up 2.2.6

Update AndroidLibXrayLite
Improve DNS, try fix
2026-10-29 22:49:23 +00:00 · 2026-07-05 18:00:05 +08:00 · 2026-07-05 17:52:47 +08:00 · 2026-07-05 17:44:47 +08:00 · 2026-07-05 14:48:33 +08:00 · 2026-07-05 14:37:29 +08:00
133 changed files with 6825 additions and 2808 deletions
@@ -10,37 +10,40 @@ on:
    branches:
      - master

+permissions:
+  contents: write
+
 jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
      with:
        submodules: 'recursive'
        fetch-depth: '0'

    - name: Setup Android SDK
-      uses: android-actions/setup-android@v4.0.1
+      uses: android-actions/setup-android@v4
      with:
        log-accepted-android-sdk-licenses: false
-        cmdline-tools-version: '13114758'
-        packages: 'platforms;android-36.1 build-tools;36.1.0 platform-tools'
+        cmdline-tools-version: '14742923'
+        packages: 'platforms;android-37.0 build-tools;37.0.0 platform-tools'

    - name: Install NDK
      run: |
        echo "y" | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager \
          --channel=0 \
-          --install "ndk;28.2.13676358"
-        echo "NDK_HOME=$ANDROID_HOME/ndk/28.2.13676358" >> $GITHUB_ENV
+          --install "ndk;29.0.14206865"
+        echo "NDK_HOME=$ANDROID_HOME/ndk/29.0.14206865" >> $GITHUB_ENV
        sed -i '10i\
        \
-            ndkVersion = "28.2.13676358"' ${{ github.workspace }}/V2rayNG/app/build.gradle.kts
+            ndkVersion = "29.0.14206865"' ${{ github.workspace }}/V2rayNG/app/build.gradle.kts

    - name: Restore cached libhevtun
      id: cache-libhevtun-restore
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v6
      with:
        path: ${{ github.workspace }}/libs
        key: libhevtun-${{ runner.os }}-${{ env.NDK_HOME }}-${{ hashFiles('.git/modules/hev-socks5-tunnel/HEAD') }}-${{ hashFiles('compile-hevtun.sh') }}
@@ -52,7 +55,7 @@ jobs:
    
    - name: Save libhevtun
      if: steps.cache-libhevtun-restore.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v6
      with:
        path: ${{ github.workspace }}/libs
        key: libhevtun-${{ runner.os }}-${{ env.NDK_HOME }}-${{ hashFiles('.git/modules/hev-socks5-tunnel/HEAD') }}-${{ hashFiles('compile-hevtun.sh') }}
@@ -119,11 +122,34 @@ jobs:
        name: x86-apk
        path: ${{ github.workspace }}/V2rayNG/app/build/outputs/apk/*/release/*x86*.apk

-    - name: Upload to release
-      uses: svenstaro/upload-release-action@v2
-      if: github.event.inputs.release_tag != ''
-      with:
-        file: ${{ github.workspace }}/V2rayNG/app/build/outputs/apk/*/release/*.apk
-        tag: ${{ github.event.inputs.release_tag }}
-        file_glob: true
-        prerelease: true
+  sign-and-release:
+    needs: build
+    runs-on: ubuntu-26.04
+    if: github.event_name == 'workflow_dispatch' && inputs.release_tag != ''
+
+    steps:
+      - name: Download APK artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: release
+
+      - name: Sign APK files
+        run: |
+          printf '%s' "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import
+          KEY=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr:/ {print $10; exit}')
+          mkdir -p release-files
+
+          find release -type f -name '*.apk' | while read apk; do
+            cp "$apk" release-files/
+            gpg --batch --yes --local-user "$KEY" --detach-sign --output "release-files/$(basename "$apk").sig" "$apk"
+          done
+
+          gpg --armor --export "$KEY" > release-files/v2rayN-public-key.asc
+
+      - name: Upload APKs, signatures and public key to release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          file: release-files/*
+          tag: ${{ inputs.release_tag }}
+          file_glob: true
+          prerelease: true
@@ -11,6 +11,6 @@ jobs:
  go:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Validate Fastlane Supply Metadata
        uses: ashutoshgngwr/validate-fastlane-supply-metadata@v2.1.0
@@ -3,30 +3,88 @@
 A V2Ray client for Android, support [Xray core](https://github.com/XTLS/Xray-core) and [v2fly core](https://github.com/v2fly/v2ray-core)

