Popover.Trigger asChild>
-                          <button
-                            type="button"
-                            className="inline-flex items-center gap-1 rounded-full border border-green-500/50 bg-green-500/5 px-2 py-0.5 text-xs font-semibold text-green-300 transition-colors hover:bg-green-500/10 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black whitespace-nowrap"
-                            title="查看流量/到期"
-                            aria-label="查看流量/到期"
-                          >
-                            ✓ {source.nodeCount} 节点
-                            <Menu className="h-3 w-3 text-green-300/70" aria-hidden="true" />
-                          </button>
-                        </Popover.Trigger>
-                        <Popover.Portal>
-                          <Popover.Content
-                            side="bottom"
-                            align="start"
-                            sideOffset={8}
-                            className="z-50 w-[260px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-                          >
-                            <div className="space-y-2 text-xs">
-                              <div className="flex items-center gap-2">
-                                <HelpCircle className="h-4 w-4 text-green-300" />
-                                <div className="text-white font-medium">订阅信息</div>
-                              </div>
-                              {hasUserInfoDisplay && userInfoDisplay ? (
-                                <div className="space-y-1 text-white/60">
-                                  {userInfoDisplay.traffic ? <div>已用流量：{userInfoDisplay.traffic}</div> : null}
-                                  {userInfoDisplay.expire ? <div>到期时间：{userInfoDisplay.expire}</div> : null}
-                                </div>
-                              ) : (
-                                <div className="text-white/60 leading-relaxed">暂无已用流量/到期时间信息</div>
-                              )}
-                            </div>
-                            <Popover.Arrow className="fill-white/10" />
-                          </Popover.Content>
-                        </Popover.Portal>
-                      </Popover.Root>
-                    )}
+                    <SourceStatusPopover source={source} nodes={sourceNodes} />
                     {(source.errorInfo || source.error) && (
                       <SubscriptionImportErrorBadge errorInfo={source.errorInfo} errorMessage={source.error} />
                     )}
                   </div>
                   <div className="flex items-center gap-0.5">
                     <div className="flex flex-col">
-                      <button
+                      <IconButton
+                        label="上移"
+                        variant="ghost"
                         onClick={() => moveSource(source.id, "up")}
                         disabled={index <= 0}
                         className="flex h-3.5 w-4 items-center justify-center text-white/30 transition-colors hover:text-indigo-300 disabled:cursor-not-allowed disabled:opacity-30"
-                        title="上移"
-                        aria-label="上移"
                       >
-                        <ChevronUp className="h-2.5 w-2.5" />
-                      </button>
-                      <button
+                        <ChevronUp className="h-2.5 w-2.5" aria-hidden="true" />
+                      </IconButton>
+                      <IconButton
+                        label="下移"
+                        variant="ghost"
                         onClick={() => moveSource(source.id, "down")}
                         disabled={index >= sources.length - 1}
                         className="flex h-3.5 w-4 items-center justify-center text-white/30 transition-colors hover:text-indigo-300 disabled:cursor-not-allowed disabled:opacity-30"
-                        title="下移"
-                        aria-label="下移"
                       >
-                        <ChevronDown className="h-2.5 w-2.5" />
-                      </button>
+                        <ChevronDown className="h-2.5 w-2.5" aria-hidden="true" />
+                      </IconButton>
                     </div>
-                    <button
+                    <IconButton
+                      label="高级编辑"
+                      variant="ghost"
                       onClick={() => setExpandedSourceId(source.id)}
-                      className="p-1 rounded transition-colors text-white/30 hover:text-white/50 hover:bg-white/5"
-                      title="高级编辑"
+                      className="h-6 w-6 rounded p-1 text-white/30 hover:bg-white/5 hover:text-white/50"
                     >
-                      <Maximize2 className="h-3.5 w-3.5" />
-                    </button>
-                    {/* 导入按钮 */}
-                    <button
+                      <Maximize2 className="h-3.5 w-3.5" aria-hidden="true" />
+                    </IconButton>
+                    <IconButton
+                      label={source.parsing ? "导入中" : source.parsed ? "重新导入" : "导入此源"}
+                      variant="ghost"
                       onClick={() => void handleImportSource(source.id)}
                       disabled={!source.content.trim() || source.parsing}
                       className={cn(
-                        "p-1 rounded transition-colors disabled:opacity-100",
+                        "h-6 w-6 rounded p-1 transition-colors disabled:opacity-100",
                         source.parsing
                           ? "text-indigo-400"
                           : source.parsed
@@ -188,20 +132,20 @@ export function InputSection({
                       title={source.parsing ? "导入中..." : source.parsed ? "重新导入" : "导入此源"}
                     >
                       {source.parsing ? (
-                        <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                        <Loader2 className="h-3.5 w-3.5 animate-spin" aria-hidden="true" />
                       ) : (
-                        <Check className="h-3.5 w-3.5" />
+                        <Check className="h-3.5 w-3.5" aria-hidden="true" />
                       )}
-                    </button>
-                    {/* 删除按钮 */}
+                    </IconButton>
                     {sources.length > 1 && (
-                      <button
+                      <IconButton
+                        label="删除导入源"
+                        variant="ghost"
                         onClick={() => removeSource(source.id)}
-                        className="p-1 text-white/50 hover:text-red-400 transition-colors"
-                        title="删除"
+                        className="h-6 w-6 rounded p-1 text-white/50 transition-colors hover:text-red-400"
                       >
-                        <X className="h-3.5 w-3.5" />
-                      </button>
+                        <X className="h-3.5 w-3.5" aria-hidden="true" />
+                      </IconButton>
                     )}
                   </div>
                 </div>
@@ -229,39 +173,7 @@ export function InputSection({
               <span className="break-all">{globalError}</span>
             </div>
           )}
-          {/* Add Source Button with Menu */}
-          <div className="relative">
-            <Button
-              variant="outline"
-              size="sm"
-              className="w-full h-7 text-xs border-dashed border-white/20 text-white/50 hover:text-white/70 hover:border-white/30"
-              onClick={() => setShowAddMenu(!showAddMenu)}
-            >
-              <Plus className="h-3.5 w-3.5 mr-1" />
-              添加订阅/节点源
-            </Button>
-
-            {showAddMenu && (
-              <div className="absolute top-full left-0 right-0 mt-1 bg-[#1a1a1a] border border-white/10 rounded-lg shadow-xl z-10 overflow-hidden">
-                {(Object.keys(sourceTypeInfo) as SourceType[]).map((type) => {
-                  const info = sourceTypeInfo[type];
-                  const Icon = info.icon;
-                  return (
-                    <button
-                      key={type}
-                      onClick={() => addSource(type)}
-                      className="w-full flex items-center gap-3 px-3 py-2 text-left hover:bg-white/5 transition-colors"
-                    >
-                      <Icon className="h-4 w-4 text-indigo-400" />
-                      <div>
-                        <div className="text-xs font-medium text-white">{info.label}</div>
-                      </div>
-                    </button>
-                  );
-                })}
-              </div>
-            )}
-          </div>
+          <AddSourceMenu open={showAddMenu} onOpenChange={setShowAddMenu} onAdd={addSource} compact />
         </div>
       )}
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts
index a3233e0..6bef7a6 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.test.ts
@@ -11,14 +11,20 @@ const mocks = vi.hoisted(() => ({
 }));
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => React.createElement("span", null, props.children),
   Arrow: () => React.createElement("span", null, "arrow"),
   Content: ({ children, sideOffset: _sideOffset, ...props }: any) => React.createElement("div", props, children),
+  Close: (props: any) => React.createElement("button", null, props.children),
   Portal: (props: any) => React.createElement("div", null, props.children),
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("div", null, props.children),
 }));
 vi.mock("lucide-react", () => ({
+  CircleHelp: () => React.createElement("span", null, "circle-help-icon"),
+  FileCode: () => React.createElement("span", null, "file-code-icon"),
   HelpCircle: () => React.createElement("span", null, "help-icon"),
+  Link2: () => React.createElement("span", null, "link-icon"),
+  Server: () => React.createElement("span", null, "server-icon"),
 }));
 vi.mock("@subboost/ui/components/ui/button", () => ({
   Button: (props: any) => {
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.tsx b/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.tsx
index 9903d9d..5abccde 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/input-source-editor-dialog.tsx
@@ -1,186 +1 @@
-"use client";
-
-import * as Popover from "@radix-ui/react-popover";
-import { HelpCircle } from "lucide-react";
-import { Button } from "@subboost/ui/components/ui/button";
-import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@subboost/ui/components/ui/dialog";
-import { Input } from "@subboost/ui/components/ui/input";
-import { Switch } from "@subboost/ui/components/ui/switch";
-import { Textarea } from "@subboost/ui/components/ui/textarea";
-import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
-import type { SubscriptionSource } from "@subboost/ui/store/config-store";
-import { sourceTypeInfo } from "../constants";
-
-type InputSourceEditorDialogProps = {
-  source: SubscriptionSource | null;
-  previewName: string;
-  onClose: () => void;
-  onUpdateContent: (id: string, content: string) => void;
-  onUpdateMeta: (id: string, patch: Partial<SubscriptionSource>) => void;
-};
-
-export function InputSourceEditorDialog({
-  source,
-  previewName,
-  onClose,
-  onUpdateContent,
-  onUpdateMeta,
-}: InputSourceEditorDialogProps) {
-  return (
-    <Dialog
-      open={Boolean(source)}
-      onOpenChange={(open) => {
-        if (!open) onClose();
-      }}
-    >
-      <DialogContent className="w-[calc(100vw-2rem)] sm:max-w-4xl">
-        <DialogHeader>
-          <DialogTitle>
-            {source ? `高级编辑：${sourceTypeInfo[source.type].label}` : "高级编辑"}
-          </DialogTitle>
-        </DialogHeader>
-
-        {source && (
-          <div className="space-y-3">
-            <div className="grid gap-3 sm:grid-cols-3">
-              <div className="space-y-1">
-                <div className="text-xs text-white/60">标签（tag）</div>
-                <Input
-                  value={source.tag ?? ""}
-                  onChange={(e) => onUpdateMeta(source.id, { tag: e.target.value })}
-                  placeholder="例如：A / 订阅1 / 自建1"
-                  className="text-xs"
-                />
-              </div>
-              <div className="space-y-1">
-                <div className="text-xs text-white/60">节点命名模板</div>
-                  <Input
-                    value={source.nameTemplate ?? DEFAULT_NODE_NAME_TEMPLATE}
-                    onChange={(e) => onUpdateMeta(source.id, { nameTemplate: e.target.value })}
-                    className="text-xs font-mono"
-                  />
-              </div>
-              <div className="space-y-1">
-                <div className="text-xs text-white/60">预览</div>
-                <Input value={previewName} readOnly className="text-xs font-mono" />
-              </div>
-            </div>
-
-            <div className="text-[11px] text-white/40">
-              可用占位符：{"{tag}"}、{"{name}"}；留空则默认：{DEFAULT_NODE_NAME_TEMPLATE}
-            </div>
-
-            <div className="space-y-1">
-              <div className="text-xs text-white/60">{sourceTypeInfo[source.type].label}</div>
-              {source.type === "url" ? (
-                <div className="space-y-3">
-                  <div className="flex items-center gap-3">
-                    <Input
-                      value={source.content}
-                      onChange={(e) => onUpdateContent(source.id, e.target.value)}
-                      placeholder={sourceTypeInfo[source.type].placeholder}
-                      className="text-xs min-w-0 flex-1"
-                    />
-
-                    <div className="flex h-10 flex-none items-center gap-2 rounded-xl border border-white/10 bg-white/5 px-3">
-                      <div className="text-xs text-white/70 whitespace-nowrap">proxy-providers模式</div>
-                      <Popover.Root>
-                        <Popover.Trigger asChild>
-                          <button
-                            type="button"
-                            className="inline-flex h-6 w-6 flex-none items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-                            aria-label="proxy-providers 模式说明"
-                            title="proxy-providers 模式说明"
-                          >
-                            <HelpCircle className="h-3.5 w-3.5" />
-                          </button>
-                        </Popover.Trigger>
-                        <Popover.Portal>
-                          <Popover.Content
-                            side="bottom"
-                            align="end"
-                            sideOffset={8}
-                            className="z-50 w-[360px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-                          >
-                            <div className="space-y-2 text-xs">
-                              <div className="flex items-center gap-2">
-                                <HelpCircle className="h-4 w-4 text-amber-300" />
-                                <div className="text-white font-medium">proxy-providers 模式</div>
-                              </div>
-                              <div className="text-white/60 leading-relaxed">
-                                部分订阅限制 CN IP 导入，url 无法在 SubBoost 内拉取解析。开启后 SubBoost
-                                不再拉取/解析该 url，而是在最终配置中写入{" "}
-                                <span className="font-mono">proxy-providers</span>，交由客户端自行拉取节点。
-                              </div>
-                              <div className="pt-2 border-t border-white/10 text-white/60 space-y-1">
-                                <div className="font-medium text-white/80">注意开启后：</div>
-                                <ul className="ml-4 list-disc space-y-1">
-                                  <li>无法在预览中查看/管理该 url 的节点</li>
-                                  <li>无法将这些节点用于中转代理组、分流组高级模式等高级功能</li>
-                                  <li>节点命名模板与 tag 在该模式下不生效</li>
-                                </ul>
-                              </div>
-                              <div className="pt-2 border-t border-white/10 text-[10px] text-white/40">
-                                若导入 url 报“未解析到有效节点/获取失败”等，可尝试开启此模式。
-                              </div>
-                            </div>
-                            <Popover.Arrow className="fill-white/10" />
-                          </Popover.Content>
-                        </Popover.Portal>
-                      </Popover.Root>
-                      <Switch
-                        checked={Boolean(source.useProxyProviders)}
-                        onCheckedChange={(checked) =>
-                          onUpdateMeta(source.id, { useProxyProviders: Boolean(checked) })
-                        }
-                      />
-                    </div>
-                  </div>
-
-                  <div className="grid gap-3 sm:grid-cols-2">
-                    <div className="space-y-1">
-                      <div className="text-xs text-white/60">流量/到期信息 URL（可选）</div>
-                      <Input
-                        value={source.userinfoUrl ?? ""}
-                        onChange={(e) => onUpdateMeta(source.id, { userinfoUrl: e.target.value })}
-                        placeholder="留空则默认使用当前订阅源 URL"
-                        className="text-xs"
-                      />
-                    </div>
-                    <div className="space-y-1">
-                      <div className="text-xs text-white/60">流量信息 User-Agent（可选）</div>
-                      <Input
-                        value={source.userinfoUserAgent ?? ""}
-                        onChange={(e) => onUpdateMeta(source.id, { userinfoUserAgent: e.target.value })}
-                        placeholder="例如 clash.meta/v1.19.16"
-                        className="text-xs"
-                      />
-                    </div>
-                  </div>
-
-                  <div className="text-[11px] text-white/40">
-                    有些订阅源不会直接返回 <span className="font-mono">subscription-userinfo</span>，但会提供独立的流量接口。
-                    设置后，SubBoost 会在导入/刷新时额外抓取该接口，用来更新这个源自己的流量与到期快照。
-                  </div>
-                </div>
-              ) : (
-                <Textarea
-                  value={source.content}
-                  onChange={(e) => onUpdateContent(source.id, e.target.value)}
-                  placeholder={sourceTypeInfo[source.type].placeholder}
-                  className="min-h-[60vh] text-xs font-mono"
-                />
-              )}
-            </div>
-          </div>
-        )}
-
-        <div className="flex justify-end gap-2">
-          <Button variant="outline" onClick={onClose}>
-            完成
-          </Button>
-        </div>
-      </DialogContent>
-    </Dialog>
-  );
-}
+export { SourceEditorDialog as InputSourceEditorDialog } from "@subboost/ui/product/converter/source-editor-dialog";
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx
index e97cd07..1d4fd9d 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx
@@ -6,7 +6,7 @@ import { Badge } from "@subboost/ui/components/ui/badge";
 import { Button } from "@subboost/ui/components/ui/button";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
 import { Input } from "@subboost/ui/components/ui/input";
-import { Switch } from "@subboost/ui/components/ui/switch";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { toast } from "@subboost/ui/components/ui/toaster";
 import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
 import { useConfigStore, type SubscriptionSource } from "@subboost/ui/store/config-store";
@@ -96,7 +96,6 @@ export function NodeManagementSection({
   const [nameRulesOpen, setNameRulesOpen] = React.useState(false);
   const [nodeSearchKeyword, setNodeSearchKeyword] = React.useState("");
   const [listenerPortEnabled, setListenerPortEnabled] = React.useState(false);
-  const listenerPortSwitchId = React.useId();
   const interactions = useProductInteractionAdapter();
 
   const [listenerPortDrafts, setListenerPortDrafts] = React.useState<Record<string, string>>({});
@@ -440,20 +439,14 @@ export function NodeManagementSection({
                 className="pl-7 text-xs h-7 bg-white/5 border-white/10"
               />
             </div>
-            <div
-              className="flex h-7 shrink-0 items-center gap-2 rounded-md border border-white/10 bg-white/5 px-2"
-              title="为节点配置 socks5/http 协议的本地监听端口"
-            >
-              <Switch
-                id={listenerPortSwitchId}
+            <div className="shrink-0" title="为节点配置 socks5/http 协议的本地监听端口">
+              <SwitchField
+                label="监听端口"
                 checked={isListenerPortVisible}
                 onCheckedChange={handleListenerPortChange}
                 disabled={nodes.length === 0 && !hasConfiguredListenerPorts}
-                aria-label="监听端口"
+                density="compact"
               />
-              <label htmlFor={listenerPortSwitchId} className="cursor-pointer select-none text-xs text-white/70">
-                监听端口
-              </label>
             </div>
             <Button
               variant="secondary"
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management/bulk-edit-dialog.tsx b/packages/ui/src/product/converter/advanced-mode/sections/node-management/bulk-edit-dialog.tsx
index 26a86e9..7808d12 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management/bulk-edit-dialog.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management/bulk-edit-dialog.tsx
@@ -4,7 +4,7 @@ import * as React from "react";
 import { Button } from "@subboost/ui/components/ui/button";
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@subboost/ui/components/ui/dialog";
 import { Input } from "@subboost/ui/components/ui/input";
-import { Switch } from "@subboost/ui/components/ui/switch";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { toast } from "@subboost/ui/components/ui/toaster";
 import { formatNodeNameFromTemplate } from "@subboost/core/node-name-template";
 import { useProductInteractionAdapter } from "@subboost/ui/product/interactions";
@@ -228,15 +228,19 @@ export function NodeManagementBulkEditDialog({
                 <div className="text-[10px] text-white/40">支持 $1、$2… 分组引用；留空表示删除匹配内容</div>
               </div>
 
-              <div className="flex flex-wrap items-center gap-3">
-                <div className="flex items-center gap-2">
-                  <Switch checked={nameRulesTrim} onCheckedChange={setNameRulesTrim} />
-                  <span className="text-xs text-white/70">去除首尾空格</span>
-                </div>
-                <div className="flex items-center gap-2">
-                  <Switch checked={nameRulesCollapseSpaces} onCheckedChange={setNameRulesCollapseSpaces} />
-                  <span className="text-xs text-white/70">空白归一化</span>
-                </div>
+              <div className="grid gap-2 sm:grid-cols-2">
+                <SwitchField
+                  label="去除首尾空格"
+                  checked={nameRulesTrim}
+                  onCheckedChange={setNameRulesTrim}
+                  density="compact"
+                />
+                <SwitchField
+                  label="空白归一化"
+                  checked={nameRulesCollapseSpaces}
+                  onCheckedChange={setNameRulesCollapseSpaces}
+                  density="compact"
+                />
               </div>
             </div>
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.test.ts
index d55b88e..4e02d9d 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.test.ts
@@ -170,13 +170,13 @@ describe("NodeManagementNodeList", () => {
   it("handles list actions for rename, listener ports, ordering, delete, and restore", () => {
     const props = makeProps();
     const tree = renderTree(props);
-    const buttons = collectElements(tree, (element) => element.type === "button");
+    const buttons = collectElements(tree, (element) => typeof element.props.label === "string");
     const inputs = collectInputs(tree);
 
-    buttons.find((button) => button.props.title === "恢复原名: Original Alpha")?.props.onClick();
+    buttons.find((button) => button.props.label === "恢复原名: Original Alpha")?.props.onClick();
     expect(props.restoreNodeName).toHaveBeenCalledWith(alpha.name);
 
-    const renameButtons = buttons.filter((button) => button.props.title === "重命名");
+    const renameButtons = buttons.filter((button) => button.props.label === "重命名节点");
     renameButtons[0].props.onClick();
     expect(props.setEditingNodeName).toHaveBeenCalledWith(alpha.name);
     expect(props.setEditNodeValue).toHaveBeenCalledWith("Alpha");
@@ -201,22 +201,22 @@ describe("NodeManagementNodeList", () => {
     expect(props.setNodeOrder).toHaveBeenCalledWith(alpha.name, 2);
     expect(props.setOrderDrafts).toHaveBeenCalled();
 
-    buttons.find((button) => button.props.title === "上移")?.props.onClick();
-    buttons.find((button) => button.props.title === "下移")?.props.onClick();
+    buttons.find((button) => button.props.label === "上移节点")?.props.onClick();
+    buttons.find((button) => button.props.label === "下移节点")?.props.onClick();
     expect(props.moveNode).toHaveBeenCalledWith(alpha.name, "up");
     expect(props.moveNode).toHaveBeenCalledWith(alpha.name, "down");
 
-    buttons.find((button) => button.props.title === "删除")?.props.onClick();
+    buttons.find((button) => button.props.label === "删除节点")?.props.onClick();
     expect(props.removeNode).toHaveBeenCalledWith(alpha.name);
 
-    buttons.find((button) => button.props.title === "恢复")?.props.onClick();
+    buttons.find((button) => button.props.label === "恢复节点 Deleted")?.props.onClick();
     expect(props.restoreDeletedNode).toHaveBeenCalledWith("Deleted");
   });
 
   it("commits and cancels rename while editing a node", () => {
     const props = makeProps({ editingNodeName: alpha.name, editNodeValue: " Gamma " });
     const tree = renderTree(props);
-    const buttons = collectElements(tree, (element) => element.type === "button");
+    const buttons = collectElements(tree, (element) => typeof element.props.label === "string");
     const input = collectInputs(tree).find((element) => element.props.autoFocus);
     expect(input).toBeDefined();
 
@@ -230,10 +230,10 @@ describe("NodeManagementNodeList", () => {
     input!.props.onKeyDown({ key: "Escape" });
     expect(props.setEditingNodeName).toHaveBeenCalledWith(null);
 
-    buttons.find((button) => button.props.title === "保存")?.props.onClick();
+    buttons.find((button) => button.props.label === "保存节点名称")?.props.onClick();
     expect(props.renameNode).toHaveBeenCalledWith(alpha.name, "[HK] Gamma");
 
-    buttons.find((button) => button.props.title === "取消")?.props.onClick();
+    buttons.find((button) => button.props.label === "取消重命名")?.props.onClick();
     expect(props.setEditingNodeName).toHaveBeenCalledWith(null);
   });
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.tsx b/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.tsx
index 80883bf..6a6c74a 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management/node-list.tsx
@@ -3,6 +3,7 @@
 import * as React from "react";
 import { Check, ChevronDown, ChevronUp, Pencil, RotateCcw, Trash2, X } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
 import { ProtocolBadge } from "@subboost/ui/components/ui/protocol-badge";
 import { toast } from "@subboost/ui/components/ui/toaster";
@@ -144,23 +145,25 @@ export function NodeManagementNodeList({
                           className="flex-1 h-6 text-xs bg-white/10"
                           autoFocus
                         />
-                        <button
+                        <IconButton
+                          label="保存节点名称"
+                          variant="ghost"
                           onClick={() => {
                             commitRename();
                             setEditingNodeName(null);
                           }}
-                          className="p-1 text-green-400 hover:text-green-300"
-                          title="保存"
+                          className="h-6 w-6 p-1 text-green-400 hover:text-green-300"
                         >
                           <Check className="h-3 w-3" />
-                        </button>
-                        <button
+                        </IconButton>
+                        <IconButton
+                          label="取消重命名"
+                          variant="ghost"
                           onClick={() => setEditingNodeName(null)}
-                          className="p-1 text-white/30 hover:text-white/50"
-                          title="取消"
+                          className="h-6 w-6 p-1 text-white/30 hover:text-white/50"
                         >
                           <X className="h-3 w-3" />
-                        </button>
+                        </IconButton>
                       </>
                     ) : (
                       <>
@@ -178,13 +181,14 @@ export function NodeManagementNodeList({
                             {parts.canEditBase ? parts.baseName : node.name}
                           </span>
                           {isRenamed && (
-                            <button
+                            <IconButton
+                              label={`恢复原名: ${originName}`}
+                              variant="ghost"
                               onClick={() => restoreNodeName(node.name)}
-                              className="p-0.5 text-white/30 hover:text-amber-400 transition-colors"
-                              title={`恢复原名: ${originName}`}
+                              className="h-5 w-5 p-0.5 text-white/30 transition-colors hover:text-amber-400"
                             >
                               <RotateCcw className="h-2.5 w-2.5" />
-                            </button>
+                            </IconButton>
                           )}
                         </span>
                         {isListenerPortVisible && (
@@ -271,25 +275,29 @@ export function NodeManagementNodeList({
                             className="h-6 w-10 text-[10px] bg-white/10 border-white/10 text-center px-1"
                           />
                           <div className="flex flex-col">
-                            <button
+                            <IconButton
+                              label="上移节点"
+                              variant="ghost"
                               onClick={() => moveNode(node.name, "up")}
                               disabled={(nodeIndexByName.get(node.name) ?? 0) <= 0}
                               className="h-3 w-4 flex items-center justify-center text-white/30 hover:text-indigo-300 disabled:opacity-30 disabled:cursor-not-allowed transition-colors"
-                              title="上移"
                             >
                               <ChevronUp className="h-2.5 w-2.5" />
-                            </button>
-                            <button
+                            </IconButton>
+                            <IconButton
+                              label="下移节点"
+                              variant="ghost"
                               onClick={() => moveNode(node.name, "down")}
                               disabled={(nodeIndexByName.get(node.name) ?? 0) >= nodes.length - 1}
                               className="h-3 w-4 flex items-center justify-center text-white/30 hover:text-indigo-300 disabled:opacity-30 disabled:cursor-not-allowed transition-colors"
-                              title="下移"
                             >
                               <ChevronDown className="h-2.5 w-2.5" />
-                            </button>
+                            </IconButton>
                           </div>
                         </div>
-                        <button
+                        <IconButton
+                          label="重命名节点"
+                          variant="ghost"
                           onClick={() => {
                             if (parts.tag && !parts.canEditBase) {
                               toast({
@@ -303,18 +311,18 @@ export function NodeManagementNodeList({
                             setEditingNodeName(node.name);
                             setEditNodeValue(parts.baseName);
                           }}
-                          className="p-1 text-white/50 hover:text-indigo-400 transition-colors"
-                          title="重命名"
+                          className="h-6 w-6 p-1 text-white/50 hover:text-indigo-400 transition-colors"
                         >
                           <Pencil className="h-3 w-3" />
-                        </button>
-                        <button
+                        </IconButton>
+                        <IconButton
+                          label="删除节点"
+                          variant="ghost"
                           onClick={() => removeNode(node.name)}
-                          className="p-1 text-white/50 hover:text-red-400 transition-colors"
-                          title="删除"
+                          className="h-6 w-6 p-1 text-white/50 hover:text-red-400 transition-colors"
                         >
                           <Trash2 className="h-3 w-3" />
-                        </button>
+                        </IconButton>
                       </>
                     )}
                   </div>
@@ -354,13 +362,14 @@ export function NodeManagementNodeList({
                         >
                           已删除
                         </Badge>
-                        <button
+                        <IconButton
+                          label={`恢复节点 ${originName}`}
+                          variant="ghost"
                           onClick={() => restoreDeletedNode(originName)}
-                          className="p-1 text-white/30 hover:text-white/60"
-                          title="恢复"
+                          className="h-6 w-6 p-1 text-white/30 hover:text-white/60"
                         >
                           <RotateCcw className="h-3 w-3" />
-                        </button>
+                        </IconButton>
                       </div>
                     ))}
                   </div>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel-interactions.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel-interactions.test.ts
index 98a8a0c..e803c43 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel-interactions.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel-interactions.test.ts
@@ -45,6 +45,15 @@ vi.mock("@subboost/ui/components/ui/button", () => ({
   Button: (props: any) => React.createElement("button", props, props.children),
 }));
 
+vi.mock("@subboost/ui/components/ui/form-field", () => ({
+  FormField: (props: any) => React.createElement("div", null, props.children),
+}));
+
+vi.mock("@subboost/ui/components/ui/choice-group", () => ({
+  ChoiceGroup: (props: any) => React.createElement("div", null, props.children),
+  ChoiceChip: ({ label, selected, ...props }: any) => React.createElement("button", { ...props, "aria-pressed": selected }, label),
+}));
+
 vi.mock("@subboost/ui/components/ui/input", () => ({
   Input: (props: any) => React.createElement("input", props),
 }));
@@ -163,7 +172,7 @@ describe("ProxyGroupAdvancedPanel interactions", () => {
     const sourceCheckboxes = elements.filter((element) => element.type === "input" && element.props.type === "checkbox");
     const textInputs = elements.filter((element) => element.type === "input" && element.props.type !== "checkbox");
     const regionButtons = elements.filter(
-      (element) => element.type === "button" && String(element.props.className || "").includes("rounded border px-2"),
+      (element) => element.type === "button" && typeof element.props["aria-pressed"] === "boolean",
     );
     const includedRows = elements.filter((element) => element.props.draggable);
     const excludeButton = elements.find((element) => element.type === "button" && element.props.title === "排除");
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx
index 4d856f4..318e3a2 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx
@@ -4,7 +4,9 @@ import * as React from "react";
 import { Plus, X } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
 import { Button } from "@subboost/ui/components/ui/button";
+import { ChoiceChip, ChoiceGroup } from "@subboost/ui/components/ui/choice-group";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
+import { FormField } from "@subboost/ui/components/ui/form-field";
 import { Input } from "@subboost/ui/components/ui/input";
 import { toast } from "@subboost/ui/components/ui/toaster";
 import { cn } from "@subboost/ui/lib/utils";
@@ -434,48 +436,49 @@ export function ProxyGroupAdvancedPanel({
 
         <div className="relative p-3 before:absolute before:bottom-3 before:left-0 before:top-3 before:w-px before:bg-white/10">
           <div className={ADVANCED_PANEL_TITLE_CLASS}>地区</div>
-          <div className="flex flex-wrap gap-1.5">
+          <ChoiceGroup label="地区筛选" className="gap-1.5">
             {REGION_PRESETS.map((region) => {
               const active = regions.includes(region.id);
               return (
-                <button
+                <ChoiceChip
                   key={region.id}
-                  type="button"
+                  label={`${region.emoji} ${region.label}`}
+                  selected={active}
                   onClick={() => onChange({ regions: toggleValue(regions, region.id as NodeRegion) })}
                   className={cn(
-                    "rounded border px-2 py-1 text-[10px] transition-colors",
-                    active
-                      ? "border-indigo-400/40 bg-indigo-500/20 text-indigo-100"
-                      : "border-white/10 bg-white/5 text-white/55 hover:bg-white/10",
+                    "min-h-0 rounded px-2 py-1 text-[10px]",
+                    active && "border-indigo-400/40 bg-indigo-500/20 text-indigo-100",
                   )}
-                >
-                  {region.emoji} {region.label}
-                </button>
+                />
               );
             })}
-          </div>
+          </ChoiceGroup>
           <div className="mt-1 text-[10px] text-white/35">不选择表示匹配所有地区</div>
         </div>
 
         <div className="relative space-y-3 p-3 before:absolute before:bottom-3 before:left-0 before:top-3 before:w-px before:bg-white/10">
-          <label className="block">
-            <span className={ADVANCED_PANEL_TITLE_CLASS}>包含正则（可选）</span>
+          <FormField
+            label={<span className="text-[11px] font-medium text-white/50">包含正则（可选）</span>}
+            className="space-y-1"
+          >
             <Input
               value={advanced.includeRegex ?? ""}
               onChange={(event) => onChange({ includeRegex: event.target.value })}
               placeholder="例如: IEPL|专线|家宽"
               className="h-8 border-white/10 bg-white/5 text-xs"
             />
-          </label>
-          <label className="block">
-            <span className={ADVANCED_PANEL_TITLE_CLASS}>排除正则（可选）</span>
+          </FormField>
+          <FormField
+            label={<span className="text-[11px] font-medium text-white/50">排除正则（可选）</span>}
+            className="space-y-1"
+          >
             <Input
               value={advanced.excludeRegex ?? ""}
               onChange={(event) => onChange({ excludeRegex: event.target.value })}
               placeholder="例如: 测试|过期"
               className="h-8 border-white/10 bg-white/5 text-xs"
             />
-          </label>
+          </FormField>
         </div>
       </div>
 
@@ -498,10 +501,11 @@ export function ProxyGroupAdvancedPanel({
             暂无已启用成员
           </div>
         ) : (
-          <div className="max-h-52 space-y-1 overflow-y-auto pr-1 custom-scrollbar">
+          <div role="list" className="max-h-52 space-y-1 overflow-y-auto pr-1 custom-scrollbar">
             {includedMembers.map((member) => (
               <div
                 key={member.key}
+                role="listitem"
                 draggable
                 onDragStart={() => setDraggingKey(member.key)}
                 onDragOver={(event) => event.preventDefault()}
@@ -555,16 +559,18 @@ export function ProxyGroupAdvancedPanel({
             <div className="max-h-52 overflow-y-auto pr-1 custom-scrollbar flex flex-wrap gap-1.5">
               {excludedMembers.map((member) => {
                 return (
-                  <button
+                  <Button
                     key={member.key}
                     type="button"
-                    className="inline-flex max-w-full items-center gap-1 rounded border border-white/10 bg-white/5 px-2 py-1 text-[10px] text-white/55 transition-colors hover:border-emerald-400/30 hover:bg-emerald-500/10 hover:text-emerald-100"
+                    variant="outline"
+                    size="sm"
+                    className="h-auto max-w-full gap-1 rounded px-2 py-1 text-[10px] text-white/55 hover:border-emerald-400/30 hover:bg-emerald-500/10 hover:text-emerald-100"
                     title={memberLabel(member)}
                     onClick={() => enableMember(member)}
                   >
                     <Plus className="h-3 w-3" />
                     <span className="truncate">{memberLabel(member)}</span>
-                  </button>
+                  </Button>
                 );
               })}
             </div>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.tsx
index 726f9a3..fcde116 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-added-rule-sets.tsx
@@ -3,6 +3,7 @@
 import * as React from "react";
 import { ArrowRight, Check, Pencil, Trash2, X } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import {
   Select,
   SelectContent,
@@ -324,6 +325,7 @@ export function ProxyGroupsAddedRuleSets({
                     </Select>
                     <div className="flex h-7 shrink-0 items-center gap-1 rounded-lg border border-white/10 bg-white/5 px-2">
                       <Switch
+                        aria-label={`设置 ${item.name} no-resolve`}
                         checked={draft.noResolve}
                         onCheckedChange={(noResolve) =>
                           setDraft((prev) =>
@@ -403,22 +405,24 @@ export function ProxyGroupsAddedRuleSets({
                 {item.target.name}
               </span>
               <div className="ml-auto flex shrink-0 items-center gap-0.5">
-                <button
+                <IconButton
+                  label="编辑规则集"
+                  variant="ghost"
                   type="button"
                   onClick={() => startEditing(item)}
                   className="inline-flex h-5 w-5 items-center justify-center rounded-md text-white/35 transition-colors hover:bg-white/10 hover:text-white/80"
-                  title="编辑规则集"
                 >
                   <Pencil className="h-3 w-3" />
-                </button>
-                <button
+                </IconButton>
+                <IconButton
+                  label="删除规则集"
+                  variant="ghost"
                   type="button"
                   onClick={() => removeRuleSet(item)}
                   className="inline-flex h-5 w-5 items-center justify-center rounded-md text-white/30 transition-colors hover:bg-red-500/10 hover:text-red-300"
-                  title="删除规则集"
                 >
                   <Trash2 className="h-3 w-3" />
-                </button>
+                </IconButton>
               </div>
             </div>
           );
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
index ccd59a3..3c922de 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
@@ -265,10 +265,11 @@ describe("ProxyGroupsCategories", () => {
     expect(mocks.captures.inputs).toHaveLength(0);
     const html = renderCategories({ 0: new Set(["core"]) }).html;
     expect(html).toContain("https://rules.example/base/");
-    expect(html).toContain("grid-cols-[minmax(0,1fr)_96px]");
-    expect(html).not.toContain("md:grid-cols-[minmax(0,1fr)_96px]");
+    expect(html).toContain("grid-cols-[minmax(0,1fr)_128px]");
+    expect(html).not.toContain("md:grid-cols-[minmax(0,1fr)_128px]");
     expect(html).toContain("min-w-0 space-y-1");
-    expect(html).toContain("h-9 w-full");
+    expect(html).toContain("高级模式");
+    expect(html).toContain("aria-labelledby=\"switch-field-");
     expect(mocks.store.setRuleProviderBaseUrl).not.toHaveBeenCalled();
 
     expect(mocks.captures.moduleCards).toHaveLength(1);
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
index aafe4be..3ddf94c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
@@ -3,8 +3,9 @@
 import * as React from "react";
 import { ChevronDown, ChevronRight, RotateCcw } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
+import { Button } from "@subboost/ui/components/ui/button";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
-import { Switch } from "@subboost/ui/components/ui/switch";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -298,10 +299,10 @@ export function ProxyGroupsCategories() {
 
   return (
     <>
-      <div className="grid grid-cols-[minmax(0,1fr)_96px] gap-3">
+      <div className="grid grid-cols-[minmax(0,1fr)_128px] gap-3">
         <div className="min-w-0 space-y-1">
           <div className={PROXY_GROUP_SECTION_LABEL_ROW_CLASS}>
-            <label className={PROXY_GROUP_SECTION_LABEL_CLASS}>规则集 URL</label>
+            <p className={PROXY_GROUP_SECTION_LABEL_CLASS}>规则集 URL</p>
           </div>
           <div
             className="min-w-0 rounded-md border border-white/10 bg-white/5 px-3 py-2 font-mono text-xs text-white/65"
@@ -310,33 +311,33 @@ export function ProxyGroupsCategories() {
             <span className="block truncate">{ruleProviderBaseUrl}</span>
           </div>
         </div>
-        <div className="min-w-0 space-y-1">
-          <div className={PROXY_GROUP_SECTION_LABEL_ROW_CLASS}>
-            <label className="text-xs text-amber-300">高级模式</label>
-          </div>
-          <div className="flex h-9 w-full items-center justify-center gap-1 rounded-md border border-white/10 bg-white/5 px-2">
-            <span className="text-[10px] text-white/65">
-              {proxyGroupAdvancedModeEnabled ? "已开启" : "未开启"}
-            </span>
-            <Switch checked={proxyGroupAdvancedModeEnabled} onCheckedChange={setProxyGroupAdvancedModeEnabled} />
-          </div>
+        <div className="min-w-0 self-end">
+          <SwitchField
+            label="高级模式"
+            description={proxyGroupAdvancedModeEnabled ? "已开启" : "未开启"}
+            checked={proxyGroupAdvancedModeEnabled}
+            onCheckedChange={setProxyGroupAdvancedModeEnabled}
+            density="compact"
+          />
         </div>
       </div>
 
       <div className="space-y-1">
         <div className={PROXY_GROUP_SECTION_LABEL_ROW_CLASS}>
-          <label className={PROXY_GROUP_SECTION_LABEL_CLASS}>分流规则组</label>
+          <p className={PROXY_GROUP_SECTION_LABEL_CLASS}>分流规则组</p>
           {hiddenModules.length > 0 && (
             <DropdownMenu>
               <DropdownMenuTrigger asChild>
-                <button
+                <Button
                   type="button"
-                  className="ml-auto inline-flex h-6 items-center gap-1 rounded-md border border-white/10 bg-white/5 px-2 text-[10px] text-white/60 transition-colors hover:bg-white/10 hover:text-white/85"
+                  variant="outline"
+                  size="sm"
+                  className="ml-auto h-6 gap-1 rounded-md px-2 text-[10px] text-white/60 hover:bg-white/10 hover:text-white/85"
                   title="恢复隐藏分组"
                 >
                   <RotateCcw className="h-3 w-3" />
                   已隐藏 {hiddenModules.length}
-                </button>
+                </Button>
               </DropdownMenuTrigger>
               <DropdownMenuContent align="end" className="w-56">
                 <DropdownMenuLabel className="text-xs">恢复隐藏分组</DropdownMenuLabel>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-routing-rules.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-routing-rules.tsx
index 587d4c5..50a45e4 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-routing-rules.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-routing-rules.tsx
@@ -8,7 +8,7 @@ export function ProxyGroupsCustomRoutingRules() {
   return (
     <div className="space-y-1">
       <div className="flex min-h-7 items-center gap-2">
-        <label className="text-xs text-white/50">自定义分流规则</label>
+        <p className="text-xs text-white/50">自定义分流规则</p>
       </div>
       <div className="overflow-hidden rounded-lg border border-white/10 bg-white/[0.03]">
         <div className="p-2">
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx
index a4075e1..32781c3 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-custom-rules.tsx
@@ -3,6 +3,7 @@
 import * as React from "react";
 import { ArrowRight, Check, Pencil, Trash2, X } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
 import {
   Select,
@@ -315,6 +316,7 @@ export function ProxyGroupsCustomRules() {
             </Select>
             <div className="flex h-7 shrink-0 items-center gap-1 rounded-lg border border-white/10 bg-white/5 px-2">
               <Switch
+                aria-label="新规则不解析域名"
                 checked={newRuleNoResolve}
                 onCheckedChange={setNewRuleNoResolve}
               />
@@ -429,6 +431,7 @@ export function ProxyGroupsCustomRules() {
                       </Select>
                       <div className="flex h-7 shrink-0 items-center gap-1 rounded-lg border border-white/10 bg-white/5 px-2">
                         <Switch
+                          aria-label="编辑规则时不解析域名"
                           checked={Boolean(editingRuleDraft.noResolve)}
                           onCheckedChange={(noResolve) =>
                             setEditingRuleDraft((prev) =>
@@ -513,22 +516,24 @@ export function ProxyGroupsCustomRules() {
                   {ruleTargetName}
                 </span>
                 <div className="ml-auto flex shrink-0 items-center gap-0.5">
-                  <button
+                  <IconButton
+                    label="编辑规则"
+                    variant="ghost"
                     type="button"
                     onClick={() => startEditingRule(rule)}
                     className="inline-flex h-5 w-5 items-center justify-center rounded-md text-white/35 transition-colors hover:bg-white/10 hover:text-white/80"
-                    title="编辑规则"
                   >
                     <Pencil className="h-3 w-3" />
-                  </button>
-                  <button
+                  </IconButton>
+                  <IconButton
+                    label="删除规则"
+                    variant="ghost"
                     type="button"
                     onClick={() => removeCustomRule(index)}
                     className="inline-flex h-5 w-5 items-center justify-center rounded-md text-white/30 transition-colors hover:bg-red-500/10 hover:text-red-300"
-                    title="删除规则"
                   >
                     <Trash2 className="h-3 w-3" />
-                  </button>
+                  </IconButton>
                 </div>
               </div>
             );
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts
index 0f4e0ac..248b1dc 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts
@@ -14,8 +14,10 @@ const mocks = vi.hoisted(() => ({
 }));
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => React.createElement("span", null, props.children),
   Arrow: () => null,
   Content: ({ align, children, className, side }: any) => React.createElement("div", { align, className, side }, children),
+  Close: (props: any) => React.createElement("button", null, props.children),
   Portal: (props: any) => React.createElement("div", null, props.children),
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("div", null, props.children),
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
index 030b844..a934511 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
@@ -1,10 +1,16 @@
 "use client";
 
 import * as React from "react";
-import * as Popover from "@radix-ui/react-popover";
 import { Check, ChevronDown, ChevronRight, HelpCircle, Pencil, SlidersHorizontal, Trash2, X } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
+import {
+  Popover,
+  PopoverArrow,
+  PopoverContent,
+  PopoverTrigger,
+} from "@subboost/ui/components/ui/popover";
 import { Switch } from "@subboost/ui/components/ui/switch";
 import {
   getEffectiveModuleRuleItems,
@@ -38,20 +44,18 @@ function ModuleHintPopover({ moduleId }: { moduleId: string }) {
   const label = isGemini ? "Gemini 分流说明" : "谷歌学术分流说明";
 
   return (
-    <Popover.Root>
-      <Popover.Trigger asChild>
-        <button
-          type="button"
+    <Popover>
+      <PopoverTrigger asChild>
+        <IconButton
+          label={label}
+          variant="ghost"
           className="inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-          aria-label={label}
-          title={label}
           onClick={(e) => e.stopPropagation()}
         >
           <HelpCircle className="h-3.5 w-3.5" />
-        </button>
-      </Popover.Trigger>
-      <Popover.Portal>
-        <Popover.Content
+        </IconButton>
+      </PopoverTrigger>
+        <PopoverContent
           side="bottom"
           align="start"
           sideOffset={8}
@@ -86,10 +90,9 @@ function ModuleHintPopover({ moduleId }: { moduleId: string }) {
               </ul>
             </div>
           )}
-          <Popover.Arrow className="fill-white/10" />
-        </Popover.Content>
-      </Popover.Portal>
-    </Popover.Root>
+          <PopoverArrow className="fill-white/10" />
+        </PopoverContent>
+    </Popover>
   );
 }
 
@@ -250,19 +253,23 @@ export function ProxyGroupsModuleCard({
       <div
         className={cn(
           "grid grid-cols-[auto_minmax(0,1fr)_auto] items-center gap-x-2 gap-y-1 px-2 py-2",
-          hasExpandedContent && "cursor-pointer transition-colors hover:bg-white/5"
+          hasExpandedContent && "transition-colors hover:bg-white/[0.03]"
         )}
-        onClick={() => {
-          if (hasExpandedContent) onToggleRulesExpanded();
-        }}
-        title={hasExpandedContent ? (isRulesExpanded ? "收起" : "展开") : undefined}
       >
         {!isEditing && (hasExpandedContent ? (
-          isRulesExpanded ? (
-            <ChevronDown className="h-4 w-4 shrink-0 text-white/50" />
-          ) : (
-            <ChevronRight className="h-4 w-4 shrink-0 text-white/50" />
-          )
+          <IconButton
+            label={isRulesExpanded ? `收起 ${display.full}` : `展开 ${display.full}`}
+            variant="ghost"
+            className="h-6 w-6 rounded-md text-white/50"
+            aria-expanded={isRulesExpanded}
+            onClick={onToggleRulesExpanded}
+          >
+            {isRulesExpanded ? (
+              <ChevronDown className="h-4 w-4" aria-hidden="true" />
+            ) : (
+              <ChevronRight className="h-4 w-4" aria-hidden="true" />
+            )}
+          </IconButton>
         ) : (
           <span className="h-4 w-4 shrink-0" />
         ))}
@@ -270,7 +277,6 @@ export function ProxyGroupsModuleCard({
           {isEditing ? (
             <div
               className="grid w-full min-w-0 grid-cols-[minmax(0,1fr)_auto_auto] items-center gap-1"
-              onClick={(e) => e.stopPropagation()}
             >
               <div
                 className={cn(
@@ -359,8 +365,9 @@ export function ProxyGroupsModuleCard({
         </div>
 
         {!isEditing && (
-          <div className="flex shrink-0 items-center justify-end gap-2" onClick={(e) => e.stopPropagation()}>
+          <div className="flex shrink-0 items-center justify-end gap-2">
             <Switch
+              aria-label={`启用 ${display.full} 分流组`}
               checked={isEnabled}
               onCheckedChange={onToggleEnabled}
               onClick={(e) => e.stopPropagation()}
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts
index 78f81de..979ac3a 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.test.ts
@@ -3,14 +3,17 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it, vi } from "vitest";
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => React.createElement("span", null, props.children),
   Arrow: () => React.createElement("span", null, "arrow"),
   Content: ({ children, sideOffset: _sideOffset, ...props }: any) => React.createElement("div", props, children),
+  Close: (props: any) => React.createElement("button", null, props.children),
   Portal: (props: any) => React.createElement("div", null, props.children),
   Root: (props: any) => React.createElement("div", null, props.children),
   Trigger: (props: any) => React.createElement("div", null, props.children),
 }));
 vi.mock("lucide-react", () => ({
   AlertCircle: () => React.createElement("span", null, "alert-icon"),
+  CircleHelp: () => React.createElement("span", null, "circle-help-icon"),
   HelpCircle: () => React.createElement("span", null, "help-icon"),
 }));
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.tsx
index bbca127..82e63c5 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-help.tsx
@@ -1,28 +1,16 @@
 "use client";
 
-import * as Popover from "@radix-ui/react-popover";
 import { AlertCircle, HelpCircle } from "lucide-react";
+import { HelpPopover } from "@subboost/ui/components/ui/popover";
 
 export function ExperimentalCnRuleHelpButton() {
   return (
-    <Popover.Root>
-      <Popover.Trigger asChild>
-        <button
-          type="button"
-          className="inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-          aria-label="国内服务实验性选项说明"
-          title="国内服务实验性选项说明"
-        >
-          <HelpCircle className="h-3.5 w-3.5" />
-        </button>
-      </Popover.Trigger>
-      <Popover.Portal>
-        <Popover.Content
-          side="bottom"
-          align="end"
-          sideOffset={8}
-          className="z-50 w-[420px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-        >
+    <HelpPopover
+      label="国内服务实验性选项说明"
+      side="bottom"
+      align="end"
+      contentClassName="w-[420px] bg-black/90 p-3"
+    >
           <div className="space-y-2 text-xs">
             <div className="flex items-center gap-2">
               <HelpCircle className="h-4 w-4 text-amber-300" />
@@ -37,33 +25,19 @@ export function ExperimentalCnRuleHelpButton() {
               预期结果：不会发生DNS泄露的同时正确分流绝大多数国内站点；但也可能导致意料之外的分流错误。
             </div>
           </div>
-          <Popover.Arrow className="fill-white/10" />
-        </Popover.Content>
-      </Popover.Portal>
-    </Popover.Root>
+    </HelpPopover>
   );
 }
 
 export function CnIpNoResolveHelpButton() {
   return (
-    <Popover.Root>
-      <Popover.Trigger asChild>
-        <button
-          type="button"
-          className="inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-          aria-label="国内服务 no-resolve 说明"
-          title="国内服务 no-resolve 说明"
-        >
-          <AlertCircle className="h-3.5 w-3.5" />
-        </button>
-      </Popover.Trigger>
-      <Popover.Portal>
-        <Popover.Content
-          side="bottom"
-          align="end"
-          sideOffset={8}
-          className="z-50 w-[360px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-        >
+    <HelpPopover
+      label="国内服务 no-resolve 说明"
+      side="bottom"
+      align="end"
+      contentClassName="w-[360px] bg-black/90 p-3"
+      className="text-amber-300/70"
+    >
           <div className="space-y-2 text-xs">
             <div className="flex items-center gap-2">
               <AlertCircle className="h-4 w-4 text-amber-300" />
@@ -80,9 +54,6 @@ export function CnIpNoResolveHelpButton() {
               该开关仅影响“国内服务”的 GeoIP（cn-ip）规则，不影响其它代理组。
             </div>
           </div>
-          <Popover.Arrow className="fill-white/10" />
-        </Popover.Content>
-      </Popover.Portal>
-    </Popover.Root>
+    </HelpPopover>
   );
 }
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
index b6e8227..dcd6914 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.test.ts
@@ -48,6 +48,8 @@ vi.mock("react", async (importOriginal) => {
 });
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => React.createElement(React.Fragment, null, props.children),
+  Close: (props: any) => React.createElement(React.Fragment, null, props.children),
   Root: (props: any) => React.createElement(React.Fragment, null, props.children),
   Trigger: (props: any) => React.createElement(React.Fragment, null, props.children),
   Portal: (props: any) => React.createElement(React.Fragment, null, props.children),
@@ -55,6 +57,7 @@ vi.mock("@radix-ui/react-popover", () => ({
   Arrow: () => null,
 }));
 vi.mock("lucide-react", () => ({
+  CircleHelp: () => null,
   HelpCircle: () => null,
   Plus: () => null,
   RotateCcw: () => null,
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
index e5b4918..5484e98 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-rules-panel.tsx
@@ -1,11 +1,11 @@
 "use client";
 
 import * as React from "react";
-import * as Popover from "@radix-ui/react-popover";
 import { HelpCircle, Plus, RotateCcw, Trash2 } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
 import { Button } from "@subboost/ui/components/ui/button";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
+import { HelpPopover } from "@subboost/ui/components/ui/popover";
 import { Switch } from "@subboost/ui/components/ui/switch";
 import { PROXY_GROUP_MODULES, type ProxyGroupModule, type ProxyGroupRule } from "@subboost/core/generator/proxy-groups";
 import {
@@ -349,7 +349,11 @@ export function ProxyGroupsModuleRulesPanel({
                       <div className="flex h-7 shrink-0 items-center gap-1">
                         <CnIpNoResolveHelpButton />
                         <span className="proxy-group-rule-no-resolve-label text-[10px] text-white/50">no-resolve</span>
-                        <Switch checked={cnIpNoResolve} onCheckedChange={onChangeCnIpNoResolve} />
+                        <Switch
+                          checked={cnIpNoResolve}
+                          onCheckedChange={onChangeCnIpNoResolve}
+                          aria-label="国内 IP 规则不解析域名"
+                        />
                       </div>
                     )}
                     <ProxyGroupRuleMoveMenu
@@ -492,40 +496,23 @@ export function ProxyGroupsModuleRulesPanel({
         <div className="rounded border border-white/10 bg-white/[0.03] px-2 py-2">
           <div className="mb-2 flex items-center gap-1.5">
             <div className="text-xs font-medium text-white">中国相关子规则集</div>
-            <Popover.Root>
-              <Popover.Trigger asChild>
-                <button
-                  type="button"
-                  className="inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-                  aria-label="实验性：中国业务子规则集"
-                  title="实验性：中国业务子规则集"
-                >
-                  <HelpCircle className="h-3.5 w-3.5" />
-                </button>
-              </Popover.Trigger>
-              <Popover.Portal>
-                <Popover.Content
-                  side="bottom"
-                  align="start"
-                  sideOffset={8}
-                  className="z-50 w-[420px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-                >
-                  <div className="space-y-2 text-xs">
-                    <div className="flex items-center gap-2">
-                      <HelpCircle className="h-4 w-4 text-amber-300" />
-                      <div className="text-white font-medium">
-                        实验性：中国业务子规则集
-                      </div>
-                    </div>
-                    <div className="text-white/60 leading-relaxed">
-                      这些是已启用规则集的中国子集，通常表示对应服务有中国业务；但不代表必然适合分流至
-                      <span className="text-white/75"> 🔒 国内服务</span>，请按自身需求启用。
-                    </div>
-                  </div>
-                  <Popover.Arrow className="fill-white/10" />
-                </Popover.Content>
-              </Popover.Portal>
-            </Popover.Root>
+            <HelpPopover
+              label="实验性：中国业务子规则集"
+              side="bottom"
+              align="start"
+              contentClassName="w-[420px] bg-black/90 p-3"
+            >
+              <div className="space-y-2 text-xs">
+                <div className="flex items-center gap-2">
+                  <HelpCircle className="h-4 w-4 text-amber-300" aria-hidden="true" />
+                  <p className="font-medium text-white">实验性：中国业务子规则集</p>
+                </div>
+                <p className="leading-relaxed text-white/60">
+                  这些是已启用规则集的中国子集，通常表示对应服务有中国业务；但不代表必然适合分流至
+                  <span className="text-white/75"> 🔒 国内服务</span>，请按自身需求启用。
+                </p>
+              </div>
+            </HelpPopover>
           </div>
           <div className="space-y-1">
             {availableCnCandidateRules.map((rule) => (
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts
index e5a6fc9..394cde0 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.test.ts
@@ -417,13 +417,13 @@ describe("ProxyGroupsRulesLibrary", () => {
     expect(stateMock.setters[1]).not.toHaveBeenCalledWith("");
 
     renderLibrary();
-    const firstRuleDiv = mocks.captures.nativeDivs.find((props) => String(props.className).includes("cursor-pointer"));
-    firstRuleDiv.onClick();
+    const firstRuleButton = mocks.captures.nativeButtons.find((props) => String(props.className).includes("w-full"));
+    firstRuleButton.onClick();
     expect(stateMock.setters[0]).toHaveBeenCalledWith([telegramRule]);
 
     renderLibrary({ 0: [telegramRule] });
-    const selectedRuleDiv = mocks.captures.nativeDivs.find((props) => String(props.className).includes("cursor-pointer"));
-    selectedRuleDiv.onClick();
+    const selectedRuleButton = mocks.captures.nativeButtons.find((props) => String(props.className).includes("w-full"));
+    selectedRuleButton.onClick();
     expect(stateMock.setters[0]).toHaveBeenCalledWith([]);
   });
 
@@ -439,7 +439,7 @@ describe("ProxyGroupsRulesLibrary", () => {
     const { html } = renderLibrary({ 0: selectedRules, 1: "custom:custom-1" });
     expect(html).toContain("+1");
 
-    mocks.captures.nativeButtons.find((props) => props.children === "清空").onClick();
+    mocks.captures.buttons.find((props) => props.children === "清空").onClick();
     expect(stateMock.setters[0]).toHaveBeenCalledWith([]);
 
     mocks.captures.badges.find((props) => typeof props.onClick === "function").onClick();
@@ -565,7 +565,7 @@ describe("ProxyGroupsRulesLibrary", () => {
     mocks.search.searchResults = [netflixRule];
     mocks.store.builtinRuleEdits = { "module:auto:netflix": { enabled: false } };
     renderLibrary();
-    expect(mocks.captures.nativeDivs.some((props) => String(props.className).includes("cursor-pointer"))).toBe(true);
+    expect(mocks.captures.nativeButtons.some((props) => String(props.className).includes("w-full"))).toBe(true);
 
     mocks.store.builtinRuleEdits = {};
     mocks.store.customRuleSets = [{ id: "netflix", name: "Netflix", behavior: "domain", path: "geosite/netflix.mrs", target: "Custom" }];
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx
index 7fac3cc..cce1dfb 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-rules-library.tsx
@@ -251,7 +251,8 @@ export function ProxyGroupsRulesLibrary() {
               }
 
               return (
-                <div
+                <button
+                  type="button"
                   key={rule.id}
                   onClick={() => {
                     if (isSelected) {
@@ -263,7 +264,7 @@ export function ProxyGroupsRulesLibrary() {
                     }
                   }}
                   className={cn(
-                    "flex items-center gap-1.5 px-1.5 py-1 rounded cursor-pointer transition-colors",
+                    "flex w-full items-center gap-1.5 rounded px-1.5 py-1 text-left transition-colors",
                     isSelected
                       ? "bg-indigo-500/20 text-indigo-400"
                       : "hover:bg-white/5 text-white/70",
@@ -294,7 +295,7 @@ export function ProxyGroupsRulesLibrary() {
                   >
                     {rule.behavior === "ipcidr" ? "IP" : "域名"}
                   </Badge>
-                </div>
+                </button>
               );
             })}
           </div>
@@ -347,12 +348,15 @@ export function ProxyGroupsRulesLibrary() {
                 </span>{" "}
                 条未分配的规则
               </span>
-              <button
+              <Button
+                type="button"
+                variant="ghost"
+                size="sm"
                 onClick={() => setSelectedRules([])}
-                className="text-[10px] text-white/40 hover:text-white/60"
+                className="h-auto p-0 text-[10px] text-white/40 hover:bg-transparent hover:text-white/60"
               >
                 清空
-              </button>
+              </Button>
             </div>
             <div className="flex flex-wrap gap-0.5">
               {selectedRules.slice(0, 5).map((rule) => (
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts
index ff52bbd..7ad7d62 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.test.ts
@@ -322,8 +322,8 @@ describe("RulesManagementSection", () => {
     stateMock.value = { "custom:one": "1" };
     const tree = renderSection({ ruleOrder: ["module:geo", "custom:one"] });
     const orderInputs = collectElements(tree, (element) => (element.props as any).title === "最终规则行号（1=最前）");
-    const upButtons = collectElements(tree, (element) => element.type === "button" && element.props.title === "上移");
-    const downButtons = collectElements(tree, (element) => element.type === "button" && element.props.title === "下移");
+    const upButtons = collectElements(tree, (element) => element.props.label === "上移规则");
+    const downButtons = collectElements(tree, (element) => element.props.label === "下移规则");
 
     orderInputs[1].props.onChange({ target: { value: "2" } });
     expect(stateMock.value["custom:one"]).toBe("2");
@@ -349,8 +349,8 @@ describe("RulesManagementSection", () => {
   it("does not turn legacy custom-only ordering into full ordering after a custom move", () => {
     const tree = renderSection({ ruleOrder: ["custom:one"] });
     const orderInputs = collectElements(tree, (element) => (element.props as any).title === "最终规则行号（1=最前）");
-    const upButtons = collectElements(tree, (element) => element.type === "button" && element.props.title === "上移");
-    const downButtons = collectElements(tree, (element) => element.type === "button" && element.props.title === "下移");
+    const upButtons = collectElements(tree, (element) => element.props.label === "上移规则");
+    const downButtons = collectElements(tree, (element) => element.props.label === "下移规则");
 
     stateMock.value = { "custom:one": "1" };
     orderInputs[1].props.onKeyDown({ key: "Enter" });
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx
index 3b408f6..8223e81 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/rules-management-section.tsx
@@ -5,6 +5,7 @@ import { ArrowDown, ArrowUp, ListOrdered } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
 import { Input } from "@subboost/ui/components/ui/input";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Switch } from "@subboost/ui/components/ui/switch";
 import {
   buildGeneratedRuleEntries,
@@ -185,6 +186,7 @@ export function RulesManagementSection({
               <div className="ml-auto flex shrink-0 items-center gap-2">
                 <span className="text-[11px] whitespace-nowrap text-white/55">调整所有规则顺序</span>
                 <Switch
+                  aria-label="调整所有规则顺序"
                   checked={allRulesMode}
                   onCheckedChange={handleToggleAllRulesMode}
                   disabled={preMatchEntries.length <= 1}
@@ -289,22 +291,24 @@ export function RulesManagementSection({
                         className="h-8 w-16 shrink-0 rounded-lg border-white/10 bg-white/10 px-1 text-center text-xs disabled:cursor-not-allowed disabled:opacity-50"
                       />
                       <div className="flex flex-col">
-                        <button
+                        <IconButton
+                          label="上移规则"
+                          variant="ghost"
                           onClick={() => moveRule(entry.key, "up")}
                           disabled={!canMoveUp}
                           className="flex h-4 w-5 items-center justify-center text-white/30 transition-colors hover:text-emerald-300 disabled:cursor-not-allowed disabled:opacity-30"
-                          title="上移"
                         >
                           <ArrowUp className="h-3 w-3" />
-                        </button>
-                        <button
+                        </IconButton>
+                        <IconButton
+                          label="下移规则"
+                          variant="ghost"
                           onClick={() => moveRule(entry.key, "down")}
                           disabled={!canMoveDown}
                           className="flex h-4 w-5 items-center justify-center text-white/30 transition-colors hover:text-emerald-300 disabled:cursor-not-allowed disabled:opacity-30"
-                          title="下移"
                         >
                           <ArrowDown className="h-3 w-3" />
-                        </button>
+                        </IconButton>
                       </div>
                     </div>
                   </div>
diff --git a/packages/ui/src/product/converter/quick-mode/constants.ts b/packages/ui/src/product/converter/quick-mode/constants.ts
index a83c81e..e679fdd 100644
--- a/packages/ui/src/product/converter/quick-mode/constants.ts
+++ b/packages/ui/src/product/converter/quick-mode/constants.ts
@@ -1,32 +1,6 @@
-import type { SourceType } from "@subboost/ui/store/config-store";
 import type { TemplateType } from "@subboost/core/types/config";
 import { getTemplateList } from "@subboost/core/templates";
-import { FileCode, Link2, Server } from "lucide-react";
-
-export const sourceTypeInfo: Record<
-  SourceType,
-  { label: string; icon: typeof Link2; placeholder: string; description: string }
-> = {
-  url: {
-    label: "订阅链接",
-    icon: Link2,
-    placeholder: "https://example.com/sub?token=xxx",
-    description: "输入订阅链接，系统将自动获取节点",
-  },
-  yaml: {
-    label: "YAML 配置",
-    icon: FileCode,
-    placeholder: "proxies:\n  - name: 节点名称\n    type: vmess\n    ...",
-    description: "粘贴完整的 Clash YAML 配置文件",
-  },
-  nodes: {
-    label: "节点链接",
-    icon: Server,
-    placeholder:
-      "ss://...\nssr://...\nvmess://...\nvless://...\ntrojan://...\nanytls://...\nhysteria2://... / hy2://...\ntuic://...\n(socks5://... / socks4://...)",
-    description: "每行一个节点链接，支持 ss/ssr/vmess/vless/trojan/anytls/hy2/tuic",
-  },
-};
+export { sourceTypeInfo } from "@subboost/ui/product/converter/source-type-info";
 
 const templateCounts = new Map(
   getTemplateList().map((template) => [template.id, { groups: template.groupCount, rules: template.ruleCount }])
diff --git a/packages/ui/src/product/converter/quick-mode/sources-section.test.ts b/packages/ui/src/product/converter/quick-mode/sources-section.test.ts
index 94668d3..38b5fd1 100644
--- a/packages/ui/src/product/converter/quick-mode/sources-section.test.ts
+++ b/packages/ui/src/product/converter/quick-mode/sources-section.test.ts
@@ -71,6 +71,8 @@ vi.mock("react/jsx-runtime", async (importOriginal) => {
 });
 
 vi.mock("@radix-ui/react-popover", () => ({
+  Anchor: (props: any) => props.children,
+  Close: (props: any) => props.children,
   Root: (props: any) => props.children,
   Trigger: (props: any) => props.children,
   Portal: (props: any) => props.children,
@@ -82,11 +84,15 @@ vi.mock("lucide-react", () => ({
   Check: () => null,
   ChevronDown: () => null,
   ChevronUp: () => null,
+  CircleHelp: () => null,
+  FileCode: () => null,
   HelpCircle: () => null,
   Loader2: () => null,
+  Link2: () => null,
   Maximize2: () => null,
   Menu: () => null,
   Plus: () => null,
+  Server: () => null,
   X: () => null,
 }));
 vi.mock("@subboost/ui/components/ui/button", () => ({
@@ -95,6 +101,12 @@ vi.mock("@subboost/ui/components/ui/button", () => ({
     return null;
   },
 }));
+vi.mock("@subboost/ui/components/ui/icon-button", () => ({
+  IconButton: (props: any) => {
+    mocks.captures.iconButtons.push(props);
+    return null;
+  },
+}));
 vi.mock("@subboost/ui/components/ui/textarea", () => ({
   Textarea: (props: any) => {
     mocks.captures.textareas.push(props);
@@ -157,6 +169,26 @@ vi.mock("@subboost/ui/product/subscription/source-order", () => ({ moveSubscript
 vi.mock("@subboost/ui/product/converter/source-display-label", () => ({
   buildSourceDisplayLabel: ({ typeLabel, order, total, tag }: any) => `${typeLabel} ${order}/${total}${tag ? ` ${tag}` : ""}`,
 }));
+vi.mock("@subboost/ui/product/converter/source-controls", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@subboost/ui/product/converter/source-controls")>();
+  return {
+    ...actual,
+    AddSourceMenu: (props: any) => {
+      mocks.captures.addSourceMenus.push(props);
+      return null;
+    },
+    SourceTypeChoices: (props: any) => {
+      mocks.captures.sourceTypeChoices.push(props);
+      return null;
+    },
+  };
+});
+vi.mock("@subboost/ui/product/converter/source-editor-dialog", () => ({
+  SourceEditorDialog: (props: any) => {
+    mocks.captures.editor = props;
+    return null;
+  },
+}));
 vi.mock("@subboost/ui/product/interactions", () => ({ useProductInteractionAdapter: () => mocks.interactions }));
 vi.mock("./constants", () => ({
   sourceTypeInfo: {
@@ -209,6 +241,9 @@ function renderSection(overrides: Record<number, unknown> = {}) {
   mocks.captures.inputs = [];
   mocks.captures.textareas = [];
   mocks.captures.switches = [];
+  mocks.captures.iconButtons = [];
+  mocks.captures.addSourceMenus = [];
+  mocks.captures.sourceTypeChoices = [];
   mocks.captures.rawButtons = [];
   try {
     const html = renderToStaticMarkup(React.createElement(SourcesSection));
@@ -221,7 +256,16 @@ function renderSection(overrides: Record<number, unknown> = {}) {
 describe("quick mode SourcesSection", () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    mocks.captures = { buttons: [], inputs: [], textareas: [], switches: [], rawButtons: [] };
+    mocks.captures = {
+      addSourceMenus: [],
+      buttons: [],
+      iconButtons: [],
+      inputs: [],
+      rawButtons: [],
+      sourceTypeChoices: [],
+      switches: [],
+      textareas: [],
+    };
     mocks.getSubscriptionUserInfoDisplay.mockReturnValue({ traffic: "1 GB", expire: "2026-01-01" });
     mocks.markSourceAsPendingImport.mockImplementation((source) => ({ ...source, pendingImport: true }));
     mocks.moveSubscriptionSource.mockImplementation((sources) => sources.slice().reverse());
@@ -242,43 +286,34 @@ describe("quick mode SourcesSection", () => {
     renderSection({ 0: true, 1: "s1" });
 
     expect(mocks.captures.errorBadge).toEqual(expect.objectContaining({ errorMessage: "parse failed" }));
-    expect(mocks.captures.dialog).toEqual(expect.objectContaining({ open: true }));
-    expect(mocks.captures.inputs.some((props: any) => props.value === "https://example.com/sub")).toBe(true);
-    expect(mocks.captures.inputs.some((props: any) => props.value === "HK")).toBe(true);
-    expect(mocks.captures.inputs.some((props: any) => props.readOnly)).toBe(true);
-    expect(mocks.captures.textareas.some((props: any) => props.value === "ss://node")).toBe(true);
-    expect(mocks.captures.switches).toEqual([expect.objectContaining({ checked: false })]);
+    expect(mocks.captures.editor).toEqual(expect.objectContaining({ source: urlSource }));
+    expect(mocks.captures.addSourceMenus[0]).toEqual(expect.objectContaining({ open: true }));
+    expect(mocks.captures.sourceTypeChoices).toHaveLength(2);
   });
 
-  it("updates source content and metadata through captured inputs", () => {
+  it("updates source content and metadata through the shared editor contract", () => {
     renderSection({ 1: "s1" });
 
-    const mainUrlInput = mocks.captures.inputs.find((props: any) => props.placeholder === "https://example.com/sub" && props.value === urlSource.content);
-    mainUrlInput.onChange({ target: { value: "https://new.example/sub" } });
+    mocks.captures.editor.onUpdateContent("s1", "https://new.example/sub");
     expect(mocks.store.setSources).toHaveBeenCalledWith(expect.any(Array));
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ content: "https://new.example/sub" }));
 
-    const textArea = mocks.captures.textareas.find((props: any) => props.value === "ss://node");
-    textArea.onChange({ target: { value: "trojan://node" } });
+    mocks.captures.editor.onUpdateContent("s2", "trojan://node");
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ content: "trojan://node" }));
 
-    const tagInput = mocks.captures.inputs.find((props: any) => props.value === "HK");
-    tagInput.onChange({ target: { value: "JP" } });
+    mocks.captures.editor.onUpdateMeta("s1", { tag: "JP" });
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ tag: "JP" }));
 
-    const templateInput = mocks.captures.inputs.find((props: any) => props.value === "[{tag}] {name}");
-    templateInput.onChange({ target: { value: "{tag}-{name}" } });
+    mocks.captures.editor.onUpdateMeta("s1", { nameTemplate: "{tag}-{name}" });
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ nameTemplate: "{tag}-{name}" }));
 
-    mocks.captures.switches[0].onCheckedChange(true);
+    mocks.captures.editor.onUpdateMeta("s1", { useProxyProviders: true });
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ useProxyProviders: true }));
 
-    const userinfoUrlInput = mocks.captures.inputs.find((props: any) => props.value === "https://example.com/userinfo");
-    userinfoUrlInput.onChange({ target: { value: "https://new.example/userinfo" } });
+    mocks.captures.editor.onUpdateMeta("s1", { userinfoUrl: "https://new.example/userinfo" });
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ userinfoUrl: "https://new.example/userinfo" }));
 
-    const userinfoUaInput = mocks.captures.inputs.find((props: any) => props.value === "clash");
-    userinfoUaInput.onChange({ target: { value: "clash.meta/v1.19.16" } });
+    mocks.captures.editor.onUpdateMeta("s1", { userinfoUserAgent: "clash.meta/v1.19.16" });
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ userinfoUserAgent: "clash.meta/v1.19.16" }));
   });
 
@@ -296,7 +331,7 @@ describe("quick mode SourcesSection", () => {
       },
     });
 
-    mocks.captures.dialog.onOpenChange(false);
+    mocks.captures.editor.onClose();
     expect(mocks.store.parseSingleSource).toHaveBeenCalledWith("s1");
     expect(stateMock.setters[1]).toHaveBeenCalledWith(null);
 
@@ -313,7 +348,7 @@ describe("quick mode SourcesSection", () => {
         userinfoUserAgent: "clash",
       },
     });
-    mocks.captures.buttons.at(-1).onClick();
+    mocks.captures.editor.onClose();
     expect(mocks.store.parseSingleSource).not.toHaveBeenCalled();
   });
 
@@ -323,7 +358,7 @@ describe("quick mode SourcesSection", () => {
     mocks.store.parseErrors = [];
     mocks.store.sources = [{ ...urlSource, content: "", parsed: false, nodeCount: undefined }];
     renderSection();
-    expect(mocks.captures.dialog).toEqual(expect.objectContaining({ open: false }));
+    expect(mocks.captures.editor).toEqual(expect.objectContaining({ source: null }));
 
     mocks.store.setSources.mockClear();
     const emptyInput = mocks.captures.inputs.find((props: any) => props.placeholder === "https://example.com/sub");
@@ -334,7 +369,7 @@ describe("quick mode SourcesSection", () => {
   it("imports sources and reports success, runtime, and validation outcomes", async () => {
     renderSection();
 
-    mocks.captures.rawButtons.find((props: any) => props.title === "重新导入").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "重新导入").onClick();
     await Promise.resolve();
     await Promise.resolve();
 
@@ -349,7 +384,7 @@ describe("quick mode SourcesSection", () => {
     });
 
     mocks.interactions.sourceImported.mockClear();
-    mocks.captures.rawButtons.find((props: any) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     await Promise.resolve();
 
@@ -361,7 +396,7 @@ describe("quick mode SourcesSection", () => {
     mocks.interactions.sourceImported.mockClear();
     mocks.store.sources = [{ ...textSource, error: undefined, errorInfo: undefined, parsed: false }];
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     await Promise.resolve();
 
@@ -374,10 +409,7 @@ describe("quick mode SourcesSection", () => {
     vi.spyOn(Date, "now").mockReturnValue(1700000000000);
 
     renderSection({ 0: true });
-    const addMenuButtons = mocks.captures.rawButtons.filter((props: any) =>
-      String(props.className).includes("w-full flex items-center gap-3")
-    );
-    addMenuButtons[0].onClick();
+    mocks.captures.addSourceMenus[0].onAdd("url");
 
     expect(mocks.store.setSources).toHaveBeenCalledWith([
       urlSource,
@@ -391,16 +423,16 @@ describe("quick mode SourcesSection", () => {
     });
 
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "下移" && !props.disabled).onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "下移" && !props.disabled).onClick();
     expect(mocks.moveSubscriptionSource).toHaveBeenCalledWith(mocks.store.sources, "s1", "down");
     expect(mocks.store.setSources).toHaveBeenCalledWith([...mocks.store.sources].reverse());
 
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "删除").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "删除导入源").onClick();
     expect(mocks.store.setSources).toHaveBeenCalledWith([textSource]);
 
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "Text").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("text");
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(
       expect.objectContaining({
         id: "s1",
@@ -417,17 +449,14 @@ describe("quick mode SourcesSection", () => {
     mocks.userStore = { user: { isAdmin: false, quota: { maxImportSourcesPerType: 1 } } };
 
     renderSection({ 0: true });
-    const addMenuButtons = mocks.captures.rawButtons.filter((props: any) =>
-      String(props.className).includes("w-full flex items-center gap-3")
-    );
-    addMenuButtons[0].onClick();
+    mocks.captures.addSourceMenus[0].onAdd("url");
     expect(mocks.toast).toHaveBeenCalledWith({
       title: "每种导入方式最多 1 个",
       variant: "warning",
     });
 
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "Text").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("text");
     expect(mocks.toast).toHaveBeenCalledWith({
       title: "每种导入方式最多 1 个",
       variant: "warning",
@@ -440,10 +469,7 @@ describe("quick mode SourcesSection", () => {
       textSource,
     ];
     renderSection({ 0: true });
-    const anonymousAddMenuButtons = mocks.captures.rawButtons.filter((props: any) =>
-      String(props.className).includes("w-full flex items-center gap-3")
-    );
-    anonymousAddMenuButtons[0].onClick();
+    mocks.captures.addSourceMenus[0].onAdd("url");
     expect(mocks.toast).toHaveBeenCalledWith({
       title: "未登录用户每种导入方式最多 2 个（登录后可提升）",
       variant: "warning",
@@ -453,12 +479,8 @@ describe("quick mode SourcesSection", () => {
   it("renders and edits non-url expanded sources", () => {
     renderSection({ 1: "s2" });
 
-    const expandedTextarea = mocks.captures.textareas.find((props: any) =>
-      String(props.className).includes("min-h-[60vh]")
-    );
-    expect(expandedTextarea).toMatchObject({ value: "ss://node" });
-
-    expandedTextarea.onChange({ target: { value: "vmess://node" } });
+    expect(mocks.captures.editor.source).toEqual(textSource);
+    mocks.captures.editor.onUpdateContent("s2", "vmess://node");
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(expect.objectContaining({ content: "vmess://node" }));
   });
 
@@ -472,10 +494,7 @@ describe("quick mode SourcesSection", () => {
     ];
 
     renderSection({ 0: true });
-    const addMenuButtons = mocks.captures.rawButtons.filter((props: any) =>
-      String(props.className).includes("w-full flex items-center gap-3")
-    );
-    addMenuButtons[0].onClick();
+    mocks.captures.addSourceMenus[0].onAdd("url");
 
     expect(mocks.toast).not.toHaveBeenCalled();
     expect(mocks.store.setSources).toHaveBeenCalledWith([
@@ -486,7 +505,7 @@ describe("quick mode SourcesSection", () => {
     mocks.store.setSources.mockClear();
     mocks.store.sources = [textSource];
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "URL").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "text").onChange("url");
 
     expect(mocks.markSourceAsPendingImport).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -503,30 +522,29 @@ describe("quick mode SourcesSection", () => {
   it("keeps no-op source actions from writing back", async () => {
     mocks.store.setSources.mockClear();
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "URL").onClick();
+    mocks.captures.sourceTypeChoices.find((props: any) => props.value === "url").onChange("url");
     expect(mocks.store.setSources).not.toHaveBeenCalled();
 
     mocks.moveSubscriptionSource.mockReturnValueOnce(mocks.store.sources);
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "下移" && !props.disabled).onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "下移" && !props.disabled).onClick();
     expect(mocks.store.setSources).not.toHaveBeenCalled();
 
     renderSection({ 1: "s1" });
     mocks.markSourceAsPendingImport.mockClear();
-    const tagInput = mocks.captures.inputs.find((props: any) => props.value === "HK");
-    tagInput.onChange({ target: { value: "HK" } });
+    mocks.captures.editor.onUpdateMeta("s1", { tag: "HK" });
     expect(mocks.markSourceAsPendingImport).not.toHaveBeenCalled();
 
     mocks.store.parseSingleSource.mockClear();
     mocks.store.sources = [{ ...urlSource, content: "", parsed: false, nodeCount: undefined }];
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "导入此源").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入此源").onClick();
     await Promise.resolve();
     expect(mocks.store.parseSingleSource).not.toHaveBeenCalled();
 
     mocks.store.sources = [{ ...urlSource, parsing: true }];
     renderSection();
-    mocks.captures.rawButtons.find((props: any) => props.title === "导入中...").onClick();
+    mocks.captures.iconButtons.find((props: any) => props.label === "导入中").onClick();
     await Promise.resolve();
     expect(mocks.store.parseSingleSource).not.toHaveBeenCalled();
   });
@@ -560,7 +578,7 @@ describe("quick mode SourcesSection", () => {
       },
     });
 
-    mocks.captures.dialog.onOpenChange(false);
+    mocks.captures.editor.onClose();
     expect(mocks.store.parseSingleSource).not.toHaveBeenCalled();
     expect(stateMock.setters[1]).toHaveBeenCalledWith(null);
   });
diff --git a/packages/ui/src/product/converter/quick-mode/sources-section.tsx b/packages/ui/src/product/converter/quick-mode/sources-section.tsx
index 260c219..ed953f0 100644
--- a/packages/ui/src/product/converter/quick-mode/sources-section.tsx
+++ b/packages/ui/src/product/converter/quick-mode/sources-section.tsx
@@ -1,17 +1,14 @@
-import * as Popover from "@radix-ui/react-popover";
-import { Plus, X, AlertCircle, Check, Loader2, Maximize2, HelpCircle, Menu, ChevronUp, ChevronDown } from "lucide-react";
+import { X, AlertCircle, Check, Loader2, Maximize2, ChevronUp, ChevronDown } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Textarea } from "@subboost/ui/components/ui/textarea";
 import { Input } from "@subboost/ui/components/ui/input";
 import { Badge } from "@subboost/ui/components/ui/badge";
-import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@subboost/ui/components/ui/dialog";
-import { Switch } from "@subboost/ui/components/ui/switch";
 import { cn } from "@subboost/ui/lib/utils";
-import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
-import type { SourceType } from "@subboost/ui/store/config-store";
 import { SubscriptionImportErrorBadge } from "@subboost/ui/product/converter/subscription-import-error";
-import { getSubscriptionUserInfoDisplay } from "@subboost/ui/product/subscription/subscription-userinfo-display";
 import { buildSourceDisplayLabel } from "@subboost/ui/product/converter/source-display-label";
+import { AddSourceMenu, SourceStatusPopover, SourceTypeChoices } from "@subboost/ui/product/converter/source-controls";
+import { SourceEditorDialog } from "@subboost/ui/product/converter/source-editor-dialog";
 import { useSubscriptionSourcesController } from "@subboost/ui/product/converter/use-subscription-sources-controller";
 import { sourceTypeInfo } from "./constants";
 
@@ -49,115 +46,56 @@ export function SourcesSection() {
             total: sources.length,
           });
           const sourceNodes = nodesBySourceId.get(source.id) ?? [];
-          const userInfoDisplay = getSubscriptionUserInfoDisplay(source.subscriptionUserInfo, sourceNodes);
-          const hasUserInfoDisplay = Boolean(userInfoDisplay && (userInfoDisplay.traffic || userInfoDisplay.expire));
-
           return (
             <div key={source.id} className="flex flex-col gap-1.5 flex-shrink-0">
               {/* Source Header */}
               <div className="flex items-center justify-between">
                 <div className="flex items-center gap-2">
-                  <div className="flex gap-1">
-                    {(Object.keys(sourceTypeInfo) as SourceType[]).map((type) => {
-                      const info = sourceTypeInfo[type];
-                      const Icon = info.icon;
-                      return (
-                        <button
-                          key={type}
-                          onClick={() => updateSourceType(source.id, type)}
-                          className={cn(
-                            "p-1 rounded transition-colors",
-                            source.type === type
-                              ? "bg-indigo-500/20 text-indigo-400"
-                              : "text-white/30 hover:text-white/50 hover:bg-white/5"
-                          )}
-                          title={info.label}
-                        >
-                          <Icon className="h-3.5 w-3.5" />
-                        </button>
-                      );
-                    })}
-                  </div>
+                  <SourceTypeChoices value={source.type} onChange={(type) => updateSourceType(source.id, type)} />
                   <span className="text-xs text-white/50">
                     {sourceDisplayLabel}
                   </span>
-                  {source.parsed && source.nodeCount !== undefined && (
-                    <Popover.Root>
-                      <Popover.Trigger asChild>
-                        <button
-                          type="button"
-                          className="inline-flex items-center gap-1 rounded-full border border-green-500/50 bg-green-500/5 px-2 py-0.5 text-xs font-semibold text-green-300 transition-colors hover:bg-green-500/10 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black whitespace-nowrap"
-                          title="查看流量/到期"
-                          aria-label="查看流量/到期"
-                        >
-                          ✓ {source.nodeCount} 节点
-                          <Menu className="h-3 w-3 text-green-300/70" aria-hidden="true" />
-                        </button>
-                      </Popover.Trigger>
-                      <Popover.Portal>
-                        <Popover.Content
-                          side="bottom"
-                          align="start"
-                          sideOffset={8}
-                          className="z-50 w-[260px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-                        >
-                          <div className="space-y-2 text-xs">
-                            <div className="flex items-center gap-2">
-                              <HelpCircle className="h-4 w-4 text-green-300" />
-                              <div className="text-white font-medium">订阅信息</div>
-                            </div>
-                            {hasUserInfoDisplay && userInfoDisplay ? (
-                              <div className="space-y-1 text-white/60">
-                                {userInfoDisplay.traffic ? <div>已用流量：{userInfoDisplay.traffic}</div> : null}
-                                {userInfoDisplay.expire ? <div>到期时间：{userInfoDisplay.expire}</div> : null}
-                              </div>
-                            ) : (
-                              <div className="text-white/60 leading-relaxed">暂无已用流量/到期时间信息</div>
-                            )}
-                          </div>
-                          <Popover.Arrow className="fill-white/10" />
-                        </Popover.Content>
-                      </Popover.Portal>
-                    </Popover.Root>
-                  )}
+                  <SourceStatusPopover source={source} nodes={sourceNodes} />
                   {(source.errorInfo || source.error) && (
                     <SubscriptionImportErrorBadge errorInfo={source.errorInfo} errorMessage={source.error} />
                   )}
                 </div>
                 <div className="flex items-center gap-1">
                   <div className="flex flex-col">
-                    <button
+                    <IconButton
+                      label="上移"
+                      variant="ghost"
                       onClick={() => moveSource(source.id, "up")}
                       disabled={index <= 0}
                       className="flex h-3.5 w-4 items-center justify-center text-white/30 transition-colors hover:text-indigo-300 disabled:cursor-not-allowed disabled:opacity-30"
-                      title="上移"
-                      aria-label="上移"
                     >
-                      <ChevronUp className="h-2.5 w-2.5" />
-                    </button>
-                    <button
+                      <ChevronUp className="h-2.5 w-2.5" aria-hidden="true" />
+                    </IconButton>
+                    <IconButton
+                      label="下移"
+                      variant="ghost"
                       onClick={() => moveSource(source.id, "down")}
                       disabled={index >= sources.length - 1}
                       className="flex h-3.5 w-4 items-center justify-center text-white/30 transition-colors hover:text-indigo-300 disabled:cursor-not-allowed disabled:opacity-30"
-                      title="下移"
-                      aria-label="下移"
                     >
-                      <ChevronDown className="h-2.5 w-2.5" />
-                    </button>
+                      <ChevronDown className="h-2.5 w-2.5" aria-hidden="true" />
+                    </IconButton>
                   </div>
-                  <button
+                  <IconButton
+                    label="高级编辑"
+                    variant="ghost"
                     onClick={() => setExpandedSourceId(source.id)}
-                    className="p-1 rounded transition-colors text-white/30 hover:text-white/60 hover:bg-white/5"
-                    title="高级编辑"
+                    className="h-6 w-6 rounded p-1 text-white/30 hover:bg-white/5 hover:text-white/60"
                   >
-                    <Maximize2 className="h-3.5 w-3.5" />
-                  </button>
-                  {/* 导入按钮 */}
-                  <button
+                    <Maximize2 className="h-3.5 w-3.5" aria-hidden="true" />
+                  </IconButton>
+                  <IconButton
+                    label={source.parsing ? "导入中" : source.parsed ? "重新导入" : "导入此源"}
+                    variant="ghost"
                     onClick={() => void handleImportSource(source.id)}
                     disabled={!source.content.trim() || source.parsing}
                     className={cn(
-                      "p-1 rounded transition-colors disabled:opacity-100",
+                      "h-6 w-6 rounded p-1 transition-colors disabled:opacity-100",
                       source.parsing
                         ? "text-indigo-400"
                         : source.parsed
@@ -169,20 +107,20 @@ export function SourcesSection() {
                     title={source.parsing ? "导入中..." : source.parsed ? "重新导入" : "导入此源"}
                   >
                     {source.parsing ? (
-                      <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                      <Loader2 className="h-3.5 w-3.5 animate-spin" aria-hidden="true" />
                     ) : (
-                      <Check className="h-3.5 w-3.5" />
+                      <Check className="h-3.5 w-3.5" aria-hidden="true" />
                     )}
-                  </button>
-                  {/* 删除按钮 */}
+                  </IconButton>
                   {sources.length > 1 && (
-                    <button
+                    <IconButton
+                      label="删除导入源"
+                      variant="ghost"
                       onClick={() => removeSource(source.id)}
-                      className="p-1 text-white/50 hover:text-red-400 transition-colors"
-                      title="删除"
+                      className="h-6 w-6 rounded p-1 text-white/50 transition-colors hover:text-red-400"
                     >
-                      <X className="h-3.5 w-3.5" />
-                    </button>
+                      <X className="h-3.5 w-3.5" aria-hidden="true" />
+                    </IconButton>
                   )}
                 </div>
               </div>
@@ -210,39 +148,8 @@ export function SourcesSection() {
           );
         })}
 
-        {/* Add Source Button */}
-        <div className="relative flex-shrink-0">
-          <Button
-            variant="outline"
-            size="sm"
-            className="w-full h-8 text-xs border-dashed border-white/20 text-white/50 hover:text-white/70 hover:border-white/30"
-            onClick={() => setShowAddMenu(!showAddMenu)}
-          >
-            <Plus className="h-3.5 w-3.5 mr-1.5" />
-            添加订阅/节点源
-          </Button>
-
-          {showAddMenu && (
-            <div className="absolute top-full left-0 right-0 mt-1 bg-[#1a1a1a] border border-white/10 rounded-lg shadow-xl z-10 overflow-hidden">
-              {(Object.keys(sourceTypeInfo) as SourceType[]).map((type) => {
-                const info = sourceTypeInfo[type];
-                const Icon = info.icon;
-                return (
-                  <button
-                    key={type}
-                    onClick={() => addSource(type)}
-                    className="w-full flex items-center gap-3 px-3 py-2.5 text-left hover:bg-white/5 transition-colors"
-                  >
-                    <Icon className="h-4 w-4 text-indigo-400" />
-                    <div>
-                      <div className="text-xs font-medium text-white">{info.label}</div>
-                      <div className="text-[10px] text-white/40">{info.description}</div>
-                    </div>
-                  </button>
-                );
-              })}
-            </div>
-          )}
+        <div className="flex-shrink-0">
+          <AddSourceMenu open={showAddMenu} onOpenChange={setShowAddMenu} onAdd={addSource} />
         </div>
 
         {/* Status */}
@@ -259,161 +166,13 @@ export function SourcesSection() {
         )}
       </div>
 
-      <Dialog
-        open={Boolean(expandedSource)}
-        onOpenChange={(open) => {
-          if (!open) closeExpandedSourceEditor();
-        }}
-      >
-        <DialogContent className="w-[calc(100vw-2rem)] sm:max-w-4xl">
-          <DialogHeader>
-            <DialogTitle>{expandedSource ? `高级编辑：${sourceTypeInfo[expandedSource.type].label}` : "高级编辑"}</DialogTitle>
-          </DialogHeader>
-
-          {expandedSource && (
-            <div className="space-y-3">
-              <div className="grid gap-3 sm:grid-cols-3">
-                <div className="space-y-1">
-                  <div className="text-xs text-white/60">标签（tag）</div>
-                  <Input
-                    value={expandedSource.tag ?? ""}
-                    onChange={(e) => updateSourceMeta(expandedSource.id, { tag: e.target.value })}
-                    placeholder="例如：A / 订阅1 / 自建1"
-                    className="text-xs"
-                  />
-                </div>
-                <div className="space-y-1">
-                  <div className="text-xs text-white/60">节点命名模板</div>
-                  <Input
-                    value={expandedSource.nameTemplate ?? DEFAULT_NODE_NAME_TEMPLATE}
-                    onChange={(e) => updateSourceMeta(expandedSource.id, { nameTemplate: e.target.value })}
-                    className="text-xs font-mono"
-                  />
-                </div>
-                <div className="space-y-1">
-                  <div className="text-xs text-white/60">预览</div>
-                  <Input value={expandedSourcePreviewName} readOnly className="text-xs font-mono" />
-                </div>
-              </div>
-
-              <div className="text-[11px] text-white/40">
-                可用占位符：{"{tag}"}、{"{name}"}；留空则默认：{DEFAULT_NODE_NAME_TEMPLATE}
-              </div>
-
-              <div className="space-y-1">
-                <div className="text-xs text-white/60">{sourceTypeInfo[expandedSource.type].label}</div>
-                {expandedSource.type === "url" ? (
-                  <div className="space-y-3">
-                    <div className="flex items-center gap-3">
-                      <Input
-                        value={expandedSource.content}
-                        onChange={(e) => updateSource(expandedSource.id, e.target.value)}
-                        placeholder={sourceTypeInfo[expandedSource.type].placeholder}
-                        className="text-xs min-w-0 flex-1"
-                      />
-
-                      <div className="flex h-10 flex-none items-center gap-2 rounded-xl border border-white/10 bg-white/5 px-3">
-                        <div className="text-xs text-white/70 whitespace-nowrap">proxy-providers模式</div>
-                        <Popover.Root>
-                          <Popover.Trigger asChild>
-                            <button
-                              type="button"
-                              className="inline-flex h-6 w-6 flex-none items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
-                              aria-label="proxy-providers 模式说明"
-                              title="proxy-providers 模式说明"
-                            >
-                              <HelpCircle className="h-3.5 w-3.5" />
-                            </button>
-                          </Popover.Trigger>
-                          <Popover.Portal>
-                            <Popover.Content
-                              side="bottom"
-                              align="end"
-                              sideOffset={8}
-                              className="z-50 w-[360px] rounded-xl border border-white/10 bg-black/90 backdrop-blur-md shadow-2xl p-3"
-                            >
-                              <div className="space-y-2 text-xs">
-                                <div className="flex items-center gap-2">
-                                  <HelpCircle className="h-4 w-4 text-amber-300" />
-                                  <div className="text-white font-medium">proxy-providers 模式</div>
-                                </div>
-                                <div className="text-white/60 leading-relaxed">
-                                  部分订阅限制 CN IP 导入，url 无法在 SubBoost 内拉取解析。开启后 SubBoost
-                                  不再拉取/解析该 url，而是在最终配置中写入{" "}
-                                  <span className="font-mono">proxy-providers</span>，交由客户端自行拉取节点。
-                                </div>
-                                <div className="pt-2 border-t border-white/10 text-white/60 space-y-1">
-                                  <div className="font-medium text-white/80">注意开启后：</div>
-                                  <ul className="ml-4 list-disc space-y-1">
-                                    <li>无法在预览中查看/管理该 url 的节点</li>
-                                    <li>无法将这些节点用于中转代理组、分流组高级模式等高级功能</li>
-                                    <li>节点命名模板与 tag 在该模式下不生效</li>
-                                  </ul>
-                                </div>
-                                <div className="pt-2 border-t border-white/10 text-[10px] text-white/40">
-                                  若导入 url 报“未解析到有效节点/获取失败”等，可尝试开启此模式。
-                                </div>
-                              </div>
-                              <Popover.Arrow className="fill-white/10" />
-                            </Popover.Content>
-                          </Popover.Portal>
-                        </Popover.Root>
-                        <Switch
-                          checked={Boolean(expandedSource.useProxyProviders)}
-                          onCheckedChange={(checked) =>
-                            updateSourceMeta(expandedSource.id, { useProxyProviders: Boolean(checked) })
-                          }
-                        />
-                      </div>
-                    </div>
-
-                    <div className="grid gap-3 sm:grid-cols-2">
-                      <div className="space-y-1">
-                        <div className="text-xs text-white/60">流量/到期信息 URL（可选）</div>
-                        <Input
-                          value={expandedSource.userinfoUrl ?? ""}
-                          onChange={(e) => updateSourceMeta(expandedSource.id, { userinfoUrl: e.target.value })}
-                          placeholder="留空则默认使用当前订阅源 URL"
-                          className="text-xs"
-                        />
-                      </div>
-                      <div className="space-y-1">
-                        <div className="text-xs text-white/60">流量信息 User-Agent（可选）</div>
-                        <Input
-                          value={expandedSource.userinfoUserAgent ?? ""}
-                          onChange={(e) =>
-                            updateSourceMeta(expandedSource.id, { userinfoUserAgent: e.target.value })
-                          }
-                          placeholder="例如 clash.meta/v1.19.16"
-                          className="text-xs"
-                        />
-                      </div>
-                    </div>
-
-                    <div className="text-[11px] text-white/40">
-                      有些订阅源不会直接返回 <span className="font-mono">subscription-userinfo</span>，但会提供独立的流量接口。
-                      设置后，SubBoost 会在导入/刷新时额外抓取该接口，用来更新这个源自己的流量与到期快照。
-                    </div>
-                  </div>
-                ) : (
-                  <Textarea
-                    value={expandedSource.content}
-                    onChange={(e) => updateSource(expandedSource.id, e.target.value)}
-                    placeholder={sourceTypeInfo[expandedSource.type].placeholder}
-                    className="min-h-[60vh] text-xs font-mono"
-                  />
-                )}
-              </div>
-            </div>
-          )}
-
-          <div className="flex justify-end gap-2">
-            <Button variant="outline" onClick={closeExpandedSourceEditor}>
-              完成
-            </Button>
-          </div>
-        </DialogContent>
-      </Dialog>
+      <SourceEditorDialog
+        source={expandedSource}
+        previewName={expandedSourcePreviewName}
+        onClose={closeExpandedSourceEditor}
+        onUpdateContent={updateSource}
+        onUpdateMeta={updateSourceMeta}
+      />
     </>
   );
 }
diff --git a/packages/ui/src/product/converter/quick-mode/templates-section.test.ts b/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
index 08d3535..7f3ae5d 100644
--- a/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
+++ b/packages/ui/src/product/converter/quick-mode/templates-section.test.ts
@@ -154,6 +154,10 @@ function flushPromises() {
   return new Promise((resolve) => setTimeout(resolve, 0));
 }
 
+function catalogApplyButtons() {
+  return mocks.captures.buttons.filter((props: any) => props.className === "flex-shrink-0");
+}
+
 function renderSection(overrides: Record<number, unknown> = {}) {
   stateMock.enabled = true;
   stateMock.callIndex = 0;
@@ -207,14 +211,14 @@ describe("quick mode TemplatesSection", () => {
   it("selects built-in templates and opens the catalog", () => {
     const { setters } = renderSection();
 
-    mocks.captures.cards[1].onClick();
+    mocks.captures.rawButtons.find((props: any) => props["aria-label"] === "选择 Standard 模板").onClick();
     expect(mocks.store.setTemplate).toHaveBeenCalledWith("standard");
     expect(mocks.interactions.templateSelected).toHaveBeenCalledWith({
       source: "builtin",
       templateType: "standard",
     });
 