 [![API](https://img.shields.io/badge/API-24%2B-yellow.svg?style=flat)](https://developer.android.com/about/versions/lollipop)
-[![Kotlin Version](https://img.shields.io/badge/Kotlin-2.3.0-blue.svg)](https://kotlinlang.org)
+[![Kotlin Version](https://img.shields.io/badge/Kotlin-2.4.0-blue.svg)](https://kotlinlang.org)
 [![GitHub commit activity](https://img.shields.io/github/commit-activity/m/2dust/v2rayNG)](https://github.com/2dust/v2rayNG/commits/master)
 [![CodeFactor](https://www.codefactor.io/repository/github/2dust/v2rayng/badge)](https://www.codefactor.io/repository/github/2dust/v2rayng)
 [![GitHub Releases](https://img.shields.io/github/downloads/2dust/v2rayNG/latest/total?logo=github)](https://github.com/2dust/v2rayNG/releases)
 [![Chat on Telegram](https://img.shields.io/badge/Chat%20on-Telegram-brightgreen.svg)](https://t.me/v2rayn)

-### Telegram Channel
-[github_2dust](https://t.me/github_2dust)
+---

-### Usage
+## Download / 下载
+
+Download the latest release here:
+
+在这里下载最新版本：
+
+[https://github.com/2dust/v2rayNG/releases](https://github.com/2dust/v2rayNG/releases)
+
+> [!TIP]
+> v2rayNG is the mobile version. For the desktop version, please visit the v2rayN \
+> v2rayNG 是手机版，电脑版请访问 v2rayN
+>
+> https://github.com/2dust/v2rayN
+
+---
+
+### Geoip and Geosite

-#### Geoip and Geosite
 - geoip.dat and geosite.dat files are in `Android/data/com.v2ray.ang/files/assets` (path may differ on some Android device)
- download feature will get enhanced version in this [repo](https://github.com/Loyalsoldier/v2ray-rules-dat) (Note it need a working proxy)
+- download feature will get enhanced version in this [repo](https://github.com/Loyalsoldier/v2ray-rules-dat) (note: it needs a working proxy)
 - latest official [domain list](https://github.com/Loyalsoldier/v2ray-rules-dat) and [ip list](https://github.com/Loyalsoldier/geoip) can be imported manually
- possible to use third party dat file in the same folder, like [h2y](https://guide.v2fly.org/routing/sitedata.html#%E5%A4%96%E7%BD%AE%E7%9A%84%E5%9F%9F%E5%90%8D%E6%96%87%E4%BB%B6)
+- possible to use a third-party dat file in the same folder, like [h2y](https://guide.v2fly.org/routing/sitedata.html#%E5%A4%96%E7%BD%AE%E7%9A%84%E5%9F%9F%E5%90%8D%E6%96%87%E4%BB%B6)

-### More in our [wiki](https://github.com/2dust/v2rayNG/wiki)
+More in our [wiki](https://github.com/2dust/v2rayNG/wiki)

-### Development guide
+### Geoip 与 Geosite

-Android project under V2rayNG folder can be compiled directly in Android Studio, or using Gradle wrapper. But the v2ray core inside the aar is (probably) outdated.  
-The aar can be compiled from the Golang project [AndroidLibV2rayLite](https://github.com/2dust/AndroidLibV2rayLite) or [AndroidLibXrayLite](https://github.com/2dust/AndroidLibXrayLite).
-For a quick start, read guide for [Go Mobile](https://github.com/golang/go/wiki/Mobile) and [Makefiles for Go Developers](https://tutorialedge.net/golang/makefiles-for-go-developers/)
+- geoip.dat 和 geosite.dat 文件位于 `Android/data/com.v2ray.ang/files/assets`（部分设备路径可能不同）
+- 下载功能将获取该 [仓库](https://github.com/Loyalsoldier/v2ray-rules-dat) 中的增强版本（注意：此功能需要一个可用的代理）
+- 最新官方 [域名列表](https://github.com/Loyalsoldier/v2ray-rules-dat) 和 [IP 列表](https://github.com/Loyalsoldier/geoip) 可手动导入
+- 也可在同一文件夹中使用第三方 dat 文件，例如 [h2y](https://guide.v2fly.org/routing/sitedata.html#%E5%A4%96%E7%BD%AE%E7%9A%84%E5%9F%9F%E5%90%8D%E6%96%87%E4%BB%B6)