-    mocks.captures.cards.at(-1).onClick();
+    mocks.captures.rawButtons.find((props: any) => props["aria-label"] === "打开Catalog").onClick();
     expect(setters[0]).toHaveBeenCalledWith(true);
     expect(mocks.interactions.templateCatalogOpened).toHaveBeenCalledWith({ mode: "quick" });
   });
@@ -240,7 +244,7 @@ describe("quick mode TemplatesSection", () => {
     });
 
     const { setters } = renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
 
     expect(setters[4]).toHaveBeenCalledWith("tpl-config");
@@ -260,7 +264,7 @@ describe("quick mode TemplatesSection", () => {
   it("rejects unsupported catalog templates and missing details", async () => {
     mocks.productApi.templates.loadTemplateDetail.mockResolvedValue({ kind: "yaml", name: "Raw YAML" });
     renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[1].onClick();
+    catalogApplyButtons()[1].onClick();
     await flushPromises();
     expect(mocks.interactions.templateApplied).toHaveBeenCalledWith({
       source: "catalog",
@@ -271,7 +275,7 @@ describe("quick mode TemplatesSection", () => {
 
     mocks.productApi.templates.loadTemplateDetail.mockResolvedValue(null);
     renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
     expect(mocks.interactions.templateApplied).toHaveBeenCalledWith({
       source: "catalog",
@@ -285,7 +289,7 @@ describe("quick mode TemplatesSection", () => {
     const errorSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
     mocks.productApi.templates.loadTemplateDetail.mockRejectedValue(new Error("network"));
     renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
     expect(mocks.toast).toHaveBeenCalledWith(expect.objectContaining({ title: "应用模板失败，请稍后重试", variant: "destructive" }));
     expect(errorSpy).toHaveBeenCalledWith(expect.objectContaining({ message: "network" }));
@@ -331,11 +335,9 @@ describe("quick mode TemplatesSection", () => {
       full: { id: "builtin-full", engagementCount: 0, isEngaged: false },
     });
 
-    const stopPropagation = vi.fn();
-    mocks.captures.rawButtons.find((props: any) => props.title === "Like").onClick({ stopPropagation });
+    mocks.captures.rawButtons.find((props: any) => props.title === "Like").onClick();
     await flushPromises();
 
-    expect(stopPropagation).toHaveBeenCalled();
     expect(mocks.productApi.templates.toggleTemplateEngagement).toHaveBeenCalledWith("builtin-minimal");
     expect(mocks.interactions.templateEngagementToggled).toHaveBeenCalledWith({ source: "builtin", engaged: true });
     expect(setters[5]).toHaveBeenCalledWith(expect.any(Function));
@@ -413,14 +415,14 @@ describe("quick mode TemplatesSection", () => {
       config: { template: "minimal" },
     });
     const unnamed = renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
     expect(mocks.toast).toHaveBeenCalledWith(expect.objectContaining({ title: "已应用模板：未命名模板" }));
     expect(unnamed.setters[4]).toHaveBeenCalledWith(null);
 
     mocks.productApi.templates.loadTemplateDetail.mockResolvedValue({ kind: "markdown", name: "Doc" });
     renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
     expect(mocks.interactions.templateApplied).toHaveBeenCalledWith({
       source: "catalog",
@@ -430,7 +432,7 @@ describe("quick mode TemplatesSection", () => {
 
     mocks.productApi.templates.loadTemplateDetail = undefined;
     const noLoader = renderSection({ 0: true, 1: false, 2: catalogItems, 3: "" });
-    mocks.captures.buttons[0].onClick();
+    catalogApplyButtons()[0].onClick();
     await flushPromises();
     expect(noLoader.setters[4]).not.toHaveBeenCalled();
   });
diff --git a/packages/ui/src/product/converter/quick-mode/templates-section.tsx b/packages/ui/src/product/converter/quick-mode/templates-section.tsx
index aa5489b..48fb744 100644
--- a/packages/ui/src/product/converter/quick-mode/templates-section.tsx
+++ b/packages/ui/src/product/converter/quick-mode/templates-section.tsx
@@ -193,25 +193,31 @@ export function TemplatesSection() {
     <>
       {/* Template Selection */}
       <div className="space-y-1.5">
-        <label className="text-xs text-white/50">选择模板</label>
+        <p className="text-xs text-white/50">选择模板</p>
         <div className="grid gap-1.5">
           {templates.map((template) => (
             <Card
               key={template.id}
               className={cn(
-                "p-2.5 cursor-pointer transition-all border-2",
+                "p-2.5 transition-all border-2",
                 selectedTemplate === template.id ? "border-indigo-500 bg-indigo-500/10" : "border-transparent hover:border-white/20"
               )}
-              onClick={() => {
-                setTemplate(template.id);
-                interactions.templateSelected?.({
-                  source: "builtin",
-                  templateType: template.id,
-                });
-              }}
             >
-              <div className="flex items-center justify-between">
-                <div className="flex items-center gap-3">
+              <div className="flex items-center gap-3">
+                <button
+                  type="button"
+                  aria-pressed={selectedTemplate === template.id}
+                  aria-label={`选择 ${template.name} 模板`}
+                  className="flex min-w-0 flex-1 items-center justify-between gap-3 text-left"
+                  onClick={() => {
+                    setTemplate(template.id);
+                    interactions.templateSelected?.({
+                      source: "builtin",
+                      templateType: template.id,
+                    });
+                  }}
+                >
+                  <div className="flex min-w-0 items-center gap-3">
                   <div
                     className={cn(
                       "w-4 h-4 rounded-full border-2 flex items-center justify-center",
@@ -223,45 +229,50 @@ export function TemplatesSection() {
                   <div>
                     <div className="flex items-center gap-2">
                       <span className="text-sm font-medium text-white">{template.name}</span>
-                      {builtinEngagementEnabled && (
-                        <button
-                          onClick={(e) => {
-                            e.stopPropagation();
-                            void toggleBuiltinEngagement(template.id);
-                          }}
-                          disabled={!user}
-                          className={cn(
-                            "inline-flex items-center gap-0.5 text-xs transition-colors",
-                            builtinEngagement[template.id]?.isEngaged ? "text-red-400" : "text-white/40 hover:text-red-400",
-                            !user && "cursor-not-allowed opacity-50"
-                          )}
-                          title={user ? engagementAction : engagementLoginRequired}
-                        >
-                          <Heart className={cn("h-3 w-3", builtinEngagement[template.id]?.isEngaged && "fill-current")} />
-                          <span>{builtinEngagement[template.id]?.engagementCount ?? 0}</span>
-                        </button>
-                      )}
                     </div>
                     <p className="text-xs text-white/40 mt-0.5">{template.description}</p>
                   </div>
-                </div>
-                <div className="text-right text-xs text-white/40 space-y-0.5">
-                  <div>{template.groups} 代理组</div>
-                  <div>{template.rules} 规则集</div>
-                </div>
+                  </div>
+                  <div className="space-y-0.5 text-right text-xs text-white/40">
+                    <div>{template.groups} 代理组</div>
+                    <div>{template.rules} 规则集</div>
+                  </div>
+                </button>
+                {builtinEngagementEnabled && (
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="sm"
+                    onClick={() => void toggleBuiltinEngagement(template.id)}
+                    disabled={!user}
+                    className={cn(
+                      "h-auto gap-0.5 p-0 text-xs transition-colors hover:bg-transparent",
+                      builtinEngagement[template.id]?.isEngaged ? "text-red-400" : "text-white/40 hover:text-red-400",
+                      !user && "cursor-not-allowed opacity-50"
+                    )}
+                    title={user ? engagementAction : engagementLoginRequired}
+                  >
+                    <Heart className={cn("h-3 w-3", builtinEngagement[template.id]?.isEngaged && "fill-current")} />
+                    <span>{builtinEngagement[template.id]?.engagementCount ?? 0}</span>
+                  </Button>
+                )}
               </div>
             </Card>
           ))}
 
           {catalogEnabled && (
             <Card
-              className="p-2.5 cursor-pointer transition-all border-2 border-dashed border-white/15 hover:border-white/25 bg-white/5"
-              onClick={() => {
-                setCatalogOpen(true);
-                interactions.templateCatalogOpened?.({ mode: "quick" });
-              }}
+              className="p-2.5 transition-all border-2 border-dashed border-white/15 hover:border-white/25 bg-white/5"
             >
-              <div className="flex items-center justify-between">
+              <button
+                type="button"
+                aria-label={`打开${catalogName}`}
+                className="flex w-full items-center justify-between text-left"
+                onClick={() => {
+                  setCatalogOpen(true);
+                  interactions.templateCatalogOpened?.({ mode: "quick" });
+                }}
+              >
                 <div className="flex items-center gap-3 min-w-0">
                   <div className="w-4 h-4 rounded-full border-2 border-white/30 flex items-center justify-center flex-shrink-0">
                     <Globe className="h-3 w-3 text-indigo-400" />
@@ -274,7 +285,7 @@ export function TemplatesSection() {
                 <div className="text-right text-xs text-white/40 flex-shrink-0">
                   <div>{catalogSelectAction}</div>
                 </div>
-              </div>
+              </button>
             </Card>
           )}
         </div>
diff --git a/packages/ui/src/product/converter/source-controls.tsx b/packages/ui/src/product/converter/source-controls.tsx
new file mode 100644
index 0000000..88ad1d3
--- /dev/null
+++ b/packages/ui/src/product/converter/source-controls.tsx
@@ -0,0 +1,155 @@
+"use client";
+
+import { HelpCircle, Menu, Plus } from "lucide-react";
+import type { ParsedNode } from "@subboost/core/types/node";
+import { Button } from "@subboost/ui/components/ui/button";
+import { ChoiceChip, ChoiceGroup } from "@subboost/ui/components/ui/choice-group";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@subboost/ui/components/ui/dropdown-menu";
+import {
+  Popover,
+  PopoverArrow,
+  PopoverContent,
+  PopoverTrigger,
+} from "@subboost/ui/components/ui/popover";
+import { cn } from "@subboost/ui/lib/utils";
+import { getSubscriptionUserInfoDisplay } from "@subboost/ui/product/subscription/subscription-userinfo-display";
+import type { SourceType, SubscriptionSource } from "@subboost/ui/store/config-store";
+import { sourceTypeInfo } from "./source-type-info";
+
+const sourceTypes = Object.keys(sourceTypeInfo) as SourceType[];
+
+export function SourceTypeChoices({
+  value,
+  onChange,
+  compact = false,
+}: {
+  value: SourceType;
+  onChange: (type: SourceType) => void;
+  compact?: boolean;
+}) {
+  return (
+    <ChoiceGroup label="导入源类型" className={compact ? "gap-0.5" : "gap-1"}>
+      {sourceTypes.map((type) => {
+        const info = sourceTypeInfo[type];
+        const Icon = info.icon;
+        return (
+          <ChoiceChip
+            key={type}
+            selected={value === type}
+            onClick={() => onChange(type)}
+            title={info.label}
+            label={
+              <>
+                <Icon className="h-3.5 w-3.5" aria-hidden="true" />
+                <span className="sr-only">{info.label}</span>
+              </>
+            }
+            className="min-h-0 rounded p-1"
+          />
+        );
+      })}
+    </ChoiceGroup>
+  );
+}
+
+export function SourceStatusPopover({
+  source,
+  nodes,
+}: {
+  source: SubscriptionSource;
+  nodes: ParsedNode[];
+}) {
+  if (!source.parsed || source.nodeCount === undefined) return null;
+
+  const userInfo = getSubscriptionUserInfoDisplay(source.subscriptionUserInfo, nodes);
+  const hasUserInfo = Boolean(userInfo && (userInfo.traffic || userInfo.expire));
+
+  return (
+    <Popover>
+      <PopoverTrigger asChild>
+        <Button
+          type="button"
+          variant="ghost"
+          size="sm"
+          className="h-auto gap-1 whitespace-nowrap rounded-full border border-green-500/50 bg-green-500/5 px-2 py-0.5 text-xs font-semibold text-green-300 hover:bg-green-500/10"
+          title="查看流量/到期"
+          aria-label="查看流量/到期"
+        >
+          ✓ {source.nodeCount} 节点
+          <Menu className="h-3 w-3 text-green-300/70" aria-hidden="true" />
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent side="bottom" align="start" className="w-[260px] bg-black/90 p-3">
+        <div className="space-y-2 text-xs">
+          <div className="flex items-center gap-2">
+            <HelpCircle className="h-4 w-4 text-green-300" aria-hidden="true" />
+            <p className="font-medium text-white">订阅信息</p>
+          </div>
+          {hasUserInfo && userInfo ? (
+            <div className="space-y-1 text-white/60">
+              {userInfo.traffic ? <p>已用流量：{userInfo.traffic}</p> : null}
+              {userInfo.expire ? <p>到期时间：{userInfo.expire}</p> : null}
+            </div>
+          ) : (
+            <p className="leading-relaxed text-white/60">暂无已用流量/到期时间信息</p>
+          )}
+        </div>
+        <PopoverArrow className="fill-black/90" />
+      </PopoverContent>
+    </Popover>
+  );
+}
+
+export function AddSourceMenu({
+  open,
+  onOpenChange,
+  onAdd,
+  compact = false,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onAdd: (type: SourceType) => void;
+  compact?: boolean;
+}) {
+  return (
+    <DropdownMenu open={open} onOpenChange={onOpenChange}>
+      <DropdownMenuTrigger asChild>
+        <Button
+          variant="outline"
+          size="sm"
+          className={cn(
+            "w-full border-dashed border-white/20 text-xs text-white/50 hover:border-white/30 hover:text-white/70",
+            compact ? "h-7" : "h-8"
+          )}
+        >
+          <Plus className="h-3.5 w-3.5" aria-hidden="true" />
+          添加订阅/节点源
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="w-[var(--radix-dropdown-menu-trigger-width)] border-white/10 bg-[#1a1a1a] text-white">
+        {sourceTypes.map((type) => {
+          const info = sourceTypeInfo[type];
+          const Icon = info.icon;
+          return (
+            <DropdownMenuItem
+              key={type}
+              onSelect={() => onAdd(type)}
+              className={cn("gap-3 focus:bg-white/5 focus:text-white", compact ? "py-2" : "py-2.5")}
+            >
+              <Icon className="h-4 w-4 text-indigo-400" aria-hidden="true" />
+              <span>
+                <span className="block text-xs font-medium text-white">{info.label}</span>
+                {!compact ? <span className="block text-[10px] text-white/40">{info.description}</span> : null}
+              </span>
+            </DropdownMenuItem>
+          );
+        })}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+}
diff --git a/packages/ui/src/product/converter/source-editor-dialog.tsx b/packages/ui/src/product/converter/source-editor-dialog.tsx
new file mode 100644
index 0000000..07fcb77
--- /dev/null
+++ b/packages/ui/src/product/converter/source-editor-dialog.tsx
@@ -0,0 +1,155 @@
+"use client";
+
+import { HelpCircle } from "lucide-react";
+import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
+import { Button } from "@subboost/ui/components/ui/button";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@subboost/ui/components/ui/dialog";
+import { FormField } from "@subboost/ui/components/ui/form-field";
+import { HelpPopover } from "@subboost/ui/components/ui/popover";
+import { Input } from "@subboost/ui/components/ui/input";
+import { Switch } from "@subboost/ui/components/ui/switch";
+import { Textarea } from "@subboost/ui/components/ui/textarea";
+import type { SubscriptionSource } from "@subboost/ui/store/config-store";
+import { sourceTypeInfo } from "./source-type-info";
+
+export type SourceEditorDialogProps = {
+  source: SubscriptionSource | null;
+  previewName: string;
+  onClose: () => void;
+  onUpdateContent: (id: string, content: string) => void;
+  onUpdateMeta: (id: string, patch: Partial<SubscriptionSource>) => void;
+};
+
+export function SourceEditorDialog({
+  source,
+  previewName,
+  onClose,
+  onUpdateContent,
+  onUpdateMeta,
+}: SourceEditorDialogProps) {
+  return (
+    <Dialog open={Boolean(source)} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent className="w-[calc(100vw-2rem)] sm:max-w-4xl">
+        <DialogHeader>
+          <DialogTitle>{source ? `高级编辑：${sourceTypeInfo[source.type].label}` : "高级编辑"}</DialogTitle>
+        </DialogHeader>
+
+        {source ? (
+          <div className="space-y-3">
+            <div className="grid gap-3 sm:grid-cols-3">
+              <FormField label="标签（tag）">
+                <Input
+                  value={source.tag ?? ""}
+                  onChange={(event) => onUpdateMeta(source.id, { tag: event.target.value })}
+                  placeholder="例如：A / 订阅1 / 自建1"
+                  className="text-xs"
+                />
+              </FormField>
+              <FormField label="节点命名模板">
+                <Input
+                  value={source.nameTemplate ?? DEFAULT_NODE_NAME_TEMPLATE}
+                  onChange={(event) => onUpdateMeta(source.id, { nameTemplate: event.target.value })}
+                  className="text-xs font-mono"
+                />
+              </FormField>
+              <FormField label="预览">
+                <Input value={previewName} readOnly className="text-xs font-mono" />
+              </FormField>
+            </div>
+
+            <p className="text-[11px] text-white/40">
+              可用占位符：{"{tag}"}、{"{name}"}；留空则默认：{DEFAULT_NODE_NAME_TEMPLATE}
+            </p>
+
+            <div className="space-y-1">
+              <p className="text-xs text-white/60">{sourceTypeInfo[source.type].label}</p>
+              {source.type === "url" ? (
+                <div className="space-y-3">
+                  <div className="flex items-center gap-3">
+                    <Input
+                      value={source.content}
+                      onChange={(event) => onUpdateContent(source.id, event.target.value)}
+                      placeholder={sourceTypeInfo[source.type].placeholder}
+                      className="min-w-0 flex-1 text-xs"
+                    />
+                    <div className="flex h-10 flex-none items-center gap-2 rounded-xl border border-white/10 bg-white/5 px-3">
+                      <span className="whitespace-nowrap text-xs text-white/70">proxy-providers模式</span>
+                      <HelpPopover
+                        label="proxy-providers 模式说明"
+                        side="bottom"
+                        align="end"
+                        contentClassName="w-[360px] bg-black/90 p-3"
+                      >
+                        <div className="space-y-2 text-xs">
+                          <div className="flex items-center gap-2">
+                            <HelpCircle className="h-4 w-4 text-amber-300" aria-hidden="true" />
+                            <p className="font-medium text-white">proxy-providers 模式</p>
+                          </div>
+                          <p className="leading-relaxed text-white/60">
+                            部分订阅限制 CN IP 导入，url 无法在 SubBoost 内拉取解析。开启后 SubBoost
+                            不再拉取/解析该 url，而是在最终配置中写入{" "}
+                            <span className="font-mono">proxy-providers</span>，交由客户端自行拉取节点。
+                          </p>
+                          <div className="space-y-1 border-t border-white/10 pt-2 text-white/60">
+                            <p className="font-medium text-white/80">注意开启后：</p>
+                            <ul className="ml-4 list-disc space-y-1">
+                              <li>无法在预览中查看/管理该 url 的节点</li>
+                              <li>无法将这些节点用于中转代理组、分流组高级模式等高级功能</li>
+                              <li>节点命名模板与 tag 在该模式下不生效</li>
+                            </ul>
+                          </div>
+                          <p className="border-t border-white/10 pt-2 text-[10px] text-white/40">
+                            若导入 url 报“未解析到有效节点/获取失败”等，可尝试开启此模式。
+                          </p>
+                        </div>
+                      </HelpPopover>
+                      <Switch
+                        checked={Boolean(source.useProxyProviders)}
+                        onCheckedChange={(checked) => onUpdateMeta(source.id, { useProxyProviders: checked })}
+                        aria-label="使用 proxy-providers 模式"
+                      />
+                    </div>
+                  </div>
+
+                  <div className="grid gap-3 sm:grid-cols-2">
+                    <FormField label="流量/到期信息 URL（可选）">
+                      <Input
+                        value={source.userinfoUrl ?? ""}
+                        onChange={(event) => onUpdateMeta(source.id, { userinfoUrl: event.target.value })}
+                        placeholder="留空则默认使用当前订阅源 URL"
+                        className="text-xs"
+                      />
+                    </FormField>
+                    <FormField label="流量信息 User-Agent（可选）">
+                      <Input
+                        value={source.userinfoUserAgent ?? ""}
+                        onChange={(event) => onUpdateMeta(source.id, { userinfoUserAgent: event.target.value })}
+                        placeholder="例如 clash.meta/v1.19.16"
+                        className="text-xs"
+                      />
+                    </FormField>
+                  </div>
+                  <p className="text-[11px] text-white/40">
+                    有些订阅源不会直接返回 <span className="font-mono">subscription-userinfo</span>，但会提供独立的流量接口。
+                    设置后，SubBoost 会在导入/刷新时额外抓取该接口，用来更新这个源自己的流量与到期快照。
+                  </p>
+                </div>
+              ) : (
+                <Textarea
+                  value={source.content}
+                  onChange={(event) => onUpdateContent(source.id, event.target.value)}
+                  placeholder={sourceTypeInfo[source.type].placeholder}
+                  className="min-h-[60vh] text-xs font-mono"
+                />
+              )}
+            </div>
+          </div>
+        ) : null}
+
+        <div className="flex justify-end gap-2">
+          <Button variant="outline" onClick={onClose}>完成</Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/packages/ui/src/product/converter/source-type-info.ts b/packages/ui/src/product/converter/source-type-info.ts
new file mode 100644
index 0000000..ca3b655
--- /dev/null
+++ b/packages/ui/src/product/converter/source-type-info.ts
@@ -0,0 +1,31 @@
+import { FileCode, Link2, Server } from "lucide-react";
+import type { SourceType } from "@subboost/ui/store/config-store";
+
+export type SourceTypeInfo = {
+  label: string;
+  icon: typeof Link2;
+  placeholder: string;
+  description: string;
+};
+
+export const sourceTypeInfo: Record<SourceType, SourceTypeInfo> = {
+  url: {
+    label: "订阅链接",
+    icon: Link2,
+    placeholder: "https://example.com/sub?token=xxx",
+    description: "输入订阅链接，系统将自动获取节点",
+  },
+  yaml: {
+    label: "YAML 配置",
+    icon: FileCode,
+    placeholder: "proxies:\n  - name: 节点名称\n    type: vmess\n    ...",
+    description: "粘贴完整的 Clash YAML 配置文件",
+  },
+  nodes: {
+    label: "节点链接",
+    icon: Server,
+    placeholder:
+      "ss://...\nssr://...\nvmess://...\nvless://...\ntrojan://...\nanytls://...\nhysteria2://... / hy2://...\ntuic://...\n(socks5://... / socks4://...)",
+    description: "每行一个节点链接，支持 ss/ssr/vmess/vless/trojan/anytls/hy2/tuic",
+  },
+};
diff --git a/packages/ui/src/product/converter/subscription-import-error.test.ts b/packages/ui/src/product/converter/subscription-import-error.test.ts
index 609b7f5..489f769 100644
--- a/packages/ui/src/product/converter/subscription-import-error.test.ts
+++ b/packages/ui/src/product/converter/subscription-import-error.test.ts
@@ -46,6 +46,13 @@ vi.mock("@subboost/ui/lib/utils", () => ({
   cn: (...parts: Array<string | false | null | undefined>) => parts.filter(Boolean).join(" "),
 }));
 
+vi.mock("@subboost/ui/components/ui/button", () => ({
+  Button: (props: any) => {
+    if (typeof props.onClick === "function") mocks.buttons.push(props);
+    return React.createElement("button", props, props.children);
+  },
+}));
+
 vi.mock("@subboost/ui/components/ui/toaster", () => ({
   toast: mocks.toast,
 }));
diff --git a/packages/ui/src/product/converter/subscription-import-error.tsx b/packages/ui/src/product/converter/subscription-import-error.tsx
index 736f7c8..c516dac 100644
--- a/packages/ui/src/product/converter/subscription-import-error.tsx
+++ b/packages/ui/src/product/converter/subscription-import-error.tsx
@@ -9,6 +9,7 @@ import {
   DialogTitle,
   DialogTrigger,
 } from "@subboost/ui/components/ui/dialog";
+import { Button } from "@subboost/ui/components/ui/button";
 import { cn } from "@subboost/ui/lib/utils";
 import { toast } from "@subboost/ui/components/ui/toaster";
 import { formatInBeijing } from "@subboost/core/time/beijing";
@@ -77,14 +78,16 @@ function ErrorDetailDialog({ error, children }: ErrorDetailDialogProps) {
           <div className="space-y-2">
             <div className="flex items-center justify-between">
               <span className="text-white/50 text-xs">{error.isUserFacingReason ? "提示内容" : "错误信息"}</span>
-              <button
+              <Button
                 type="button"
+                variant="ghost"
+                size="sm"
                 onClick={() => copyText(message)}
-                className="text-xs text-white/40 hover:text-white flex items-center gap-1 transition-colors"
+                className="h-auto gap-1 p-0 text-xs text-white/40 hover:bg-transparent hover:text-white"
               >
                 <Copy className="h-3 w-3" />
                 复制
-              </button>
+              </Button>
             </div>
             <div
               className={cn(
@@ -102,14 +105,16 @@ function ErrorDetailDialog({ error, children }: ErrorDetailDialogProps) {
             <div className="space-y-2">
               <div className="flex items-center justify-between">
                 <span className="text-white/50 text-xs">技术细节</span>
-                <button
+                <Button
                   type="button"
+                  variant="ghost"
+                  size="sm"
                   onClick={() => copyText(technicalDetail!, "已复制技术细节")}
-                  className="text-xs text-white/40 hover:text-white flex items-center gap-1 transition-colors"
+                  className="h-auto gap-1 p-0 text-xs text-white/40 hover:bg-transparent hover:text-white"
                 >
                   <Copy className="h-3 w-3" />
                   复制
-                </button>
+                </Button>
               </div>
               <div className="bg-black/30 border border-white/5 rounded-lg p-3 text-white/80 text-xs font-mono whitespace-pre-wrap break-all max-h-32 overflow-y-auto custom-scrollbar">
                 {technicalDetail}
@@ -163,10 +168,12 @@ export function SubscriptionImportErrorBadge({
 
   return (
     <ErrorDetailDialog error={normalized}>
-      <button
+      <Button
         type="button"
+        variant="ghost"
+        size="sm"
         className={cn(
-          "inline-flex items-center justify-center rounded-full px-1.5 py-0.5 text-[10px] font-medium leading-none",
+          "h-auto rounded-full px-1.5 py-0.5 text-[10px] font-medium leading-none",
           "bg-red-500/15 text-red-300 border border-red-500/20",
           "hover:bg-red-500/25 hover:text-red-200 transition-colors cursor-pointer",
           "focus:outline-none focus:ring-2 focus:ring-red-500/40",
@@ -176,7 +183,7 @@ export function SubscriptionImportErrorBadge({
       >
         <span>{badgeText}</span>
         <Menu className="ml-1 h-3 w-3 text-red-200/70" aria-hidden="true" />
-      </button>
+      </Button>
     </ErrorDetailDialog>
   );
 }
diff --git a/packages/ui/src/product/home/home-layout.tsx b/packages/ui/src/product/home/home-layout.tsx
index 0ec4bdf..c9939f3 100644
--- a/packages/ui/src/product/home/home-layout.tsx
+++ b/packages/ui/src/product/home/home-layout.tsx
@@ -223,19 +223,20 @@ export function HomeLayout({
                   )}
                 </Button>
                 {user && templateUploadHref && (
-                  <Link href={templateUploadHref}>
-                    <Button
+                  <Button
+                    asChild
                       variant="outline"
                       className="h-10 gap-2"
                       onClick={() => {
                         onTemplateUploadOpen?.();
                         interactions.templateUploadOpened?.({ entry: "home" });
                       }}
-                    >
+                  >
+                    <Link href={templateUploadHref}>
                       <Upload className="h-4 w-4" />
                       上传模板
-                    </Button>
-                  </Link>
+                    </Link>
+                  </Button>
                 )}
               </CardFooter>
             </Card>
diff --git a/packages/ui/src/product/home/subscription-link-dialog.tsx b/packages/ui/src/product/home/subscription-link-dialog.tsx
index 191051b..baaa5e3 100644
--- a/packages/ui/src/product/home/subscription-link-dialog.tsx
+++ b/packages/ui/src/product/home/subscription-link-dialog.tsx
@@ -3,9 +3,11 @@
 import type * as React from "react";
 import { Check, Copy, Link as LinkIcon, Loader2 } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { FormField } from "@subboost/ui/components/ui/form-field";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Input } from "@subboost/ui/components/ui/input";
-import { Label } from "@subboost/ui/components/ui/label";
 import { Switch } from "@subboost/ui/components/ui/switch";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { SmartNodeMatchingHelp } from "@subboost/ui/components/subscription/smart-node-matching-help";
 import {
   Dialog,
@@ -83,15 +85,14 @@ export function SubscriptionLinkDialog({
 
         {!subscriptionUrl ? (
           <div className="space-y-4 py-4">
-            <div className="space-y-2">
-              <Label>订阅名称</Label>
+            <FormField label="订阅名称">
               <Input
                 placeholder="例如：我的配置"
                 value={subscriptionName}
                 onChange={(e) => setSubscriptionName(e.target.value)}
                 maxLength={100}
               />
-            </div>
+            </FormField>
 
             <div className="rounded-lg border border-white/10 bg-white/5 p-3">
               <div className="flex items-center justify-between gap-4">
@@ -101,22 +102,28 @@ export function SubscriptionLinkDialog({
                     <SmartNodeMatchingHelp enabled={smartNodeMatchingEnabled} />
                   </div>
                 </div>
-                <Switch checked={smartNodeMatchingEnabled} onCheckedChange={setSmartNodeMatchingEnabled} />
+                <Switch
+                  checked={smartNodeMatchingEnabled}
+                  onCheckedChange={setSmartNodeMatchingEnabled}
+                  aria-label="更新时智能匹配节点"
+                />
               </div>
 
               <div className="my-3 border-t border-white/10" />
 
-              <div className="flex items-center justify-between gap-4">
-                <div className="min-w-0">
-                  <p className="text-sm text-white/80">启用自动更新</p>
-                  <p className="mt-1 text-xs text-white/45">开启后服务器会按设定间隔刷新缓存</p>
-                </div>
-                <Switch checked={autoUpdateEnabled} onCheckedChange={setAutoUpdateEnabled} />
-              </div>
+              <SwitchField
+                label="启用自动更新"
+                description="开启后服务器会按设定间隔刷新缓存"
+                checked={autoUpdateEnabled}
+                onCheckedChange={setAutoUpdateEnabled}
+              />
 
               {autoUpdateEnabled && (
-                <div className="mt-4 space-y-2">
-                  <Label>自动更新间隔（小时）</Label>
+                <FormField
+                  label="自动更新间隔（小时）"
+                  description={`最小 ${minAutoUpdateLabel}，按创建时间计时`}
+                  className="mt-4"
+                >
                   <Input
                     type="number"
                     min={autoUpdatePolicy.minHours}
@@ -124,8 +131,7 @@ export function SubscriptionLinkDialog({
                     value={autoUpdateHours}
                     onChange={(e) => setAutoUpdateHours(Number(e.target.value))}
                   />
-                  <p className="text-xs text-white/45">最小 {minAutoUpdateLabel}，按创建时间计时</p>
-                </div>
+                </FormField>
               )}
             </div>
 
@@ -149,12 +155,12 @@ export function SubscriptionLinkDialog({
         ) : (
           <div className="space-y-4 py-4">
             <div className="space-y-2">
-              <label className="text-sm font-medium">订阅链接</label>
+              <p className="text-sm font-medium">订阅链接</p>
               <div className="flex gap-2">
                 <Input value={subscriptionUrl} readOnly className="font-mono text-xs" />
-                <Button
+                <IconButton
+                  label={copied ? "已复制订阅链接" : "复制订阅链接"}
                   variant="outline"
-                  size="icon"
                   onClick={handleCopyUrl}
                   className="flex-shrink-0"
                 >
@@ -163,7 +169,7 @@ export function SubscriptionLinkDialog({
                   ) : (
                     <Copy className="h-4 w-4" />
                   )}
-                </Button>
+                </IconButton>
               </div>
             </div>
 
diff --git a/packages/ui/src/product/preview/diff-highlight.test.ts b/packages/ui/src/product/preview/diff-highlight.test.ts
index de78259..a8b0861 100644
--- a/packages/ui/src/product/preview/diff-highlight.test.ts
+++ b/packages/ui/src/product/preview/diff-highlight.test.ts
@@ -7,7 +7,8 @@ const reactMocks = vi.hoisted(() => ({
   useState: vi.fn((initial: unknown) => [initial, vi.fn()]),
 }));
 
-vi.mock("react", () => ({
+vi.mock("react", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("react")>()),
   useMemo: reactMocks.useMemo,
   useEffect: reactMocks.useEffect,
   useState: reactMocks.useState,
diff --git a/packages/ui/src/product/preview/diff-highlight.tsx b/packages/ui/src/product/preview/diff-highlight.tsx
index 3c6ee8e..727e364 100644
--- a/packages/ui/src/product/preview/diff-highlight.tsx
+++ b/packages/ui/src/product/preview/diff-highlight.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import * as React from "react";
+import { Button } from "@subboost/ui/components/ui/button";
 import { cn } from "@subboost/ui/lib/utils";
 
 /**
@@ -88,21 +89,25 @@ export function YamlHighlight({ content, className }: { content: string; classNa
                 `（${renderStats.lineCount} 行 / ${renderStats.charCount} 字符）`}
             </span>
             {forceHighlight ? (
-              <button
+              <Button
                 type="button"
+                variant="outline"
+                size="sm"
                 onClick={() => setForceHighlight(false)}
-                className="rounded border border-amber-300/40 px-2 py-0.5 text-[10px] text-amber-100 transition-colors hover:bg-amber-300/10"
+                className="h-auto rounded border-amber-300/40 px-2 py-0.5 text-[10px] text-amber-100 hover:bg-amber-300/10"
               >
                 恢复纯文本
-              </button>
+              </Button>
             ) : (
-              <button
+              <Button
                 type="button"
+                variant="outline"
+                size="sm"
                 onClick={() => setForceHighlight(true)}
-                className="rounded border border-amber-300/40 px-2 py-0.5 text-[10px] text-amber-100 transition-colors hover:bg-amber-300/10"
+                className="h-auto rounded border-amber-300/40 px-2 py-0.5 text-[10px] text-amber-100 hover:bg-amber-300/10"
               >
                 强制语法高亮
-              </button>
+              </Button>
             )}
           </div>
         </div>
diff --git a/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.test.ts b/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.test.ts
index 3f77bbc..f813183 100644
--- a/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.test.ts
+++ b/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.test.ts
@@ -202,24 +202,25 @@ describe("ProxyGroupsPreview", () => {
     vi.useFakeTimers();
     const props = makeProps({ dragOverGroup: null });
     const tree = renderTree(props);
-    const buttons = collectElements(tree, (element) => element.type === "button");
+    const groupRows = collectElements(tree, (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
+    const disclosureButtons = collectElements(tree, (element) => element.type === "button" && "aria-expanded" in element.props);
 
-    buttons[0].props.onClick();
+    disclosureButtons[0].props.onClick();
     expect(props.onToggleExpand).toHaveBeenCalledWith("module:select");
 
-    const rejectButton = buttons[3];
+    const rejectRow = groupRows[3];
     const dragEvent = {
       clientY: 25,
       currentTarget: { getBoundingClientRect: () => ({ top: 10, height: 20 }) },
       dataTransfer: { getData: vi.fn(() => "module:auto"), dropEffect: "" },
       preventDefault: vi.fn(),
     };
-    rejectButton.props.onDragOver(dragEvent);
+    rejectRow.props.onDragOver(dragEvent);
     expect(dragEvent.preventDefault).toHaveBeenCalled();
     expect(dragEvent.dataTransfer.dropEffect).toBe("move");
     expect(props.onSetDragOverGroup).toHaveBeenCalledWith({ id: "custom:reject", position: "after" });
 
-    rejectButton.props.onDrop(dragEvent);
+    rejectRow.props.onDrop(dragEvent);
     expect(props.onSetProxyGroupOrder).toHaveBeenCalledWith([
       "module:select",
       "dialer:relay",
@@ -232,8 +233,8 @@ describe("ProxyGroupsPreview", () => {
     expect(props.onSetDraggingGroupId).toHaveBeenLastCalledWith(null);
 
     const dragLeaveProps = makeProps({ dragOverGroup: { id: "custom:reject", position: "before" } });
-    const dragLeaveButtons = collectElements(renderTree(dragLeaveProps), (element) => element.type === "button");
-    dragLeaveButtons[3].props.onDragLeave();
+    const dragLeaveRows = collectElements(renderTree(dragLeaveProps), (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
+    dragLeaveRows[3].props.onDragLeave();
     expect(dragLeaveProps.onSetDragOverGroup).toHaveBeenCalledWith(null);
 
     const remove = vi.fn();
@@ -243,7 +244,7 @@ describe("ProxyGroupsPreview", () => {
       getBoundingClientRect: () => ({ width: 320 }),
     };
     vi.stubGlobal("document", { body: { appendChild: vi.fn() } });
-    const handles = collectElements(tree, (element) => element.type === "span" && element.props.title === "拖动排序");
+    const handles = collectElements(tree, (element) => element.type === "button" && element.props.title === "拖动排序（也可用方向键）");
     const stopPropagation = vi.fn();
     handles[0].props.onDragStart({
       currentTarget: { closest: vi.fn(() => card) },
@@ -261,8 +262,7 @@ describe("ProxyGroupsPreview", () => {
     vi.runAllTimers();
     expect(remove).toHaveBeenCalled();
 
-    handles[0].props.onPointerDown({ stopPropagation });
-    handles[0].props.onClick({ stopPropagation });
+    handles[0].props.onKeyDown({ key: "ArrowDown", preventDefault: vi.fn() });
     handles[0].props.onDragEnd();
     expect(props.onSetDragOverGroup).toHaveBeenLastCalledWith(null);
     expect(props.onSetDraggingGroupId).toHaveBeenLastCalledWith(null);
@@ -274,7 +274,7 @@ describe("ProxyGroupsPreview", () => {
       draggingGroupId: null,
       dragOverGroup: null,
     });
-    const buttons = collectElements(renderTree(props), (element) => element.type === "button");
+    const groupRows = collectElements(renderTree(props), (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
     const event = {
       clientY: 0,
       currentTarget: { getBoundingClientRect: () => ({ top: 0, height: 20 }) },
@@ -282,22 +282,22 @@ describe("ProxyGroupsPreview", () => {
       preventDefault: vi.fn(),
     };
 
-    buttons[0].props.onDragOver(event);
-    buttons[0].props.onDrop(event);
+    groupRows[0].props.onDragOver(event);
+    groupRows[0].props.onDrop(event);
 
     expect(event.preventDefault).not.toHaveBeenCalled();
     expect(props.onSetProxyGroupOrder).not.toHaveBeenCalled();
     expect(props.onSetDragOverGroup).not.toHaveBeenCalled();
 
     const sameActiveProps = makeProps({ draggingGroupId: "module:select", dragOverGroup: { id: "module:select", position: "before" } });
-    const sameActiveButtons = collectElements(renderTree(sameActiveProps), (element) => element.type === "button");
-    sameActiveButtons[0].props.onDragOver({
+    const sameActiveRows = collectElements(renderTree(sameActiveProps), (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
+    sameActiveRows[0].props.onDragOver({
       clientY: 0,
       currentTarget: { getBoundingClientRect: () => ({ top: 0, height: 20 }) },
       dataTransfer: { getData: vi.fn(() => "module:select"), dropEffect: "" },
       preventDefault: vi.fn(),
     });
-    sameActiveButtons[0].props.onDrop({
+    sameActiveRows[0].props.onDrop({
       clientY: 0,
       currentTarget: { getBoundingClientRect: () => ({ top: 0, height: 20 }) },
       dataTransfer: { getData: vi.fn(() => "module:select"), dropEffect: "" },
@@ -309,8 +309,8 @@ describe("ProxyGroupsPreview", () => {
       draggingGroupId: "module:auto",
       dragOverGroup: { id: "custom:reject", position: "after" },
     });
-    const unchangedButtons = collectElements(renderTree(unchangedDragOverProps), (element) => element.type === "button");
-    unchangedButtons[3].props.onDragOver({
+    const unchangedRows = collectElements(renderTree(unchangedDragOverProps), (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
+    unchangedRows[3].props.onDragOver({
       clientY: 25,
       currentTarget: { getBoundingClientRect: () => ({ top: 10, height: 20 }) },
       dataTransfer: { getData: vi.fn(() => "module:auto"), dropEffect: "" },
@@ -321,7 +321,7 @@ describe("ProxyGroupsPreview", () => {
     vi.useFakeTimers();
     const dragStartProps = makeProps();
     const dragStartTree = renderTree(dragStartProps);
-    const handles = collectElements(dragStartTree, (element) => element.type === "span" && element.props.title === "拖动排序");
+    const handles = collectElements(dragStartTree, (element) => element.type === "button" && element.props.title === "拖动排序（也可用方向键）");
     handles[0].props.onDragStart({
       currentTarget: { closest: vi.fn(() => null) },
       dataTransfer: {
@@ -359,7 +359,7 @@ describe("ProxyGroupsPreview", () => {
       draggingGroupId: null,
       dragOverGroup: null,
     });
-    const buttons = collectElements(renderTree(props), (element) => element.type === "button");
+    const groupRows = collectElements(renderTree(props), (element) => element.props.role === "group" && typeof element.props.onDragOver === "function");
     const beforeEvent = {
       clientY: 5,
       currentTarget: { getBoundingClientRect: () => ({ top: 0, height: 20 }) },
@@ -367,11 +367,11 @@ describe("ProxyGroupsPreview", () => {
       preventDefault: vi.fn(),
     };
 
-    buttons[3].props.onDragOver(beforeEvent);
+    groupRows[3].props.onDragOver(beforeEvent);
     expect(beforeEvent.preventDefault).toHaveBeenCalled();
     expect(props.onSetDragOverGroup).toHaveBeenCalledWith({ id: "custom:reject", position: "before" });
 
-    buttons[3].props.onDrop(beforeEvent);
+    groupRows[3].props.onDrop(beforeEvent);
     expect(props.onSetProxyGroupOrder).toHaveBeenCalledWith([
       "module:select",
       "dialer:relay",
@@ -381,7 +381,7 @@ describe("ProxyGroupsPreview", () => {
       "custom:fallback",
     ]);
 
-    buttons[0].props.onDragLeave();
+    groupRows[0].props.onDragLeave();
     expect(props.onSetDragOverGroup).not.toHaveBeenCalledWith({ id: "module:select", position: expect.any(String) });
 
     const singleProps = makeProps({
@@ -389,7 +389,7 @@ describe("ProxyGroupsPreview", () => {
       draggingGroupId: null,
       dragOverGroup: null,
     });
-    const singleHandles = collectElements(renderTree(singleProps), (element) => element.type === "span" && element.props.title === "拖动排序");
+    const singleHandles = collectElements(renderTree(singleProps), (element) => element.type === "button" && element.props.title === "拖动排序（也可用方向键）");
     singleHandles[0].props.onDragStart({
       currentTarget: { closest: vi.fn() },
       dataTransfer: {
diff --git a/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.tsx b/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.tsx
index 3e44fff..42895e3 100644
--- a/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.tsx
+++ b/packages/ui/src/product/preview/visual-graph/proxy-groups-preview.tsx
@@ -185,8 +185,9 @@ export function ProxyGroupsPreview({
                 )}
               />
             )}
-            <button
-              onClick={() => hasRules && onToggleExpand(group.id)}
+            <div
+              role="group"
+              aria-label={`${getDisplayName(group.name)} 代理组`}
               onDragOver={(e) => {
                 if (!canReorderGroups) return;
                 const activeId = (
@@ -243,11 +244,12 @@ export function ProxyGroupsPreview({
               }}
               className={cn(
                 "w-full flex items-center gap-2 p-2 text-left",
-                hasRules && "cursor-pointer hover:bg-white/5",
               )}
             >
-              <span
+              <button
+                type="button"
                 draggable={canReorderGroups}
+                disabled={!canReorderGroups}
                 onDragStart={(e) => {
                   if (!canReorderGroups) return;
                   e.stopPropagation();
@@ -287,16 +289,24 @@ export function ProxyGroupsPreview({
                   onSetDraggingGroupId(null);
                   onSetDragOverGroup(null);
                 }}
-                onPointerDown={(e) => e.stopPropagation()}
-                onClick={(e) => e.stopPropagation()}
+                onKeyDown={(event) => {
+                  if (!canReorderGroups || (event.key !== "ArrowUp" && event.key !== "ArrowDown")) return;
+                  event.preventDefault();
+                  const currentIndex = displayGroups.findIndex((item) => item.id === group.id);
+                  const targetIndex = event.key === "ArrowUp" ? currentIndex - 1 : currentIndex + 1;
+                  if (currentIndex < 0 || targetIndex < 0 || targetIndex >= displayGroups.length) return;
+                  const nextOrder = displayGroups.map((item) => item.id);
+                  [nextOrder[currentIndex], nextOrder[targetIndex]] = [nextOrder[targetIndex], nextOrder[currentIndex]];
+                  onSetProxyGroupOrder(nextOrder);
+                }}
                 className={cn(
-                  "flex h-4 w-4 items-center justify-center text-white/40 hover:text-white/70",
+                  "ml-2 flex h-6 w-6 flex-none items-center justify-center text-white/40 hover:text-white/70 disabled:opacity-30",
                   canReorderGroups
                     ? "cursor-grab active:cursor-grabbing"
                     : "cursor-default opacity-30",
                 )}
-                title="拖动排序"
-                aria-label="拖动排序"
+                title="拖动排序（也可用方向键）"
+                aria-label="调整代理组顺序"
               >
                 <span className="grid grid-cols-2 gap-0.5">
                   {Array.from({ length: 6 }).map((_, i) => (
@@ -306,7 +316,15 @@ export function ProxyGroupsPreview({
                     />
                   ))}
                 </span>
-              </span>
+              </button>
+
+              <button
+                type="button"
+                onClick={() => onToggleExpand(group.id)}
+                disabled={!hasRules}
+                aria-expanded={hasRules ? isExpanded : undefined}
+                className="flex min-w-0 flex-1 items-center gap-2 py-2 pr-2 text-left disabled:cursor-default"
+              >
 
               {hasRules ? (
                 isExpanded ? (
@@ -345,7 +363,8 @@ export function ProxyGroupsPreview({
                   </span>
                 )}
               </div>
-            </button>
+              </button>
+            </div>
 
             {isDialerGroup && (
               <div className="border-t border-white/10 p-2">
diff --git a/packages/ui/src/templates/template-card.test.ts b/packages/ui/src/templates/template-card.test.ts
index a868f5b..a917343 100644
--- a/packages/ui/src/templates/template-card.test.ts
+++ b/packages/ui/src/templates/template-card.test.ts
@@ -108,12 +108,12 @@ describe("TemplateCard", () => {
     expect(html).toContain("公开");
     expect(html).toContain("使用");
 
-    mocks.captures.buttons.find((button) => button.title === "删除").onClick();
+    mocks.captures.buttons.find((button) => button.title === "删除模板").onClick();
     expect(props.onDelete).toHaveBeenCalled();
     mocks.captures.buttons.find((button) => button.children?.includes?.("使用")).onClick();
     expect(props.onApply).toHaveBeenCalled();
 
-    const engageButton = mocks.captures.nativeButtons.find((button) => button.title === "取消收藏");
+    const engageButton = mocks.captures.buttons.find((button) => button.title === "取消收藏");
     expect(engageButton.disabled).toBe(false);
     expect(engageButton.className).toContain("text-red-400");
     engageButton.onClick();
@@ -140,10 +140,10 @@ describe("TemplateCard", () => {
     expect(html).toContain("私有");
     expect(html).toContain("应用中");
     expect(html).toContain("loader-icon");
-    expect(mocks.captures.buttons.some((button) => button.title === "删除")).toBe(false);
+    expect(mocks.captures.buttons.some((button) => button.title === "删除模板")).toBe(false);
     expect(mocks.captures.buttons.find((button) => button.children?.includes?.("应用中")).disabled).toBe(true);
 
-    const engageButton = mocks.captures.nativeButtons.find((button) => button.title === "登录后可收藏");
+    const engageButton = mocks.captures.buttons.find((button) => button.title === "登录后可收藏");
     expect(engageButton.disabled).toBe(true);
     expect(engageButton.className).toContain("cursor-not-allowed");
   });
@@ -157,7 +157,7 @@ describe("TemplateCard", () => {
 
     expect(html).not.toContain("公开");
     expect(html).not.toContain("私有");
-    expect(mocks.captures.buttons.some((button) => button.title === "删除")).toBe(false);
-    expect(mocks.captures.nativeButtons).toEqual([]);
+    expect(mocks.captures.buttons.some((button) => button.title === "删除模板")).toBe(false);
+    expect(mocks.captures.buttons.some((button) => button.title === "登录后可收藏")).toBe(false);
   });
 });
diff --git a/packages/ui/src/templates/template-card.tsx b/packages/ui/src/templates/template-card.tsx
index bfc6d6d..3ca19ad 100644
--- a/packages/ui/src/templates/template-card.tsx
+++ b/packages/ui/src/templates/template-card.tsx
@@ -13,6 +13,7 @@ import {
   Trash2,
 } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { IconButton } from "@subboost/ui/components/ui/icon-button";
 import { Card, CardContent } from "@subboost/ui/components/ui/card";
 import { cn } from "@subboost/ui/lib/utils";
 import type { Template } from "./types";
@@ -58,15 +59,14 @@ export function TemplateCard({
           </div>
           <div className="flex items-center gap-2 flex-shrink-0">
             {showDelete && onDelete && (
-              <Button
+              <IconButton
+                label="删除模板"
                 variant="outline"
-                size="icon"
                 onClick={onDelete}
-                title="删除"
                 className="h-8 w-8 border-white/10 hover:border-red-500/40 hover:text-red-400"
               >
                 <Trash2 className="h-4 w-4" />
-              </Button>
+              </IconButton>
             )}
             <Button size="sm" onClick={onApply} disabled={isApplying} className="gap-1">
               {isApplying ? <Loader2 className="h-4 w-4 animate-spin" /> : <CheckCircle className="h-4 w-4" />}
@@ -91,11 +91,14 @@ export function TemplateCard({
           </span>
 
           {showEngagement && (
-            <button
+            <Button
+              type="button"
+              variant="ghost"
+              size="sm"
               onClick={onEngage}
               disabled={!isLoggedIn}
               className={cn(
-                "inline-flex items-center gap-1 transition-colors",
+                "h-auto gap-1 p-0 transition-colors hover:bg-transparent",
                 template.isEngaged ? "text-red-400" : "hover:text-red-400",
                 !isLoggedIn && "cursor-not-allowed opacity-50"
               )}
@@ -103,7 +106,7 @@ export function TemplateCard({
             >
               <Heart className={cn("h-3.5 w-3.5", template.isEngaged && "fill-current")} />
               {formatNumber(template.engagementCount)}
-            </button>
+            </Button>
           )}
 
           <span className="inline-flex items-center gap-1">
diff --git a/packages/ui/src/templates/template-upload-dialog.test.ts b/packages/ui/src/templates/template-upload-dialog.test.ts
index 6ec7666..be687c1 100644
--- a/packages/ui/src/templates/template-upload-dialog.test.ts
+++ b/packages/ui/src/templates/template-upload-dialog.test.ts
@@ -4,9 +4,11 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
   buttons: [] as any[],
+  choiceChips: [] as any[],
   dialogs: [] as any[],
   inputs: [] as any[],
   rawButtons: [] as any[],
+  switchFields: [] as any[],
   textareas: [] as any[],
 }));
 
@@ -40,6 +42,19 @@ vi.mock("@subboost/ui/components/ui/button", () => ({
     return React.createElement("button", props, props.children);
   },
 }));
+vi.mock("@subboost/ui/components/ui/choice-group", () => ({
+  ChoiceGroup: (props: any) => React.createElement("div", null, props.children),
+  ChoiceChip: (props: any) => {
+    mocks.choiceChips.push(props);
+    return React.createElement("button", { onClick: props.onClick, disabled: props.disabled }, props.label);
+  },
+}));
+vi.mock("@subboost/ui/components/ui/switch-field", () => ({
+  SwitchField: (props: any) => {
+    mocks.switchFields.push(props);
+    return React.createElement("div", null, props.label, props.description);
+  },
+}));
 vi.mock("@subboost/ui/components/ui/dialog", () => ({
   Dialog: (props: any) => {
     mocks.dialogs.push(props);
@@ -69,9 +84,11 @@ import { TemplateUploadDialog } from "./template-upload-dialog";
 
 function renderDialog(overrides: Partial<React.ComponentProps<typeof TemplateUploadDialog>> = {}) {
   mocks.buttons = [];
+  mocks.choiceChips = [];
   mocks.dialogs = [];
   mocks.inputs = [];
   mocks.rawButtons = [];
+  mocks.switchFields = [];
   mocks.textareas = [];
   const props = {
     open: true,
@@ -113,10 +130,10 @@ describe("TemplateUploadDialog", () => {
 
     mocks.inputs[0].onChange({ target: { value: "New template" } });
     mocks.textareas[0].onChange({ target: { value: "New description" } });
-    mocks.buttons.find((button) => button.children === "配置模板").onClick();
-    mocks.buttons.find((button) => button.children === "YAML（开发中）").onClick();
-    mocks.rawButtons[0].onClick();
-    mocks.rawButtons[1].onClick();
+    mocks.choiceChips.find((chip) => chip.label === "配置模板").onClick();
+    mocks.choiceChips.find((chip) => chip.label === "YAML（开发中）").onClick();
+    mocks.switchFields[0].onCheckedChange(true);
+    mocks.switchFields[1].onCheckedChange(true);
     mocks.buttons.at(-2).onClick();
     mocks.buttons.at(-1).onClick();
 
@@ -167,8 +184,8 @@ describe("TemplateUploadDialog", () => {
     expect(html).toContain("公开模板");
     expect(html).toContain("其他用户可以搜索和使用此模板");
     expect(html).toContain("globe-icon");
-    expect(mocks.rawButtons).toHaveLength(1);
-    mocks.rawButtons[0].onClick();
+    expect(mocks.switchFields).toHaveLength(1);
+    mocks.switchFields[0].onCheckedChange(false);
     expect(props.onPublicChange).toHaveBeenCalledWith(false);
   });
 
@@ -180,7 +197,7 @@ describe("TemplateUploadDialog", () => {
 
     expect(html).toContain("默认模板");
     expect(html).toContain("将展示在默认模板中");
-    mocks.rawButtons[1].onClick();
+    expect(mocks.switchFields[1]).toEqual(expect.objectContaining({ disabled: true }));
     expect(props.onPublicChange).not.toHaveBeenCalled();
   });
 });
diff --git a/packages/ui/src/templates/template-upload-dialog.tsx b/packages/ui/src/templates/template-upload-dialog.tsx
index 6c8092c..b7a6d32 100644
--- a/packages/ui/src/templates/template-upload-dialog.tsx
+++ b/packages/ui/src/templates/template-upload-dialog.tsx
@@ -2,6 +2,7 @@
 
 import { Globe, Loader2, Lock, Upload } from "lucide-react";
 import { Button } from "@subboost/ui/components/ui/button";
+import { ChoiceChip, ChoiceGroup } from "@subboost/ui/components/ui/choice-group";
 import {
   Dialog,
   DialogContent,
@@ -11,7 +12,9 @@ import {
   DialogTitle,
 } from "@subboost/ui/components/ui/dialog";
 import { Input } from "@subboost/ui/components/ui/input";
+import { FormField } from "@subboost/ui/components/ui/form-field";
 import { Textarea } from "@subboost/ui/components/ui/textarea";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { cn } from "@subboost/ui/lib/utils";
 
 type UploadMode = "config" | "yaml";
@@ -78,18 +81,16 @@ export function TemplateUploadDialog({
         </DialogHeader>
 
         <div className="space-y-4 py-4">
-          <div className="space-y-2">
-            <label className="text-sm font-medium">模板名称 *</label>
+          <FormField label="模板名称" required>
             <Input
               placeholder="例如：流媒体优化配置"
               value={name}
               onChange={(event) => onNameChange(event.target.value)}
               maxLength={100}
             />
-          </div>
+          </FormField>
 
-          <div className="space-y-2">
-            <label className="text-sm font-medium">描述（可选）</label>
+          <FormField label="描述（可选）">
             <Textarea
               placeholder="简要描述模板的特点和适用场景..."
               value={description}
@@ -97,29 +98,23 @@ export function TemplateUploadDialog({
               className="min-h-[80px]"
               maxLength={500}
             />
-          </div>
+          </FormField>
 
           <div className="space-y-2">
-            <label className="text-sm font-medium">模板类型</label>
-            <div className="flex items-center gap-2">
-              <Button
-                type="button"
-                variant={mode === "config" ? "default" : "outline"}
-                size="sm"
+            <p className="text-sm font-medium">模板类型</p>
+            <ChoiceGroup label="模板类型">
+              <ChoiceChip
+                selected={mode === "config"}
+                label="配置模板"
                 onClick={() => onModeChange("config")}
-              >
-                配置模板
-              </Button>
-              <Button
-                type="button"
-                variant={mode === "yaml" ? "default" : "outline"}
-                size="sm"
+              />
+              <ChoiceChip
+                selected={mode === "yaml"}
+                label="YAML（开发中）"
                 onClick={() => onModeChange("yaml")}
-                disabled={true}
-              >
-                YAML（开发中）
-              </Button>
-            </div>
+                disabled
+              />
+            </ChoiceGroup>
             {mode === "config" ? (
               <p className="text-xs text-white/50">
                 将保存你当前的配置器设置（模板/分组/规则/DNS/自定义分流/中转等），不包含节点，可直接“使用”应用到配置器。
@@ -130,16 +125,11 @@ export function TemplateUploadDialog({
           </div>
 
           {userIsAdmin && (
-            <div className="flex items-center justify-between p-3 rounded-lg bg-white/5 border border-white/10">
-              <div className="min-w-0">
-                <div className="text-sm font-medium">作为默认模板</div>
-                <div className="text-xs text-white/50">
-                  开启后将发布到“默认模板”（公开）
-                </div>
-              </div>
-              <button
-                type="button"
-                onClick={() => {
+            <SwitchField
+              label="作为默认模板"
+              description="开启后将发布到“默认模板”（公开）"
+              checked={asDefault}
+              onCheckedChange={() => {
                   const next = !asDefault;
                   onDefaultChange(next);
                   if (next) {
@@ -148,71 +138,41 @@ export function TemplateUploadDialog({
                     onYamlContentChange("");
                   }
                 }}
-                className={cn(
-                  "relative w-10 h-5 rounded-full transition-colors flex-shrink-0",
-                  asDefault ? "bg-primary-500" : "bg-white/20"
-                )}
-              >
-                <span
-                  className={cn(
-                    "absolute top-0.5 left-0.5 w-4 h-4 rounded-full bg-white shadow transition-all duration-200",
-                    asDefault && "translate-x-5"
-                  )}
-                />
-              </button>
-            </div>
+            />
           )}
 
           {mode === "yaml" && (
-            <div className="space-y-2">
-              <label className="text-sm font-medium">配置内容（YAML）*</label>
+            <FormField
+              label="配置内容（YAML）"
+              description="注意：系统会自动移除实际节点信息，只保留配置结构"
+              required
+            >
               <Textarea
                 placeholder="粘贴您的 YAML 配置内容..."
                 value={yamlContent}
                 onChange={(event) => onYamlContentChange(event.target.value)}
                 className="min-h-[150px] font-mono text-xs"
               />
-              <p className="text-xs text-white/50">
-                注意：系统会自动移除实际节点信息，只保留配置结构
-              </p>
-            </div>
+            </FormField>
           )}
 
           {showVisibilityControls && (
-            <div className="flex items-center justify-between p-3 rounded-lg bg-white/5 border border-white/10">
-              <div className="flex items-center gap-2">
+            <SwitchField
+              label={
+                <span className="flex items-center gap-2">
                 {asDefault || isPublic ? (
                   <Globe className="h-4 w-4 text-green-400" />
                 ) : (
                   <Lock className="h-4 w-4 text-white/50" />
                 )}
-                <div>
-                  <div className="text-sm font-medium">{visibilityLabel}</div>
-                  <div className="text-xs text-white/50">{visibilityDescription}</div>
-                </div>
-              </div>
-              <button
-                onClick={() => {
-                  if (asDefault) return;
-                  onPublicChange(!isPublic);
-                }}
-                className={cn(
-                  "relative w-10 h-5 rounded-full transition-colors flex-shrink-0",
-                  asDefault
-                    ? "bg-green-500 opacity-60 cursor-not-allowed"
-                    : isPublic
-                      ? "bg-green-500"
-                      : "bg-white/20"
-                )}
-              >
-                <span
-                  className={cn(
-                    "absolute top-0.5 left-0.5 w-4 h-4 rounded-full bg-white shadow transition-all duration-200",
-                    (asDefault || isPublic) && "translate-x-5"
-                  )}
-                />
-              </button>
-            </div>
+                  {visibilityLabel}
+                </span>
+              }
+              description={visibilityDescription}
+              checked={asDefault || isPublic}
+              disabled={asDefault}
+              onCheckedChange={(checked) => onPublicChange(checked)}
+            />
           )}
         </div>
 
diff --git a/scripts/check-ui-consistency.cjs b/scripts/check-ui-consistency.cjs
new file mode 100644
index 0000000..994452d
--- /dev/null
+++ b/scripts/check-ui-consistency.cjs
@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+
+const fs = require("node:fs");
+const path = require("node:path");
+const ts = require("typescript");
+
+const workspaceRoot = process.cwd();
+const requestedRoots = process.argv.slice(2);
+const roots = (requestedRoots.length > 0 ? requestedRoots : ["packages", "local"])
+  .map((entry) => path.resolve(workspaceRoot, entry))
+  .filter((entry) => fs.existsSync(entry));
+
+const ignoredDirectoryNames = new Set([".next", "dist", "generated", "node_modules"]);
+const findings = [];
+
+function normalizePath(filePath) {
+  return filePath.replaceAll("\\", "/");
+}
+
+function isIgnoredFile(filePath) {
+  const normalized = normalizePath(filePath);
+  return (
+    /\.(test|spec)\.[jt]sx?$/.test(normalized) ||
+    normalized.includes("/__tests__/") ||
+    normalized.includes("/components/ui/radix-")
+  );
+}
+
+function collectFiles(entry, output) {
+  const stat = fs.statSync(entry);
+  if (stat.isFile()) {
+    if (/\.[jt]sx?$/.test(entry) && !isIgnoredFile(entry)) output.push(entry);
+    return;
+  }
+
+  for (const item of fs.readdirSync(entry, { withFileTypes: true })) {
+    if (item.isDirectory() && ignoredDirectoryNames.has(item.name)) continue;
+    collectFiles(path.join(entry, item.name), output);
+  }
+}
+
+function tagName(node) {
+  return node.tagName?.getText() ?? "";
+}
+
+function attributesOf(node) {
+  return node.attributes?.properties ?? [];
+}
+
+function findAttribute(node, name) {
+  return attributesOf(node).find(
+    (attribute) => ts.isJsxAttribute(attribute) && attribute.name.getText() === name
+  );
+}
+
+function hasDescendantTag(node, prohibitedNames) {
+  let found = false;
+  function visit(child) {
+    if (found) return;
+    if ((ts.isJsxElement(child) || ts.isJsxSelfClosingElement(child)) && prohibitedNames.has(tagName(child.openingElement ?? child))) {
+      found = true;
+      return;
+    }
+    ts.forEachChild(child, visit);
+  }
+  for (const child of node.children ?? []) visit(child);
+  return found;
+}
+
+function report(sourceFile, node, message) {
+  const position = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+  findings.push({
+    file: path.relative(workspaceRoot, sourceFile.fileName),
+    line: position.line + 1,
+    column: position.character + 1,
+    message,
+  });
+}
+
+function checkFile(filePath) {
+  const sourceText = fs.readFileSync(filePath, "utf8");
+  const sourceFile = ts.createSourceFile(filePath, sourceText, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+  const normalized = normalizePath(filePath);
+  const isUiWrapper = normalized.includes("/components/ui/");
+  const isIconButtonWrapper = normalized.endsWith("/components/ui/icon-button.tsx");
+  const isSwitchFieldWrapper = normalized.endsWith("/components/ui/switch-field.tsx");
+
+  function visit(node) {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      const moduleName = node.moduleSpecifier.text;
+      if (moduleName.startsWith("@radix-ui/react-") && !isUiWrapper) {
+        report(sourceFile, node, `业务代码不得直接导入 ${moduleName}，请使用共享 UI 包装组件`);
+      }
+    }
+
+    if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node)) {
+      const opening = ts.isJsxElement(node) ? node.openingElement : node;
+      const name = tagName(opening);
+
+      if ((name === "Link" || name === "a") && ts.isJsxElement(node) && hasDescendantTag(node, new Set(["Button", "button"]))) {
+        report(sourceFile, opening, `${name} 内不得嵌套 Button/button；请使用 Button 或 IconButton 的 asChild`);
+      }
+
+      if (name === "Button" && !isIconButtonWrapper) {
+        const size = findAttribute(opening, "size");
+        if (size?.initializer && ts.isStringLiteral(size.initializer) && size.initializer.text === "icon") {
+          report(sourceFile, opening, '业务代码不得直接使用 Button size="icon"；请使用 IconButton');
+        }
+      }
+
+      if (name === "Switch" && !isSwitchFieldWrapper) {
+        const hasAccessibleName = Boolean(
+          findAttribute(opening, "aria-label") || findAttribute(opening, "aria-labelledby")
+        );
+        if (!hasAccessibleName) {
+          report(sourceFile, opening, "裸 Switch 必须提供 aria-label 或 aria-labelledby");
+        }
+      }
+    }
+
+    ts.forEachChild(node, visit);
+  }
+
+  visit(sourceFile);
+}
+
+const files = [];
+for (const root of roots) collectFiles(root, files);
+for (const file of files) checkFile(file);
+
+if (findings.length > 0) {
+  for (const finding of findings) {
+    console.error(`${finding.file}:${finding.line}:${finding.column} ${finding.message}`);
+  }
+  console.error(`\nUI consistency check failed with ${findings.length} finding(s).`);
+  process.exit(1);
+}
+
+console.log(`UI consistency check passed (${files.length} source files scanned).`);

From a9d6437bc8bfe749528d16a999274da8bb0471ac Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sat, 18 Jul 2026 15:47:26 +0800
Subject: [PATCH 28/36] fix(ui): align form field aria prop types

---
 packages/ui/src/components/ui/form-field.tsx | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/packages/ui/src/components/ui/form-field.tsx b/packages/ui/src/components/ui/form-field.tsx
index 92a071b..9cfc3b9 100644
--- a/packages/ui/src/components/ui/form-field.tsx
+++ b/packages/ui/src/components/ui/form-field.tsx
@@ -7,8 +7,8 @@ import { cn } from "@subboost/ui/lib/utils";
 type FormFieldControlProps = {
   id?: string;
   "aria-describedby"?: string;
-  "aria-invalid"?: boolean;
-  "aria-required"?: boolean;
+  "aria-invalid"?: React.AriaAttributes["aria-invalid"];
+  "aria-required"?: React.AriaAttributes["aria-required"];
 };
 
 export interface FormFieldProps {
@@ -18,7 +18,7 @@ export interface FormFieldProps {
   error?: React.ReactNode;
   required?: boolean;
   className?: string;
-  children: React.ReactElement<FormFieldControlProps>;
+  children?: React.ReactElement<FormFieldControlProps>;
 }
 
 function mergeIds(...values: Array<string | undefined>) {
@@ -34,26 +34,27 @@ function FormField({
   className,
   children,
 }: FormFieldProps) {
+  const controlChild = React.Children.only(children) as React.ReactElement<FormFieldControlProps>;
   const generatedId = React.useId();
   const controlId = id ?? `form-field-${generatedId.replaceAll(":", "")}`;
   const descriptionId = description ? `${controlId}-description` : undefined;
   const errorId = error ? `${controlId}-error` : undefined;
   const describedBy = mergeIds(
-    children.props["aria-describedby"],
+    controlChild.props["aria-describedby"],
     descriptionId,
     errorId
   );
 
-  const control = React.cloneElement(children, {
-    id: children.props.id ?? controlId,
+  const control = React.cloneElement(controlChild, {
+    id: controlChild.props.id ?? controlId,
     "aria-describedby": describedBy,
-    "aria-invalid": error ? true : children.props["aria-invalid"],
-    "aria-required": required || children.props["aria-required"] || undefined,
+    "aria-invalid": error ? true : controlChild.props["aria-invalid"],
+    "aria-required": required || controlChild.props["aria-required"] || undefined,
   });
 
   return (
     <div className={cn("space-y-2", className)}>
-      <Label htmlFor={children.props.id ?? controlId}>
+      <Label htmlFor={controlChild.props.id ?? controlId}>
         {label}
         {required ? <span aria-hidden="true" className="ml-1 text-red-400">*</span> : null}
       </Label>

From dbc0eef3e31c66e2c4be39ca5a423b4c47e07bc2 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sat, 18 Jul 2026 15:55:06 +0800
Subject: [PATCH 29/36] chore(ui): enforce icon button labels

---
 scripts/check-ui-consistency.cjs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/check-ui-consistency.cjs b/scripts/check-ui-consistency.cjs
index 994452d..39caecd 100644
--- a/scripts/check-ui-consistency.cjs
+++ b/scripts/check-ui-consistency.cjs
@@ -108,6 +108,10 @@ function checkFile(filePath) {
         }
       }
 
+      if (name === "IconButton" && !findAttribute(opening, "label")) {
+        report(sourceFile, opening, "IconButton 必须提供 label");
+      }
+
       if (name === "Switch" && !isSwitchFieldWrapper) {
         const hasAccessibleName = Boolean(
           findAttribute(opening, "aria-label") || findAttribute(opening, "aria-labelledby")

From 5c1ae39ace99dc8f2092531ab11fc03f1852c3ec Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sat, 18 Jul 2026 16:32:40 +0800
Subject: [PATCH 30/36] fix(ui): restore source and advanced mode styling

---
 .../sections/proxy-groups-categories.test.ts  |  8 +++----
 .../sections/proxy-groups-categories.tsx      | 22 ++++++++++---------
 .../src/product/converter/source-controls.tsx |  7 +++++-
 3 files changed, 22 insertions(+), 15 deletions(-)

diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
index 3c922de..cc3ea8c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
@@ -265,11 +265,11 @@ describe("ProxyGroupsCategories", () => {
     expect(mocks.captures.inputs).toHaveLength(0);
     const html = renderCategories({ 0: new Set(["core"]) }).html;
     expect(html).toContain("https://rules.example/base/");
-    expect(html).toContain("grid-cols-[minmax(0,1fr)_128px]");
-    expect(html).not.toContain("md:grid-cols-[minmax(0,1fr)_128px]");
+    expect(html).toContain("grid-cols-[minmax(0,1fr)_96px]");
+    expect(html).not.toContain("md:grid-cols-[minmax(0,1fr)_96px]");
     expect(html).toContain("min-w-0 space-y-1");
-    expect(html).toContain("高级模式");
-    expect(html).toContain("aria-labelledby=\"switch-field-");
+    expect(html).toContain("text-xs text-amber-300");
+    expect(html).toContain('aria-label="高级模式"');
     expect(mocks.store.setRuleProviderBaseUrl).not.toHaveBeenCalled();
 
     expect(mocks.captures.moduleCards).toHaveLength(1);
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
index 3ddf94c..76802dc 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
@@ -5,7 +5,7 @@ import { ChevronDown, ChevronRight, RotateCcw } from "lucide-react";
 import { Badge } from "@subboost/ui/components/ui/badge";
 import { Button } from "@subboost/ui/components/ui/button";
 import { confirmDialog } from "@subboost/ui/components/ui/confirm-dialog";
-import { SwitchField } from "@subboost/ui/components/ui/switch-field";
+import { Switch } from "@subboost/ui/components/ui/switch";
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -299,7 +299,7 @@ export function ProxyGroupsCategories() {
 
   return (
     <>
-      <div className="grid grid-cols-[minmax(0,1fr)_128px] gap-3">
+      <div className="grid grid-cols-[minmax(0,1fr)_96px] gap-3">
         <div className="min-w-0 space-y-1">
           <div className={PROXY_GROUP_SECTION_LABEL_ROW_CLASS}>
             <p className={PROXY_GROUP_SECTION_LABEL_CLASS}>规则集 URL</p>
@@ -311,14 +311,16 @@ export function ProxyGroupsCategories() {
             <span className="block truncate">{ruleProviderBaseUrl}</span>
           </div>
         </div>
-        <div className="min-w-0 self-end">
-          <SwitchField
-            label="高级模式"
-            description={proxyGroupAdvancedModeEnabled ? "已开启" : "未开启"}
-            checked={proxyGroupAdvancedModeEnabled}
-            onCheckedChange={setProxyGroupAdvancedModeEnabled}
-            density="compact"
-          />
+        <div className="min-w-0 space-y-1">
+          <div className={PROXY_GROUP_SECTION_LABEL_ROW_CLASS}>
+            <p className="text-xs text-amber-300">高级模式</p>
+          </div>
+          <div className="flex h-9 w-full items-center justify-center gap-1 rounded-md border border-white/10 bg-white/5 px-2">
+            <span className="text-[10px] text-white/65">
+              {proxyGroupAdvancedModeEnabled ? "已开启" : "未开启"}
+            </span>
+            <Switch checked={proxyGroupAdvancedModeEnabled} onCheckedChange={setProxyGroupAdvancedModeEnabled} aria-label="高级模式" />
+          </div>
         </div>
       </div>
 
diff --git a/packages/ui/src/product/converter/source-controls.tsx b/packages/ui/src/product/converter/source-controls.tsx
index 88ad1d3..36e242d 100644
--- a/packages/ui/src/product/converter/source-controls.tsx
+++ b/packages/ui/src/product/converter/source-controls.tsx
@@ -49,7 +49,12 @@ export function SourceTypeChoices({
                 <span className="sr-only">{info.label}</span>
               </>
             }
-            className="min-h-0 rounded p-1"
+            className={cn(
+              "min-h-0 rounded border-0 p-1",
+              value === type
+                ? "bg-indigo-500/20 text-indigo-400"
+                : "bg-transparent text-white/30 hover:bg-white/5 hover:text-white/50"
+            )}
           />
         );
       })}

From a08c7a39d1b813dd597756e6250c738d235eb00d Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sat, 18 Jul 2026 16:54:27 +0800
Subject: [PATCH 31/36] fix(ui): restore full-row group disclosure

---
 .../dialer-proxy-groups-section.test.ts       |  4 +-
 .../sections/dialer-proxy-groups-section.tsx  | 45 +++++++++--------
 .../sections/proxy-groups-module-card.test.ts | 13 +++++
 .../sections/proxy-groups-module-card.tsx     | 49 +++++++++++--------
 4 files changed, 69 insertions(+), 42 deletions(-)

diff --git a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
index b4e7b32..d1a3bce 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
@@ -446,11 +446,11 @@ describe("DialerProxyGroupsSection", () => {
 
   it("toggles expansion and relay or target membership from native rows", () => {
     let result = renderSection();
-    mocks.captures.iconButtons.find((props: any) => props.label === "展开 Group A").onClick();
+    findIntrinsic("button", (props) => props["aria-label"] === "展开 Group A").onClick();
     expect((result.setters[0] as any).lastValue).toEqual(new Set(["g-a"]));
 
     result = renderSection({ 0: new Set(["g-a"]) });
-    mocks.captures.iconButtons.find((props: any) => props.label === "收起 Group A").onClick();
+    findIntrinsic("button", (props) => props["aria-label"] === "收起 Group A").onClick();
     expect((result.setters[0] as any).lastValue).toEqual(new Set());
 
     renderSection({ 0: new Set(["g-a"]) });
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
index 3011f88..f2da85f 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
@@ -245,22 +245,26 @@ export function DialerProxyGroupsSection({
               <div key={group.id} className="bg-white/5 rounded-lg border border-white/10">
               {/* 组标题 */}
               <div
-                className="flex items-center gap-2 px-3 py-2 hover:bg-white/[0.03]"
+                className={cn(
+                  "relative flex items-center gap-2 px-3 py-2",
+                  !isEditing && "cursor-pointer",
+                )}
               >
-                <IconButton
-                  label={expandedDialerGroups.has(group.id) ? `收起 ${group.name}` : `展开 ${group.name}`}
-                  variant="ghost"
-                  className="h-6 w-6 rounded-md text-white/50"
-                  aria-expanded={expandedDialerGroups.has(group.id)}
-                  disabled={isEditing}
-                  onClick={() => toggleDialerGroupExpand(group.id)}
-                >
-                  {expandedDialerGroups.has(group.id) ? (
-                    <ChevronDown className="h-4 w-4" aria-hidden="true" />
-                  ) : (
-                    <ChevronRight className="h-4 w-4" aria-hidden="true" />
-                  )}
-                </IconButton>
+                {!isEditing && (
+                  <button
+                    type="button"
+                    className="absolute inset-0 z-0 cursor-pointer rounded-none transition-colors hover:bg-white/5 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-indigo-500/60"
+                    aria-label={expandedDialerGroups.has(group.id) ? `收起 ${group.name}` : `展开 ${group.name}`}
+                    aria-expanded={expandedDialerGroups.has(group.id)}
+                    onClick={() => toggleDialerGroupExpand(group.id)}
+                    title={expandedDialerGroups.has(group.id) ? "收起" : "展开"}
+                  />
+                )}
+                {expandedDialerGroups.has(group.id) ? (
+                  <ChevronDown className="pointer-events-none relative z-10 h-4 w-4 text-white/50" aria-hidden="true" />
+                ) : (
+                  <ChevronRight className="pointer-events-none relative z-10 h-4 w-4 text-white/50" aria-hidden="true" />
+                )}
 
                 {isEditing ? (
                   <ProxyGroupNameEditor
@@ -273,14 +277,14 @@ export function DialerProxyGroupsSection({
                     }}
                   />
                 ) : (
-                  <div className="flex items-center gap-1 min-w-0">
+                  <div className="pointer-events-none relative z-10 flex min-w-0 items-center gap-1">
                     <span className="text-sm font-medium text-white truncate" title={group.name}>
                       {group.name}
                     </span>
                     <Button
                       variant="ghost"
                       size="sm"
-                      className="h-7 px-2"
+                      className="pointer-events-auto h-7 px-2"
                       onClick={(e) => {
                         e.stopPropagation();
                         setEditingDialerGroupId(group.id);
@@ -305,7 +309,7 @@ export function DialerProxyGroupsSection({
                 ) : (
                   <>
                     <ProxyGroupSummary
-                      className="ml-auto flex"
+                      className="pointer-events-none relative z-10 ml-auto flex"
                       disabled={!isEnabled}
                       items={[
                         { label: `${group.relayNodes.length} 中转`, tone: "accent" },
@@ -315,6 +319,7 @@ export function DialerProxyGroupsSection({
                     <Switch
                       aria-label={`启用 ${group.name} 中转组`}
                       checked={isEnabled}
+                      className="pointer-events-auto relative z-10"
                       onCheckedChange={(checked) => {
                         const nextEnabled = Boolean(checked);
                         if (!nextEnabled) {
@@ -385,7 +390,7 @@ export function DialerProxyGroupsSection({
                           type="button"
                           variant="ghost"
                           size="sm"
-                          className="h-7 shrink-0 px-2 text-white/35 hover:text-indigo-200"
+                          className="pointer-events-auto relative z-10 h-7 shrink-0 px-2 text-white/35 hover:text-indigo-200"
                           title={`类型：${dialerTypeLabel}`}
                           aria-label={`修改 ${group.name} 类型`}
                           onClick={(event) => event.stopPropagation()}
@@ -401,7 +406,7 @@ export function DialerProxyGroupsSection({
                         e.stopPropagation();
                         removeDialerProxyGroup(group.id);
                       }}
-                      className="h-7 w-7 p-1 text-white/30 hover:text-red-400"
+                      className="pointer-events-auto relative z-10 h-7 w-7 p-1 text-white/30 hover:text-red-400"
                     >
                       <Trash2 className="h-3.5 w-3.5" />
                     </IconButton>
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts
index 248b1dc..6a1067c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.test.ts
@@ -156,6 +156,8 @@ describe("ProxyGroupsModuleCard", () => {
     expect(html).toContain("Gemini 分流说明");
     expect(html).toContain("rules-panel");
     expect(mocks.panels[0]).toEqual(expect.objectContaining({ module: baseModule, cnIpNoResolve: true }));
+    expect(html).toContain('aria-label="收起 Gemini Display"');
+    expect(html).toContain('aria-expanded="true"');
 
     capturesClick(html);
     mocks.buttons.find((button) => button.title === "改名").onClick({ stopPropagation: vi.fn() });
@@ -266,6 +268,17 @@ describe("ProxyGroupsModuleCard", () => {
     expect(mocks.panels).toHaveLength(0);
   });
 
+  it("keeps the full module header as the disclosure control", () => {
+    const collapsedHandlers = props({ isRulesExpanded: false });
+    const collapsedHtml = renderToStaticMarkup(
+      React.createElement(ProxyGroupsModuleCard, collapsedHandlers),
+    );
+
+    expect(collapsedHtml).toContain('class="absolute inset-0');
+    expect(collapsedHtml).toContain('aria-label="展开 Gemini Display"');
+    expect(collapsedHtml).toContain('aria-expanded="false"');
+  });
+
   it("renders module summary with the requested description and rule colors", () => {
     const html = renderToStaticMarkup(
       React.createElement(
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
index a934511..fd493b2 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-module-card.tsx
@@ -49,7 +49,7 @@ function ModuleHintPopover({ moduleId }: { moduleId: string }) {
         <IconButton
           label={label}
           variant="ghost"
-          className="inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
+          className="pointer-events-auto inline-flex h-6 w-6 items-center justify-center rounded-full border border-white/10 bg-white/5 text-white/40 transition-colors hover:bg-white/10 hover:text-white/80 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black"
           onClick={(e) => e.stopPropagation()}
         >
           <HelpCircle className="h-3.5 w-3.5" />
@@ -252,28 +252,36 @@ export function ProxyGroupsModuleCard({
     <div className="overflow-hidden rounded border border-white/10 bg-white/5">
       <div
         className={cn(
-          "grid grid-cols-[auto_minmax(0,1fr)_auto] items-center gap-x-2 gap-y-1 px-2 py-2",
-          hasExpandedContent && "transition-colors hover:bg-white/[0.03]"
+          "relative grid grid-cols-[auto_minmax(0,1fr)_auto] items-center gap-x-2 gap-y-1 px-2 py-2",
+          hasExpandedContent && !isEditing && "cursor-pointer"
         )}
       >
-        {!isEditing && (hasExpandedContent ? (
-          <IconButton
-            label={isRulesExpanded ? `收起 ${display.full}` : `展开 ${display.full}`}
-            variant="ghost"
-            className="h-6 w-6 rounded-md text-white/50"
+        {hasExpandedContent && !isEditing && (
+          <button
+            type="button"
+            className="absolute inset-0 z-0 cursor-pointer rounded-none transition-colors hover:bg-white/5 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-indigo-500/60"
+            aria-label={isRulesExpanded ? `收起 ${display.full}` : `展开 ${display.full}`}
             aria-expanded={isRulesExpanded}
             onClick={onToggleRulesExpanded}
-          >
-            {isRulesExpanded ? (
-              <ChevronDown className="h-4 w-4" aria-hidden="true" />
-            ) : (
-              <ChevronRight className="h-4 w-4" aria-hidden="true" />
-            )}
-          </IconButton>
+            title={isRulesExpanded ? "收起" : "展开"}
+          />
+        )}
+        {!isEditing && (hasExpandedContent ? (
+          isRulesExpanded ? (
+            <ChevronDown className="pointer-events-none relative z-10 h-4 w-4 shrink-0 text-white/50" aria-hidden="true" />
+          ) : (
+            <ChevronRight className="pointer-events-none relative z-10 h-4 w-4 shrink-0 text-white/50" aria-hidden="true" />
+          )
         ) : (
           <span className="h-4 w-4 shrink-0" />
         ))}
-        <div className={cn("min-w-0", isEditing && "col-span-3")}>
+        <div
+          className={cn(
+            "min-w-0",
+            isEditing && "col-span-3",
+            hasExpandedContent && !isEditing && "pointer-events-none relative z-10",
+          )}
+        >
           {isEditing ? (
             <div
               className="grid w-full min-w-0 grid-cols-[minmax(0,1fr)_auto_auto] items-center gap-1"
@@ -342,7 +350,7 @@ export function ProxyGroupsModuleCard({
                     <Button
                       variant="ghost"
                       size="sm"
-                      className="h-7 px-2"
+                      className="pointer-events-auto h-7 px-2"
                       onClick={(e) => {
                         e.stopPropagation();
                         onStartEditing();
@@ -365,11 +373,12 @@ export function ProxyGroupsModuleCard({
         </div>
 
         {!isEditing && (
-          <div className="flex shrink-0 items-center justify-end gap-2">
+          <div className="pointer-events-none relative z-10 flex shrink-0 items-center justify-end gap-2">
             <Switch
               aria-label={`启用 ${display.full} 分流组`}
               checked={isEnabled}
               onCheckedChange={onToggleEnabled}
+              className="pointer-events-auto"
               onClick={(e) => e.stopPropagation()}
             />
             {onChangeGroupType && (
@@ -383,7 +392,7 @@ export function ProxyGroupsModuleCard({
                     type="button"
                     variant="ghost"
                     size="sm"
-                    className="h-7 shrink-0 px-2 text-white/35 hover:text-indigo-200"
+                    className="pointer-events-auto h-7 shrink-0 px-2 text-white/35 hover:text-indigo-200"
                     title={`类型：${typeLabel}`}
                     aria-label={`修改 ${display.full} 类型`}
                   >
@@ -395,7 +404,7 @@ export function ProxyGroupsModuleCard({
             <Button
               variant="ghost"
               size="sm"
-              className="h-7 shrink-0 px-2 text-white/30 hover:text-red-400"
+              className="pointer-events-auto h-7 shrink-0 px-2 text-white/30 hover:text-red-400"
               onClick={(e) => {
                 e.stopPropagation();
                 onHide();

From afc28f292c1720cc72b9772fbba41f48f92dc2ec Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sun, 26 Jul 2026 22:15:03 +0800
Subject: [PATCH 32/36] fix(deps): resolve runtime security advisories

---
 local/package.json         |   19 +-
 package-lock.json          | 1169 +++++++++++++++++++++++++-----------
 package.json               |   21 +-
 packages/core/package.json |    2 +-
 packages/ui/package.json   |    2 +-
 5 files changed, 841 insertions(+), 372 deletions(-)

diff --git a/local/package.json b/local/package.json
index 4d32242..5b6ba74 100644
--- a/local/package.json
+++ b/local/package.json
@@ -22,8 +22,8 @@
     "check": "npm run lint && npm run typecheck && npm run build"
   },
   "dependencies": {
-    "@prisma/adapter-pg": "^7.8.0",
-    "@prisma/client": "^7.8.0",
+    "@prisma/adapter-pg": "^7.9.0",
+    "@prisma/client": "^7.9.0",
     "@radix-ui/react-avatar": "^1.1.0",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -44,11 +44,11 @@
     "clsx": "^2.1.0",
     "dotenv": "^17.4.2",
     "jose": "^6.2.3",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.3.0",
     "lucide-react": "^1.17.0",
-    "next": "^16.2.7",
+    "next": "^16.2.12",
     "peggy": "^5.1.0",
-    "prisma": "^7.8.0",
+    "prisma": "^7.9.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "react-remove-scroll-bar": "^2.3.8",
@@ -62,14 +62,9 @@
     "@types/react": "^19.2.16",
     "@types/react-dom": "^19.2.3",
     "eslint": "^9.39.4",
-    "eslint-config-next": "^16.2.7",
-    "postcss": "8.5.15",
+    "eslint-config-next": "^16.2.12",
+    "postcss": "8.5.23",
     "tailwindcss": "^4.3.0",
     "typescript": "^6.0.3"
-  },
-  "overrides": {
-    "@hono/node-server": "1.19.13",
-    "hono": "4.12.25",
-    "postcss": "8.5.15"
   }
 }
diff --git a/package-lock.json b/package-lock.json
index f69eea1..c9580c8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,8 +13,8 @@
         "local"
       ],
       "dependencies": {
-        "@prisma/adapter-pg": "^7.8.0",
-        "@prisma/client": "^7.8.0",
+        "@prisma/adapter-pg": "^7.9.0",
+        "@prisma/client": "^7.9.0",
         "@radix-ui/react-avatar": "^1.1.0",
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -35,9 +35,9 @@
         "clsx": "^2.1.0",
         "dotenv": "^17.4.2",
         "jose": "^6.2.3",
-        "js-yaml": "^4.2.0",
+        "js-yaml": "^4.3.0",
         "lucide-react": "^1.17.0",
-        "next": "^16.2.7",
+        "next": "^16.2.12",
         "peggy": "^5.1.0",
         "react": "^19.2.7",
         "react-dom": "^19.2.7",
@@ -52,9 +52,9 @@
         "@types/react": "^19.2.16",
         "@types/react-dom": "^19.2.3",
         "eslint": "^9.39.4",
-        "eslint-config-next": "^16.2.7",
-        "postcss": "8.5.15",
-        "prisma": "^7.8.0",
+        "eslint-config-next": "^16.2.12",
+        "postcss": "8.5.23",
+        "prisma": "^7.9.0",
         "tailwindcss": "^4.3.0",
         "typescript": "^6.0.3",
         "vitest": "^4.1.7"
@@ -68,8 +68,8 @@
       "version": "2.6.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "@prisma/adapter-pg": "^7.8.0",
-        "@prisma/client": "^7.8.0",
+        "@prisma/adapter-pg": "^7.9.0",
+        "@prisma/client": "^7.9.0",
         "@radix-ui/react-avatar": "^1.1.0",
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -90,11 +90,11 @@
         "clsx": "^2.1.0",
         "dotenv": "^17.4.2",
         "jose": "^6.2.3",
-        "js-yaml": "^4.2.0",
+        "js-yaml": "^4.3.0",
         "lucide-react": "^1.17.0",
-        "next": "^16.2.7",
+        "next": "^16.2.12",
         "peggy": "^5.1.0",
-        "prisma": "^7.8.0",
+        "prisma": "^7.9.0",
         "react": "^19.2.7",
         "react-dom": "^19.2.7",
         "react-remove-scroll-bar": "^2.3.8",
@@ -108,8 +108,8 @@
         "@types/react": "^19.2.16",
         "@types/react-dom": "^19.2.3",
         "eslint": "^9.39.4",
-        "eslint-config-next": "^16.2.7",
-        "postcss": "8.5.15",
+        "eslint-config-next": "^16.2.12",
+        "postcss": "8.5.23",
         "tailwindcss": "^4.3.0",
         "typescript": "^6.0.3"
       },
@@ -371,30 +371,30 @@
       }
     },
     "node_modules/@electric-sql/pglite": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite/-/pglite-0.4.1.tgz",
-      "integrity": "sha512-mZ9NzzUSYPOCnxHH1oAHPRzoMFJHY472raDKwXl/+6oPbpdJ7g8LsCN4FSaIIfkiCKHhb3iF/Zqo3NYxaIhU7Q==",
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@electric-sql/pglite/-/pglite-0.4.3.tgz",
+      "integrity": "sha512-ichuWTgtd4mOM1G4SpyGJa5trT03lWbMypDV0fUXUCXg5hiHqVAz/bZyV68NqmkLB7WcYmj1RMJVSp8HV/v/ZQ==",
       "license": "Apache-2.0"
     },
     "node_modules/@electric-sql/pglite-socket": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-socket/-/pglite-socket-0.1.1.tgz",
-      "integrity": "sha512-p2hoXw3Z3LQHwTeikdZNsFBOvXGqKY2hk51BBw+8NKND8eoH+8LFOtW9Z8CQKmTJ2qqGYu82ipqiyFZOTTXNfw==",
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-socket/-/pglite-socket-0.1.3.tgz",
+      "integrity": "sha512-LAciWM0M1dCL8hlsxu2venbVZcdxema0BtDfpWYVqr+Y468UADw0pFWidhKw1M8sfJ8rdLT71tjMmnirf/IZRQ==",
       "license": "Apache-2.0",
       "bin": {
         "pglite-server": "dist/scripts/server.js"
       },
       "peerDependencies": {
-        "@electric-sql/pglite": "0.4.1"
+        "@electric-sql/pglite": "0.4.3"
       }
     },
     "node_modules/@electric-sql/pglite-tools": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-tools/-/pglite-tools-0.3.1.tgz",
-      "integrity": "sha512-C+T3oivmy9bpQvSxVqXA1UDY8cB9Eb9vZHL9zxWwEUfDixbXv4G3r2LjoTdR33LD8aomR3O9ZXEO3XEwr/cUCA==",
+      "version": "0.3.3",
+      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-tools/-/pglite-tools-0.3.3.tgz",
+      "integrity": "sha512-AlzLJTRJ8+UFgK8CmxIpyIpJ0+YaFw02IiOSdYrqxwPXdSyeIShz8aa9Tq+tYFXdPwcaMp/Fc80mQZ1dkOQ/wg==",
       "license": "Apache-2.0",
       "peerDependencies": {
-        "@electric-sql/pglite": "0.4.1"
+        "@electric-sql/pglite": "0.4.3"
       }
     },
     "node_modules/@emnapi/core": {
@@ -413,6 +413,7 @@
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
       "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -612,18 +613,6 @@
       "integrity": "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==",
       "license": "MIT"
     },
-    "node_modules/@hono/node-server": {
-      "version": "1.19.13",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.13.tgz",
-      "integrity": "sha512-TsQLe4i2gvoTtrHje625ngThGBySOgSK3Xo2XRYOdqGN1teR8+I7vchQC46uLJi8OF62YTYA3AhSpumtkhsaKQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.14.1"
-      },
-      "peerDependencies": {
-        "hono": "^4"
-      }
-    },
     "node_modules/@humanfs/core": {
       "version": "0.19.2",
       "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
@@ -701,9 +690,9 @@
       }
     },
     "node_modules/@img/sharp-darwin-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.5.tgz",
-      "integrity": "sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.3.tgz",
+      "integrity": "sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg==",
       "cpu": [
         "arm64"
       ],
@@ -713,19 +702,19 @@
         "darwin"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-arm64": "1.2.4"
+        "@img/sharp-libvips-darwin-arm64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-darwin-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.5.tgz",
-      "integrity": "sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.3.tgz",
+      "integrity": "sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w==",
       "cpu": [
         "x64"
       ],
@@ -735,19 +724,38 @@
         "darwin"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-x64": "1.2.4"
+        "@img/sharp-libvips-darwin-x64": "1.3.2"
+      }
+    },
+    "node_modules/@img/sharp-freebsd-wasm32": {
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.3.tgz",
+      "integrity": "sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "dependencies": {
+        "@img/sharp-wasm32": "0.35.3"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-libvips-darwin-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.4.tgz",
-      "integrity": "sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.2.tgz",
+      "integrity": "sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg==",
       "cpu": [
         "arm64"
       ],
@@ -761,9 +769,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-darwin-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.4.tgz",
-      "integrity": "sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.2.tgz",
+      "integrity": "sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw==",
       "cpu": [
         "x64"
       ],
@@ -777,9 +785,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.4.tgz",
-      "integrity": "sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.2.tgz",
+      "integrity": "sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ==",
       "cpu": [
         "arm"
       ],
@@ -793,9 +801,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.4.tgz",
-      "integrity": "sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.2.tgz",
+      "integrity": "sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA==",
       "cpu": [
         "arm64"
       ],
@@ -809,9 +817,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-ppc64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.2.4.tgz",
-      "integrity": "sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.2.tgz",
+      "integrity": "sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw==",
       "cpu": [
         "ppc64"
       ],
@@ -825,9 +833,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-riscv64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.2.4.tgz",
-      "integrity": "sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.2.tgz",
+      "integrity": "sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w==",
       "cpu": [
         "riscv64"
       ],
@@ -841,9 +849,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-s390x": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.2.4.tgz",
-      "integrity": "sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.2.tgz",
+      "integrity": "sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ==",
       "cpu": [
         "s390x"
       ],
@@ -857,9 +865,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.2.4.tgz",
-      "integrity": "sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.2.tgz",
+      "integrity": "sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w==",
       "cpu": [
         "x64"
       ],
@@ -873,9 +881,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.2.4.tgz",
-      "integrity": "sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.2.tgz",
+      "integrity": "sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw==",
       "cpu": [
         "arm64"
       ],
@@ -889,9 +897,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.4.tgz",
-      "integrity": "sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.2.tgz",
+      "integrity": "sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ==",
       "cpu": [
         "x64"
       ],
@@ -905,9 +913,9 @@
       }
     },
     "node_modules/@img/sharp-linux-arm": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.5.tgz",
-      "integrity": "sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.3.tgz",
+      "integrity": "sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA==",
       "cpu": [
         "arm"
       ],
@@ -917,19 +925,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm": "1.2.4"
+        "@img/sharp-libvips-linux-arm": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.5.tgz",
-      "integrity": "sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.3.tgz",
+      "integrity": "sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ==",
       "cpu": [
         "arm64"
       ],
@@ -939,19 +947,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm64": "1.2.4"
+        "@img/sharp-libvips-linux-arm64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-ppc64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.34.5.tgz",
-      "integrity": "sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.3.tgz",
+      "integrity": "sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA==",
       "cpu": [
         "ppc64"
       ],
@@ -961,19 +969,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-ppc64": "1.2.4"
+        "@img/sharp-libvips-linux-ppc64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-riscv64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.34.5.tgz",
-      "integrity": "sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.3.tgz",
+      "integrity": "sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ==",
       "cpu": [
         "riscv64"
       ],
@@ -983,19 +991,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-riscv64": "1.2.4"
+        "@img/sharp-libvips-linux-riscv64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-s390x": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.5.tgz",
-      "integrity": "sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.3.tgz",
+      "integrity": "sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw==",
       "cpu": [
         "s390x"
       ],
@@ -1005,19 +1013,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-s390x": "1.2.4"
+        "@img/sharp-libvips-linux-s390x": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.5.tgz",
-      "integrity": "sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.3.tgz",
+      "integrity": "sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA==",
       "cpu": [
         "x64"
       ],
@@ -1027,19 +1035,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-x64": "1.2.4"
+        "@img/sharp-libvips-linux-x64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linuxmusl-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.5.tgz",
-      "integrity": "sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.3.tgz",
+      "integrity": "sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w==",
       "cpu": [
         "arm64"
       ],
@@ -1049,19 +1057,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4"
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linuxmusl-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.5.tgz",
-      "integrity": "sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.3.tgz",
+      "integrity": "sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg==",
       "cpu": [
         "x64"
       ],
@@ -1071,38 +1079,64 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-x64": "1.2.4"
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-wasm32": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.34.5.tgz",
-      "integrity": "sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.3.tgz",
+      "integrity": "sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w==",
+      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/runtime": "^1.11.1"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-wasm32/node_modules/@emnapi/runtime": {
+      "version": "1.11.3",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.3.tgz",
+      "integrity": "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@img/sharp-webcontainers-wasm32": {
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.3.tgz",
+      "integrity": "sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q==",
       "cpu": [
         "wasm32"
       ],
-      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@emnapi/runtime": "^1.7.0"
+        "@img/sharp-wasm32": "0.35.3"
       },
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-win32-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.5.tgz",
-      "integrity": "sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.3.tgz",
+      "integrity": "sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w==",
       "cpu": [
         "arm64"
       ],
@@ -1112,16 +1146,16 @@
         "win32"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-win32-ia32": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.5.tgz",
-      "integrity": "sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.3.tgz",
+      "integrity": "sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw==",
       "cpu": [
         "ia32"
       ],
@@ -1131,16 +1165,16 @@
         "win32"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": "^20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-win32-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.5.tgz",
-      "integrity": "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.3.tgz",
+      "integrity": "sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA==",
       "cpu": [
         "x64"
       ],
@@ -1150,7 +1184,7 @@
         "win32"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
@@ -1206,12 +1240,6 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
-    "node_modules/@kurkle/color": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@kurkle/color/-/color-0.3.4.tgz",
-      "integrity": "sha512-M5UknZPHRu3DEDWoipU6sE8PdkZ6Z/S+v4dD+Ke8IaNlpdSQah50lz1KtcFBa2vsdOnwbbnxJwVM4wty6udA5w==",
-      "license": "MIT"
-    },
     "node_modules/@napi-rs/wasm-runtime": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
@@ -1232,15 +1260,15 @@
       }
     },
     "node_modules/@next/env": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.7.tgz",
-      "integrity": "sha512-tMJizPlj6ZYpBMMdK8S0LJufrP4QTdR6pcv9KQ/bVETPAmg0j1mlHE9G2c38UyGHxoBapgwuj7XjbGJ2RcDFOg==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.12.tgz",
+      "integrity": "sha512-d0Z5Bc13Fa4nR8pFAKx2jay2yhJM16vlfHbTzYnUQAxlNb6B6lmn4hjt69lYNt4kRtyYP6gEM49lPRHNbIyneg==",
       "license": "MIT"
     },
     "node_modules/@next/eslint-plugin-next": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.2.7.tgz",
-      "integrity": "sha512-VbS+QgMHqvIDMTIqD2xMBKK1otIpdAUKA8VLHFwR9h6OfU/mOm7w/69nQcvdmI8hCk99Wr2AsGLn/PJ/tMHw1w==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.2.12.tgz",
+      "integrity": "sha512-uF2z/qAK2q7B5/6CpnFcBRX6jOq5iCO+Uqh1UkJhXljX1JwLarLYhhoJadO6dPb6moTprOKewMXheBcbIoSbug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1248,9 +1276,9 @@
       }
     },
     "node_modules/@next/swc-darwin-arm64": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.7.tgz",
-      "integrity": "sha512-vm1EDI/pVaBNNiychmxk3fft+OhQPVD9cIM/tReLZIQ3TfQ4kqI9DwKk00dzuS1ulC7icbrzCFrmRRlk9PfNdw==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.12.tgz",
+      "integrity": "sha512-0W1R0teHWJrqKX0FH20IzzIWAOuGtBxPGuObrxy1lE8hQvCFj49KE8a3WUg0D7sq6rn6zkM4c7YGUnhudBS6oA==",
       "cpu": [
         "arm64"
       ],
@@ -1264,9 +1292,9 @@
       }
     },
     "node_modules/@next/swc-darwin-x64": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.7.tgz",
-      "integrity": "sha512-O3IRSv1ZBL1zs0WrIgefTEcTKFVn+ryxBNe54erJ6KsD+2f/Mmt7g2jOYh8PSBdUwPtKQJuCsTMlZ7tIu2AcsQ==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.12.tgz",
+      "integrity": "sha512-Hy5Ls099+aFUmOLmIgPfLqNi6iCwhL3uQCssz5rWk+5Nkc6TUKCE83DY5BbNylfm3+mfwcSFnLRfrZDJhVxdtw==",
       "cpu": [
         "x64"
       ],
@@ -1280,9 +1308,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.7.tgz",
-      "integrity": "sha512-Re6PZtjBDd0aMU+VcZcC/PrIvj4WhrjDYtMhhCVQamWN4L90EVP0pcEOBQD25prSlw7OzNw5QpHLWMilRLsRNw==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.12.tgz",
+      "integrity": "sha512-+YqU2h1cQkHsGfvjAsrSmst8UIFBibBGm5x3Xgel8NLMiDQtNOM4sM2GOEMvG5YiOBNeN/Ykk8cQC2S0Xrqljg==",
       "cpu": [
         "arm64"
       ],
@@ -1296,9 +1324,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.7.tgz",
-      "integrity": "sha512-qyogG9QtBzWxgJfeGBvOEHI3851gTfCF3wLZ5RDLTBJGAmE9p1qDwKCOdrBrvBzRvYDT+gUDp72pzlSEfAXgNA==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.12.tgz",
+      "integrity": "sha512-0qjhiYBaKAqF63LA1ZWAAnKTzFUguAaZiRa5etMLGGPj/B6uEVjtIZldIzFEp3wHlB0koK6aTzqPtSdplTCjoA==",
       "cpu": [
         "arm64"
       ],
@@ -1312,9 +1340,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.7.tgz",
-      "integrity": "sha512-Vhe4ZDuBpmMogrGi5D4R2Kq4JAQlj6+wvgaFYy31zfES0zPmt6TLA+cuYpM/OLrPZjo2MYQTHVqNUSCR6+fDZQ==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.12.tgz",
+      "integrity": "sha512-7A3q26W+h7gnA15uqBToNuDqBEFZZcqh0mW2mn4AJh/G5pdg2RVE3n4slzLEliASZFG3NmsbEzng/x2Sh09mBg==",
       "cpu": [
         "x64"
       ],
@@ -1328,9 +1356,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-musl": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.7.tgz",
-      "integrity": "sha512-srvian89JahFLw1YLBEuhvPJ0DO5lpUeJQMXy4xYo7g628ZlNgXdNkqoxSAv9OYrBfByh6vxISMwW/mRbzCY+g==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.12.tgz",
+      "integrity": "sha512-qSjL/uppm+cbh21s72Ss8gkiOhQ4dExWHNGOWy6eZV7STj5WsKehgxT61beSsOj+YYQuTplL376lOCdMQU5T8w==",
       "cpu": [
         "x64"
       ],
@@ -1344,9 +1372,9 @@
       }
     },
     "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.7.tgz",
-      "integrity": "sha512-GX3wvLpULFuRFJzwHaKfm7QZJ18F4ZSuxlPJ96BoBglCzBmdSjyeBKF+ZhWhvL/ckxNfLnNa7bsObO2ipYpszw==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.12.tgz",
+      "integrity": "sha512-X6hzsOUJac/e7AWSbn9gQ9nzHld1xWP5iyjHpYWvud8pufB679O1xg4JDyKr8Xd69Jvd+kM2Der6uftiZCmjYA==",
       "cpu": [
         "arm64"
       ],
@@ -1360,9 +1388,9 @@
       }
     },
     "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.7.tgz",
-      "integrity": "sha512-J4WlM72NMk076Qsg0jTdK3SNXatlSdnjW7L7oNGLst1tAGjHrJh/FYi+pw9wyIjEtGRKDNzD0zuiY16oWYWVaw==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.12.tgz",
+      "integrity": "sha512-F6fakeHuFTLOPt0bslQJdf+xtT+WIP9DVn/m4y1w1mRnVPyh3D/cNvzlRkxM444xfm+IvvYNSOrKiA2CDJ0Uxw==",
       "cpu": [
         "x64"
       ],
@@ -1458,24 +1486,24 @@
       }
     },
     "node_modules/@prisma/adapter-pg": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/adapter-pg/-/adapter-pg-7.8.0.tgz",
-      "integrity": "sha512-ygb3UkerK3v8MDpXVgCISdRNDozpxh6+JVJgiIGbSr5KBgz10LLf5ejUskPGoXlsIjxsOu6nuy1JVQr2EKGSlg==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/adapter-pg/-/adapter-pg-7.9.0.tgz",
+      "integrity": "sha512-kPYuFvNTlqnaFf2UpXBBG3ycTT3PL76uSZtLFBEwDytjMMUW8ZHrsb9cSNIarzdPW5EXWmBOeOq9/MVjMtbWkA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/driver-adapter-utils": "7.8.0",
+        "@prisma/driver-adapter-utils": "7.9.0",
         "@types/pg": "^8.16.0",
         "pg": "^8.16.3",
         "postgres-array": "3.0.4"
       }
     },
     "node_modules/@prisma/client": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/client/-/client-7.8.0.tgz",
-      "integrity": "sha512-HFp3Dawv/3sU3JtlPha90IB+48lS7zHiH4LKZPjmcE8YH5P9DOXGPvo8dqOtO7MqLDd1p2hOWMcFlRT1DMblHw==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/client/-/client-7.9.0.tgz",
+      "integrity": "sha512-BTG/mB+WL/1sD2gWwdNc2uuVJjNNBgCDlPFdjco6jJArgbg4IAChtzVeW4debFa/NKBbsGedCjET316sjllWTQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/client-runtime-utils": "7.8.0"
+        "@prisma/client-runtime-utils": "7.9.0"
       },
       "engines": {
         "node": "^20.19 || ^22.12 || >=24.0"
@@ -1494,15 +1522,15 @@
       }
     },
     "node_modules/@prisma/client-runtime-utils": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/client-runtime-utils/-/client-runtime-utils-7.8.0.tgz",
-      "integrity": "sha512-5NQZztQ0oY/ADFkmd9gPuweH5A1/CCY8YQPorLLO0Mu6a87mY5gsnDkzmFmIHs9NFaLnZojzgddFVN4RpKYrdw==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/client-runtime-utils/-/client-runtime-utils-7.9.0.tgz",
+      "integrity": "sha512-kMVmS4ZEy3xlkca+TfxOEm/ToVVlOS2x1Tc6/wIRf/HfczBqENtSPcKszy4ZpFNzjJ8SRKvlU5V0rrpoFw2KOg==",
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/config": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/config/-/config-7.8.0.tgz",
-      "integrity": "sha512-HFESzd9rx2ZQxlK+TL7tu1HPvCqrHiL6LCxYykI2c34mvaUuIVVl3lYuicJD/MNnzgPnyeBEMlK4WTomJCV5jw==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/config/-/config-7.9.0.tgz",
+      "integrity": "sha512-CsoK2mhl0u+N4/8V+XroQMOUNIic4isqD+E2HBG8l1yGEKo62CFDu3FHo0FdwItjl6XkW+omA1STSzeN1DAXlg==",
       "license": "Apache-2.0",
       "dependencies": {
         "c12": "3.3.4",
@@ -1512,28 +1540,26 @@
       }
     },
     "node_modules/@prisma/debug": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.8.0.tgz",
-      "integrity": "sha512-p+QZReysDUqXC+mk17q9a+Y/qzh4c2KYliDK30buYUyfrGeTGSyfmc0AIrJRhZJrLHhRiJa9Au/J72h3C+szvA==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.9.0.tgz",
+      "integrity": "sha512-i0KdVQuKUE6N9NloHs+sUNAk2c9svR3myBndQbA3BoeoArsSpwtNgTdHZL+wBtCLCcdS2OOC/PKhgTe36jkF5A==",
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/dev": {
-      "version": "0.24.3",
-      "resolved": "https://registry.npmjs.org/@prisma/dev/-/dev-0.24.3.tgz",
-      "integrity": "sha512-ffHlQuKXZiaDt9Go0OnCTdJZrHxK0k7omJKNV86/VjpsXu5EIHZLK0T7JSWgvNlJwh56kW9JFu9v0qJciFzepg==",
+      "version": "0.24.14",
+      "resolved": "https://registry.npmjs.org/@prisma/dev/-/dev-0.24.14.tgz",
+      "integrity": "sha512-NhFO49O2JPTdzYiLHvceQn/HiwmcKF/iGV39ko3CpYsoGqS3rz3ko6gzuxFSIeHNwNJeuNcDexyyGeTO3DW80A==",
       "license": "ISC",
       "dependencies": {
-        "@electric-sql/pglite": "0.4.1",
-        "@electric-sql/pglite-socket": "0.1.1",
-        "@electric-sql/pglite-tools": "0.3.1",
-        "@hono/node-server": "1.19.11",
+        "@electric-sql/pglite": "0.4.3",
+        "@electric-sql/pglite-socket": "0.1.3",
+        "@electric-sql/pglite-tools": "0.3.3",
         "@prisma/get-platform": "7.2.0",
         "@prisma/query-plan-executor": "7.2.0",
-        "@prisma/streams-local": "0.1.2",
+        "@prisma/streams-local": "0.1.11",
+        "find-my-way": "9.6.0",
         "foreground-child": "3.3.1",
         "get-port-please": "3.2.0",
-        "hono": "^4.12.8",
-        "http-status-codes": "2.3.0",
         "pathe": "2.0.3",
         "proper-lockfile": "4.1.2",
         "remeda": "2.33.4",
@@ -1543,60 +1569,60 @@
       }
     },
     "node_modules/@prisma/driver-adapter-utils": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/driver-adapter-utils/-/driver-adapter-utils-7.8.0.tgz",
-      "integrity": "sha512-/Q13o0ZT0rjc1Xk0Q9KhZYwuq2EW/vSbWUBKfgEKkaCuB/Sg6bqnjmTZqC5cD4d6y1vfFAEwBRzfzoSMIVJ55A==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/driver-adapter-utils/-/driver-adapter-utils-7.9.0.tgz",
+      "integrity": "sha512-fFXujitfMyjk3kOd1Tbs5FXBm6i2OWwEhaP5lHgkUM99jHpPEQwCWj+z/WKPFq6EDMThE1zGzSlVegtR0Pmu2w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "7.8.0"
+        "@prisma/debug": "7.9.0"
       }
     },
     "node_modules/@prisma/engines": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-7.8.0.tgz",
-      "integrity": "sha512-jx3rCnNNrt5uzbkKlegtQ2GZHxSlihMCzutgT/BP6UIDF1r9tDI39hV/0T/cHZgzJ3ELbuQPXlVZy+Y1n0pcgw==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-7.9.0.tgz",
+      "integrity": "sha512-lDWJp/pgSWCLfYsupmmNo96jfsbQnH1yjia8XVM2Kh8nRZhD0bQU2jCHuy3ZTPMLR3apRD3k145ybENalAYjYw==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "7.8.0",
-        "@prisma/engines-version": "7.8.0-6.3c6e192761c0362d496ed980de936e2f3cebcd3a",
-        "@prisma/fetch-engine": "7.8.0",
-        "@prisma/get-platform": "7.8.0"
+        "@prisma/debug": "7.9.0",
+        "@prisma/engines-version": "7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad",
+        "@prisma/fetch-engine": "7.9.0",
+        "@prisma/get-platform": "7.9.0"
       }
     },
     "node_modules/@prisma/engines-version": {
-      "version": "7.8.0-6.3c6e192761c0362d496ed980de936e2f3cebcd3a",
-      "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-7.8.0-6.3c6e192761c0362d496ed980de936e2f3cebcd3a.tgz",
-      "integrity": "sha512-fJPQxCkLgA5EayWaW8eArgCvjJ+N+Kz3VyeNKMEeYiQC4alNkxRKFVAGxv/ZUzuJISKqdw+zGeDbS6mn6RCPOA==",
+      "version": "7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad",
+      "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad.tgz",
+      "integrity": "sha512-2BsPPFksz3CQUXG6af3rVCtJKg6+JJGJTtfgu2fU8DdXhOfkBjulCq8mwybCd6ge0/jhZq2kOtLAbmUDMyI1nA==",
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/engines/node_modules/@prisma/get-platform": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.8.0.tgz",
-      "integrity": "sha512-WlxgRGnolL8VH2EmkH1R/DkKNr/mVdS3G2h42IZFFZ3eUrH9OT6t73kIOSlkkrv50wG123Iq8d96ufv5LlZktw==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.9.0.tgz",
+      "integrity": "sha512-4awv6ATdgrHdLms0XKikCyfArn8BrUHZfqg0mtCKrI4+WJe24nmpsdwsypM9ozd03wa846AngY+zSbnngkMrXQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "7.8.0"
+        "@prisma/debug": "7.9.0"
       }
     },
     "node_modules/@prisma/fetch-engine": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-7.8.0.tgz",
-      "integrity": "sha512-gwB0Euiz/DDRyxFRpLXYlK3RfaZUj1c5dAYMuhZYfApg7arknJlcb9bIsOHDppJmbqYaVA+yBIiFMDBfprsNPQ==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-7.9.0.tgz",
+      "integrity": "sha512-F0XlIgjbE3EywRVR/HpCerNI/dxo40vK66tHcWpsWYwH/Jk9+FsICEzATeMsZ7bdnpZz93hkD4sAb5rKLsCCpA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "7.8.0",
-        "@prisma/engines-version": "7.8.0-6.3c6e192761c0362d496ed980de936e2f3cebcd3a",
-        "@prisma/get-platform": "7.8.0"
+        "@prisma/debug": "7.9.0",
+        "@prisma/engines-version": "7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad",
+        "@prisma/get-platform": "7.9.0"
       }
     },
     "node_modules/@prisma/fetch-engine/node_modules/@prisma/get-platform": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.8.0.tgz",
-      "integrity": "sha512-WlxgRGnolL8VH2EmkH1R/DkKNr/mVdS3G2h42IZFFZ3eUrH9OT6t73kIOSlkkrv50wG123Iq8d96ufv5LlZktw==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.9.0.tgz",
+      "integrity": "sha512-4awv6ATdgrHdLms0XKikCyfArn8BrUHZfqg0mtCKrI4+WJe24nmpsdwsypM9ozd03wa846AngY+zSbnngkMrXQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "7.8.0"
+        "@prisma/debug": "7.9.0"
       }
     },
     "node_modules/@prisma/get-platform": {
@@ -1621,9 +1647,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/streams-local": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/@prisma/streams-local/-/streams-local-0.1.2.tgz",
-      "integrity": "sha512-l49yTxKKF2odFxaAXTmwmkBKL3+bVQ1tFOooGifu4xkdb9NMNLxHj27XAhTylWZod8I+ISGM5erU1xcl/oBCtg==",
+      "version": "0.1.11",
+      "resolved": "https://registry.npmjs.org/@prisma/streams-local/-/streams-local-0.1.11.tgz",
+      "integrity": "sha512-0TcebL559MByKqTJ+SsrFIEg228iw8UCVRFckzgfRSiJqczhs+MuAgWOF9lnOIV/IVqvu+KMnFTH0eDeTQMpUg==",
       "license": "Apache-2.0",
       "dependencies": {
         "ajv": "^8.12.0",
@@ -1632,7 +1658,7 @@
         "proper-lockfile": "^4.1.2"
       },
       "engines": {
-        "bun": ">=1.3.6",
+        "bun": ">=1.2.0",
         "node": ">=22.0.0"
       }
     },
@@ -1659,13 +1685,22 @@
       "license": "MIT"
     },
     "node_modules/@prisma/studio-core": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@prisma/studio-core/-/studio-core-0.27.3.tgz",
-      "integrity": "sha512-AADjNFPdsrglxHQVTmHFqv6DuKQZ5WY4p5/gVFY017twvNrSwpLJ9lqUbYYxEu2W7nbvVxTZA8deJ8LseNALsw==",
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@prisma/studio-core/-/studio-core-0.33.0.tgz",
+      "integrity": "sha512-V2fX/nKEymNTrHXwfP26PGjoLStO35Ogu+ex7CFJbLrMYEcZxxZpiSNOs7px23Hk5mzLWvM5RsqG6Ka+rha+wg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@radix-ui/react-toggle": "1.1.10",
-        "chart.js": "4.5.1"
+        "@visx/curve": "4.0.1-alpha.0",
+        "@visx/event": "4.0.1-alpha.0",
+        "@visx/grid": "4.0.1-alpha.0",
+        "@visx/group": "4.0.1-alpha.0",
+        "@visx/responsive": "4.0.1-alpha.0",
+        "@visx/scale": "4.0.1-alpha.0",
+        "@visx/shape": "4.0.1-alpha.0",
+        "d3-array": "3.2.4",
+        "d3-shape": "3.2.0",
+        "elkjs": "0.11.1"
       },
       "engines": {
         "node": "^20.19 || ^22.12 || >=24.0",
@@ -3355,6 +3390,84 @@
         "assertion-error": "^2.0.1"
       }
     },
+    "node_modules/@types/d3-array": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.0.3.tgz",
+      "integrity": "sha512-Reoy+pKnvsksN0lQUlcH6dOGjRZ/3WRwXR//m+/8lt1BXeI4xyaUZoqULNjyXXRuh0Mj4LNpkCvhUpQlY3X5xQ==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-color": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.0.tgz",
+      "integrity": "sha512-HKuicPHJuvPgCD+np6Se9MQvS6OCbJmOjGvylzMJRlDwUXjKTTXs6Pwgk79O09Vj/ho3u1ofXnhFOaEWWPrlwA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-delaunay": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-delaunay/-/d3-delaunay-6.0.1.tgz",
+      "integrity": "sha512-tLxQ2sfT0p6sxdG75c6f/ekqxjyYR0+LwPrsO1mbC9YDBzPJhs2HbJJRrn8Ez1DBoHRo2yx7YEATI+8V1nGMnQ==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-format": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-format/-/d3-format-3.0.1.tgz",
+      "integrity": "sha512-5KY70ifCCzorkLuIkDe0Z9YTf9RR2CjBX1iaJG+rgM/cPP+sO+q9YdQ9WdhQcgPj1EQiJ2/0+yUkkziTG6Lubg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-geo": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-geo/-/d3-geo-3.1.0.tgz",
+      "integrity": "sha512-856sckF0oP/diXtS4jNsiQw/UuK5fQG8l/a9VVLeSouf1/PPbBE1i1W852zVwKwYCBkFJJB7nCFTbk6UMEXBOQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/geojson": "*"
+      }
+    },
+    "node_modules/@types/d3-interpolate": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
+      "integrity": "sha512-jx5leotSeac3jr0RePOH1KdR9rISG91QIE4Q2PYTu4OymLTZfA3SrnURSLzKH48HmXVUru50b8nje4E79oQSQw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-color": "*"
+      }
+    },
+    "node_modules/@types/d3-path": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.1.tgz",
+      "integrity": "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-scale": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha512-Yk4htunhPAwN0XGlIwArRomOjdoBFXC3+kCxK2Ubg7I9shQlVSJy/pG/Ht5ASN+gdMIalpk8TJ5xV74jFsetLA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-time": "*"
+      }
+    },
+    "node_modules/@types/d3-shape": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.1.7.tgz",
+      "integrity": "sha512-VLvUQ33C+3J+8p+Daf+nYSOsjB4GXp19/S/aGo60m9h1v6XaxjiT82lKVWJCfzhtuZ3yD7i/TPeC/fuKLLOSmg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-path": "*"
+      }
+    },
+    "node_modules/@types/d3-time": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.0.tgz",
+      "integrity": "sha512-sZLCdHvBUcNby1cB6Fd3ZBrABbjz3v1Vm90nysCQ6Vt7vd6e/h9Lt7SiJUoEX0l4Dzc7P5llKyhqSi1ycSf1Hg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-time-format": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-time-format/-/d3-time-format-2.1.0.tgz",
+      "integrity": "sha512-/myT3I7EwlukNOX2xVdMzb8FRgNzRMpsZddwst9Ld/VFe6LyJyRp0s32l/V9XoUzk+Gqu56F/oGk6507+8BxrA==",
+      "license": "MIT"
+    },
     "node_modules/@types/deep-eql": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
@@ -3369,6 +3482,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/geojson": {
+      "version": "7946.0.16",
+      "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.16.tgz",
+      "integrity": "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==",
+      "license": "MIT"
+    },
     "node_modules/@types/js-yaml": {
       "version": "4.0.9",
       "resolved": "https://registry.npmjs.org/@types/js-yaml/-/js-yaml-4.0.9.tgz",
@@ -3390,6 +3509,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/lodash": {
+      "version": "4.17.24",
+      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.24.tgz",
+      "integrity": "sha512-gIW7lQLZbue7lRSWEFql49QJJWThrTFFeIMJdp3eH4tKoxm1OvEPg02rm4wCCSHS0cL3/Fizimb35b7k8atwsQ==",
+      "license": "MIT"
+    },
     "node_modules/@types/node": {
       "version": "22.19.19",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.19.tgz",
@@ -4037,6 +4162,147 @@
         "win32"
       ]
     },
+    "node_modules/@visx/curve": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/curve/-/curve-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-jRu61Uz274pV1zyioXmboyrLutYbnKsgjj4njSGCnhdXj5GkZvZbg+ThDb6oOzoAnJOBRLz4rzPlWvNJOzuVMg==",
+      "license": "MIT",
+      "dependencies": {
+        "@visx/vendor": "4.0.0-alpha.0"
+      }
+    },
+    "node_modules/@visx/event": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/event/-/event-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-EQqCMSv/s8NbFjo+hz3FKsvvYfP+2QslsFJ/24/O5l/W+7UC6J6aAvO0ujVwrTwdYbuQ+vhxKi1xdPdKR/qj1g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/react": "*",
+        "@visx/point": "4.0.1-alpha.0"
+      }
+    },
+    "node_modules/@visx/grid": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/grid/-/grid-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-rycutGmTHO+znNdPumheWMglm7YfpffvRwUkVy5zy4WoORIuKTMkDxwnOzHG2xMxU3EE/YCd37xFV5AxA30yeg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/react": "*",
+        "@visx/curve": "4.0.1-alpha.0",
+        "@visx/group": "4.0.1-alpha.0",
+        "@visx/point": "4.0.1-alpha.0",
+        "@visx/scale": "4.0.1-alpha.0",
+        "@visx/shape": "4.0.1-alpha.0",
+        "classnames": "^2.3.1"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || ^17.0.0-0 || ^18.0.0-0 || ^19.0.0-0"
+      }
+    },
+    "node_modules/@visx/group": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/group/-/group-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-V19l7iQ7jccBv8kao/EByuI6o4xtxzzLV9nqVI1hRvmdzTVsuLpqlwzYCZUXJaTVvUWf8s4D2SQFjGkj/Nw+0w==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/react": "*",
+        "classnames": "^2.3.1"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || ^17.0.0-0 || ^18.0.0-0 || ^19.0.0-0"
+      }
+    },
+    "node_modules/@visx/point": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/point/-/point-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-ijTfr/Nx09f03vIj9nyTr3z4Xth4Y75427UaogJh6dnIRLMEFHQOwNu791sbfiNj0a+ZXuaE32h0vKrFe4/8Qg==",
+      "license": "MIT"
+    },
+    "node_modules/@visx/responsive": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/responsive/-/responsive-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-o+1zGywQZY0+yOx3Iw87wc4bbPJRr/HnIukTwfOz4UVyj9pB1OQNVHB7OORO1+LBHJceWpB31co/ZV9KHncKrA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/lodash": "^4.17.13",
+        "@types/react": "*",
+        "lodash": "^4.17.21"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || ^17.0.0-0 || ^18.0.0-0 || ^19.0.0-0"
+      }
+    },
+    "node_modules/@visx/scale": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/scale/-/scale-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-nzjeE87vFSAXGWFiiNfBpNLAf0Q8Qmf6syvKLjqNi4kGZkdhbUll3E/59YsgWXmjM8+llPLWzGsP+JPvo5eq1A==",
+      "license": "MIT",
+      "dependencies": {
+        "@visx/vendor": "4.0.0-alpha.0"
+      }
+    },
+    "node_modules/@visx/shape": {
+      "version": "4.0.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/shape/-/shape-4.0.1-alpha.0.tgz",
+      "integrity": "sha512-62QeiVNmPlterQGwhkEDcbq7M0MqY0lBsK5QKXtM9ZoPZWkuGV3aykA3+Xu20B2FAvyJq4LqJzBc7Sxr+EAdbA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/lodash": "^4.17.13",
+        "@types/react": "*",
+        "@visx/curve": "4.0.1-alpha.0",
+        "@visx/group": "4.0.1-alpha.0",
+        "@visx/scale": "4.0.1-alpha.0",
+        "@visx/vendor": "4.0.0-alpha.0",
+        "classnames": "^2.3.1",
+        "lodash": "^4.17.21"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || ^17.0.0-0 || ^18.0.0-0 || ^19.0.0-0"
+      }
+    },
+    "node_modules/@visx/vendor": {
+      "version": "4.0.0-alpha.0",
+      "resolved": "https://registry.npmjs.org/@visx/vendor/-/vendor-4.0.0-alpha.0.tgz",
+      "integrity": "sha512-6I+MuqXBcv9jnlcVowHoHKSdk9gXTWkHLKyqBwRWg7LY6A3Ei8SHfubpqGV5rBUSppxMq2RszPJUS6w+H0YgmQ==",
+      "license": "MIT and ISC",
+      "dependencies": {
+        "@types/d3-array": "3.0.3",
+        "@types/d3-color": "3.1.0",
+        "@types/d3-delaunay": "6.0.1",
+        "@types/d3-format": "3.0.1",
+        "@types/d3-geo": "3.1.0",
+        "@types/d3-interpolate": "3.0.1",
+        "@types/d3-path": "3.1.1",
+        "@types/d3-scale": "4.0.2",
+        "@types/d3-shape": "3.1.7",
+        "@types/d3-time": "3.0.0",
+        "@types/d3-time-format": "2.1.0",
+        "d3-array": "3.2.1",
+        "d3-color": "3.1.0",
+        "d3-delaunay": "6.0.2",
+        "d3-format": "3.1.0",
+        "d3-geo": "3.1.0",
+        "d3-interpolate": "3.0.1",
+        "d3-path": "3.1.0",
+        "d3-scale": "4.0.2",
+        "d3-shape": "3.2.0",
+        "d3-time": "3.1.0",
+        "d3-time-format": "4.1.0",
+        "internmap": "2.0.3"
+      }
+    },
+    "node_modules/@visx/vendor/node_modules/d3-array": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.1.tgz",
+      "integrity": "sha512-gUY/qeHq/yNqqoCKNq4vtpFLdoCdvyNpWoC/KNjhGbhDuQpAM9sIQQKkXSNpXa9h5KySs/gzm7R88WkUutgwWQ==",
+      "license": "ISC",
+      "dependencies": {
+        "internmap": "1 - 2"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/@vitest/expect": {
       "version": "4.1.8",
       "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.8.tgz",
@@ -4495,9 +4761,9 @@
       }
     },
     "node_modules/better-result": {
-      "version": "2.9.2",
-      "resolved": "https://registry.npmjs.org/better-result/-/better-result-2.9.2.tgz",
-      "integrity": "sha512-WIFoBPCdnTOdk9inkE1ZRvCZ4P0CpSkAiLlchC65N7n9DcjZ3NhqkBOlafzpOVnO8ixyi37kicmSJ3ENhPZl7Q==",
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/better-result/-/better-result-2.10.0.tgz",
+      "integrity": "sha512-oQhh0y1qo2/ZKdAAEvHZAqKKiHOFU5k/bW96fE2ScgQOVkJRiHwB+nOS1SgFsYqRlxMDWvefXi9Q3px7QvgNDw==",
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
@@ -4693,18 +4959,6 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
-    "node_modules/chart.js": {
-      "version": "4.5.1",
-      "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-4.5.1.tgz",
-      "integrity": "sha512-GIjfiT9dbmHRiYi6Nl2yFCq7kkwdkp1W/lp2J99rX0yo9tgJGn3lKQATztIjb5tVtevcBtIdICNWqlq5+E8/Pw==",
-      "license": "MIT",
-      "dependencies": {
-        "@kurkle/color": "^0.3.0"
-      },
-      "engines": {
-        "pnpm": ">=8"
-      }
-    },
     "node_modules/chokidar": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-5.0.0.tgz",
@@ -4732,6 +4986,12 @@
         "url": "https://polar.sh/cva"
       }
     },
+    "node_modules/classnames": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/classnames/-/classnames-2.5.1.tgz",
+      "integrity": "sha512-saHYOzhIQs6wy2sVxTM6bUDsQO4F50V9RQ22qBpEdCW+I+/Wmke2HOl6lS6dTpdxVhb88/I6+Hs+438c3lfUow==",
+      "license": "MIT"
+    },
     "node_modules/client-only": {
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
@@ -4816,6 +5076,133 @@
       "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
       "license": "MIT"
     },
+    "node_modules/d3-array": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
+      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
+      "license": "ISC",
+      "dependencies": {
+        "internmap": "1 - 2"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-color": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
+      "integrity": "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-delaunay": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/d3-delaunay/-/d3-delaunay-6.0.2.tgz",
+      "integrity": "sha512-IMLNldruDQScrcfT+MWnazhHbDJhcRJyOEBAJfwQnHle1RPh6WDuLvxNArUju2VSMSUuKlY5BGHRJ2cYyoFLQQ==",
+      "license": "ISC",
+      "dependencies": {
+        "delaunator": "5"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-format": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.0.tgz",
+      "integrity": "sha512-YyUI6AEuY/Wpt8KWLgZHsIU86atmikuoOmCfommt0LYHiQSPjvX2AcFc38PX0CBpr2RCyZhjex+NS/LPOv6YqA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-geo": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-geo/-/d3-geo-3.1.0.tgz",
+      "integrity": "sha512-JEo5HxXDdDYXCaWdwLRt79y7giK8SbhZJbFWXqbRTolCHFI5jRqteLzCsq51NKbUoX0PjBVSohxrx+NoOUujYA==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2.5.0 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-interpolate": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
+      "integrity": "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-color": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-path": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
+      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-scale": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2.10.0 - 3",
+        "d3-format": "1 - 3",
+        "d3-interpolate": "1.2.0 - 3",
+        "d3-time": "2.1.1 - 3",
+        "d3-time-format": "2 - 4"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-path": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
+      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time-format": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
+      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-time": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/damerau-levenshtein": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/damerau-levenshtein/-/damerau-levenshtein-1.0.8.tgz",
@@ -4953,6 +5340,15 @@
       "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
       "license": "MIT"
     },
+    "node_modules/delaunator": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/delaunator/-/delaunator-5.1.0.tgz",
+      "integrity": "sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ==",
+      "license": "ISC",
+      "dependencies": {
+        "robust-predicates": "^3.0.2"
+      }
+    },
     "node_modules/denque": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/denque/-/denque-2.1.0.tgz",
@@ -5041,6 +5437,12 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/elkjs": {
+      "version": "0.11.1",
+      "resolved": "https://registry.npmjs.org/elkjs/-/elkjs-0.11.1.tgz",
+      "integrity": "sha512-zxxR9k+rx5ktMwT/FwyLdPCrq7xN6e4VGGHH8hA01vVYKjTFik7nHOxBnAYtrgYUB1RpAiLvA1/U2YraWxyKKg==",
+      "license": "EPL-2.0"
+    },
     "node_modules/emoji-regex": {
       "version": "9.2.2",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
@@ -5351,13 +5753,13 @@
       }
     },
     "node_modules/eslint-config-next": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.2.7.tgz",
-      "integrity": "sha512-CQ2aNXkrsjaGA2oJBE1LYnlRdphIAQE9ZQfX9hSv1PNGPyiOMSaVeBfTIO29QxYz+ij/hZudK0cfpCG1HXWstg==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.2.12.tgz",
+      "integrity": "sha512-iaaf4vvKo5h2LBdGt0JuRv7t0Ysqr9FMCiFxbptDg8LqOE//mIKR80DdpOnSVM7qjLH3jT8P0aFiwXxBEGZRXw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@next/eslint-plugin-next": "16.2.7",
+        "@next/eslint-plugin-next": "16.2.12",
         "eslint-import-resolver-node": "^0.3.6",
         "eslint-import-resolver-typescript": "^3.5.2",
         "eslint-plugin-import": "^2.32.0",
@@ -5717,9 +6119,9 @@
       }
     },
     "node_modules/exsolve": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
-      "integrity": "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.1.0.tgz",
+      "integrity": "sha512-D+42+T12DdIlJM3uepa55qGiL3sYdLBOxIl2ifQCzCHz4c7eiolaHsi3BIqEr7JxBzxv2pYZQX9kw16ziMcEmw==",
       "license": "MIT"
     },
     "node_modules/fast-check": {
@@ -5744,6 +6146,12 @@
         "node": ">=8.0.0"
       }
     },
+    "node_modules/fast-decode-uri-component": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/fast-decode-uri-component/-/fast-decode-uri-component-1.0.1.tgz",
+      "integrity": "sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==",
+      "license": "MIT"
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -5794,10 +6202,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/fast-querystring": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/fast-querystring/-/fast-querystring-1.1.2.tgz",
+      "integrity": "sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-decode-uri-component": "^1.0.1"
+      }
+    },
     "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
       "funding": [
         {
           "type": "github",
@@ -5846,6 +6263,20 @@
         "node": ">=8"
       }
     },
+    "node_modules/find-my-way": {
+      "version": "9.7.0",
+      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-9.7.0.tgz",
+      "integrity": "sha512-f2JHn75x2JlwUwLenZypgczR7YWMb/uO9BvUXtus+JMgkbIkLADd38cI4EiV+OQqrGo1Zlq6V8wnqMJ8e62wUQ==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-querystring": "^1.0.0",
+        "safe-regex2": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/find-up": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
@@ -6087,9 +6518,9 @@
       }
     },
     "node_modules/giget": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/giget/-/giget-3.2.0.tgz",
-      "integrity": "sha512-GvHTWcykIR/fP8cj8dMpuMMkvaeJfPvYnhq0oW+chSeIr+ldX21ifU2Ms6KBoyKZQZmVaUAAhQ2EZ68KJF8a7A==",
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/giget/-/giget-3.3.1.tgz",
+      "integrity": "sha512-r+mvuDjrjMpsdw46Kmeydb8bdHm7wOKw8wNBtTndkjbPjgAp5oUJUxRE76wZFknxIPokfWvep2qSXK37aXE6zg==",
       "license": "MIT",
       "bin": {
         "giget": "dist/cli.mjs"
@@ -6158,9 +6589,9 @@
       "license": "ISC"
     },
     "node_modules/grammex": {
-      "version": "3.1.12",
-      "resolved": "https://registry.npmjs.org/grammex/-/grammex-3.1.12.tgz",
-      "integrity": "sha512-6ufJOsSA7LcQehIJNCO7HIBykfM7DXQual0Ny780/DEcJIpBlHRvcqEBWGPYd7hrXL2GJ3oJI1MIhaXjWmLQOQ==",
+      "version": "3.1.13",
+      "resolved": "https://registry.npmjs.org/grammex/-/grammex-3.1.13.tgz",
+      "integrity": "sha512-LnPnhOBLEJEVKS8WFDVaA397L9Kq55Q9oSITJiVLHVdhAclfUkWzQv74KhvZHKL2Q09Pb1XdsrOsZ4LfTFFTEg==",
       "license": "MIT"
     },
     "node_modules/graphmatch": {
@@ -6280,21 +6711,6 @@
         "hermes-estree": "0.25.1"
       }
     },
-    "node_modules/hono": {
-      "version": "4.12.25",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.25.tgz",
-      "integrity": "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.9.0"
-      }
-    },
-    "node_modules/http-status-codes": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/http-status-codes/-/http-status-codes-2.3.0.tgz",
-      "integrity": "sha512-RJ8XvFvpPM/Dmc5SV+dC4y5PCeOhT3x1Hq0NU3rjGeg5a/CqlhZ7uudknPwZFz4aeAXDcbAyaeP7GAo9lvngtA==",
-      "license": "MIT"
-    },
     "node_modules/iconv-lite": {
       "version": "0.7.2",
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
@@ -6363,6 +6779,15 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/internmap": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
+      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/is-array-buffer": {
       "version": "3.0.5",
       "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.5.tgz",
@@ -6841,9 +7266,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "funding": [
         {
           "type": "github",
@@ -7246,6 +7671,12 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/lodash": {
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
+      "license": "MIT"
+    },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
       "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
@@ -7413,9 +7844,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.16",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
       "funding": [
         {
           "type": "github",
@@ -7454,12 +7885,12 @@
       "license": "MIT"
     },
     "node_modules/next": {
-      "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/next/-/next-16.2.7.tgz",
-      "integrity": "sha512-eMJxgjRzBaj3olkP4cBamHDXL79A8FC6u1GcsO1D1Tsx8bw/LLXUJCaoajVxtnhD3A1IJqIT8IcRJjgBIPJq4w==",
+      "version": "16.2.12",
+      "resolved": "https://registry.npmjs.org/next/-/next-16.2.12.tgz",
+      "integrity": "sha512-iD59eYQWmbFcEbX7v/acG5DRym9iw1DdaPoD0WTA920naWsE25wShzJW4+UvAs8MK9EC2kBfIH6vtto1H1PHGw==",
       "license": "MIT",
       "dependencies": {
-        "@next/env": "16.2.7",
+        "@next/env": "16.2.12",
         "@swc/helpers": "0.5.15",
         "baseline-browser-mapping": "^2.9.19",
         "caniuse-lite": "^1.0.30001579",
@@ -7473,14 +7904,14 @@
         "node": ">=20.9.0"
       },
       "optionalDependencies": {
-        "@next/swc-darwin-arm64": "16.2.7",
-        "@next/swc-darwin-x64": "16.2.7",
-        "@next/swc-linux-arm64-gnu": "16.2.7",
-        "@next/swc-linux-arm64-musl": "16.2.7",
-        "@next/swc-linux-x64-gnu": "16.2.7",
-        "@next/swc-linux-x64-musl": "16.2.7",
-        "@next/swc-win32-arm64-msvc": "16.2.7",
-        "@next/swc-win32-x64-msvc": "16.2.7",
+        "@next/swc-darwin-arm64": "16.2.12",
+        "@next/swc-darwin-x64": "16.2.12",
+        "@next/swc-linux-arm64-gnu": "16.2.12",
+        "@next/swc-linux-arm64-musl": "16.2.12",
+        "@next/swc-linux-x64-gnu": "16.2.12",
+        "@next/swc-linux-x64-musl": "16.2.12",
+        "@next/swc-win32-arm64-msvc": "16.2.12",
+        "@next/swc-win32-x64-msvc": "16.2.12",
         "sharp": "^0.34.5"
       },
       "peerDependencies": {
@@ -7950,9 +8381,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.23",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
+      "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
       "funding": [
         {
           "type": "opencollective",
@@ -7969,7 +8400,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -8040,16 +8471,16 @@
       }
     },
     "node_modules/prisma": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/prisma/-/prisma-7.8.0.tgz",
-      "integrity": "sha512-yfN4yrw7HV9kEJhoy1+jgah0jafEIQsf7uWouSsM8MvJtlubsk+kM7AIBWZ8+GJl74Yj3c+nbYqBkMOxtsZ3Lw==",
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/prisma/-/prisma-7.9.0.tgz",
+      "integrity": "sha512-isQTJEK4pyOlAVzm6kBUDjzgdsgs0A/snpB38ycTHeOHW34qfepP+ClQltgDXqjZBnXALhEtE4duh9L3tN5fHw==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/config": "7.8.0",
-        "@prisma/dev": "0.24.3",
-        "@prisma/engines": "7.8.0",
-        "@prisma/studio-core": "0.27.3",
+        "@prisma/config": "7.9.0",
+        "@prisma/dev": "0.24.14",
+        "@prisma/engines": "7.9.0",
+        "@prisma/studio-core": "0.33.0",
         "mysql2": "3.15.3",
         "postgres": "3.4.7"
       },
@@ -8374,6 +8805,15 @@
         "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
       }
     },
+    "node_modules/ret": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/ret/-/ret-0.5.0.tgz",
+      "integrity": "sha512-I1XxrZSQ+oErkRR4jYbAyEEu2I0avBvvMM5JN+6EBprOGRCs63ENqZ3vjavq8fBw2+62G5LF5XelKwuJpcvcxw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/retry": {
       "version": "0.12.0",
       "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
@@ -8394,6 +8834,12 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/robust-predicates": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",
+      "integrity": "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==",
+      "license": "Unlicense"
+    },
     "node_modules/rolldown": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
@@ -8507,6 +8953,28 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/safe-regex2": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/safe-regex2/-/safe-regex2-5.1.1.tgz",
+      "integrity": "sha512-mOSBvHGDZMuIEZMdOz/aCEYDCv0E7nfcNsIhUF+/P+xC7Hyf3FkvymqgPbg9D1EdSGu+uKbJgy09K/RKKc7kJA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "ret": "~0.5.0"
+      },
+      "bin": {
+        "safe-regex2": "bin/safe-regex2.js"
+      }
+    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
@@ -8584,54 +9052,59 @@
       }
     },
     "node_modules/sharp": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz",
-      "integrity": "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==",
-      "hasInstallScript": true,
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.3.tgz",
+      "integrity": "sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@img/colour": "^1.0.0",
+        "@img/colour": "^1.1.0",
         "detect-libc": "^2.1.2",
-        "semver": "^7.7.3"
+        "semver": "^7.8.5"
       },
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-darwin-arm64": "0.34.5",
-        "@img/sharp-darwin-x64": "0.34.5",
-        "@img/sharp-libvips-darwin-arm64": "1.2.4",
-        "@img/sharp-libvips-darwin-x64": "1.2.4",
-        "@img/sharp-libvips-linux-arm": "1.2.4",
-        "@img/sharp-libvips-linux-arm64": "1.2.4",
-        "@img/sharp-libvips-linux-ppc64": "1.2.4",
-        "@img/sharp-libvips-linux-riscv64": "1.2.4",
-        "@img/sharp-libvips-linux-s390x": "1.2.4",
-        "@img/sharp-libvips-linux-x64": "1.2.4",
-        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4",
-        "@img/sharp-libvips-linuxmusl-x64": "1.2.4",
-        "@img/sharp-linux-arm": "0.34.5",
-        "@img/sharp-linux-arm64": "0.34.5",
-        "@img/sharp-linux-ppc64": "0.34.5",
-        "@img/sharp-linux-riscv64": "0.34.5",
-        "@img/sharp-linux-s390x": "0.34.5",
-        "@img/sharp-linux-x64": "0.34.5",
-        "@img/sharp-linuxmusl-arm64": "0.34.5",
-        "@img/sharp-linuxmusl-x64": "0.34.5",
-        "@img/sharp-wasm32": "0.34.5",
-        "@img/sharp-win32-arm64": "0.34.5",
-        "@img/sharp-win32-ia32": "0.34.5",
-        "@img/sharp-win32-x64": "0.34.5"
+        "@img/sharp-darwin-arm64": "0.35.3",
+        "@img/sharp-darwin-x64": "0.35.3",
+        "@img/sharp-freebsd-wasm32": "0.35.3",
+        "@img/sharp-libvips-darwin-arm64": "1.3.2",
+        "@img/sharp-libvips-darwin-x64": "1.3.2",
+        "@img/sharp-libvips-linux-arm": "1.3.2",
+        "@img/sharp-libvips-linux-arm64": "1.3.2",
+        "@img/sharp-libvips-linux-ppc64": "1.3.2",
+        "@img/sharp-libvips-linux-riscv64": "1.3.2",
+        "@img/sharp-libvips-linux-s390x": "1.3.2",
+        "@img/sharp-libvips-linux-x64": "1.3.2",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.2",
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.2",
+        "@img/sharp-linux-arm": "0.35.3",
+        "@img/sharp-linux-arm64": "0.35.3",
+        "@img/sharp-linux-ppc64": "0.35.3",
+        "@img/sharp-linux-riscv64": "0.35.3",
+        "@img/sharp-linux-s390x": "0.35.3",
+        "@img/sharp-linux-x64": "0.35.3",
+        "@img/sharp-linuxmusl-arm64": "0.35.3",
+        "@img/sharp-linuxmusl-x64": "0.35.3",
+        "@img/sharp-webcontainers-wasm32": "0.35.3",
+        "@img/sharp-win32-arm64": "0.35.3",
+        "@img/sharp-win32-ia32": "0.35.3",
+        "@img/sharp-win32-x64": "0.35.3"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        }
       }
     },
     "node_modules/sharp/node_modules/semver": {
-      "version": "7.8.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.1.tgz",
-      "integrity": "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "license": "ISC",
       "optional": true,
       "bin": {
@@ -9462,9 +9935,9 @@
       }
     },
     "node_modules/valibot": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.2.0.tgz",
-      "integrity": "sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==",
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.4.2.tgz",
+      "integrity": "sha512-gjdCvJ6d3RyHAneqxMYMW9QMCwYMb3jpOO0IyHZV1bnRHFBHrX3VkIILt5XYR0WhwHiH7Mty8ovuPZ/O3gamrg==",
       "license": "MIT",
       "peerDependencies": {
         "typescript": ">=5"
@@ -9908,7 +10381,7 @@
       "version": "0.1.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "js-yaml": "^4.2.0",
+        "js-yaml": "^4.3.0",
         "peggy": "^5.1.0"
       }
     },
@@ -9940,7 +10413,7 @@
         "class-variance-authority": "^0.7.0",
         "clsx": "^2.1.0",
         "lucide-react": "^1.17.0",
-        "next": "^16.2.7",
+        "next": "^16.2.12",
         "react": "^19.2.7",
         "react-dom": "^19.2.7",
         "react-remove-scroll-bar": "^2.3.8",
diff --git a/package.json b/package.json
index cbc7e62..76a2232 100644
--- a/package.json
+++ b/package.json
@@ -24,8 +24,8 @@
     "local:build": "npm --prefix local run build"
   },
   "dependencies": {
-    "@prisma/adapter-pg": "^7.8.0",
-    "@prisma/client": "^7.8.0",
+    "@prisma/adapter-pg": "^7.9.0",
+    "@prisma/client": "^7.9.0",
     "@radix-ui/react-avatar": "^1.1.0",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.0",
@@ -46,9 +46,9 @@
     "clsx": "^2.1.0",
     "dotenv": "^17.4.2",
     "jose": "^6.2.3",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.3.0",
     "lucide-react": "^1.17.0",
-    "next": "^16.2.7",
+    "next": "^16.2.12",
     "peggy": "^5.1.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
@@ -63,16 +63,17 @@
     "@types/react": "^19.2.16",
     "@types/react-dom": "^19.2.3",
     "eslint": "^9.39.4",
-    "eslint-config-next": "^16.2.7",
-    "postcss": "8.5.15",
-    "prisma": "^7.8.0",
+    "eslint-config-next": "^16.2.12",
+    "postcss": "8.5.23",
+    "prisma": "^7.9.0",
     "tailwindcss": "^4.3.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.7"
   },
   "overrides": {
-    "@hono/node-server": "1.19.13",
-    "hono": "4.12.25",
-    "postcss": "8.5.15"
+    "find-my-way": "9.7.0",
+    "postcss": "8.5.23",
+    "sharp": "0.35.3",
+    "valibot": "1.4.2"
   }
 }
diff --git a/packages/core/package.json b/packages/core/package.json
index 85859fb..57c4824 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -31,7 +31,7 @@
     "./types/*": "./src/types/*.ts"
   },
   "dependencies": {
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.3.0",
     "peggy": "^5.1.0"
   }
 }
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 2fb3228..316fb97 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -24,7 +24,7 @@
     "class-variance-authority": "^0.7.0",
     "clsx": "^2.1.0",
     "lucide-react": "^1.17.0",
-    "next": "^16.2.7",
+    "next": "^16.2.12",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "react-remove-scroll-bar": "^2.3.8",

From 889aa2942f68632946d5f96ce831a48cb151cac0 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sun, 26 Jul 2026 22:26:19 +0800
Subject: [PATCH 33/36] feat(core): add persistent node regex filtering

---
 local/src/lib/subscription-service.test.ts    |  59 ++++
 local/src/lib/subscription-service.ts         |  21 +-
 package-lock.json                             |   3 +-
 packages/core/package.json                    |   3 +-
 .../src/subscription/config-utils.test.ts     | 102 +++++++
 .../core/src/subscription/config-utils.ts     |   4 +-
 .../src/subscription/node-name-filter.test.ts | 205 ++++++++++++++
 .../core/src/subscription/node-name-filter.ts | 251 ++++++++++++++++++
 .../server-core/src/subscription/crud.test.ts |  95 +++++++
 packages/server-core/src/subscription/crud.ts |   5 +
 .../subscription/refresh-cache-result.test.ts |  91 +++++++
 .../src/subscription/refresh-cache-result.ts  |  18 +-
 12 files changed, 847 insertions(+), 10 deletions(-)
 create mode 100644 packages/core/src/subscription/node-name-filter.test.ts
 create mode 100644 packages/core/src/subscription/node-name-filter.ts

diff --git a/local/src/lib/subscription-service.test.ts b/local/src/lib/subscription-service.test.ts
index 15457ac..4a37a0b 100644
--- a/local/src/lib/subscription-service.test.ts
+++ b/local/src/lib/subscription-service.test.ts
@@ -350,6 +350,51 @@ describe("local subscription service", () => {
     ).rejects.toThrow("Node count cannot exceed 10000");
   });
 
+  it("validates node filters and permits provider-only output on create", async () => {
+    await expect(
+      createSubscription("owner-1", {
+        name: "Invalid filter",
+        nodes: [node("套餐到期提醒")],
+        config: {
+          nodeNameFilter: { enabled: true, excludeRegexes: ["("] },
+        },
+      })
+    ).rejects.toThrow("节点名称过滤配置无效");
+
+    mocks.buildGenerateOptionsFromConfig.mockReturnValueOnce({ nodes: [] });
+    await expect(
+      createSubscription("owner-1", {
+        name: "Empty filter result",
+        nodes: [node("套餐到期提醒")],
+        config: {
+          nodeNameFilter: { enabled: true, excludeRegexes: ["套餐到期"] },
+        },
+      })
+    ).rejects.toThrow("过滤后没有可用节点");
+
+    mocks.buildGenerateOptionsFromConfig.mockReturnValueOnce({
+      nodes: [],
+      proxyProviders: { provider: { type: "http" } },
+    });
+    await expect(
+      createSubscription("owner-1", {
+        name: "Provider output",
+        nodes: [node("套餐到期提醒")],
+        config: {
+          sources: [
+            {
+              id: "provider",
+              type: "url",
+              content: "https://provider.example/sub",
+              useProxyProviders: true,
+            },
+          ],
+          nodeNameFilter: { enabled: true, excludeRegexes: ["套餐到期"] },
+        },
+      })
+    ).resolves.toMatchObject({ name: "Created" });
+  });
+
   it("updates subscriptions and preserves existing values when fields are omitted", async () => {
     await expect(updateSubscription("owner-1", "missing", { name: "A" })).resolves.toMatchObject({ id: "sub-1" });
 
@@ -418,6 +463,20 @@ describe("local subscription service", () => {
     });
   });
 
+  it("rejects updates whose filter removes every ordinary node", async () => {
+    mocks.buildGenerateOptionsFromConfig.mockReturnValueOnce({ nodes: [] });
+
+    await expect(
+      updateSubscription("owner-1", "sub-1", {
+        nodes: [node("套餐到期提醒")],
+        config: {
+          nodeNameFilter: { enabled: true, excludeRegexes: ["套餐到期"] },
+        },
+      })
+    ).rejects.toThrow("过滤后没有可用节点");
+    expect(mocks.prisma.subscription.update).not.toHaveBeenCalled();
+  });
+
   it("replaces submitted config instead of retaining omitted stale fields", async () => {
     mocks.prisma.subscription.findFirst.mockResolvedValueOnce(
       row({
diff --git a/local/src/lib/subscription-service.ts b/local/src/lib/subscription-service.ts
index f76e31e..401e0d4 100644
--- a/local/src/lib/subscription-service.ts
+++ b/local/src/lib/subscription-service.ts
@@ -132,6 +132,20 @@ function buildLocalSubscriptionConfig(
   );
 }
 
+function assertNodeNameFilterKeepsOutput(
+  nodes: ParsedNode[],
+  config: Record<string, unknown>
+): void {
+  if (nodes.length === 0) return;
+  const options = buildGenerateOptionsFromConfig(config, { nodes });
+  const hasProxyProviders = Boolean(
+    options.proxyProviders && Object.keys(options.proxyProviders).length > 0
+  );
+  if (options.nodes.length === 0 && !hasProxyProviders) {
+    throw new Error("过滤后没有可用节点");
+  }
+}
+
 export function generateLocalSubscriptionToken(): string {
   return randomBytes(32).toString("base64url");
 }
@@ -193,6 +207,7 @@ export async function createSubscription(ownerId: string, body: unknown): Promis
   if (urls.length === 0 && nodes.length === 0) throw new Error("At least one URL or node is required.");
 
   const config = buildLocalSubscriptionConfig(body);
+  assertNodeNameFilterKeepsOutput(nodes, config);
   const autoUpdateInterval = normalizeLocalAutoUpdateIntervalSeconds(body.autoUpdateInterval);
   const subscriptionInfo = normalizeSubscriptionInfoForPersistence(body.subscriptionInfo) ?? {};
 
@@ -224,6 +239,7 @@ export async function updateSubscription(ownerId: string, id: string, body: unkn
   const hasNodes = "nodes" in body;
   const hasConfig = "config" in body || "smartNodeMatchingEnabled" in body;
   const nextNodes = hasNodes ? validateLocalSubscriptionNodes(body.nodes) : currentSecrets.nodes;
+  let nextConfig = currentSecrets.config;
 
   if (hasUrls) {
     data.encryptedUrls = encryptJson(normalizeSubscriptionUrlList(body.urls));
@@ -232,8 +248,8 @@ export async function updateSubscription(ownerId: string, id: string, body: unkn
     data.encryptedNodes = encryptJson(nextNodes);
   }
   if (hasConfig) {
-    const config = buildLocalSubscriptionConfig(body, currentSecrets.config);
-    data.encryptedConfig = encryptJson(config);
+    nextConfig = buildLocalSubscriptionConfig(body, currentSecrets.config);
+    data.encryptedConfig = encryptJson(nextConfig);
   }
   if ("subscriptionInfo" in body) {
     data.encryptedSubscriptionInfo = encryptJson(normalizeSubscriptionInfoForPersistence(body.subscriptionInfo) ?? {});
@@ -244,6 +260,7 @@ export async function updateSubscription(ownerId: string, id: string, body: unkn
     if (nextUrls.length === 0 && nextNodes.length === 0) {
       throw new Error("At least one URL or node is required.");
     }
+    assertNodeNameFilterKeepsOutput(nextNodes, nextConfig);
   }
 
   let resetAutoUpdateState = false;
diff --git a/package-lock.json b/package-lock.json
index c9580c8..645671f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10382,7 +10382,8 @@
       "license": "AGPL-3.0-only",
       "dependencies": {
         "js-yaml": "^4.3.0",
-        "peggy": "^5.1.0"
+        "peggy": "^5.1.0",
+        "safe-regex2": "^5.1.1"
       }
     },
     "packages/server-core": {
diff --git a/packages/core/package.json b/packages/core/package.json
index 57c4824..1dd887e 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -32,6 +32,7 @@
   },
   "dependencies": {
     "js-yaml": "^4.3.0",
-    "peggy": "^5.1.0"
+    "peggy": "^5.1.0",
+    "safe-regex2": "^5.1.1"
   }
 }
diff --git a/packages/core/src/subscription/config-utils.test.ts b/packages/core/src/subscription/config-utils.test.ts
index 310139f..4771a3f 100644
--- a/packages/core/src/subscription/config-utils.test.ts
+++ b/packages/core/src/subscription/config-utils.test.ts
@@ -3,6 +3,7 @@ import {
   buildGenerateOptionsFromConfig,
   getEffectiveTestOptions,
 } from "./config-utils";
+import { generateClashConfig } from "@subboost/core/generator";
 import type { ParsedNode } from "@subboost/core/types/node";
 
 function node(patch: Partial<ParsedNode> = {}): ParsedNode {
@@ -156,6 +157,107 @@ describe("subscription config utils", () => {
     expect(options.proxyGroupOrder).toEqual(["auto"]);
   });
 
+  it("generates from effective nodes while matching persisted original names", () => {
+    const kept = node({ name: "Singapore", _originName: "SG Premium" });
+    const excluded = node({ name: "Pinned Hong Kong", _originName: "HK IPLC" });
+    const options = buildGenerateOptionsFromConfig(
+      {
+        nodeNameFilter: {
+          enabled: true,
+          excludeRegexes: ["^hk"],
+        },
+      },
+      { nodes: [kept, excluded] }
+    );
+
+    expect(options.nodes).toHaveLength(1);
+    expect(options.nodes[0]).toMatchObject({
+      name: "Singapore",
+      _originName: "SG Premium",
+    });
+    expect(options.nodes[0]).not.toHaveProperty("dialer-proxy");
+  });
+
+  it("temporarily ignores filtered listener and dialer references and restores them when disabled", () => {
+    const nodes = [
+      node({ name: "Relay", _originName: "Relay" }),
+      node({ name: "Target", _originName: "Target" }),
+    ];
+    const config = {
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["^target$"],
+      },
+      listenerPorts: {
+        Relay: 12000,
+        Target: 12001,
+      },
+      dialerProxyGroups: [
+        {
+          id: "chain",
+          name: "Chain",
+          enabled: true,
+          type: "select",
+          relayNodes: ["Relay"],
+          targetNodes: ["Target"],
+        },
+      ],
+    };
+
+    const filteredOptions = buildGenerateOptionsFromConfig(config, { nodes });
+    const filtered = generateClashConfig(filteredOptions);
+    expect(filteredOptions.userConfig?.listenerPorts).toEqual(config.listenerPorts);
+    expect(filteredOptions.dialerProxyGroups?.[0]).toMatchObject({
+      relayNodes: ["Relay"],
+      targetNodes: ["Target"],
+    });
+    expect(filtered.proxies?.map((proxy) => proxy.name)).toEqual(["Relay"]);
+    expect(filtered.listeners).toEqual([
+      { name: "mixed0", type: "mixed", port: 12000, proxy: "Relay" },
+    ]);
+    expect(filtered["proxy-groups"]?.find((group) => group.name === "Chain")).toMatchObject({
+      proxies: ["Relay"],
+    });
+
+    const restored = generateClashConfig(
+      buildGenerateOptionsFromConfig(
+        {
+          ...config,
+          nodeNameFilter: {
+            ...config.nodeNameFilter,
+            enabled: false,
+          },
+        },
+        { nodes }
+      )
+    );
+    expect(restored.proxies?.map((proxy) => proxy.name)).toEqual(["Relay", "Target"]);
+    expect(restored.proxies?.find((proxy) => proxy.name === "Target")).toMatchObject({
+      "dialer-proxy": "Chain",
+    });
+    expect(restored.listeners).toEqual([
+      { name: "mixed0", type: "mixed", port: 12000, proxy: "Relay" },
+      { name: "mixed1", type: "mixed", port: 12001, proxy: "Target" },
+    ]);
+    expect(restored["proxy-groups"]?.find((group) => group.name === "Chain")).toMatchObject({
+      proxies: ["Relay"],
+    });
+  });
+
+  it("rejects invalid persisted node-name filters", () => {
+    expect(() =>
+      buildGenerateOptionsFromConfig(
+        {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["(a+)+$"],
+          },
+        },
+        { nodes: [node()] }
+      )
+    ).toThrow("节点名称过滤配置无效");
+  });
+
   it("drops malformed persisted config while keeping safe defaults", () => {
     const options = buildGenerateOptionsFromConfig(
       {
diff --git a/packages/core/src/subscription/config-utils.ts b/packages/core/src/subscription/config-utils.ts
index 09d4517..e867494 100644
--- a/packages/core/src/subscription/config-utils.ts
+++ b/packages/core/src/subscription/config-utils.ts
@@ -14,6 +14,7 @@ import {
 } from "@subboost/core/types/config";
 import { stripImportedNodeControlFieldsFromList } from "@subboost/core/subscription/imported-node-controls";
 import { buildProxyProvidersFromConfig } from "@subboost/core/subscription/proxy-providers";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import { ensureCustomRuleId } from "@subboost/core/rules/custom-rule-utils";
 import { DEFAULT_SUBBOOST_CONFIG } from "@subboost/core/config/defaults";
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
@@ -298,7 +299,8 @@ export function buildGenerateOptionsFromConfig(
 
   const dialerProxyGroups = normalizeDialerProxyGroups(config.dialerProxyGroups);
   const proxyGroupOrder = normalizeProxyGroupOrder(config.proxyGroupOrder);
-  const sanitizedNodes = stripImportedNodeControlFieldsFromList(opts.nodes);
+  const effectiveNodes = resolveNodeNameFilter(opts.nodes, config.nodeNameFilter).effectiveNodes;
+  const sanitizedNodes = stripImportedNodeControlFieldsFromList(effectiveNodes);
   const proxyGroupAdvanced = isRecord(config.proxyGroupAdvanced)
     ? Object.fromEntries(
         Object.entries(config.proxyGroupAdvanced)
diff --git a/packages/core/src/subscription/node-name-filter.test.ts b/packages/core/src/subscription/node-name-filter.test.ts
new file mode 100644
index 0000000..217cea3
--- /dev/null
+++ b/packages/core/src/subscription/node-name-filter.test.ts
@@ -0,0 +1,205 @@
+import { describe, expect, it } from "vitest";
+import type { ParsedNode } from "../types/node";
+import {
+  NODE_NAME_FILTER_MAX_REGEXES,
+  NodeNameFilterConfigError,
+  normalizeNodeNameFilterConfig,
+  parseNodeNameFilterConfig,
+  resolveNodeNameFilter,
+  validateNodeNameFilterConfig,
+} from "./node-name-filter";
+
+function node(name: string, originName?: string): ParsedNode {
+  return {
+    name,
+    type: "trojan",
+    server: `${name.toLowerCase()}.example.com`,
+    port: 443,
+    password: "secret",
+    ...(originName === undefined ? {} : { _originName: originName }),
+  };
+}
+
+describe("node name filter config", () => {
+  it("treats a missing config as disabled and disables an empty enabled config", () => {
+    expect(parseNodeNameFilterConfig(undefined)).toEqual({
+      enabled: false,
+      excludeRegexes: [],
+    });
+    expect(
+      parseNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: ["", "   "],
+      })
+    ).toEqual({
+      enabled: false,
+      excludeRegexes: [],
+    });
+  });
+
+  it("trims rules, ignores empty lines, and deduplicates repeated lines", () => {
+    expect(
+      parseNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: ["  hk|hong kong  ", "", "hk|hong kong", "  "],
+      })
+    ).toEqual({
+      enabled: true,
+      excludeRegexes: ["hk|hong kong"],
+    });
+  });
+
+  it("keeps valid rules while the filter is disabled", () => {
+    expect(
+      parseNodeNameFilterConfig({
+        enabled: false,
+        excludeRegexes: ["expired", "traffic"],
+      })
+    ).toEqual({
+      enabled: false,
+      excludeRegexes: ["expired", "traffic"],
+    });
+  });
+
+  it("reports the original line for invalid, unsafe, and non-string rules", () => {
+    const result = validateNodeNameFilterConfig({
+      enabled: true,
+      excludeRegexes: ["valid", 123, "[", "(a+)+$"],
+    });
+
+    expect(result).toEqual({
+      ok: false,
+      errors: [
+        { code: "invalid_line", line: 2, message: "规则必须是文本" },
+        { code: "invalid_regex", line: 3, message: "正则语法无效" },
+        { code: "unsafe_regex", line: 4, message: "正则可能导致运行时间过长" },
+      ],
+    });
+  });
+
+  it("enforces the unique rule count and per-rule length limits", () => {
+    const tooMany = validateNodeNameFilterConfig({
+      enabled: true,
+      excludeRegexes: Array.from(
+        { length: NODE_NAME_FILTER_MAX_REGEXES + 1 },
+        (_, index) => `node-${index}`
+      ),
+    });
+    expect(tooMany).toMatchObject({
+      ok: false,
+      errors: [
+        {
+          code: "too_many_regexes",
+          line: NODE_NAME_FILTER_MAX_REGEXES + 1,
+        },
+      ],
+    });
+
+    expect(
+      validateNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: ["a".repeat(201)],
+      })
+    ).toMatchObject({
+      ok: false,
+      errors: [{ code: "regex_too_long", line: 1 }],
+    });
+  });
+
+  it("counts limits after empty-line removal and deduplication", () => {
+    expect(
+      parseNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: [
+          "",
+          ...Array.from({ length: NODE_NAME_FILTER_MAX_REGEXES }, (_, index) => `rule-${index}`),
+          "rule-0",
+          " ",
+        ],
+      }).excludeRegexes
+    ).toHaveLength(NODE_NAME_FILTER_MAX_REGEXES);
+  });
+
+  it("strictly rejects malformed persisted config while normalize offers an explicit fallback", () => {
+    expect(() => parseNodeNameFilterConfig({ enabled: "yes", excludeRegexes: [] })).toThrow(
+      NodeNameFilterConfigError
+    );
+
+    try {
+      parseNodeNameFilterConfig({ enabled: true, excludeRegexes: ["(", "(a+)+$"] });
+      throw new Error("Expected parsing to fail");
+    } catch (error) {
+      expect(error).toBeInstanceOf(NodeNameFilterConfigError);
+      expect((error as NodeNameFilterConfigError).errors).toEqual([
+        { code: "invalid_regex", line: 1, message: "正则语法无效" },
+        { code: "unsafe_regex", line: 2, message: "正则可能导致运行时间过长" },
+      ]);
+    }
+
+    expect(normalizeNodeNameFilterConfig({ enabled: "yes", excludeRegexes: [] })).toEqual({
+      enabled: false,
+      excludeRegexes: [],
+    });
+  });
+});
+
+describe("resolveNodeNameFilter", () => {
+  it("matches original names case-insensitively and falls back to display names", () => {
+    const renamed = node("Japan Premium", "HK IPLC");
+    const legacy = node("hK legacy");
+    const kept = node("Singapore", "SG IEPL");
+    const result = resolveNodeNameFilter(
+      [renamed, legacy, kept],
+      {
+        enabled: true,
+        excludeRegexes: ["^hk"],
+      }
+    );
+
+    expect(result).toEqual({
+      rawNodes: [renamed, legacy, kept],
+      effectiveNodes: [kept],
+      excludedNodes: [renamed, legacy],
+      rawCount: 3,
+      excludedCount: 2,
+      effectiveCount: 1,
+    });
+  });
+
+  it("does not let display-name edits or duplicate origin names change matching semantics", () => {
+    const first = node("Pinned Name", "Expired");
+    const second = node("Expired (2)", "Expired");
+    const renamedKeep = node("Expired", "Available");
+    const result = resolveNodeNameFilter(
+      [first, second, renamedKeep],
+      {
+        enabled: true,
+        excludeRegexes: ["^expired$"],
+      }
+    );
+
+    expect(result.excludedNodes).toEqual([first, second]);
+    expect(result.effectiveNodes).toEqual([renamedKeep]);
+  });
+
+  it("returns the complete snapshot unchanged when disabled", () => {
+    const nodes = [node("Expired")];
+    const result = resolveNodeNameFilter(nodes, {
+      enabled: false,
+      excludeRegexes: ["expired"],
+    });
+
+    expect(result.rawNodes).toBe(nodes);
+    expect(result.effectiveNodes).toBe(nodes);
+    expect(result.excludedNodes).toEqual([]);
+  });
+
+  it("rejects invalid rules instead of exposing the unfiltered node list", () => {
+    expect(() =>
+      resolveNodeNameFilter([node("Node")], {
+        enabled: true,
+        excludeRegexes: ["(a+)+$"],
+      })
+    ).toThrow(NodeNameFilterConfigError);
+  });
+});
diff --git a/packages/core/src/subscription/node-name-filter.ts b/packages/core/src/subscription/node-name-filter.ts
new file mode 100644
index 0000000..9d2defa
--- /dev/null
+++ b/packages/core/src/subscription/node-name-filter.ts
@@ -0,0 +1,251 @@
+import safeRegex from "safe-regex2";
+import type { ParsedNode } from "../types/node";
+import { getNodeOriginName } from "./node-source-state";
+
+export const NODE_NAME_FILTER_MAX_REGEXES = 20;
+export const NODE_NAME_FILTER_MAX_REGEX_LENGTH = 200;
+
+export type NodeNameFilterConfig = {
+  enabled: boolean;
+  excludeRegexes: string[];
+};
+
+export const DEFAULT_NODE_NAME_FILTER_CONFIG: NodeNameFilterConfig = {
+  enabled: false,
+  excludeRegexes: [],
+};
+
+export type NodeNameFilterValidationErrorCode =
+  | "invalid_config"
+  | "invalid_line"
+  | "too_many_regexes"
+  | "regex_too_long"
+  | "invalid_regex"
+  | "unsafe_regex";
+
+export type NodeNameFilterValidationError = {
+  code: NodeNameFilterValidationErrorCode;
+  message: string;
+  line?: number;
+};
+
+export type NodeNameFilterValidationResult =
+  | {
+      ok: true;
+      config: NodeNameFilterConfig;
+    }
+  | {
+      ok: false;
+      errors: NodeNameFilterValidationError[];
+    };
+
+export type NodeNameFilterResult = {
+  rawNodes: ParsedNode[];
+  effectiveNodes: ParsedNode[];
+  excludedNodes: ParsedNode[];
+  rawCount: number;
+  excludedCount: number;
+  effectiveCount: number;
+};
+
+type ParsedNodeNameFilterConfig = {
+  config: NodeNameFilterConfig;
+  compiledRegexes: RegExp[];
+};
+
+export class NodeNameFilterConfigError extends Error {
+  readonly errors: NodeNameFilterValidationError[];
+
+  constructor(errors: NodeNameFilterValidationError[]) {
+    const first = errors[0];
+    const detail = first
+      ? `${first.line ? `第 ${first.line} 行：` : ""}${first.message}`
+      : "配置格式无效";
+    super(`节点名称过滤配置无效：${detail}`);
+    this.name = "NodeNameFilterConfigError";
+    this.errors = errors;
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function defaultConfig(): NodeNameFilterConfig {
+  return {
+    enabled: DEFAULT_NODE_NAME_FILTER_CONFIG.enabled,
+    excludeRegexes: [],
+  };
+}
+
+function inspectNodeNameFilterConfig(
+  value: unknown
+):
+  | { ok: true; parsed: ParsedNodeNameFilterConfig }
+  | { ok: false; errors: NodeNameFilterValidationError[] } {
+  if (value === undefined) {
+    return {
+      ok: true,
+      parsed: {
+        config: defaultConfig(),
+        compiledRegexes: [],
+      },
+    };
+  }
+
+  if (!isRecord(value)) {
+    return {
+      ok: false,
+      errors: [{ code: "invalid_config", message: "配置必须是对象" }],
+    };
+  }
+
+  const errors: NodeNameFilterValidationError[] = [];
+  const enabled = value.enabled === true;
+  if (typeof value.enabled !== "boolean") {
+    errors.push({ code: "invalid_config", message: "enabled 必须是布尔值" });
+  }
+  if (!Array.isArray(value.excludeRegexes)) {
+    errors.push({ code: "invalid_config", message: "excludeRegexes 必须是字符串数组" });
+  }
+  if (errors.length > 0 || !Array.isArray(value.excludeRegexes)) {
+    return { ok: false, errors };
+  }
+
+  const excludeRegexes: string[] = [];
+  const compiledRegexes: RegExp[] = [];
+  const seen = new Set<string>();
+  let reportedTooMany = false;
+
+  for (let index = 0; index < value.excludeRegexes.length; index += 1) {
+    const line = index + 1;
+    const rawPattern = value.excludeRegexes[index];
+    if (typeof rawPattern !== "string") {
+      errors.push({
+        code: "invalid_line",
+        line,
+        message: "规则必须是文本",
+      });
+      continue;
+    }
+
+    const pattern = rawPattern.trim();
+    if (!pattern || seen.has(pattern)) continue;
+    seen.add(pattern);
+
+    if (seen.size > NODE_NAME_FILTER_MAX_REGEXES) {
+      if (!reportedTooMany) {
+        errors.push({
+          code: "too_many_regexes",
+          line,
+          message: `最多允许 ${NODE_NAME_FILTER_MAX_REGEXES} 条规则`,
+        });
+        reportedTooMany = true;
+      }
+      continue;
+    }
+
+    if (pattern.length > NODE_NAME_FILTER_MAX_REGEX_LENGTH) {
+      errors.push({
+        code: "regex_too_long",
+        line,
+        message: `每条规则最多 ${NODE_NAME_FILTER_MAX_REGEX_LENGTH} 个字符`,
+      });
+      continue;
+    }
+
+    let compiled: RegExp;
+    try {
+      compiled = new RegExp(pattern, "i");
+    } catch {
+      errors.push({
+        code: "invalid_regex",
+        line,
+        message: "正则语法无效",
+      });
+      continue;
+    }
+
+    if (!safeRegex(compiled)) {
+      errors.push({
+        code: "unsafe_regex",
+        line,
+        message: "正则可能导致运行时间过长",
+      });
+      continue;
+    }
+
+    excludeRegexes.push(pattern);
+    compiledRegexes.push(compiled);
+  }
+
+  if (errors.length > 0) return { ok: false, errors };
+
+  return {
+    ok: true,
+    parsed: {
+      config: {
+        enabled: enabled && excludeRegexes.length > 0,
+        excludeRegexes,
+      },
+      compiledRegexes,
+    },
+  };
+}
+
+export function validateNodeNameFilterConfig(value: unknown): NodeNameFilterValidationResult {
+  const result = inspectNodeNameFilterConfig(value);
+  return result.ok
+    ? { ok: true, config: result.parsed.config }
+    : { ok: false, errors: result.errors };
+}
+
+export function parseNodeNameFilterConfig(value: unknown): NodeNameFilterConfig {
+  const result = inspectNodeNameFilterConfig(value);
+  if (!result.ok) throw new NodeNameFilterConfigError(result.errors);
+  return result.parsed.config;
+}
+
+export function normalizeNodeNameFilterConfig(value: unknown): NodeNameFilterConfig {
+  const result = inspectNodeNameFilterConfig(value);
+  return result.ok ? result.parsed.config : defaultConfig();
+}
+
+export function resolveNodeNameFilter(
+  rawNodes: ParsedNode[],
+  configValue: unknown
+): NodeNameFilterResult {
+  const parsed = inspectNodeNameFilterConfig(configValue);
+  if (!parsed.ok) throw new NodeNameFilterConfigError(parsed.errors);
+
+  if (!parsed.parsed.config.enabled) {
+    return {
+      rawNodes,
+      effectiveNodes: rawNodes,
+      excludedNodes: [],
+      rawCount: rawNodes.length,
+      excludedCount: 0,
+      effectiveCount: rawNodes.length,
+    };
+  }
+
+  const effectiveNodes: ParsedNode[] = [];
+  const excludedNodes: ParsedNode[] = [];
+  for (const node of rawNodes) {
+    const originName = getNodeOriginName(node);
+    if (parsed.parsed.compiledRegexes.some((regex) => regex.test(originName))) {
+      excludedNodes.push(node);
+    } else {
+      effectiveNodes.push(node);
+    }
+  }
+
+  return {
+    rawNodes,
+    effectiveNodes,
+    excludedNodes,
+    rawCount: rawNodes.length,
+    excludedCount: excludedNodes.length,
+    effectiveCount: effectiveNodes.length,
+  };
+}
diff --git a/packages/server-core/src/subscription/crud.test.ts b/packages/server-core/src/subscription/crud.test.ts
index 8886582..59c0a53 100644
--- a/packages/server-core/src/subscription/crud.test.ts
+++ b/packages/server-core/src/subscription/crud.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import { NodeNameFilterConfigError } from "@subboost/core/subscription/node-name-filter";
 import {
   areSubscriptionUrlListsEquivalent,
   normalizeSubscriptionConfigForPersistence,
@@ -99,6 +100,100 @@ describe("subscription CRUD shared helpers", () => {
     ).toEqual({ old: true, smartNodeMatchingEnabled: true });
   });
 
+  it("strictly normalizes a persisted node name filter after config merge", () => {
+    expect(
+      normalizeSubscriptionConfigForPersistence(
+        { config: { theme: "light" } },
+        {
+          existingConfig: {
+            keep: true,
+            nodeNameFilter: {
+              enabled: true,
+              excludeRegexes: ["  expired  ", "", "expired", "Traffic"],
+            },
+          },
+        }
+      )
+    ).toEqual({
+      keep: true,
+      theme: "light",
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["expired", "Traffic"],
+      },
+    });
+  });
+
+  it("keeps node name filter absent for legacy configs", () => {
+    const merged = normalizeSubscriptionConfigForPersistence(
+      { config: { theme: "light" } },
+      { existingConfig: { keep: true } }
+    );
+    expect(merged).toEqual({ keep: true, theme: "light" });
+    expect(merged).not.toHaveProperty("nodeNameFilter");
+
+    const replaced = normalizeSubscriptionConfigForPersistence(
+      { config: { theme: "light" } },
+      {
+        existingConfig: {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["expired"],
+          },
+        },
+        mergeExistingConfig: false,
+      }
+    );
+    expect(replaced).toEqual({ theme: "light" });
+    expect(replaced).not.toHaveProperty("nodeNameFilter");
+  });
+
+  it("rejects invalid node name filter syntax with structured line errors", () => {
+    try {
+      normalizeSubscriptionConfigForPersistence({
+        config: {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["valid", "["],
+          },
+        },
+      });
+      throw new Error("Expected invalid node name filter syntax to be rejected");
+    } catch (error) {
+      expect(error).toBeInstanceOf(NodeNameFilterConfigError);
+      expect((error as NodeNameFilterConfigError).errors).toEqual([
+        {
+          code: "invalid_regex",
+          line: 2,
+          message: "正则语法无效",
+        },
+      ]);
+    }
+  });
+
+  it("rejects unsafe node name filter regexes with structured line errors", () => {
+    try {
+      normalizeSubscriptionConfigForPersistence({
+        config: {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["safe", "(a+)+$"],
+          },
+        },
+      });
+      throw new Error("Expected unsafe node name filter regex to be rejected");
+    } catch (error) {
+      expect(error).toBeInstanceOf(NodeNameFilterConfigError);
+      expect((error as NodeNameFilterConfigError).errors).toEqual([
+        {
+          code: "unsafe_regex",
+          line: 2,
+          message: "正则可能导致运行时间过长",
+        },
+      ]);
+    }
+  });
+
   it("serializes summary and detail response data", () => {
     const subscription = {
       id: "sub-1",
diff --git a/packages/server-core/src/subscription/crud.ts b/packages/server-core/src/subscription/crud.ts
index b4f339f..de049f7 100644
--- a/packages/server-core/src/subscription/crud.ts
+++ b/packages/server-core/src/subscription/crud.ts
@@ -1,4 +1,5 @@
 import { stripImportedNodeControlFieldsFromList } from "@subboost/core/subscription/imported-node-controls";
+import { parseNodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import { normalizeSubscriptionResponseInfo } from "@subboost/core/subscription/subscription-response-info";
 import { tryNormalizeSubscriptionUrlInput } from "@subboost/core/subscription/url-input";
 import type { ParsedNode } from "@subboost/core/types/node";
@@ -140,6 +141,10 @@ export function normalizeSubscriptionConfigForPersistence(
     }
   }
 
+  if ("nodeNameFilter" in baseConfig) {
+    baseConfig.nodeNameFilter = parseNodeNameFilterConfig(baseConfig.nodeNameFilter);
+  }
+
   if (typeof input.smartNodeMatchingEnabled === "boolean") {
     baseConfig.smartNodeMatchingEnabled = input.smartNodeMatchingEnabled;
   } else if (typeof baseConfig.smartNodeMatchingEnabled !== "boolean" && options.defaultSmartNodeMatchingEnabled !== undefined) {
diff --git a/packages/server-core/src/subscription/refresh-cache-result.test.ts b/packages/server-core/src/subscription/refresh-cache-result.test.ts
index c260b1b..cd3000d 100644
--- a/packages/server-core/src/subscription/refresh-cache-result.test.ts
+++ b/packages/server-core/src/subscription/refresh-cache-result.test.ts
@@ -79,6 +79,64 @@ describe("prepareRefreshCacheResult", () => {
     expect(providerOnly.nodeCount).toBe(0);
     expect(providerOnly.generatedYaml).toContain("proxy-providers:");
     expect(providerOnly.cacheEntry.nodes).toEqual([]);
+
+    expect(
+      prepareRefreshCacheResult({
+        config: {},
+        snapshot: snapshot({ nodes: [] }),
+        maxNodesPerSubscription: 10,
+        proxyProviders: {},
+      })
+    ).toMatchObject({
+      ok: false,
+      reason: "empty_result",
+    });
+  });
+
+  it("keeps the raw cache snapshot but rejects refreshes with no effective nodes", () => {
+    const filtered = prepareRefreshCacheResult({
+      config: {
+        nodeNameFilter: {
+          enabled: true,
+          excludeRegexes: ["^node-a$"],
+        },
+      },
+      snapshot: snapshot({ nodes: [node] }),
+      maxNodesPerSubscription: 10,
+    });
+
+    expect(filtered).toMatchObject({
+      ok: false,
+      reason: "empty_result",
+      nodeCount: 1,
+    });
+  });
+
+  it("allows provider output when all raw nodes are excluded and caches the raw snapshot", () => {
+    const filtered = prepareRefreshCacheResult({
+      config: {
+        nodeNameFilter: {
+          enabled: true,
+          excludeRegexes: ["^node-a$"],
+        },
+      },
+      snapshot: snapshot({ nodes: [node] }),
+      maxNodesPerSubscription: 10,
+      proxyProviders: {
+        remote: {
+          type: "http",
+          url: "https://provider.example.com/sub.yaml",
+          path: "./remote.yaml",
+        },
+      },
+    });
+
+    expect(filtered.ok).toBe(true);
+    if (!filtered.ok) return;
+    expect(filtered.nodeCount).toBe(1);
+    expect(filtered.cacheEntry.nodes).toEqual([node]);
+    expect(filtered.generatedYaml).toContain("proxy-providers:");
+    expect(filtered.generatedYaml).not.toContain("node-a.example.com");
   });
 
   it("enforces node quota before generating YAML", () => {
@@ -94,6 +152,24 @@ describe("prepareRefreshCacheResult", () => {
       nodeCount: 2,
       maxNodesPerSubscription: 1,
     });
+
+    expect(
+      prepareRefreshCacheResult({
+        config: {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: [".*"],
+          },
+        },
+        snapshot: snapshot({ nodes: [node, { ...node, name: "node-b" }] }),
+        maxNodesPerSubscription: 1,
+      })
+    ).toMatchObject({
+      ok: false,
+      reason: "node_quota_exceeded",
+      nodeCount: 2,
+      maxNodesPerSubscription: 1,
+    });
   });
 
   it("returns cache entries with generated YAML for valid snapshots", () => {
@@ -125,4 +201,19 @@ describe("prepareRefreshCacheResult", () => {
       },
     });
   });
+
+  it("rejects invalid persisted filters before publishing refresh output", () => {
+    expect(() =>
+      prepareRefreshCacheResult({
+        config: {
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["(a+)+$"],
+          },
+        },
+        snapshot: snapshot(),
+        maxNodesPerSubscription: 10,
+      })
+    ).toThrow("节点名称过滤配置无效");
+  });
 });
diff --git a/packages/server-core/src/subscription/refresh-cache-result.ts b/packages/server-core/src/subscription/refresh-cache-result.ts
index 1225b68..433b40d 100644
--- a/packages/server-core/src/subscription/refresh-cache-result.ts
+++ b/packages/server-core/src/subscription/refresh-cache-result.ts
@@ -4,6 +4,7 @@ import {
   getEffectiveTestOptions,
 } from "@subboost/core/subscription/config-utils";
 import { buildProxyProvidersFromConfig } from "@subboost/core/subscription/proxy-providers";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import type { ParsedNode } from "@subboost/core/types/node";
 import type { SubscriptionResponseInfo } from "@subboost/core/subscription/subscription-response-info";
 import type { RefreshNodeSnapshotResult } from "./refresh-node-snapshot";
@@ -48,10 +49,17 @@ export function prepareRefreshCacheResult(params: {
       testUrl,
       testInterval,
     });
+  const hasProxyProviders = Boolean(
+    proxyProviders && Object.keys(proxyProviders).length > 0
+  );
   const common = {
     proxyProviders,
     nodeCount: params.snapshot.nodes.length,
   };
+  const nodeNameFilterResult = resolveNodeNameFilter(
+    params.snapshot.nodes,
+    params.config.nodeNameFilter
+  );
 
   if (params.snapshot.refreshableSourceCount > 0 && params.snapshot.refreshedSourceCount === 0) {
     return {
@@ -61,19 +69,19 @@ export function prepareRefreshCacheResult(params: {
     };
   }
 
-  if (params.snapshot.nodes.length === 0 && !proxyProviders) {
+  if (params.snapshot.nodes.length > params.maxNodesPerSubscription) {
     return {
       ok: false,
-      reason: "empty_result",
+      reason: "node_quota_exceeded",
+      maxNodesPerSubscription: params.maxNodesPerSubscription,
       ...common,
     };
   }
 
-  if (params.snapshot.nodes.length > params.maxNodesPerSubscription) {
+  if (nodeNameFilterResult.effectiveCount === 0 && !hasProxyProviders) {
     return {
       ok: false,
-      reason: "node_quota_exceeded",
-      maxNodesPerSubscription: params.maxNodesPerSubscription,
+      reason: "empty_result",
       ...common,
     };
   }

From e4ea0a5a4850e86c26684efa0c489aebecbf91a5 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sun, 26 Jul 2026 22:26:38 +0800
Subject: [PATCH 34/36] feat(ui): add automatic node processing

---
 .../dialer-proxy-groups-section.test.ts       |  28 +++
 .../sections/dialer-proxy-groups-section.tsx  |  44 +++-
 .../sections/node-management-section.test.ts  | 107 +++++++++-
 .../sections/node-management-section.tsx      | 150 ++++++++++---
 .../auto-processing-dialog.test.ts            | 202 ++++++++++++++++++
 .../auto-processing-dialog.tsx                | 197 +++++++++++++++++
 .../proxy-group-advanced-panel.test.ts        |  20 ++
 .../sections/proxy-group-advanced-panel.tsx   |  98 ++++++---
 .../sections/proxy-group-member-bulk.test.ts  |  25 +++
 .../sections/proxy-group-member-bulk.ts       |  35 +++
 .../sections/proxy-groups-categories.test.ts  |  34 +++
 .../sections/proxy-groups-categories.tsx      |  14 +-
 .../use-editing-subscription-loader.test.ts   |  13 ++
 .../home/use-editing-subscription-loader.ts   |   7 +
 .../home/use-subscription-link.test.ts        |  11 +
 .../product/home/use-subscription-link.tsx    |   3 +
 .../src/product/preview/visual-graph.test.ts  |  26 +++
 .../ui/src/product/preview/visual-graph.tsx   |  46 +++-
 .../actions/history-actions.test.ts           |  74 ++++++-
 .../config-store/actions/history-actions.ts   |  38 +++-
 .../config-store/actions/node-actions.test.ts |  41 ++++
 .../config-store/actions/node-actions.ts      |  37 +++-
 .../actions/settings-actions.test.ts          |  27 ++-
 .../config-store/actions/settings-actions.ts  |   8 +
 .../actions/template-actions.test.ts          |   2 +
 .../store/config-store/auth-handoff.test.ts   |   8 +
 .../ui/src/store/config-store/auth-handoff.ts |   5 +
 .../store/config-store/definitions.test.ts    |   3 +
 .../ui/src/store/config-store/definitions.ts  |  22 +-
 .../store/config-store/generated-yaml.test.ts | 117 ++++++++++
 .../src/store/config-store/generated-yaml.ts  |  14 +-
 .../store/config-store/persistence.test.ts    |  75 +++++++
 .../ui/src/store/config-store/persistence.ts  |   3 +
 33 files changed, 1431 insertions(+), 103 deletions(-)
 create mode 100644 packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.test.ts
 create mode 100644 packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.tsx
 create mode 100644 packages/ui/src/store/config-store/persistence.test.ts

diff --git a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
index d1a3bce..d436709 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.test.ts
@@ -250,6 +250,34 @@ describe("DialerProxyGroupsSection", () => {
     expect(mocks.captures.switches[1]).toEqual(expect.objectContaining({ checked: false }));
   });
 
+  it("offers only effective nodes while retaining configured group references", () => {
+    mocks.store.nodes = nodes;
+    mocks.store.nodeNameFilter = {
+      enabled: true,
+      excludeRegexes: ["^alpha$"],
+    };
+    mocks.store.dialerProxyGroups = [
+      groupA,
+      {
+        ...groupB,
+        relayNodes: ["Alpha", "DIRECT"],
+        targetNodes: ["Alpha"],
+      },
+    ];
+
+    const { html } = renderSection({ 0: new Set(["g-a"]) });
+
+    expect(html).not.toContain(">Alpha<");
+    expect(html).toContain("Beta");
+    expect(mocks.store.dialerProxyGroups[0].relayNodes).toEqual(["Alpha"]);
+    mocks.captures.switches[1].onCheckedChange(true);
+    expect(mocks.store.updateDialerProxyGroup).toHaveBeenCalledWith("g-b", {
+      enabled: true,
+      relayNodes: ["Alpha", "DIRECT"],
+      targetNodes: ["Alpha"],
+    });
+  });
+
   it("adds custom groups, rejects duplicates, and records interactions", () => {
     const { setters } = renderSection({ 1: true, 2: { emoji: "🧩", name: "New Dialer" } });
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
index f2da85f..ebe112e 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/dialer-proxy-groups-section.tsx
@@ -19,6 +19,7 @@ import { toast } from "@subboost/ui/components/ui/toaster";
 import { DEFAULT_LOAD_BALANCE_STRATEGY, type ProxyGroupGroupType } from "@subboost/core/types/config";
 import { PROXY_GROUP_MODULES } from "@subboost/core/generator/proxy-groups";
 import { resolveProxyGroupModuleName } from "@subboost/core/proxy-group-name";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import { cn } from "@subboost/ui/lib/utils";
 import { useConfigStore, PRESET_RELAY_NAMES } from "@subboost/ui/store/config-store";
 import { useProductInteractionAdapter } from "@subboost/ui/product/interactions";
@@ -53,6 +54,7 @@ export function DialerProxyGroupsSection({
 }) {
   const {
     nodes,
+    nodeNameFilter,
     dialerProxyGroups,
     customProxyGroups,
     proxyGroupNameOverrides,
@@ -77,6 +79,18 @@ export function DialerProxyGroupsSection({
   const [relaySearchByGroupId, setRelaySearchByGroupId] = React.useState<Record<string, string>>({});
   const [targetSearchByGroupId, setTargetSearchByGroupId] = React.useState<Record<string, string>>({});
   const interactions = useProductInteractionAdapter();
+  const effectiveNodes = React.useMemo(
+    () => resolveNodeNameFilter(nodes, nodeNameFilter).effectiveNodes,
+    [nodeNameFilter, nodes],
+  );
+  const rawNodeNameSet = React.useMemo(
+    () => new Set(nodes.map((node) => node.name)),
+    [nodes],
+  );
+  const effectiveNodeNameSet = React.useMemo(
+    () => new Set(effectiveNodes.map((node) => node.name)),
+    [effectiveNodes],
+  );
 
   const toggleDialerGroupExpand = (groupId: string) => {
     setExpandedDialerGroups((prev) => {
@@ -142,7 +156,7 @@ export function DialerProxyGroupsSection({
       }
     }
 
-    const available = nodes
+    const available = effectiveNodes
       .filter((n) => !usedTargets.has(n.name))
       .map((n) => ({
         name: n.name,
@@ -199,6 +213,12 @@ export function DialerProxyGroupsSection({
           {/* 已有的中转组 */}
           {dialerProxyGroups.map((group) => {
             const isEnabled = group.enabled !== false;
+            const visibleRelayCount = group.relayNodes.filter(
+              (name) => !rawNodeNameSet.has(name) || effectiveNodeNameSet.has(name),
+            ).length;
+            const visibleTargetCount = group.targetNodes.filter((name) =>
+              effectiveNodeNameSet.has(name),
+            ).length;
             const isEditing = editingDialerGroupId === group.id;
             const dialerGroupType: ProxyGroupGroupType = group.type;
             const dialerStrategy = group.strategy ?? DEFAULT_LOAD_BALANCE_STRATEGY;
@@ -215,7 +235,7 @@ export function DialerProxyGroupsSection({
                   return displayName.toLowerCase().includes(relaySearchKeyword);
                 })
               : availableRelayNodes;
-            const availableTargetNodes = nodes.filter((node) => !group.relayNodes.includes(node.name));
+            const availableTargetNodes = effectiveNodes.filter((node) => !group.relayNodes.includes(node.name));
             const visibleTargetNodes = targetSearchKeyword
               ? availableTargetNodes.filter((node) => node.name.toLowerCase().includes(targetSearchKeyword))
               : availableTargetNodes;
@@ -312,8 +332,8 @@ export function DialerProxyGroupsSection({
                       className="pointer-events-none relative z-10 ml-auto flex"
                       disabled={!isEnabled}
                       items={[
-                        { label: `${group.relayNodes.length} 中转`, tone: "accent" },
-                        { label: `${group.targetNodes.length} 落地`, tone: "success", separator: "arrow" },
+                        { label: `${visibleRelayCount} 中转`, tone: "accent" },
+                        { label: `${visibleTargetCount} 落地`, tone: "success", separator: "arrow" },
                       ]}
                     />
                     <Switch
@@ -327,25 +347,29 @@ export function DialerProxyGroupsSection({
                           return;
                         }
 
-                        const nodeNameSet = new Set(nodes.map((n) => n.name));
                         const otherEnabledGroups = dialerProxyGroups.filter(
                           (g) => g.id !== group.id && g.enabled !== false
                         );
                         const otherTargets = new Set<string>();
                         const otherRelayNodeNames = new Set<string>();
                         for (const g of otherEnabledGroups) {
-                          for (const t of g.targetNodes) otherTargets.add(t);
+                          for (const t of g.targetNodes) {
+                            if (effectiveNodeNameSet.has(t)) otherTargets.add(t);
+                          }
                           for (const r of g.relayNodes) {
-                            if (nodeNameSet.has(r)) otherRelayNodeNames.add(r);
+                            if (effectiveNodeNameSet.has(r)) otherRelayNodeNames.add(r);
                           }
                         }
 
                         const nextTargetNodes = group.targetNodes.filter(
-                          (n) => !otherTargets.has(n) && !otherRelayNodeNames.has(n)
+                          (n) =>
+                            !effectiveNodeNameSet.has(n) ||
+                            (!otherTargets.has(n) && !otherRelayNodeNames.has(n))
                         );
                         const nextRelayNodes = group.relayNodes.filter((n) => {
                           if (n === "DIRECT") return true;
-                          if (!nodeNameSet.has(n)) return true; // 代理组等
+                          if (!rawNodeNameSet.has(n)) return true; // 代理组等
+                          if (!effectiveNodeNameSet.has(n)) return true;
                           return !otherTargets.has(n);
                         });
 
@@ -561,7 +585,7 @@ export function DialerProxyGroupsSection({
             );
           })}
 
-          {nodes.length === 0 && dialerProxyGroups.length === 0 && (
+          {effectiveNodes.length === 0 && dialerProxyGroups.length === 0 && (
             <p className="text-xs text-white/30 text-center py-2">请先导入节点后配置中转代理组</p>
           )}
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.test.ts
index 75f4219..e84623c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.test.ts
@@ -50,7 +50,8 @@ vi.mock("lucide-react", () => ({
 vi.mock("@subboost/ui/components/ui/badge", () => ({ Badge: () => null }));
 vi.mock("@subboost/ui/components/ui/button", () => ({
   Button: (props: any) => {
-    mocks.captures.button = props;
+    mocks.captures.buttons = [...(mocks.captures.buttons || []), props];
+    if (props.children === "批量编辑") mocks.captures.button = props;
     return null;
   },
 }));
@@ -83,6 +84,12 @@ vi.mock("./node-management/bulk-edit-dialog", () => ({
     return null;
   },
 }));
+vi.mock("./node-management/auto-processing-dialog", () => ({
+  NodeManagementAutoProcessingDialog: (props: any) => {
+    mocks.captures.autoProcessingDialog = props;
+    return null;
+  },
+}));
 vi.mock("./node-management/node-list", () => ({
   NodeManagementNodeList: (props: any) => {
     mocks.captures.nodeList = props;
@@ -147,6 +154,7 @@ describe("NodeManagementSection", () => {
         },
       ],
       nodes,
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
       deletedNodeNames: [" Gone ", "Deleted", ""],
       deletedNodes: [
         { originName: "Deleted", name: "[HK] Deleted" },
@@ -163,6 +171,7 @@ describe("NodeManagementSection", () => {
       listenerPorts: { "[HK] Alpha": 7891, Beta: 7892 },
       setListenerPort: vi.fn(),
       bulkSetListenerPorts: vi.fn(),
+      setNodeNameFilter: vi.fn(),
     };
   });
 
@@ -374,6 +383,102 @@ describe("NodeManagementSection", () => {
     });
   });
 
+  it("uses effective nodes for the list, search, and bulk edit while keeping the raw snapshot for auto processing", () => {
+    mocks.store.nodeNameFilter = { enabled: true, excludeRegexes: ["beta"] };
+    const { setters } = renderSection();
+
+    expect(mocks.captures.nodeList.nodes).toEqual([nodes[0]]);
+    expect(mocks.captures.nodeList.visibleNodes).toEqual([nodes[0]]);
+    expect(mocks.captures.bulkDialog.nodes).toEqual([nodes[0]]);
+    expect(mocks.captures.autoProcessingDialog).toEqual(
+      expect.objectContaining({
+        nodes,
+        config: { enabled: true, excludeRegexes: ["beta"] },
+        hasProxyProviders: false,
+      })
+    );
+
+    const autoProcessingButton = mocks.captures.buttons.find(
+      (props: any) => Array.isArray(props.children) && props.children[0] === "自动处理"
+    );
+    expect(autoProcessingButton.disabled).not.toBe(true);
+    autoProcessingButton.onClick();
+    expect(setters[8]).toHaveBeenCalledWith(true);
+
+    mocks.captures.autoProcessingDialog.onSave({
+      enabled: true,
+      excludeRegexes: ["beta"],
+    });
+    expect(mocks.store.setNodeNameFilter).toHaveBeenCalledWith({
+      enabled: true,
+      excludeRegexes: ["beta"],
+    });
+  });
+
+  it("keeps automatic processing available before nodes are imported", () => {
+    mocks.store.nodes = [];
+    renderSection();
+
+    const autoProcessingButton = mocks.captures.buttons.find(
+      (props: any) => Array.isArray(props.children) && props.children[0] === "自动处理"
+    );
+    expect(autoProcessingButton.disabled).not.toBe(true);
+  });
+
+  it("orders only effective node slots when filtered nodes are hidden", () => {
+    const gamma = {
+      name: "Gamma",
+      type: "trojan",
+      server: "gamma.test",
+      port: 443,
+      password: "secret",
+      _originName: "Gamma",
+    };
+    mocks.store.nodes = [nodes[0], nodes[1], gamma];
+    mocks.store.nodeNameFilter = { enabled: true, excludeRegexes: ["beta"] };
+    renderSection();
+
+    mocks.captures.nodeList.moveNode(nodes[0].name, "down");
+    expect(mocks.store.setNodeOrder).toHaveBeenCalledWith(
+      nodes[0].name,
+      2,
+      [nodes[0].name, gamma.name]
+    );
+
+    mocks.captures.nodeList.setNodeOrder(gamma.name, 1);
+    expect(mocks.store.setNodeOrder).toHaveBeenCalledWith(
+      gamma.name,
+      1,
+      [nodes[0].name, gamma.name]
+    );
+  });
+
+  it("only treats a usable http(s) source as a proxy-provider output", () => {
+    for (const content of ["", "not a url", "ftp://example.com/provider"]) {
+      mocks.store.sources = [
+        {
+          id: "provider",
+          type: "url",
+          content,
+          useProxyProviders: true,
+        },
+      ];
+      renderSection();
+      expect(mocks.captures.autoProcessingDialog.hasProxyProviders).toBe(false);
+    }
+
+    mocks.store.sources = [
+      {
+        id: "provider",
+        type: "url",
+        content: " https://example.com/provider ",
+        useProxyProviders: true,
+      },
+    ];
+    renderSection();
+    expect(mocks.captures.autoProcessingDialog.hasProxyProviders).toBe(true);
+  });
+
   it("ignores empty listener-port cleanup requests and keeps unchanged cleanup state", () => {
     renderSection({ 5: { Beta: "7890" }, 6: { Beta: "bad" } });
 
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx b/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx
index 1d4fd9d..ac4de22 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management-section.tsx
@@ -9,9 +9,14 @@ import { Input } from "@subboost/ui/components/ui/input";
 import { SwitchField } from "@subboost/ui/components/ui/switch-field";
 import { toast } from "@subboost/ui/components/ui/toaster";
 import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
+import {
+  DEFAULT_NODE_NAME_FILTER_CONFIG,
+  resolveNodeNameFilter,
+} from "@subboost/core/subscription/node-name-filter";
 import { useConfigStore, type SubscriptionSource } from "@subboost/ui/store/config-store";
 import { useProductInteractionAdapter } from "@subboost/ui/product/interactions";
 import { SectionHeader } from "../section-header";
+import { NodeManagementAutoProcessingDialog } from "./node-management/auto-processing-dialog";
 import { NodeManagementBulkEditDialog } from "./node-management/bulk-edit-dialog";
 import { NodeManagementNodeList } from "./node-management/node-list";
 
@@ -19,6 +24,17 @@ const NODE_SOURCE_IDS_KEY = "_sourceIds";
 const ORIGIN_NAME_KEY = "_originName";
 const LISTENER_PORT_WARNING_STORAGE_KEY = "subboost.listenerPortWarningAccepted";
 
+function canGenerateProxyProvider(source: SubscriptionSource): boolean {
+  if (source.type !== "url" || source.useProxyProviders !== true) return false;
+  const content = typeof source.content === "string" ? source.content.trim() : "";
+  if (!content) return false;
+  try {
+    return ["http:", "https:"].includes(new URL(content).protocol);
+  } catch {
+    return false;
+  }
+}
+
 function hasAcceptedListenerPortWarning(): boolean {
   if (typeof window === "undefined") return false;
   try {
@@ -47,6 +63,7 @@ export function NodeManagementSection({
   const {
     sources,
     nodes,
+    nodeNameFilter,
     deletedNodeNames,
     deletedNodes,
     removeNode,
@@ -54,13 +71,24 @@ export function NodeManagementSection({
     renameNode,
     restoreNodeName,
     bulkRenameNodes,
-    moveNode,
     setNodeOrder,
     listenerPorts,
     setListenerPort,
     bulkSetListenerPorts,
+    setNodeNameFilter,
   } = useConfigStore();
 
+  const normalizedNodeNameFilter = nodeNameFilter ?? DEFAULT_NODE_NAME_FILTER_CONFIG;
+  const nodeNameFilterResult = React.useMemo(
+    () => resolveNodeNameFilter(nodes, normalizedNodeNameFilter),
+    [nodes, normalizedNodeNameFilter]
+  );
+  const effectiveNodes = nodeNameFilterResult.effectiveNodes;
+  const hasProxyProviders = React.useMemo(
+    () => sources.some(canGenerateProxyProvider),
+    [sources]
+  );
+
   const deletedMarkedNodes = React.useMemo(() => {
     const activeOrigins = new Set<string>();
     for (const node of nodes) {
@@ -101,6 +129,7 @@ export function NodeManagementSection({
   const [listenerPortDrafts, setListenerPortDrafts] = React.useState<Record<string, string>>({});
   const [listenerPortErrors, setListenerPortErrors] = React.useState<Record<string, string>>({});
   const [orderDrafts, setOrderDrafts] = React.useState<Record<string, string>>({});
+  const [autoProcessingOpen, setAutoProcessingOpen] = React.useState(false);
 
   const hasConfiguredListenerPorts = React.useMemo(
     () => Object.values(listenerPorts).some((port) => Number.isInteger(port) && port >= 1 && port <= 65535),
@@ -158,15 +187,44 @@ export function NodeManagementSection({
 
   const nodeIndexByName = React.useMemo(() => {
     const map = new Map<string, number>();
-    nodes.forEach((n, i) => map.set(n.name, i));
+    effectiveNodes.forEach((n, i) => map.set(n.name, i));
     return map;
-  }, [nodes]);
+  }, [effectiveNodes]);
+  const effectiveNodeNames = React.useMemo(
+    () => effectiveNodes.map((node) => node.name),
+    [effectiveNodes]
+  );
 
   const visibleNodes = React.useMemo(() => {
     const keyword = nodeSearchKeyword.trim().toLowerCase();
-    if (!keyword) return nodes;
-    return nodes.filter((node) => node.name.toLowerCase().includes(keyword));
-  }, [nodeSearchKeyword, nodes]);
+    if (!keyword) return effectiveNodes;
+    return effectiveNodes.filter((node) => node.name.toLowerCase().includes(keyword));
+  }, [effectiveNodes, nodeSearchKeyword]);
+
+  const setEffectiveNodeOrder = React.useCallback(
+    (nodeName: string, order: number) => {
+      const currentIndex = nodeIndexByName.get(nodeName);
+      if (currentIndex === undefined || !Number.isFinite(order)) return;
+      const targetIndex = Math.max(
+        0,
+        Math.min(effectiveNodes.length - 1, Math.floor(order) - 1)
+      );
+      if (targetIndex === currentIndex) return;
+      setNodeOrder(nodeName, targetIndex + 1, effectiveNodeNames);
+    },
+    [effectiveNodeNames, effectiveNodes.length, nodeIndexByName, setNodeOrder]
+  );
+
+  const moveEffectiveNode = React.useCallback(
+    (nodeName: string, direction: "up" | "down") => {
+      const currentIndex = nodeIndexByName.get(nodeName);
+      if (currentIndex === undefined) return;
+      const nextIndex = direction === "up" ? currentIndex - 1 : currentIndex + 1;
+      if (nextIndex < 0 || nextIndex >= effectiveNodes.length) return;
+      setEffectiveNodeOrder(nodeName, nextIndex + 1);
+    },
+    [effectiveNodes.length, nodeIndexByName, setEffectiveNodeOrder]
+  );
 
   const visibleDeletedMarkedNodes = React.useMemo(() => {
     const keyword = nodeSearchKeyword.trim().toLowerCase();
@@ -410,9 +468,9 @@ export function NodeManagementSection({
         onToggle={onToggle}
         badge={
           <div className="ml-auto flex items-center gap-2">
-            {nodes.length > 0 ? (
+            {effectiveNodes.length > 0 ? (
               <Badge variant="outline" className="border-green-500/50 bg-green-500/10 text-green-300">
-                {nodes.length} 个节点
+                {effectiveNodes.length} 个节点
               </Badge>
             ) : (
               <Badge variant="secondary">无节点</Badge>
@@ -428,41 +486,60 @@ export function NodeManagementSection({
 
       {isExpanded && (
         <div className="mt-2 pl-6">
-          <div className="flex items-center gap-2 pb-2 pr-2">
-            <div className="relative flex-1 min-w-0">
+          <div className="flex flex-col gap-2 pb-2 pr-2 sm:flex-row sm:items-center">
+            <div className="relative w-full sm:min-w-0 sm:flex-1">
               <Search className="absolute left-2 top-1/2 -translate-y-1/2 h-3.5 w-3.5 text-white/30" />
               <Input
                 value={nodeSearchKeyword}
                 onChange={(e) => setNodeSearchKeyword(e.target.value)}
                 placeholder="搜索节点..."
-                disabled={nodes.length === 0 && deletedMarkedNodes.length === 0}
+                disabled={effectiveNodes.length === 0 && deletedMarkedNodes.length === 0}
                 className="pl-7 text-xs h-7 bg-white/5 border-white/10"
               />
             </div>
-            <div className="shrink-0" title="为节点配置 socks5/http 协议的本地监听端口">
-              <SwitchField
-                label="监听端口"
-                checked={isListenerPortVisible}
-                onCheckedChange={handleListenerPortChange}
-                disabled={nodes.length === 0 && !hasConfiguredListenerPorts}
-                density="compact"
-              />
+            <div className="flex w-full flex-wrap items-center gap-2 sm:w-auto">
+              <div className="shrink-0" title="为节点配置 socks5/http 协议的本地监听端口">
+                <SwitchField
+                  label="监听端口"
+                  checked={isListenerPortVisible}
+                  onCheckedChange={handleListenerPortChange}
+                  disabled={effectiveNodes.length === 0 && !hasConfiguredListenerPorts}
+                  density="compact"
+                />
+              </div>
+              <Button
+                variant="secondary"
+                size="sm"
+                onClick={() => setNameRulesOpen(true)}
+                disabled={effectiveNodes.length === 0}
+                className="h-7 shrink-0 px-2 text-xs"
+              >
+                批量编辑
+              </Button>
+              <Button
+                variant="secondary"
+                size="sm"
+                onClick={() => setAutoProcessingOpen(true)}
+                className="h-7 shrink-0 gap-1.5 px-2 text-xs"
+              >
+                自动处理
+                {normalizedNodeNameFilter.enabled &&
+                normalizedNodeNameFilter.excludeRegexes.length > 0 ? (
+                  <Badge
+                    variant="outline"
+                    className="h-4 min-w-4 border-indigo-400/40 bg-indigo-400/10 px-1 text-[10px] leading-none text-indigo-200"
+                  >
+                    {normalizedNodeNameFilter.excludeRegexes.length}
+                  </Badge>
+                ) : null}
+              </Button>
             </div>
-            <Button
-              variant="secondary"
-              size="sm"
-              onClick={() => setNameRulesOpen(true)}
-              disabled={nodes.length === 0}
-              className="h-7 px-2 text-xs"
-            >
-              批量编辑
-            </Button>
           </div>
 
           <NodeManagementBulkEditDialog
             open={nameRulesOpen}
             onOpenChange={setNameRulesOpen}
-            nodes={nodes}
+            nodes={effectiveNodes}
             resolveNodeNameParts={resolveNodeNameParts}
             bulkRenameNodes={bulkRenameNodes}
             listenerPortEnabled={isListenerPortVisible}
@@ -471,8 +548,17 @@ export function NodeManagementSection({
             onClearListenerPortUiState={clearListenerPortUiState}
           />
 
-          <NodeManagementNodeList
+          <NodeManagementAutoProcessingDialog
+            open={autoProcessingOpen}
+            onOpenChange={setAutoProcessingOpen}
             nodes={nodes}
+            config={normalizedNodeNameFilter}
+            hasProxyProviders={hasProxyProviders}
+            onSave={setNodeNameFilter}
+          />
+
+          <NodeManagementNodeList
+            nodes={effectiveNodes}
             deletedMarkedNodes={deletedMarkedNodes}
             visibleNodes={visibleNodes}
             visibleDeletedMarkedNodes={visibleDeletedMarkedNodes}
@@ -493,8 +579,8 @@ export function NodeManagementSection({
             orderDrafts={orderDrafts}
             setOrderDrafts={setOrderDrafts}
             nodeIndexByName={nodeIndexByName}
-            setNodeOrder={setNodeOrder}
-            moveNode={moveNode}
+            setNodeOrder={setEffectiveNodeOrder}
+            moveNode={moveEffectiveNode}
             isListenerPortVisible={isListenerPortVisible}
             removeNode={removeNode}
             restoreDeletedNode={restoreDeletedNode}
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.test.ts
new file mode 100644
index 0000000..8912c76
--- /dev/null
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.test.ts
@@ -0,0 +1,202 @@
+import * as React from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { ParsedNode } from "@subboost/core/types/node";
+
+const mocks = vi.hoisted(() => ({
+  buttons: [] as Array<Record<string, any>>,
+  dialog: null as Record<string, any> | null,
+  switchField: null as Record<string, any> | null,
+  textarea: null as Record<string, any> | null,
+}));
+
+vi.mock("@subboost/ui/components/ui/button", () => ({
+  Button: (props: any) => {
+    mocks.buttons.push(props);
+    return React.createElement("button", { disabled: props.disabled }, props.children);
+  },
+}));
+vi.mock("@subboost/ui/components/ui/dialog", () => ({
+  Dialog: (props: any) => {
+    mocks.dialog = props;
+    return props.children;
+  },
+  DialogContent: (props: any) => React.createElement("section", null, props.children),
+  DialogDescription: (props: any) => React.createElement("p", null, props.children),
+  DialogFooter: (props: any) => React.createElement("footer", null, props.children),
+  DialogHeader: (props: any) => React.createElement("header", null, props.children),
+  DialogTitle: (props: any) => React.createElement("h2", null, props.children),
+}));
+vi.mock("@subboost/ui/components/ui/form-field", () => ({
+  FormField: (props: any) =>
+    React.createElement(
+      "div",
+      null,
+      React.createElement("label", null, props.label),
+      props.children,
+      props.description ? React.createElement("p", null, props.description) : null,
+      props.error ? React.createElement("p", { role: "alert" }, props.error) : null
+    ),
+}));
+vi.mock("@subboost/ui/components/ui/switch-field", () => ({
+  SwitchField: (props: any) => {
+    mocks.switchField = props;
+    return React.createElement(
+      "label",
+      null,
+      props.label,
+      React.createElement("input", {
+        checked: props.checked,
+        readOnly: true,
+        type: "checkbox",
+      })
+    );
+  },
+}));
+vi.mock("@subboost/ui/components/ui/textarea", () => ({
+  Textarea: (props: any) => {
+    mocks.textarea = props;
+    return React.createElement("textarea", {
+      placeholder: props.placeholder,
+      readOnly: true,
+      value: props.value,
+    });
+  },
+}));
+
+import { NodeManagementAutoProcessingDialog } from "./auto-processing-dialog";
+
+const nodes = [
+  {
+    name: "[HK] Alpha",
+    type: "ss",
+    server: "alpha.test",
+    port: 443,
+    cipher: "aes-128-gcm",
+    password: "secret",
+    _originName: "Alpha",
+  },
+  {
+    name: "Beta",
+    type: "vless",
+    server: "beta.test",
+    port: 8443,
+    uuid: "00000000-0000-4000-8000-000000000001",
+  },
+] as ParsedNode[];
+
+function renderDialog(
+  overrides: Partial<React.ComponentProps<typeof NodeManagementAutoProcessingDialog>> = {}
+) {
+  const props: React.ComponentProps<typeof NodeManagementAutoProcessingDialog> = {
+    open: true,
+    onOpenChange: vi.fn(),
+    nodes,
+    config: { enabled: true, excludeRegexes: ["alpha"] },
+    hasProxyProviders: false,
+    onSave: vi.fn(),
+    ...overrides,
+  };
+  const html = renderToStaticMarkup(
+    React.createElement(NodeManagementAutoProcessingDialog, props)
+  );
+  return { html, props };
+}
+
+function findButton(label: string) {
+  return mocks.buttons.find((button) => button.children === label);
+}
+
+describe("NodeManagementAutoProcessingDialog", () => {
+  beforeEach(() => {
+    mocks.buttons = [];
+    mocks.dialog = null;
+    mocks.switchField = null;
+    mocks.textarea = null;
+  });
+
+  it("renders the compact wording, counts, and matching display/origin names", () => {
+    const { html } = renderDialog();
+
+    expect(html).toContain("自动处理");
+    expect(html).toContain("启用");
+    expect(html).toContain("排除正则");
+    expect(html).toContain("每行一条，匹配导入名称。");
+    expect(html).toContain("剩余流量|套餐到期|注意事项");
+    expect(html).toContain("导入 2 · 排除 1 · 保留 1");
+    expect(html).toContain("[HK] Alpha");
+    expect(html).toContain("原名：Alpha");
+    expect(html).not.toContain("原名：Beta");
+    expect(mocks.switchField).toEqual(
+      expect.objectContaining({ checked: true, label: "启用" })
+    );
+  });
+
+  it("normalizes empty and duplicate lines before saving", () => {
+    const { props } = renderDialog({
+      config: {
+        enabled: true,
+        excludeRegexes: [" Alpha ", "", "Alpha"],
+      },
+    });
+
+    const saveButton = findButton("保存");
+    expect(saveButton).toEqual(expect.objectContaining({ disabled: false }));
+    saveButton?.onClick();
+
+    expect(props.onSave).toHaveBeenCalledWith({
+      enabled: true,
+      excludeRegexes: ["Alpha"],
+    });
+    expect(props.onOpenChange).toHaveBeenCalledWith(false);
+  });
+
+  it.each([
+    { pattern: "[", message: "第 2 行正则无效" },
+    { pattern: "(a+)+$", message: "第 2 行正则过于复杂" },
+  ])("blocks invalid rules and reports their source line", ({ pattern, message }) => {
+    const { html, props } = renderDialog({
+      config: { enabled: true, excludeRegexes: ["nomatch", pattern] },
+    });
+
+    expect(html).toContain(message);
+    const saveButton = findButton("保存");
+    expect(saveButton).toEqual(expect.objectContaining({ disabled: true }));
+    saveButton?.onClick();
+    expect(props.onSave).not.toHaveBeenCalled();
+  });
+
+  it("blocks an empty effective result unless proxy-providers keep output valid", () => {
+    let result = renderDialog({
+      config: { enabled: true, excludeRegexes: [".*"] },
+    });
+
+    expect(result.html).toContain("过滤后没有可用节点，请调整规则或关闭过滤。");
+    expect(findButton("保存")).toEqual(expect.objectContaining({ disabled: true }));
+
+    mocks.buttons = [];
+    result = renderDialog({
+      config: { enabled: true, excludeRegexes: [".*"] },
+      hasProxyProviders: true,
+    });
+    expect(result.html).toContain("proxy-providers 不参与。");
+    const providerSaveButton = findButton("保存");
+    expect(providerSaveButton).toEqual(expect.objectContaining({ disabled: false }));
+    providerSaveButton?.onClick();
+    expect(result.props.onSave).toHaveBeenCalledWith({
+      enabled: true,
+      excludeRegexes: [".*"],
+    });
+  });
+
+  it("closes through both the dialog contract and the cancel button", () => {
+    const { props } = renderDialog();
+
+    mocks.dialog?.onOpenChange(false);
+    findButton("取消")?.onClick();
+
+    expect(props.onOpenChange).toHaveBeenCalledTimes(2);
+    expect(props.onOpenChange).toHaveBeenNthCalledWith(1, false);
+    expect(props.onOpenChange).toHaveBeenNthCalledWith(2, false);
+  });
+});
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.tsx b/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.tsx
new file mode 100644
index 0000000..6842b1f
--- /dev/null
+++ b/packages/ui/src/product/converter/advanced-mode/sections/node-management/auto-processing-dialog.tsx
@@ -0,0 +1,197 @@
+"use client";
+
+import * as React from "react";
+import {
+  NodeNameFilterConfigError,
+  parseNodeNameFilterConfig,
+  resolveNodeNameFilter,
+  type NodeNameFilterConfig,
+  type NodeNameFilterValidationError,
+} from "@subboost/core/subscription/node-name-filter";
+import { getNodeOriginName } from "@subboost/core/subscription/node-source-state";
+import type { ParsedNode } from "@subboost/core/types/node";
+import { Button } from "@subboost/ui/components/ui/button";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@subboost/ui/components/ui/dialog";
+import { FormField } from "@subboost/ui/components/ui/form-field";
+import { SwitchField } from "@subboost/ui/components/ui/switch-field";
+import { Textarea } from "@subboost/ui/components/ui/textarea";
+
+type NodeManagementAutoProcessingDialogProps = {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  nodes: ParsedNode[];
+  config: NodeNameFilterConfig;
+  hasProxyProviders: boolean;
+  onSave: (config: NodeNameFilterConfig) => void;
+};
+
+function formatValidationError(error: NodeNameFilterValidationError): string {
+  if (error.line && error.code === "invalid_regex") {
+    return `第 ${error.line} 行正则无效`;
+  }
+  if (error.line && error.code === "unsafe_regex") {
+    return `第 ${error.line} 行正则过于复杂`;
+  }
+  return error.line ? `第 ${error.line} 行${error.message}` : error.message;
+}
+
+export function NodeManagementAutoProcessingDialog({
+  open,
+  onOpenChange,
+  nodes,
+  config,
+  hasProxyProviders,
+  onSave,
+}: NodeManagementAutoProcessingDialogProps) {
+  const configText = config.excludeRegexes.join("\n");
+  const [enabled, setEnabled] = React.useState(config.enabled);
+  const [excludeRegexText, setExcludeRegexText] = React.useState(configText);
+
+  React.useEffect(() => {
+    if (!open) return;
+    setEnabled(config.enabled);
+    setExcludeRegexText(configText);
+  }, [config.enabled, configText, open]);
+
+  const plan = React.useMemo(() => {
+    try {
+      const parsedConfig = parseNodeNameFilterConfig({
+        enabled,
+        excludeRegexes: excludeRegexText.split("\n"),
+      });
+      return {
+        config: parsedConfig,
+        result: resolveNodeNameFilter(nodes, parsedConfig),
+        errors: [] as NodeNameFilterValidationError[],
+      };
+    } catch (error) {
+      return {
+        config: null,
+        result: null,
+        errors:
+          error instanceof NodeNameFilterConfigError
+            ? error.errors
+            : [{ code: "invalid_config" as const, message: "配置格式无效" }],
+      };
+    }
+  }, [enabled, excludeRegexText, nodes]);
+
+  const validationMessage =
+    plan.errors.length > 0 ? plan.errors.map(formatValidationError).join("；") : undefined;
+  const blocksEmptyResult = Boolean(
+    plan.config?.enabled &&
+      plan.result &&
+      plan.result.rawCount > 0 &&
+      plan.result.effectiveCount === 0 &&
+      !hasProxyProviders
+  );
+  const canSave = Boolean(plan.config && plan.result && !blocksEmptyResult);
+
+  const handleSave = () => {
+    if (!plan.config || !canSave) return;
+    onSave(plan.config);
+    onOpenChange(false);
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="w-[calc(100%_-_2rem)] max-w-xl gap-4 p-4 sm:p-6">
+        <DialogHeader>
+          <DialogTitle>自动处理</DialogTitle>
+          <DialogDescription className="sr-only">
+            设置按导入名称自动排除节点的规则
+          </DialogDescription>
+        </DialogHeader>
+
+        <SwitchField
+          label="启用"
+          checked={enabled}
+          onCheckedChange={setEnabled}
+        />
+
+        <FormField
+          label="排除正则"
+          description="每行一条，匹配导入名称。"
+          error={validationMessage}
+        >
+          <Textarea
+            value={excludeRegexText}
+            onChange={(event) => setExcludeRegexText(event.target.value)}
+            placeholder="剩余流量|套餐到期|注意事项"
+            rows={6}
+            className="min-h-32 resize-y break-words [overflow-wrap:anywhere]"
+          />
+        </FormField>
+
+        <div
+          className="space-y-2 rounded-xl border border-white/10 bg-white/[0.03] p-3"
+          aria-live="polite"
+        >
+          <p className="text-xs leading-relaxed text-white/60">
+            导入 {plan.result?.rawCount ?? nodes.length} · 排除{" "}
+            {plan.result?.excludedCount ?? "—"} · 保留{" "}
+            {plan.result?.effectiveCount ?? "—"}
+          </p>
+
+          {hasProxyProviders ? (
+            <p className="text-xs leading-relaxed text-white/40">
+              proxy-providers 不参与。
+            </p>
+          ) : null}
+
+          {blocksEmptyResult ? (
+            <p className="text-xs leading-relaxed text-red-400" role="alert">
+              过滤后没有可用节点，请调整规则或关闭过滤。
+            </p>
+          ) : null}
+
+          {plan.result ? (
+            <div className="space-y-1.5">
+              <p className="text-xs font-medium text-white/60">匹配节点</p>
+              {plan.result.excludedNodes.length > 0 ? (
+                <div className="max-h-48 space-y-1 overflow-y-auto pr-1 custom-scrollbar">
+                  {plan.result.excludedNodes.map((node, index) => {
+                    const originName = getNodeOriginName(node);
+                    return (
+                      <div
+                        key={`${node.name}:${index}`}
+                        className="rounded-lg border border-red-500/15 bg-red-500/[0.06] px-2.5 py-2"
+                      >
+                        <p className="break-words text-xs leading-relaxed text-white/75 [overflow-wrap:anywhere]">
+                          {node.name}
+                        </p>
+                        {originName !== node.name ? (
+                          <p className="mt-0.5 break-words text-[11px] leading-relaxed text-white/40 [overflow-wrap:anywhere]">
+                            原名：{originName}
+                          </p>
+                        ) : null}
+                      </div>
+                    );
+                  })}
+                </div>
+              ) : (
+                <p className="text-xs text-white/40">没有匹配节点</p>
+              )}
+            </div>
+          ) : null}
+        </div>
+
+        <DialogFooter className="gap-2 sm:space-x-0">
+          <Button variant="ghost" onClick={() => onOpenChange(false)}>
+            取消
+          </Button>
+          <Button onClick={handleSave} disabled={!canSave}>
+            保存
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.test.ts
index d2d9f5d..ac3b84b 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.test.ts
@@ -168,6 +168,26 @@ describe("ProxyGroupAdvancedPanel", () => {
     );
   });
 
+  it("omits globally filtered nodes from member candidates", () => {
+    mocks.store.nodeNameFilter = {
+      enabled: true,
+      excludeRegexes: ["japan"],
+    };
+
+    const html = renderToStaticMarkup(
+      React.createElement(ProxyGroupAdvancedPanel, {
+        target: { kind: "custom", id: "media", name: "Media" },
+        advanced: {},
+        onChange: vi.fn(),
+        rulesCount: 0,
+        rulesContent: null,
+      }),
+    );
+
+    expect(html).toContain("US Source");
+    expect(html).not.toContain("Japan Source");
+  });
+
   it("renders empty states without generated members or source matches", () => {
     mocks.store = {
       ...mocks.store,
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx
index 318e3a2..73497f7 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-advanced-panel.tsx
@@ -14,6 +14,7 @@ import { PROXY_GROUP_MODULES, generateProxyGroups } from "@subboost/core/generat
 import { resolveProxyGroupModuleName } from "@subboost/core/proxy-group-name";
 import { REGION_PRESETS } from "@subboost/core/proxy-group-advanced";
 import { getProxyGroupMemberKey } from "@subboost/core/proxy-group-targets";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import { getNodeSourceIds } from "@subboost/core/subscription/node-source-state";
 import { isSubscriptionInfoNodeName } from "@subboost/core/subscription/info-node-name";
 import type {
@@ -31,6 +32,7 @@ import {
   insertMemberAfterProtected,
   isNodeMember,
   isProxyGroupMember,
+  mergeVisibleMemberOrder,
   normalizeList,
   withMember,
   withoutMember,
@@ -136,6 +138,7 @@ export function ProxyGroupAdvancedPanel({
 }) {
   const {
     nodes,
+    nodeNameFilter,
     sources,
     enabledProxyGroups,
     customProxyGroups,
@@ -148,6 +151,32 @@ export function ProxyGroupAdvancedPanel({
     ruleProviderBaseUrl,
   } = useConfigStore();
   const [draggingKey, setDraggingKey] = React.useState<string | null>(null);
+  const effectiveNodes = React.useMemo(
+    () => resolveNodeNameFilter(nodes, nodeNameFilter).effectiveNodes,
+    [nodeNameFilter, nodes],
+  );
+  const effectiveNodeNameSet = React.useMemo(
+    () => new Set(effectiveNodes.map((node) => node.name)),
+    [effectiveNodes],
+  );
+  const filteredNodeMemberKeys = React.useMemo(
+    () =>
+      new Set(
+        nodes
+          .filter((node) => !effectiveNodeNameSet.has(node.name))
+          .map((node) => getProxyGroupMemberKey({ kind: "node", name: node.name })),
+      ),
+    [effectiveNodeNameSet, nodes],
+  );
+  const preserveFilteredMemberOrder = React.useCallback(
+    (nextVisibleOrder: readonly ProxyGroupMemberRef[]) =>
+      mergeVisibleMemberOrder(
+        advanced.memberOrder,
+        nextVisibleOrder,
+        filteredNodeMemberKeys,
+      ),
+    [advanced.memberOrder, filteredNodeMemberKeys],
+  );
   const activeCustomProxyGroups = React.useMemo(
     () => customProxyGroups.filter((group) => group.enabled !== false),
     [customProxyGroups],
@@ -164,8 +193,8 @@ export function ProxyGroupAdvancedPanel({
   }, [customProxyGroups, target.id, target.kind]);
 
   const activeNodes = React.useMemo(
-    () => nodes.filter((node) => !isSubscriptionInfoNodeName(node.name)),
-    [nodes],
+    () => effectiveNodes.filter((node) => !isSubscriptionInfoNodeName(node.name)),
+    [effectiveNodes],
   );
   const moduleNames = React.useMemo(
     () =>
@@ -180,7 +209,7 @@ export function ProxyGroupAdvancedPanel({
 
   const generatedProxyGroups = React.useMemo(() => {
     return generateProxyGroups({
-      nodes,
+      nodes: effectiveNodes,
       enabledModules: previewEnabledProxyGroups,
       ruleProviderBaseUrl,
       testUrl,
@@ -192,7 +221,7 @@ export function ProxyGroupAdvancedPanel({
       proxyGroupNameOverrides,
     });
   }, [
-    nodes,
+    effectiveNodes,
     previewEnabledProxyGroups,
     ruleProviderBaseUrl,
     testUrl,
@@ -204,9 +233,9 @@ export function ProxyGroupAdvancedPanel({
     proxyGroupNameOverrides,
   ]);
   const generatedProxyNames = React.useMemo(() => {
-    if (nodes.length === 0) return [];
+    if (effectiveNodes.length === 0) return [];
     return generatedProxyGroups.find((group) => group.name === target.name)?.proxies ?? [];
-  }, [generatedProxyGroups, nodes.length, target.name]);
+  }, [effectiveNodes.length, generatedProxyGroups, target.name]);
 
   const candidateMembers = React.useMemo(() => {
     const rawNames = [
@@ -309,9 +338,9 @@ export function ProxyGroupAdvancedPanel({
       const next = [...current];
       const [item] = next.splice(from, 1);
       next.splice(to, 0, item);
-      onChange({ memberOrder: next });
+      onChange({ memberOrder: preserveFilteredMemberOrder(next) });
     },
-    [includedMembers, onChange],
+    [includedMembers, onChange, preserveFilteredMemberOrder],
   );
 
   const sourceIds = normalizeList(advanced.sourceIds);
@@ -338,21 +367,37 @@ export function ProxyGroupAdvancedPanel({
       onChange({
         extraMembers: withMember(extraRefs, member.ref),
         excludedMembers: withoutMember(excludedRefs, member.key),
-        memberOrder: insertMemberAfterProtected(includedMembers, member.ref),
+        memberOrder: preserveFilteredMemberOrder(
+          insertMemberAfterProtected(includedMembers, member.ref),
+        ),
       });
     },
-    [excludedRefs, extraRefs, includedMembers, onChange],
+    [
+      excludedRefs,
+      extraRefs,
+      includedMembers,
+      onChange,
+      preserveFilteredMemberOrder,
+    ],
   );
 
   const addAllNodes = React.useCallback(() => {
-    onChange(
-      buildAddAllMembersPatch({
-        advanced,
-        currentMembers: includedMembers,
-        membersToAdd: excludedNodeMembers,
-      }),
-    );
-  }, [advanced, excludedNodeMembers, includedMembers, onChange]);
+    const patch = buildAddAllMembersPatch({
+      advanced,
+      currentMembers: includedMembers,
+      membersToAdd: excludedNodeMembers,
+    });
+    onChange({
+      ...patch,
+      memberOrder: preserveFilteredMemberOrder(patch.memberOrder ?? []),
+    });
+  }, [
+    advanced,
+    excludedNodeMembers,
+    includedMembers,
+    onChange,
+    preserveFilteredMemberOrder,
+  ]);
 
   const removeAllNodes = React.useCallback(() => {
     onChange(
@@ -365,13 +410,15 @@ export function ProxyGroupAdvancedPanel({
 
   const addAllProxyGroups = React.useCallback(() => {
     if (addableProxyGroupMembers.length > 0) {
-      onChange(
-        buildAddAllMembersPatch({
-          advanced,
-          currentMembers: includedMembers,
-          membersToAdd: addableProxyGroupMembers,
-        }),
-      );
+      const patch = buildAddAllMembersPatch({
+        advanced,
+        currentMembers: includedMembers,
+        membersToAdd: addableProxyGroupMembers,
+      });
+      onChange({
+        ...patch,
+        memberOrder: preserveFilteredMemberOrder(patch.memberOrder ?? []),
+      });
     }
     const skippedCount =
       excludedProxyGroupMembers.length - addableProxyGroupMembers.length;
@@ -387,6 +434,7 @@ export function ProxyGroupAdvancedPanel({
     excludedProxyGroupMembers.length,
     includedMembers,
     onChange,
+    preserveFilteredMemberOrder,
   ]);
 
   const removeAllProxyGroups = React.useCallback(() => {
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.test.ts
index f4d27ce..d901d5e 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.test.ts
@@ -6,6 +6,7 @@ import {
   findCycleCreatingProxyGroupKeys,
   isNodeMember,
   isProxyGroupMember,
+  mergeVisibleMemberOrder,
   type ResolvedMember,
 } from "./proxy-group-member-bulk";
 
@@ -90,6 +91,30 @@ describe("proxy group member bulk helpers", () => {
     });
   });
 
+  it("reorders visible members without removing filtered-node slots", () => {
+    expect(
+      mergeVisibleMemberOrder(
+        [
+          { kind: "direct" },
+          { kind: "node", name: "Visible A" },
+          { kind: "node", name: "Filtered" },
+          { kind: "node", name: "Visible B" },
+        ],
+        [
+          { kind: "direct" },
+          { kind: "node", name: "Visible B" },
+          { kind: "node", name: "Visible A" },
+        ],
+        new Set(["node:Filtered"]),
+      ),
+    ).toEqual([
+      { kind: "direct" },
+      { kind: "node", name: "Visible B" },
+      { kind: "node", name: "Filtered" },
+      { kind: "node", name: "Visible A" },
+    ]);
+  });
+
   it("distinguishes nodes and proxy groups from fixed policies", () => {
     const node = resolved({ kind: "node", name: "A" }, "A");
     const moduleMember = resolved({ kind: "module", id: "auto" }, "Auto");
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.ts
index bc42638..9755f0c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-group-member-bulk.ts
@@ -49,6 +49,41 @@ function uniqueMemberRefs(members: readonly ProxyGroupMemberRef[]): ProxyGroupMe
   });
 }
 
+export function mergeVisibleMemberOrder(
+  currentOrder: readonly ProxyGroupMemberRef[] | undefined,
+  nextVisibleOrder: readonly ProxyGroupMemberRef[],
+  preservedKeys: ReadonlySet<string>,
+): ProxyGroupMemberRef[] {
+  const visible = uniqueMemberRefs(nextVisibleOrder).filter(
+    (member) => !preservedKeys.has(getProxyGroupMemberKey(member)),
+  );
+  const merged: ProxyGroupMemberRef[] = [];
+  const used = new Set<string>();
+  let visibleIndex = 0;
+
+  const append = (member: ProxyGroupMemberRef) => {
+    const key = getProxyGroupMemberKey(member);
+    if (used.has(key)) return;
+    used.add(key);
+    merged.push(member);
+  };
+
+  for (const member of normalizeList(currentOrder)) {
+    if (preservedKeys.has(getProxyGroupMemberKey(member))) {
+      append(member);
+      continue;
+    }
+    const replacement = visible[visibleIndex];
+    visibleIndex += 1;
+    if (replacement) append(replacement);
+  }
+
+  for (; visibleIndex < visible.length; visibleIndex += 1) {
+    append(visible[visibleIndex]);
+  }
+  return merged;
+}
+
 export function insertMembersAfterProtected(
   currentMembers: readonly ResolvedMember[],
   members: readonly ProxyGroupMemberRef[],
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
index cc3ea8c..9abb12c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.test.ts
@@ -444,6 +444,40 @@ describe("ProxyGroupsCategories", () => {
     expect(mocks.store.updateProxyGroupAdvanced).toHaveBeenCalledWith("auto", { sourceIds: ["source-a"] });
   });
 
+  it("builds proxy-group previews from effective nodes", () => {
+    mocks.store.nodes = [
+      {
+        name: "TAG-Notice",
+        _originName: "套餐到期提醒",
+        type: "ss",
+        server: "notice.example.com",
+        port: 8388,
+        cipher: "aes-128-gcm",
+        password: "secret",
+      },
+      {
+        name: "US",
+        type: "ss",
+        server: "us.example.com",
+        port: 8388,
+        cipher: "aes-128-gcm",
+        password: "secret",
+      },
+    ];
+    mocks.store.nodeNameFilter = {
+      enabled: true,
+      excludeRegexes: ["套餐到期"],
+    };
+
+    renderCategories({ 0: new Set(["core"]) });
+
+    expect(vi.mocked(generateProxyGroups)).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        nodes: [expect.objectContaining({ name: "US" })],
+      }),
+    );
+  });
+
   it("renders custom category and disabled non-core module branches", async () => {
     mocks.store.hiddenProxyGroups = [];
     mocks.store.enabledProxyGroups = [];
diff --git a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
index 76802dc..3642d3c 100644
--- a/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
+++ b/packages/ui/src/product/converter/advanced-mode/sections/proxy-groups-categories.tsx
@@ -26,6 +26,7 @@ import {
 import type { HiddenPresetRuleIds } from "@subboost/core/generator/module-rules";
 import { resolveProxyGroupModuleName } from "@subboost/core/proxy-group-name";
 import { resolveProxyGroupTargetName } from "@subboost/core/proxy-group-targets";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import { useConfigStore, type RuleSetDraft } from "@subboost/ui/store/config-store";
 import {
   buildManualRuleTargets,
@@ -44,6 +45,7 @@ export function ProxyGroupsCategories() {
   const {
     ruleProviderBaseUrl,
     nodes = [],
+    nodeNameFilter,
     testUrl,
     testInterval,
     cnIpNoResolve,
@@ -82,6 +84,10 @@ export function ProxyGroupsCategories() {
     Set<string>
   >(new Set(customProxyGroups.length > 0 ? [CUSTOM_CATEGORY_ID] : []));
   const didApplyCustomCategoryDefault = React.useRef(customProxyGroups.length > 0);
+  const effectiveNodes = React.useMemo(
+    () => resolveNodeNameFilter(nodes, nodeNameFilter).effectiveNodes,
+    [nodeNameFilter, nodes],
+  );
   const [editingModuleId, setEditingModuleId] = React.useState<string | null>(
     null,
   );
@@ -159,9 +165,9 @@ export function ProxyGroupsCategories() {
     return grouped;
   }, [hiddenProxyGroups]);
   const generatedProxyGroupNodeCounts = React.useMemo(() => {
-    if (nodes.length === 0) return new Map<string, number>();
+    if (effectiveNodes.length === 0) return new Map<string, number>();
     const generated = generateProxyGroups({
-      nodes,
+      nodes: effectiveNodes,
       enabledModules: enabledProxyGroups,
       ruleProviderBaseUrl,
       testUrl,
@@ -172,7 +178,7 @@ export function ProxyGroupsCategories() {
       builtinRuleEdits,
       proxyGroupNameOverrides,
     });
-    const nodeNameSet = new Set(nodes.map((node) => node.name));
+    const nodeNameSet = new Set(effectiveNodes.map((node) => node.name));
     return new Map(
       generated.map((group) => [
         group.name,
@@ -187,7 +193,7 @@ export function ProxyGroupsCategories() {
       ]),
     );
   }, [
-    nodes,
+    effectiveNodes,
     enabledProxyGroups,
     ruleProviderBaseUrl,
     testUrl,
diff --git a/packages/ui/src/product/home/use-editing-subscription-loader.test.ts b/packages/ui/src/product/home/use-editing-subscription-loader.test.ts
index 87d54d3..2e8a7f7 100644
--- a/packages/ui/src/product/home/use-editing-subscription-loader.test.ts
+++ b/packages/ui/src/product/home/use-editing-subscription-loader.test.ts
@@ -116,6 +116,7 @@ function resetStoreState(overrides: Record<string, unknown> = {}) {
     proxyGroupAdvanced: {},
     proxyGroupOrder: [],
     ruleOrder: [],
+    nodeNameFilter: { enabled: false, excludeRegexes: [] },
     ...overrides,
   };
   return { reset, generateConfig };
@@ -235,6 +236,10 @@ describe("useEditingSubscriptionLoader", () => {
               cnIpNoResolve: false,
               experimentalCnUseCnRuleSet: true,
               smartNodeMatchingEnabled: false,
+              nodeNameFilter: {
+                enabled: true,
+                excludeRegexes: ["^Remote$"],
+              },
             },
           },
         })
@@ -285,6 +290,10 @@ describe("useEditingSubscriptionLoader", () => {
       proxyGroupOrder: ["module:ai"],
       listenerPorts: { Remote: 41000 },
       appliedTemplateId: "template-1",
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["^Remote$"],
+      },
       dnsYaml: "dns: {}",
       ruleProviderBaseUrl: "https://rules.example.com",
       testUrl: "https://test.example.com",
@@ -340,6 +349,10 @@ describe("useEditingSubscriptionLoader", () => {
         smartNodeMatchingEnabled: true,
       })
     );
+    expect(mocks.bag.storeState.nodeNameFilter).toEqual({
+      enabled: false,
+      excludeRegexes: [],
+    });
   });
 
   it("hydrates single URL sources from the saved subscription info snapshot", async () => {
diff --git a/packages/ui/src/product/home/use-editing-subscription-loader.ts b/packages/ui/src/product/home/use-editing-subscription-loader.ts
index 5a615c7..a9363a0 100644
--- a/packages/ui/src/product/home/use-editing-subscription-loader.ts
+++ b/packages/ui/src/product/home/use-editing-subscription-loader.ts
@@ -15,6 +15,10 @@ import {
   normalizeSubscriptionUserInfo,
   type SubscriptionUserInfo,
 } from "@subboost/core/subscription/subscription-userinfo";
+import {
+  normalizeNodeNameFilterConfig,
+  type NodeNameFilterConfig,
+} from "@subboost/core/subscription/node-name-filter";
 import { useConfigStore } from "@subboost/ui/store/config-store";
 import { captureAuthConfigHandoff } from "@subboost/ui/store/config-store/auth-handoff";
 import { toast } from "@subboost/ui/components/ui/toaster";
@@ -486,6 +490,8 @@ export function useEditingSubscriptionLoader({
           typeof cfg.appliedTemplateId === "string" && cfg.appliedTemplateId.trim()
             ? (cfg.appliedTemplateId as string)
             : null;
+        const nodeNameFilterFromCfg: NodeNameFilterConfig =
+          normalizeNodeNameFilterConfig(cfg.nodeNameFilter);
         const proxyGroupAdvancedModeEnabledFromCfg = resolveProxyGroupAdvancedModeEnabled({
           proxyGroupAdvancedModeEnabled: (cfg as any).proxyGroupAdvancedModeEnabled,
           customProxyGroups: customProxyGroupsFromCfg,
@@ -535,6 +541,7 @@ export function useEditingSubscriptionLoader({
           ruleOrder: ruleOrderFromCfg.length > 0 ? ruleOrderFromCfg : state.ruleOrder,
           listenerPorts: listenerPortsFromCfg,
           appliedTemplateId: appliedTemplateIdFromCfg ?? state.appliedTemplateId,
+          nodeNameFilter: nodeNameFilterFromCfg,
           dnsYaml: typeof cfg.dnsYaml === "string" ? (cfg.dnsYaml as string) : state.dnsYaml,
           ruleProviderBaseUrl:
             typeof cfg.ruleProviderBaseUrl === "string" ? (cfg.ruleProviderBaseUrl as string) : state.ruleProviderBaseUrl,
diff --git a/packages/ui/src/product/home/use-subscription-link.test.ts b/packages/ui/src/product/home/use-subscription-link.test.ts
index e91fb21..e09b0c4 100644
--- a/packages/ui/src/product/home/use-subscription-link.test.ts
+++ b/packages/ui/src/product/home/use-subscription-link.test.ts
@@ -106,6 +106,7 @@ describe("useSubscriptionLink", () => {
       proxyGroupAdvanced: { auto: { includeRegex: "Fast" } },
       proxyGroupAdvancedModeEnabled: true,
       proxyGroupOrder: ["select", "auto"],
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
     };
     originalWindow = globalThis.window;
     originalNavigator = globalThis.navigator;
@@ -260,6 +261,7 @@ describe("useSubscriptionLink", () => {
             proxyGroupAdvancedModeEnabled: true,
             listenerPorts: { "Node A": 41000 },
             proxyGroupOrder: ["select", "auto"],
+            nodeNameFilter: { enabled: false, excludeRegexes: [] },
           }),
         }),
       })
@@ -362,6 +364,10 @@ describe("useSubscriptionLink", () => {
 
   it("persists resolved per-source subscription info for one source among multiple imports", async () => {
     const adapter = makeAdapter();
+    mocks.bag.storeState.nodeNameFilter = {
+      enabled: true,
+      excludeRegexes: ["^剩余流量", "^套餐流量", "^套餐到期"],
+    };
     const storeSources = [
       {
         id: "source-1",
@@ -417,6 +423,11 @@ describe("useSubscriptionLink", () => {
       total: 10 * 1024 ** 3,
       expire: 1893499200,
     });
+    expect(payload.nodes).toEqual(nodes);
+    expect(payload.config.nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["^剩余流量", "^套餐流量", "^套餐到期"],
+    });
     expect(payload.config.sources).toEqual([
       expect.objectContaining({
         id: "source-1",
diff --git a/packages/ui/src/product/home/use-subscription-link.tsx b/packages/ui/src/product/home/use-subscription-link.tsx
index 8d0822e..5907a75 100644
--- a/packages/ui/src/product/home/use-subscription-link.tsx
+++ b/packages/ui/src/product/home/use-subscription-link.tsx
@@ -27,6 +27,7 @@ import {
   type AutoUpdateIntervalPolicy,
   type AutoUpdateIntervalPolicyOverride,
 } from "@subboost/core/subscription/auto-update-interval";
+import type { NodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import { tryNormalizeSubscriptionUrlInput } from "@subboost/core/subscription/url-input";
 import { DEFAULT_NODE_NAME_TEMPLATE } from "@subboost/core/node-name-template";
 import { formatDateInBeijing } from "@subboost/core/time/beijing";
@@ -296,6 +297,7 @@ export function useSubscriptionLink({
     setIsCreatingSubscription(true);
 
     try {
+      const nodeNameFilter: NodeNameFilterConfig = useConfigStore.getState().nodeNameFilter;
       const subscriptionInfo: SubscriptionUserInfo = {};
       const sourceSubscriptionInfoById = new Map<string, SubscriptionUserInfo>();
       for (const source of storeSources) {
@@ -324,6 +326,7 @@ export function useSubscriptionLink({
             template,
             appliedTemplateId,
             smartNodeMatchingEnabled,
+            nodeNameFilter,
             // 用于“我的订阅 → 编辑”恢复输入源（保留 YAML/节点链接/多个 URL 的顺序）
             sources: storeSources
             .filter((s) => typeof s?.content === "string" && s.content.trim())
diff --git a/packages/ui/src/product/preview/visual-graph.test.ts b/packages/ui/src/product/preview/visual-graph.test.ts
index da37c11..9ea9914 100644
--- a/packages/ui/src/product/preview/visual-graph.test.ts
+++ b/packages/ui/src/product/preview/visual-graph.test.ts
@@ -182,6 +182,32 @@ describe("VisualGraph", () => {
     expect(mocks.captures.proxyGroupsPreview).toBeUndefined();
   });
 
+  it("renders counts and node previews from effective nodes", () => {
+    mocks.store.nodes = [
+      { name: "TAG-Notice", _originName: "套餐到期提醒", type: "ss" },
+      { name: "US", type: "vless" },
+    ];
+    mocks.store.nodeNameFilter = {
+      enabled: true,
+      excludeRegexes: ["套餐到期"],
+    };
+
+    const { html } = renderGraph();
+
+    expect(html).toContain("US");
+    expect(html).not.toContain("TAG-Notice");
+    expect(mocks.captures.protocolBadges.map((props: any) => props.type)).toEqual(["vless"]);
+    expect(
+      mocks.captures.proxyGroupsPreview.displayGroups.find(
+        (group: any) => group.id === "dialer:d1",
+      ).dialer,
+    ).toEqual({
+      relayNodes: ["Relay"],
+      targetNodes: [],
+      type: "select",
+    });
+  });
+
   it("builds display groups, node previews, custom rules, and drag callbacks", () => {
     const { html, setters } = renderGraph({ 0: new Set(["module:auto"]), 1: null, 2: null, 3: 360 });
 
diff --git a/packages/ui/src/product/preview/visual-graph.tsx b/packages/ui/src/product/preview/visual-graph.tsx
index 029796d..96a5769 100644
--- a/packages/ui/src/product/preview/visual-graph.tsx
+++ b/packages/ui/src/product/preview/visual-graph.tsx
@@ -13,6 +13,7 @@ import {
 import { getModuleRuleOrderKey } from "@subboost/core/generator/module-rules";
 import { resolveProxyGroupModuleName } from "@subboost/core/proxy-group-name";
 import { resolveProxyGroupTargetName } from "@subboost/core/proxy-group-targets";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import { collectCustomRoutingRuleSets } from "@subboost/core/rules/custom-routing-rule-sets";
 import { CustomRulesPreview } from "./visual-graph/custom-rules-preview";
 import { getDialerEmojiFromName } from "./visual-graph/emoji";
@@ -28,6 +29,7 @@ import {
 export function VisualGraph() {
   const {
     nodes,
+    nodeNameFilter,
     enabledProxyGroups,
     dialerProxyGroups,
     customRules,
@@ -44,6 +46,7 @@ export function VisualGraph() {
   } = useConfigStore(
     useShallow((state) => ({
       nodes: state.nodes,
+      nodeNameFilter: state.nodeNameFilter,
       enabledProxyGroups: state.enabledProxyGroups,
       dialerProxyGroups: state.dialerProxyGroups ?? [],
       customRules: state.customRules ?? [],
@@ -59,6 +62,18 @@ export function VisualGraph() {
       setProxyGroupOrder: state.setProxyGroupOrder,
     })),
   );
+  const effectiveNodes = React.useMemo(
+    () => resolveNodeNameFilter(nodes, nodeNameFilter).effectiveNodes,
+    [nodeNameFilter, nodes],
+  );
+  const rawNodeNameSet = React.useMemo(
+    () => new Set(nodes.map((node) => node.name)),
+    [nodes],
+  );
+  const effectiveNodeNameSet = React.useMemo(
+    () => new Set(effectiveNodes.map((node) => node.name)),
+    [effectiveNodes],
+  );
 
   const enabledDialerProxyGroups = React.useMemo(
     () => dialerProxyGroups.filter((g) => g && g.enabled !== false),
@@ -114,9 +129,9 @@ export function VisualGraph() {
   // 节点名称列表
   // 生成当前配置下的代理组（用于显示“默认选中项”）
   const generatedProxyGroups = React.useMemo(() => {
-    if (nodes.length === 0) return [];
+    if (effectiveNodes.length === 0) return [];
     return generateProxyGroups({
-      nodes,
+      nodes: effectiveNodes,
       enabledModules: enabledProxyGroups,
       ruleProviderBaseUrl,
       testUrl,
@@ -128,7 +143,7 @@ export function VisualGraph() {
       proxyGroupNameOverrides,
     });
   }, [
-    nodes,
+    effectiveNodes,
     enabledProxyGroups,
     ruleProviderBaseUrl,
     testUrl,
@@ -259,8 +274,15 @@ export function VisualGraph() {
             category: "dialer",
             rules: [],
             dialer: {
-              relayNodes: Array.isArray(g.relayNodes) ? g.relayNodes : [],
-              targetNodes: Array.isArray(g.targetNodes) ? g.targetNodes : [],
+              relayNodes: Array.isArray(g.relayNodes)
+                ? g.relayNodes.filter(
+                    (name) =>
+                      !rawNodeNameSet.has(name) || effectiveNodeNameSet.has(name),
+                  )
+                : [],
+              targetNodes: Array.isArray(g.targetNodes)
+                ? g.targetNodes.filter((name) => effectiveNodeNameSet.has(name))
+                : [],
               type: g.type,
             },
           }));
@@ -314,6 +336,8 @@ export function VisualGraph() {
   }, [
     activeCustomProxyGroups,
     enabledDialerProxyGroups,
+    effectiveNodeNameSet,
+    rawNodeNameSet,
     generatedProxyGroups,
     customRuleSets,
     builtinRuleEdits,
@@ -382,7 +406,7 @@ export function VisualGraph() {
       .sort((a, b) => a.order - b.order);
   }, [enabledDialerProxyGroups.length, displayGroups]);
 
-  if (nodes.length === 0) {
+  if (effectiveNodes.length === 0) {
     return (
       <div className="flex flex-col items-center justify-center h-full text-white/50">
         <Network className="h-12 w-12 mb-3 opacity-50" />
@@ -410,7 +434,7 @@ export function VisualGraph() {
       <div className="grid grid-cols-3 gap-2 text-center">
         <div className="rounded-lg bg-white/5 p-2">
           <div className="text-lg font-bold text-primary-500">
-            {nodes.length}
+            {effectiveNodes.length}
           </div>
           <div className="text-[10px] text-white/50">节点</div>
         </div>
@@ -449,12 +473,12 @@ export function VisualGraph() {
             节点列表
           </span>
           <span className="text-[10px] text-white/50">
-            共 {nodes.length} 个
+            共 {effectiveNodes.length} 个
           </span>
         </div>
 
         <div className="max-h-48 overflow-y-auto space-y-1 rounded-lg bg-white/5 p-2">
-          {nodes.slice(0, 50).map((node, idx) => (
+          {effectiveNodes.slice(0, 50).map((node, idx) => (
             <div
               key={node.name + idx}
               className="flex items-center gap-2 rounded-md px-2 py-1 text-[10px] hover:bg-white/5"
@@ -486,9 +510,9 @@ export function VisualGraph() {
               <ProtocolBadge type={node.type} className="flex-shrink-0" />
             </div>
           ))}
-          {nodes.length > 50 && (
+          {effectiveNodes.length > 50 && (
             <div className="text-center text-[10px] text-white/50 py-1">
-              ... 还有 {nodes.length - 50} 个节点
+              ... 还有 {effectiveNodes.length - 50} 个节点
             </div>
           )}
         </div>
diff --git a/packages/ui/src/store/config-store/actions/history-actions.test.ts b/packages/ui/src/store/config-store/actions/history-actions.test.ts
index 1da671f..da44ad5 100644
--- a/packages/ui/src/store/config-store/actions/history-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/history-actions.test.ts
@@ -41,27 +41,90 @@ describe("config store history actions", () => {
     const store = createStore({
       generatedYaml: "current",
       generatedYamlError: "bad",
+      nodeNameFilter: { enabled: true, excludeRegexes: ["expire"] },
       history,
       historyIndex: history.length - 1,
     });
     const actions = createHistoryActions(store.set as any, store.get as any);
 
     actions.pushHistory();
-    expect((store.state().history as string[])).toHaveLength(50);
+    expect((store.state().history as unknown[])).toHaveLength(50);
     expect(store.state().historyIndex).toBe(49);
-    expect((store.state().history as string[]).at(-1)).toBe("current");
+    expect((store.state().history as unknown[]).at(-1)).toEqual({
+      yaml: "current",
+      nodeNameFilter: { enabled: true, excludeRegexes: ["expire"] },
+    });
 
     actions.undo();
-    expect(store.state()).toMatchObject({ historyIndex: 48, generatedYaml: "yaml-54", generatedYamlError: null });
+    expect(store.state()).toMatchObject({
+      historyIndex: 48,
+      generatedYaml: "yaml-54",
+      generatedYamlError: null,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["expire"] },
+    });
 
     actions.redo();
-    expect(store.state()).toMatchObject({ historyIndex: 49, generatedYaml: "current", generatedYamlError: null });
+    expect(store.state()).toMatchObject({
+      historyIndex: 49,
+      generatedYaml: "current",
+      generatedYamlError: null,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["expire"] },
+    });
 
     const emptyStore = createStore({ generatedYaml: "", history: [], historyIndex: -1 });
     createHistoryActions(emptyStore.set as any, emptyStore.get as any).pushHistory();
     expect(emptyStore.set).not.toHaveBeenCalled();
   });
 
+  it("restores node-name filters from new snapshots and supports legacy string entries", () => {
+    const store = createStore({
+      generatedYaml: "filtered",
+      generatedYamlError: null,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["test"] },
+      history: [
+        "legacy yaml",
+        {
+          yaml: "unfiltered",
+          nodeNameFilter: { enabled: false, excludeRegexes: [] },
+        },
+        {
+          yaml: "filtered",
+          nodeNameFilter: { enabled: true, excludeRegexes: ["test"] },
+        },
+      ],
+      historyIndex: 2,
+    });
+    const actions = createHistoryActions(store.set as any, store.get as any);
+
+    actions.undo();
+    expect(store.state()).toMatchObject({
+      historyIndex: 1,
+      generatedYaml: "unfiltered",
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
+    });
+
+    actions.undo();
+    expect(store.state()).toMatchObject({
+      historyIndex: 0,
+      generatedYaml: "legacy yaml",
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
+    });
+
+    actions.redo();
+    expect(store.state()).toMatchObject({
+      historyIndex: 1,
+      generatedYaml: "unfiltered",
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
+    });
+
+    actions.redo();
+    expect(store.state()).toMatchObject({
+      historyIndex: 2,
+      generatedYaml: "filtered",
+      nodeNameFilter: { enabled: true, excludeRegexes: ["test"] },
+    });
+  });
+
   it("returns current state at undo/redo boundaries and resets to initial state", () => {
     const store = createStore({ generatedYaml: "only", history: ["only"], historyIndex: 0 });
     const actions = createHistoryActions(store.set as any, store.get as any);
@@ -73,5 +136,8 @@ describe("config store history actions", () => {
 
     actions.reset();
     expect(store.state()).toEqual(expect.objectContaining(initialState));
+    expect(store.state()).toMatchObject({
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
+    });
   });
 });
diff --git a/packages/ui/src/store/config-store/actions/history-actions.ts b/packages/ui/src/store/config-store/actions/history-actions.ts
index 7cb7ef1..5800eb2 100644
--- a/packages/ui/src/store/config-store/actions/history-actions.ts
+++ b/packages/ui/src/store/config-store/actions/history-actions.ts
@@ -1,6 +1,7 @@
 import type { ConfigActions } from "../definitions";
 import { initialState } from "../definitions";
 import { computeGeneratedYamlResult } from "../generated-yaml";
+import { normalizeNodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import type { GetState, SetState } from "../store-types";
 
 type HistoryActions = Pick<
@@ -8,6 +9,23 @@ type HistoryActions = Pick<
   "generateConfig" | "setGeneratedYaml" | "pushHistory" | "undo" | "redo" | "reset"
 >;
 
+function restoreHistoryEntry(
+  entry: ReturnType<GetState>["history"][number]
+): Partial<ReturnType<GetState>> {
+  if (typeof entry === "string") {
+    return {
+      generatedYaml: entry,
+      generatedYamlError: null,
+    };
+  }
+
+  return {
+    generatedYaml: entry.yaml,
+    generatedYamlError: null,
+    nodeNameFilter: normalizeNodeNameFilterConfig(entry.nodeNameFilter),
+  };
+}
+
 export function createHistoryActions(set: SetState, get: GetState): HistoryActions {
   return {
     generateConfig: () => {
@@ -31,7 +49,13 @@ export function createHistoryActions(set: SetState, get: GetState): HistoryActio
       if (!currentYaml) return;
 
       set((state) => {
-        const newHistory = [...state.history.slice(0, state.historyIndex + 1), currentYaml].slice(-50); // 最多保留 50 条历史
+        const newHistory = [
+          ...state.history.slice(0, state.historyIndex + 1),
+          {
+            yaml: currentYaml,
+            nodeNameFilter: normalizeNodeNameFilterConfig(state.nodeNameFilter),
+          },
+        ].slice(-50); // 最多保留 50 条历史
 
         return {
           history: newHistory,
@@ -43,10 +67,10 @@ export function createHistoryActions(set: SetState, get: GetState): HistoryActio
     undo: () => {
       set((state) => {
         if (state.historyIndex > 0) {
+          const historyIndex = state.historyIndex - 1;
           return {
-            historyIndex: state.historyIndex - 1,
-            generatedYaml: state.history[state.historyIndex - 1],
-            generatedYamlError: null,
+            historyIndex,
+            ...restoreHistoryEntry(state.history[historyIndex]),
           };
         }
         return state;
@@ -56,10 +80,10 @@ export function createHistoryActions(set: SetState, get: GetState): HistoryActio
     redo: () => {
       set((state) => {
         if (state.historyIndex < state.history.length - 1) {
+          const historyIndex = state.historyIndex + 1;
           return {
-            historyIndex: state.historyIndex + 1,
-            generatedYaml: state.history[state.historyIndex + 1],
-            generatedYamlError: null,
+            historyIndex,
+            ...restoreHistoryEntry(state.history[historyIndex]),
           };
         }
         return state;
diff --git a/packages/ui/src/store/config-store/actions/node-actions.test.ts b/packages/ui/src/store/config-store/actions/node-actions.test.ts
index 622ef57..9262304 100644
--- a/packages/ui/src/store/config-store/actions/node-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/node-actions.test.ts
@@ -304,6 +304,47 @@ describe("createNodeActions", () => {
     expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual(["C", "B", "A"]);
   });
 
+  it("reorders only scoped node slots while preserving hidden node positions", () => {
+    const { actions, getState } = createHarness({
+      nodes: [
+        node("A"),
+        node("Hidden 1"),
+        node("B"),
+        node("Hidden 2"),
+        node("C"),
+      ],
+    });
+    const effectiveNodeNames = ["A", "B", "C"];
+
+    actions.setNodeOrder("C", 1, effectiveNodeNames);
+    expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual([
+      "C",
+      "Hidden 1",
+      "A",
+      "Hidden 2",
+      "B",
+    ]);
+
+    actions.setNodeOrder("C", 3, effectiveNodeNames);
+    expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual([
+      "A",
+      "Hidden 1",
+      "B",
+      "Hidden 2",
+      "C",
+    ]);
+
+    actions.setNodeOrder("Hidden 1", 2, effectiveNodeNames);
+    actions.setNodeOrder("A", 2, []);
+    expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual([
+      "A",
+      "Hidden 1",
+      "B",
+      "Hidden 2",
+      "C",
+    ]);
+  });
+
   it("bulk renames nodes and listener ports without duplicate names", () => {
     const { actions, getState } = createHarness({
       nodes: [node("A"), node("B"), node("C"), node("X")],
diff --git a/packages/ui/src/store/config-store/actions/node-actions.ts b/packages/ui/src/store/config-store/actions/node-actions.ts
index af80914..a6436b6 100644
--- a/packages/ui/src/store/config-store/actions/node-actions.ts
+++ b/packages/ui/src/store/config-store/actions/node-actions.ts
@@ -257,11 +257,44 @@ export function createNodeActions(
       });
     },
 
-    setNodeOrder: (nodeName: string, order: number) => {
+    setNodeOrder: (nodeName: string, order: number, scopeNodeNames?: string[]) => {
       setAndGenerateConfig((state) => {
+        if (!Number.isFinite(order)) return state;
+
+        if (Array.isArray(scopeNodeNames)) {
+          const scope = new Set(
+            scopeNodeNames.filter(
+              (name): name is string => typeof name === "string" && name.trim() !== ""
+            )
+          );
+          if (!scope.has(nodeName)) return state;
+
+          const scopedNodes = state.nodes.filter((node) => scope.has(node.name));
+          const from = scopedNodes.findIndex((node) => node.name === nodeName);
+          if (from < 0) return state;
+          const to = Math.max(
+            0,
+            Math.min(scopedNodes.length - 1, Math.floor(order) - 1)
+          );
+          if (to === from) return state;
+
+          const reorderedScopedNodes = scopedNodes.slice();
+          const [item] = reorderedScopedNodes.splice(from, 1);
+          reorderedScopedNodes.splice(to, 0, item);
+
+          let scopedIndex = 0;
+          return {
+            nodes: state.nodes.map((node) => {
+              if (!scope.has(node.name)) return node;
+              const replacement = reorderedScopedNodes[scopedIndex];
+              scopedIndex += 1;
+              return replacement ?? node;
+            }),
+          };
+        }
+
         const from = state.nodes.findIndex((n) => n.name === nodeName);
         if (from < 0) return state;
-        if (!Number.isFinite(order)) return state;
         const to = Math.max(0, Math.min(state.nodes.length - 1, Math.floor(order) - 1));
         if (to === from) return state;
         const next = state.nodes.slice();
diff --git a/packages/ui/src/store/config-store/actions/settings-actions.test.ts b/packages/ui/src/store/config-store/actions/settings-actions.test.ts
index f17b2e0..f93a2bb 100644
--- a/packages/ui/src/store/config-store/actions/settings-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/settings-actions.test.ts
@@ -25,6 +25,10 @@ describe("config store settings actions", () => {
     actions.setTestUrl("https://cp.cloudflare.com/generate_204");
     actions.setTestInterval(600);
     actions.setRuleProviderBaseUrl("https://rules.example.com");
+    actions.setNodeNameFilter({
+      enabled: true,
+      excludeRegexes: ["  expire  ", "expire", ""],
+    });
     actions.setCnIpNoResolve(true);
     actions.setExperimentalCnUseCnRuleSet(1 as unknown as boolean);
 
@@ -35,10 +39,31 @@ describe("config store settings actions", () => {
       testUrl: "https://cp.cloudflare.com/generate_204",
       testInterval: 600,
       ruleProviderBaseUrl: "https://rules.example.com",
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["expire"],
+      },
       cnIpNoResolve: true,
       experimentalCnUseCnRuleSet: true,
     });
-    expect(store.setAndGenerateConfig).toHaveBeenCalledTimes(8);
+    expect(store.setAndGenerateConfig).toHaveBeenCalledTimes(9);
     expect(store.set).not.toHaveBeenCalled();
   });
+
+  it("rejects invalid node-name filters before updating generated config", () => {
+    const store = createStore();
+    const actions = createSettingsActions(
+      store.set as any,
+      store.get as any,
+      store.setAndGenerateConfig as any
+    );
+
+    expect(() =>
+      actions.setNodeNameFilter({
+        enabled: true,
+        excludeRegexes: ["("],
+      })
+    ).toThrow("第 1 行");
+    expect(store.state()).toEqual({});
+  });
 });
diff --git a/packages/ui/src/store/config-store/actions/settings-actions.ts b/packages/ui/src/store/config-store/actions/settings-actions.ts
index c1508f2..c1445f1 100644
--- a/packages/ui/src/store/config-store/actions/settings-actions.ts
+++ b/packages/ui/src/store/config-store/actions/settings-actions.ts
@@ -1,4 +1,5 @@
 import type { ConfigActions } from "../definitions";
+import { parseNodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import type { GetState, SetAndGenerateConfig, SetState } from "../store-types";
 
 type SettingsActions = Pick<
@@ -9,6 +10,7 @@ type SettingsActions = Pick<
   | "setTestUrl"
   | "setTestInterval"
   | "setRuleProviderBaseUrl"
+  | "setNodeNameFilter"
   | "setProxyGroupAdvancedModeEnabled"
   | "setCnIpNoResolve"
   | "setExperimentalCnUseCnRuleSet"
@@ -44,6 +46,12 @@ export function createSettingsActions(
       setAndGenerateConfig(() => ({ ruleProviderBaseUrl: url }));
     },
 
+    setNodeNameFilter: (config) => {
+      setAndGenerateConfig(() => ({
+        nodeNameFilter: parseNodeNameFilterConfig(config),
+      }));
+    },
+
     setProxyGroupAdvancedModeEnabled: (value: boolean) => {
       setAndGenerateConfig(() => ({ proxyGroupAdvancedModeEnabled: Boolean(value) }));
     },
diff --git a/packages/ui/src/store/config-store/actions/template-actions.test.ts b/packages/ui/src/store/config-store/actions/template-actions.test.ts
index 62fae65..b624f95 100644
--- a/packages/ui/src/store/config-store/actions/template-actions.test.ts
+++ b/packages/ui/src/store/config-store/actions/template-actions.test.ts
@@ -38,6 +38,7 @@ describe("createTemplateActions", () => {
       builtinRuleEdits: { "module:ai:anthropic": { enabled: false } },
       ruleOrder: ["module:ai:openai"],
       moduleRuleEditWarningAccepted: true,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["套餐到期"] },
     });
 
     actions.setTemplate("standard");
@@ -52,6 +53,7 @@ describe("createTemplateActions", () => {
       builtinRuleEdits: {},
       ruleOrder: [],
       moduleRuleEditWarningAccepted: false,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["套餐到期"] },
     });
 
     actions.setAppliedTemplateId(null);
diff --git a/packages/ui/src/store/config-store/auth-handoff.test.ts b/packages/ui/src/store/config-store/auth-handoff.test.ts
index 9e805fb..7f47558 100644
--- a/packages/ui/src/store/config-store/auth-handoff.test.ts
+++ b/packages/ui/src/store/config-store/auth-handoff.test.ts
@@ -51,6 +51,7 @@ function meaningfulState(overrides: Record<string, unknown> = {}) {
       },
     ],
     nodes: [{ name: "Node A" }],
+    nodeNameFilter: { enabled: true, excludeRegexes: ["expire", "test"] },
     deletedNodeNames: ["Gone"],
     deletedNodes: [{ originName: "Gone", name: "Gone" }],
     customRules: [{ id: "rule-1", type: "DOMAIN", value: "example.com", target: "Proxy" }],
@@ -142,6 +143,7 @@ describe("auth config handoff", () => {
         }),
       ],
       nodes: [{ name: "Node A" }],
+      nodeNameFilter: { enabled: true, excludeRegexes: ["expire", "test"] },
       deletedNodeNames: ["Gone"],
       deletedNodes: [{ originName: "Gone", name: "Gone" }],
       template: "full",
@@ -243,6 +245,10 @@ describe("auth config handoff", () => {
         state: {
           sources: [{ id: "bad", type: "bad", content: "x" }],
           nodes: [{ name: "Node" }, "bad"],
+          nodeNameFilter: {
+            enabled: true,
+            excludeRegexes: ["  expire  ", "expire", "", 42],
+          },
           deletedNodeNames: ["Gone", 1],
           deletedNodes: [{ originName: "Gone" }],
           template: "bad",
@@ -284,6 +290,7 @@ describe("auth config handoff", () => {
     const consumed = consumeAuthConfigHandoff();
 
     expect(consumed).toEqual({
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
       deletedNodeNames: ["Gone"],
       deletedNodes: [{ originName: "Gone" }],
       enabledProxyGroups: ["select"],
@@ -341,6 +348,7 @@ describe("auth config handoff", () => {
 
     expect(consumed).toEqual({
       sources: [{ id: "source-1", type: "url", content: "https://example.com/sub" }],
+      nodeNameFilter: { enabled: false, excludeRegexes: [] },
     });
   });
 });
diff --git a/packages/ui/src/store/config-store/auth-handoff.ts b/packages/ui/src/store/config-store/auth-handoff.ts
index 79cee51..922cedf 100644
--- a/packages/ui/src/store/config-store/auth-handoff.ts
+++ b/packages/ui/src/store/config-store/auth-handoff.ts
@@ -1,6 +1,7 @@
 import type { ConfigState, SourceType, SubscriptionSource } from "./definitions";
 import { initialState } from "./definitions";
 import { safeParseJsonObject } from "@subboost/core/json";
+import { normalizeNodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import { resolveProxyGroupAdvancedModeEnabled } from "@subboost/core/proxy-group-advanced-mode";
 import { normalizeRuleModelFromConfig } from "@subboost/core/rules/rule-model";
 
@@ -109,6 +110,8 @@ function hasMeaningfulConfig(state: ConfigState): boolean {
   return (
     state.sources.some((source) => source.content.trim()) ||
     state.nodes.length > 0 ||
+    state.nodeNameFilter.enabled ||
+    state.nodeNameFilter.excludeRegexes.length > 0 ||
     state.deletedNodeNames.length > 0 ||
     state.deletedNodes.length > 0 ||
     state.customRules.length > 0 ||
@@ -142,6 +145,7 @@ function buildHandoffState(state: ConfigState): Partial<ConfigState> {
   return {
     sources: sourceArray(state.sources) ?? [],
     nodes: state.nodes,
+    nodeNameFilter: normalizeNodeNameFilterConfig(state.nodeNameFilter),
     deletedNodeNames: state.deletedNodeNames,
     deletedNodes: state.deletedNodes,
     template: state.template,
@@ -179,6 +183,7 @@ function normalizeHandoffState(raw: unknown): Partial<ConfigState> | null {
   if (sources) out.sources = sources;
   const nodes = objectArray<ConfigState["nodes"][number]>(raw.nodes);
   if (nodes) out.nodes = nodes;
+  out.nodeNameFilter = normalizeNodeNameFilterConfig(raw.nodeNameFilter);
   const deletedNodeNames = stringArray(raw.deletedNodeNames);
   if (deletedNodeNames) out.deletedNodeNames = deletedNodeNames;
   const deletedNodes = objectArray<ConfigState["deletedNodes"][number]>(raw.deletedNodes);
diff --git a/packages/ui/src/store/config-store/definitions.test.ts b/packages/ui/src/store/config-store/definitions.test.ts
index b00e86e..8787f2e 100644
--- a/packages/ui/src/store/config-store/definitions.test.ts
+++ b/packages/ui/src/store/config-store/definitions.test.ts
@@ -1,6 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { TEMPLATES } from "@subboost/core/templates";
 import { DEFAULT_SUBBOOST_CONFIG } from "@subboost/core/config/defaults";
+import { DEFAULT_NODE_NAME_FILTER_CONFIG } from "@subboost/core/subscription/node-name-filter";
 
 const mocks = vi.hoisted(() => ({
   importSource: vi.fn(),
@@ -43,6 +44,8 @@ describe("config store definitions", () => {
     expect(initialState.testUrl).toBe(DEFAULT_SUBBOOST_CONFIG.testUrl);
     expect(initialState.testInterval).toBe(DEFAULT_SUBBOOST_CONFIG.testInterval);
     expect(initialState.ruleProviderBaseUrl).toBe(DEFAULT_SUBBOOST_CONFIG.ruleProviderBaseUrl);
+    expect(initialState.nodeNameFilter).toEqual(DEFAULT_NODE_NAME_FILTER_CONFIG);
+    expect(initialState.nodeNameFilter).not.toBe(DEFAULT_NODE_NAME_FILTER_CONFIG);
     expect(initialState.generatedYaml).toBe("");
     expect(initialState.historyIndex).toBe(-1);
   });
diff --git a/packages/ui/src/store/config-store/definitions.ts b/packages/ui/src/store/config-store/definitions.ts
index 91e2dc0..6d94831 100644
--- a/packages/ui/src/store/config-store/definitions.ts
+++ b/packages/ui/src/store/config-store/definitions.ts
@@ -17,6 +17,10 @@ import {
 } from "@subboost/core/subscription/import-error";
 import type { SubscriptionUserInfo } from "@subboost/core/subscription/subscription-userinfo";
 import { tryNormalizeSubscriptionUrlInput } from "@subboost/core/subscription/url-input";
+import {
+  DEFAULT_NODE_NAME_FILTER_CONFIG,
+  type NodeNameFilterConfig,
+} from "@subboost/core/subscription/node-name-filter";
 import { getActiveProductApiAdapter } from "@subboost/ui/product/api-adapter";
 import {
   getNodeSourceIds,
@@ -32,6 +36,14 @@ export { DEFAULT_BASE_CONFIG_YAML };
 export type RuleSetDraft = Omit<CustomRuleSet, "target">;
 export type { BuiltinRuleEdits, CustomRuleSet, ProxyGroupAdvancedConfig };
 export type { DialerProxyGroup, SubBoostTemplateConfig } from "@subboost/core/types/template-config";
+export type { NodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
+
+export type ConfigHistoryEntry =
+  | string
+  | {
+      yaml: string;
+      nodeNameFilter: NodeNameFilterConfig;
+    };
 
 // 预设的中转组名称
 export const PRESET_RELAY_NAMES = [
@@ -164,6 +176,7 @@ export interface ConfigState {
   }>;
   parseErrors: string[];
   isLoading: boolean;
+  nodeNameFilter: NodeNameFilterConfig;
 
   // 订阅源
   sources: SubscriptionSource[];
@@ -217,7 +230,7 @@ export interface ConfigState {
   generatedYamlError: string | null;
 
   // 历史记录（用于撤销）
-  history: string[];
+  history: ConfigHistoryEntry[];
   historyIndex: number;
 }
 
@@ -236,7 +249,8 @@ export interface ConfigActions {
   restoreNodeName: (nodeName: string) => void;
   restoreDeletedNode: (originName: string) => void;
   moveNode: (nodeName: string, direction: "up" | "down") => void;
-  setNodeOrder: (nodeName: string, order: number) => void;
+  setNodeOrder: (nodeName: string, order: number, scopeNodeNames?: string[]) => void;
+  setNodeNameFilter: (config: NodeNameFilterConfig) => void;
 
   // 模板和配置
   setTemplate: (template: TemplateType) => void;
@@ -330,6 +344,10 @@ export const initialState: ConfigState = {
   deletedNodes: [],
   parseErrors: [],
   isLoading: false,
+  nodeNameFilter: {
+    enabled: DEFAULT_NODE_NAME_FILTER_CONFIG.enabled,
+    excludeRegexes: [...DEFAULT_NODE_NAME_FILTER_CONFIG.excludeRegexes],
+  },
   sources: [
     { id: "1", type: "url", content: "" },
     { id: "2", type: "yaml", content: "" },
diff --git a/packages/ui/src/store/config-store/generated-yaml.test.ts b/packages/ui/src/store/config-store/generated-yaml.test.ts
index dc4c0e8..7f77555 100644
--- a/packages/ui/src/store/config-store/generated-yaml.test.ts
+++ b/packages/ui/src/store/config-store/generated-yaml.test.ts
@@ -5,6 +5,7 @@ import { computeGeneratedYaml, computeGeneratedYamlResult } from "./generated-ya
 const mocks = vi.hoisted(() => ({
   generateClashYaml: vi.fn(),
   stripImportedNodeControlFieldsFromList: vi.fn(),
+  resolveNodeNameFilter: vi.fn(),
 }));
 
 vi.mock("@subboost/core/generator", () => ({
@@ -15,6 +16,11 @@ vi.mock("@subboost/core/subscription/imported-node-controls", () => ({
   stripImportedNodeControlFieldsFromList: mocks.stripImportedNodeControlFieldsFromList,
 }));
 
+vi.mock("@subboost/core/subscription/node-name-filter", () => ({
+  DEFAULT_NODE_NAME_FILTER_CONFIG: { enabled: false, excludeRegexes: [] },
+  resolveNodeNameFilter: mocks.resolveNodeNameFilter,
+}));
+
 function createState(overrides: Record<string, unknown> = {}) {
   return {
     ...structuredClone(initialState),
@@ -27,6 +33,14 @@ describe("computeGeneratedYamlResult", () => {
     vi.clearAllMocks();
     mocks.generateClashYaml.mockReturnValue("generated yaml");
     mocks.stripImportedNodeControlFieldsFromList.mockImplementation((nodes) => nodes);
+    mocks.resolveNodeNameFilter.mockImplementation((nodes) => ({
+      rawNodes: nodes,
+      effectiveNodes: nodes,
+      excludedNodes: [],
+      rawCount: nodes.length,
+      excludedCount: 0,
+      effectiveCount: nodes.length,
+    }));
   });
 
   it("passes sanitized nodes and valid proxy providers to the core generator", () => {
@@ -62,6 +76,10 @@ describe("computeGeneratedYamlResult", () => {
     );
 
     expect(result).toEqual({ yaml: "generated yaml", error: null });
+    expect(mocks.resolveNodeNameFilter).toHaveBeenCalledWith(
+      nodes,
+      expect.objectContaining({ enabled: false, excludeRegexes: [] })
+    );
     expect(mocks.stripImportedNodeControlFieldsFromList).toHaveBeenCalledWith(nodes);
     expect(mocks.generateClashYaml).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -89,6 +107,58 @@ describe("computeGeneratedYamlResult", () => {
     );
   });
 
+  it("generates from effective nodes while preserving the complete state snapshot", () => {
+    const rawNodes = [
+      { name: "Keep", type: "ss" },
+      { name: "Drop", type: "ss" },
+    ];
+    const effectiveNodes = [rawNodes[0]];
+    mocks.resolveNodeNameFilter.mockReturnValueOnce({
+      rawNodes,
+      effectiveNodes,
+      excludedNodes: [rawNodes[1]],
+      rawCount: 2,
+      excludedCount: 1,
+      effectiveCount: 1,
+    });
+    const state = createState({
+      nodes: rawNodes,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["drop"] },
+    });
+
+    expect(computeGeneratedYaml(state)).toBe("generated yaml");
+
+    expect(mocks.stripImportedNodeControlFieldsFromList).toHaveBeenCalledWith(effectiveNodes);
+    expect(mocks.generateClashYaml).toHaveBeenCalledWith(
+      expect.objectContaining({ nodes: effectiveNodes })
+    );
+    expect(state.nodes).toBe(rawNodes);
+  });
+
+  it("hides generated preview when filtering removes every node", () => {
+    const rawNodes = [{ name: "Drop", type: "ss" }];
+    mocks.resolveNodeNameFilter.mockReturnValueOnce({
+      rawNodes,
+      effectiveNodes: [],
+      excludedNodes: rawNodes,
+      rawCount: 1,
+      excludedCount: 1,
+      effectiveCount: 0,
+    });
+
+    const result = computeGeneratedYamlResult(
+      createState({
+        nodes: rawNodes,
+        nodeNameFilter: { enabled: true, excludeRegexes: ["drop"] },
+      })
+    );
+
+    expect(result).toEqual({ yaml: "", error: null });
+    expect(mocks.generateClashYaml).toHaveBeenCalledWith(
+      expect.objectContaining({ nodes: [] })
+    );
+  });
+
   it("hides generated preview output when there are no nodes or providers", () => {
     const result = computeGeneratedYamlResult(createState());
 
@@ -113,6 +183,41 @@ describe("computeGeneratedYamlResult", () => {
     expect(yaml).toBe("generated yaml");
   });
 
+  it("keeps provider output visible when every ordinary node is excluded", () => {
+    const rawNodes = [{ name: "Drop", type: "ss" }];
+    mocks.resolveNodeNameFilter.mockReturnValueOnce({
+      rawNodes,
+      effectiveNodes: [],
+      excludedNodes: rawNodes,
+      rawCount: 1,
+      excludedCount: 1,
+      effectiveCount: 0,
+    });
+
+    const yaml = computeGeneratedYaml(
+      createState({
+        nodes: rawNodes,
+        nodeNameFilter: { enabled: true, excludeRegexes: ["drop"] },
+        sources: [
+          {
+            id: "remote",
+            type: "url",
+            content: "https://example.com/sub.yaml",
+            useProxyProviders: true,
+          },
+        ],
+      })
+    );
+
+    expect(yaml).toBe("generated yaml");
+    expect(mocks.generateClashYaml).toHaveBeenCalledWith(
+      expect.objectContaining({
+        nodes: [],
+        proxyProviders: expect.objectContaining({ url_remote: expect.any(Object) }),
+      })
+    );
+  });
+
   it("formats generator failures for UI display", () => {
     mocks.generateClashYaml.mockImplementationOnce(() => {
       throw new Error("dns yaml failed");
@@ -130,4 +235,16 @@ describe("computeGeneratedYamlResult", () => {
       error: "生成配置失败",
     });
   });
+
+  it("formats node-filter failures for UI display", () => {
+    mocks.resolveNodeNameFilter.mockImplementationOnce(() => {
+      throw new Error("第 1 行：正则表达式无效");
+    });
+
+    expect(computeGeneratedYamlResult(createState({ nodes: [{ name: "Node A" }] }))).toEqual({
+      yaml: "",
+      error: "第 1 行：正则表达式无效",
+    });
+    expect(mocks.generateClashYaml).not.toHaveBeenCalled();
+  });
 });
diff --git a/packages/ui/src/store/config-store/generated-yaml.ts b/packages/ui/src/store/config-store/generated-yaml.ts
index b202822..514f703 100644
--- a/packages/ui/src/store/config-store/generated-yaml.ts
+++ b/packages/ui/src/store/config-store/generated-yaml.ts
@@ -1,5 +1,7 @@
 import { generateClashYaml } from "@subboost/core/generator";
 import { stripImportedNodeControlFieldsFromList } from "@subboost/core/subscription/imported-node-controls";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
+import type { ParsedNode } from "@subboost/core/types/node";
 import type { ConfigState } from "./definitions";
 
 function buildProxyProvidersFromSources(
@@ -50,10 +52,11 @@ function formatGeneratedYamlError(error: unknown): string {
 
 function buildGenerateClashYamlOptions(
   state: ConfigState,
-  proxyProviders: Record<string, unknown> | undefined
+  proxyProviders: Record<string, unknown> | undefined,
+  effectiveNodes: ParsedNode[]
 ): GenerateClashYamlOptions {
   return {
-    nodes: stripImportedNodeControlFieldsFromList(state.nodes),
+    nodes: stripImportedNodeControlFieldsFromList(effectiveNodes),
     proxyProviders,
     template: state.template,
     userConfig: {
@@ -84,10 +87,13 @@ function buildGenerateClashYamlOptions(
 
 export function computeGeneratedYamlResult(state: ConfigState): GeneratedYamlResult {
   const proxyProviders = buildProxyProvidersFromSources(state);
-  const hasPreviewContent = state.nodes.length > 0 || Boolean(proxyProviders);
 
   try {
-    const yaml = generateClashYaml(buildGenerateClashYamlOptions(state, proxyProviders));
+    const { effectiveNodes } = resolveNodeNameFilter(state.nodes, state.nodeNameFilter);
+    const hasPreviewContent = effectiveNodes.length > 0 || Boolean(proxyProviders);
+    const yaml = generateClashYaml(
+      buildGenerateClashYamlOptions(state, proxyProviders, effectiveNodes)
+    );
     return { yaml: hasPreviewContent ? yaml : "", error: null };
   } catch (error) {
     return { yaml: "", error: formatGeneratedYamlError(error) };
diff --git a/packages/ui/src/store/config-store/persistence.test.ts b/packages/ui/src/store/config-store/persistence.test.ts
new file mode 100644
index 0000000..cdf737c
--- /dev/null
+++ b/packages/ui/src/store/config-store/persistence.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, it } from "vitest";
+import { DEFAULT_NODE_NAME_FILTER_CONFIG } from "@subboost/core/subscription/node-name-filter";
+import { initialState } from "./definitions";
+import {
+  CONFIG_DRAFT_STORAGE_VERSION,
+  normalizePersistedConfigState,
+  partializeConfigState,
+  prepareConfigDraftScope,
+} from "./persistence";
+
+describe("config store persistence", () => {
+  it("round-trips the normalized node-name filter without persisting node snapshots", () => {
+    const state = {
+      ...structuredClone(initialState),
+      nodes: [{ name: "完整节点快照" }],
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["  expire  ", "expire", "", "test"],
+      },
+    } as typeof initialState;
+
+    const persisted = partializeConfigState(state);
+
+    expect(persisted).toMatchObject({
+      nodeNameFilter: {
+        enabled: true,
+        excludeRegexes: ["expire", "test"],
+      },
+    });
+    expect(persisted).not.toHaveProperty("nodes");
+    expect(normalizePersistedConfigState(persisted).nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["expire", "test"],
+    });
+  });
+
+  it("defaults missing or malformed node-name filter data without a storage-version bump", () => {
+    expect(CONFIG_DRAFT_STORAGE_VERSION).toBe(10);
+    expect(normalizePersistedConfigState({}).nodeNameFilter).toEqual(
+      DEFAULT_NODE_NAME_FILTER_CONFIG
+    );
+    expect(
+      normalizePersistedConfigState({
+        nodeNameFilter: {
+          enabled: "yes",
+          excludeRegexes: "expire",
+        },
+      }).nodeNameFilter
+    ).toEqual(DEFAULT_NODE_NAME_FILTER_CONFIG);
+  });
+
+  it("restores the filter only from the current draft envelope", () => {
+    const storageName = "subboost-config:user:user-1";
+    const storage = {
+      getItem: (key: string) =>
+        key === storageName
+          ? JSON.stringify({
+              version: CONFIG_DRAFT_STORAGE_VERSION,
+              state: {
+                nodeNameFilter: {
+                  enabled: true,
+                  excludeRegexes: ["test"],
+                },
+              },
+            })
+          : null,
+      setItem: () => undefined,
+    };
+
+    expect(prepareConfigDraftScope(storage, "user-1").state.nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["test"],
+    });
+  });
+});
diff --git a/packages/ui/src/store/config-store/persistence.ts b/packages/ui/src/store/config-store/persistence.ts
index 8f359f3..b640224 100644
--- a/packages/ui/src/store/config-store/persistence.ts
+++ b/packages/ui/src/store/config-store/persistence.ts
@@ -1,5 +1,6 @@
 import type { ConfigState } from "./definitions";
 import { safeParseJsonObject } from "@subboost/core/json";
+import { normalizeNodeNameFilterConfig } from "@subboost/core/subscription/node-name-filter";
 import { getConfigDraftStorageNameForUser } from "./draft-storage";
 
 export {
@@ -58,6 +59,7 @@ export function normalizePersistedConfigState(
     ...(typeof state.proxyGroupAdvancedModeEnabled === "boolean"
       ? { proxyGroupAdvancedModeEnabled: state.proxyGroupAdvancedModeEnabled }
       : {}),
+    nodeNameFilter: normalizeNodeNameFilterConfig(state.nodeNameFilter),
     cnIpNoResolve: typeof state.cnIpNoResolve === "boolean" ? state.cnIpNoResolve : true,
     experimentalCnUseCnRuleSet:
       typeof state.experimentalCnUseCnRuleSet === "boolean" ? state.experimentalCnUseCnRuleSet : true,
@@ -76,6 +78,7 @@ export function partializeConfigState(state: ConfigState): Partial<ConfigState>
     testInterval: state.testInterval,
     ruleProviderBaseUrl: state.ruleProviderBaseUrl,
     proxyGroupAdvancedModeEnabled: state.proxyGroupAdvancedModeEnabled,
+    nodeNameFilter: normalizeNodeNameFilterConfig(state.nodeNameFilter),
     cnIpNoResolve: state.cnIpNoResolve,
     experimentalCnUseCnRuleSet: state.experimentalCnUseCnRuleSet,
   };

From b842fb5b12e8f51d45949a534962800db6a11586 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sun, 26 Jul 2026 22:43:39 +0800
Subject: [PATCH 35/36] test(ui): cover filter import refresh paths

---
 .../source-actions-multiple.test.ts           | 14 +++++++++++++-
 .../store/config-store/source-actions.test.ts | 19 +++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/packages/ui/src/store/config-store/source-actions-multiple.test.ts b/packages/ui/src/store/config-store/source-actions-multiple.test.ts
index 8979cf7..1ed8504 100644
--- a/packages/ui/src/store/config-store/source-actions-multiple.test.ts
+++ b/packages/ui/src/store/config-store/source-actions-multiple.test.ts
@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it } from "vitest";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import type { ParsedNode } from "@subboost/core/types/node";
 import type { SubscriptionSource } from "./definitions";
 import {
@@ -47,12 +48,23 @@ describe("createSourceActions parseMultipleSources", () => {
       source({ id: "yaml", type: "yaml", content: "proxies: []", tag: "Y" }),
       source({ id: "empty", type: "nodes", content: "   " }),
     ];
-    const { actions, getState } = createHarness({ sources });
+    const { actions, getState } = createHarness({
+      sources,
+      nodeNameFilter: { enabled: true, excludeRegexes: ["remote|yaml"] },
+    });
 
     await actions.parseMultipleSources(sources);
 
     expect(getState().isLoading).toBe(false);
     expect(getState().nodes.map((item: ParsedNode) => item.name)).toEqual(["[U]Remote", "[Y]Yaml"]);
+    expect(
+      resolveNodeNameFilter(getState().nodes, getState().nodeNameFilter)
+        .effectiveNodes
+    ).toEqual([]);
+    expect(getState().nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["remote|yaml"],
+    });
     expect(getState().parseErrors).toEqual([
       "源 #3 获取失败: fetch failed",
       "源 #4: yaml warning",
diff --git a/packages/ui/src/store/config-store/source-actions.test.ts b/packages/ui/src/store/config-store/source-actions.test.ts
index afd0b7a..3470057 100644
--- a/packages/ui/src/store/config-store/source-actions.test.ts
+++ b/packages/ui/src/store/config-store/source-actions.test.ts
@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it } from "vitest";
+import { resolveNodeNameFilter } from "@subboost/core/subscription/node-name-filter";
 import type { ParsedNode } from "@subboost/core/types/node";
 import type { SubscriptionSource } from "./definitions";
 import {
@@ -100,6 +101,7 @@ describe("createSourceActions", () => {
     const { actions, getState } = createHarness({
       nodes: [node("Existing", { server: "same.example.com" })],
       deletedNodeNames: ["Gone"],
+      nodeNameFilter: { enabled: true, excludeRegexes: ["fresh"] },
     });
 
     actions.parseContent("ss://content");
@@ -109,6 +111,14 @@ describe("createSourceActions", () => {
     expect(getState().nodes[0]).toMatchObject({ _originName: "Existing" });
     expect(getState().nodes[1]).toMatchObject({ _originName: "Fresh" });
     expect(getState().parseErrors).toEqual(["minor warning"]);
+    expect(getState().nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["fresh"],
+    });
+    expect(
+      resolveNodeNameFilter(getState().nodes, getState().nodeNameFilter)
+        .effectiveNodes.map((item) => item.name)
+    ).toEqual(["Existing"]);
   });
 
   it("marks invalid parse content errors without changing nodes", () => {
@@ -245,6 +255,7 @@ describe("createSourceActions", () => {
           nameTemplate: "{tag}-{name}",
         }),
       ],
+      nodeNameFilter: { enabled: true, excludeRegexes: ["^remote node$"] },
     });
 
     await actions.parseSingleSource("s1");
@@ -254,6 +265,14 @@ describe("createSourceActions", () => {
       _originName: "Remote Node",
       _sourceIds: ["s1"],
     });
+    expect(
+      resolveNodeNameFilter(getState().nodes, getState().nodeNameFilter)
+        .effectiveNodes
+    ).toEqual([]);
+    expect(getState().nodeNameFilter).toEqual({
+      enabled: true,
+      excludeRegexes: ["^remote node$"],
+    });
     expect(getState().parseErrors).toEqual(["remote warning"]);
     expect(getState().sources[0]).toMatchObject({
       parsing: false,

From 1dd7a739b6fecfe2388a845cfd44f44d540b3235 Mon Sep 17 00:00:00 2001
From: RyanVan <150385913+Ryson-32@users.noreply.github.com>
Date: Sun, 26 Jul 2026 23:14:45 +0800
Subject: [PATCH 36/36] fix(security): keep regex validation linear

---
 .../core/src/subscription/import-error.test.ts     |  2 ++
 packages/core/src/subscription/import-error.ts     | 12 ++++++++++--
 .../core/src/subscription/node-name-filter.test.ts | 14 +++++++++++---
 3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/packages/core/src/subscription/import-error.test.ts b/packages/core/src/subscription/import-error.test.ts
index e45928d..e6b3ecb 100644
--- a/packages/core/src/subscription/import-error.test.ts
+++ b/packages/core/src/subscription/import-error.test.ts
@@ -15,7 +15,9 @@ import {
 describe("extractHttpStatus", () => {
   it("only extracts explicit HTTP error status context", () => {
     expect(extractHttpStatus("upstream HTTP 503 then 404")).toBe(503);
+    expect(extractHttpStatus("upstream HTTP: 503")).toBe(503);
     expect(extractHttpStatus("request failed with status code 429")).toBe(429);
+    expect(extractHttpStatus("request failed with status=404")).toBe(404);
     expect(extractHttpStatus("upstream returned 502")).toBe(502);
     expect(extractHttpStatus("成功解析 502 个节点")).toBeNull();
     expect(extractHttpStatus("HTTP 200")).toBeNull();
diff --git a/packages/core/src/subscription/import-error.ts b/packages/core/src/subscription/import-error.ts
index 44e6dfa..4f73e1c 100644
--- a/packages/core/src/subscription/import-error.ts
+++ b/packages/core/src/subscription/import-error.ts
@@ -72,10 +72,18 @@ const NETWORK_CODE_BADGE: Record<string, string> = {
 };
 
 export function extractHttpStatus(text: string): number | null {
-  const match = text.match(
-    /\b(?:HTTP(?:\/\d(?:\.\d)?)?|status(?:\s+code)?|returned|responded(?:\s+with)?)\s*[:=]?\s*(\d{3})\b/i
+  const prefix = text.match(
+    /\b(?:HTTP(?:\/\d(?:\.\d)?)?|status(?:\s+code)?|returned|responded(?:\s+with)?)/i
   );
+  if (!prefix || prefix.index === undefined) return null;
+
+  let remainder = text.slice(prefix.index + prefix[0].length).trimStart();
+  if (remainder.startsWith(":") || remainder.startsWith("=")) {
+    remainder = remainder.slice(1).trimStart();
+  }
+  const match = remainder.match(/^(\d{3})\b/);
   if (!match) return null;
+
   const code = Number.parseInt(match[1], 10);
   return code >= 400 && code < 600 ? code : null;
 }
diff --git a/packages/core/src/subscription/node-name-filter.test.ts b/packages/core/src/subscription/node-name-filter.test.ts
index 217cea3..49e96fa 100644
--- a/packages/core/src/subscription/node-name-filter.test.ts
+++ b/packages/core/src/subscription/node-name-filter.test.ts
@@ -20,6 +20,11 @@ function node(name: string, originName?: string): ParsedNode {
   };
 }
 
+function unsafeNestedQuantifierPattern(): string {
+  const plus = String.fromCharCode(43);
+  return `(a${plus})${plus}$`;
+}
+
 describe("node name filter config", () => {
   it("treats a missing config as disabled and disables an empty enabled config", () => {
     expect(parseNodeNameFilterConfig(undefined)).toEqual({
@@ -64,7 +69,7 @@ describe("node name filter config", () => {
   it("reports the original line for invalid, unsafe, and non-string rules", () => {
     const result = validateNodeNameFilterConfig({
       enabled: true,
-      excludeRegexes: ["valid", 123, "[", "(a+)+$"],
+      excludeRegexes: ["valid", 123, "[", unsafeNestedQuantifierPattern()],
     });
 
     expect(result).toEqual({
@@ -126,7 +131,10 @@ describe("node name filter config", () => {
     );
 
     try {
-      parseNodeNameFilterConfig({ enabled: true, excludeRegexes: ["(", "(a+)+$"] });
+      parseNodeNameFilterConfig({
+        enabled: true,
+        excludeRegexes: ["(", unsafeNestedQuantifierPattern()],
+      });
       throw new Error("Expected parsing to fail");
     } catch (error) {
       expect(error).toBeInstanceOf(NodeNameFilterConfigError);
@@ -198,7 +206,7 @@ describe("resolveNodeNameFilter", () => {
     expect(() =>
       resolveNodeNameFilter([node("Node")], {
         enabled: true,
-        excludeRegexes: ["(a+)+$"],
+        excludeRegexes: [unsafeNestedQuantifierPattern()],
       })
     ).toThrow(NodeNameFilterConfigError);
   });