-v2rayNG can run on Android Emulators. For WSA, VPN permission need to be granted via
-`appops set [package name] ACTIVATE_VPN allow`
+更多内容请见我们的 [wiki](https://github.com/2dust/v2rayNG/wiki)
+
+---
+
+## Development guide / 开发指南
+
+### Note
+
+- Android project under the V2rayNG folder can be compiled directly in Android Studio, or using the Gradle wrapper. But the v2ray core inside the aar is (probably) outdated.
+- The aar can be compiled from the Golang project [AndroidLibV2rayLite](https://github.com/2dust/AndroidLibV2rayLite) or [AndroidLibXrayLite](https://github.com/2dust/AndroidLibXrayLite). For a quick start, read the guides for [Go Mobile](https://github.com/golang/go/wiki/Mobile) and [Makefiles for Go Developers](https://tutorialedge.net/golang/makefiles-for-go-developers/).
+- v2rayNG can run on Android Emulators. For WSA, VPN permission needs to be granted via `appops set [package name] ACTIVATE_VPN allow`.
+
+### 提示
+
+- V2rayNG 文件夹下的 Android 项目可直接在 Android Studio 中编译，或使用 Gradle wrapper 编译。但 aar 内置的 v2ray core（可能）已过时。
+- aar 可由 Golang 项目 [AndroidLibV2rayLite](https://github.com/2dust/AndroidLibV2rayLite) 或 [AndroidLibXrayLite](https://github.com/2dust/AndroidLibXrayLite) 编译而成。快速入门可参考 [Go Mobile](https://github.com/golang/go/wiki/Mobile) 指南和 [Makefiles for Go Developers](https://tutorialedge.net/golang/makefiles-for-go-developers/)。
+- v2rayNG 可在 Android 模拟器上运行。对于 WSA，需要通过 `appops set [package name] ACTIVATE_VPN allow` 授予 VPN 权限。
+
+---
+
+
+## GPG Verification / GPG 签名校验
+
+Release files are signed with GPG to verify authenticity and integrity, helping prevent mirror, ISP, or CDN hijacking.
+
+发布文件已使用 GPG 签名，可用于校验文件真实性与完整性，预防镜像站、运营商或 CDN 劫持。
+
+### Fingerprint / 公钥指纹
+
+```text
+7694 5E9F 3E9A 168F 8070 F195 805D 661C
+134D FAF6 8903 C199 463C 31E5 AE90 3AE0
+```
+
+---
+
+## Community / 社区
+
+Telegram Group / Telegram 群组：
+
+[https://t.me/v2rayN](https://t.me/v2rayN)
+
+Telegram Channel / Telegram 频道：
+
+[https://t.me/github_2dust](https://t.me/github_2dust)
@@ -6,14 +6,14 @@ plugins {

 android {
    namespace = "com.v2ray.ang"
-    compileSdk = 36
+    compileSdk = 37

    defaultConfig {
        applicationId = "com.v2ray.ang"
        minSdk = 24
-        targetSdk = 36
-        versionCode = 724
-        versionName = "2.1.4"
+        targetSdk = 37
+        versionCode = 736
+        versionName = "2.2.6"
        multiDexEnabled = true

        val abiFilterList = (properties["ABI_FILTERS"] as? String)?.split(';')
@@ -21,7 +21,7 @@ android {
            abi {
                isEnable = true
                reset()
-                if (abiFilterList != null && abiFilterList.isNotEmpty()) {
+                if (!abiFilterList.isNullOrEmpty()) {
                    include(*abiFilterList.toTypedArray())
                } else {
                    include(
@@ -29,16 +29,16 @@
        tools:ignore="PackageVisibilityPolicy,QueryAllPackagesPermission" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.ACCESS_LOCAL_NETWORK" />
    <uses-permission android:name="android.permission.INTERNET" />
-    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.CAMERA" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE"
+        tools:ignore="ForegroundServicesPolicy" />
    <uses-permission
        android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE"
        android:minSdkVersion="34" />
    <!-- <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" /> -->
    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
-    <uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />

    <application
@@ -82,6 +82,10 @@
            android:name=".ui.ServerGroupActivity"
            android:exported="false"
            android:windowSoftInputMode="stateUnchanged" />
+        <activity
+            android:name=".ui.ServerProxyChainActivity"
+            android:exported="false"
+            android:windowSoftInputMode="stateUnchanged" />
        <activity
            android:name=".ui.SettingsActivity"
            android:exported="false" />
@@ -168,7 +172,7 @@
            android:exported="false" />

        <service
-            android:name=".service.V2RayVpnService"
+            android:name=".service.CoreVpnService"
            android:enabled="true"
            android:exported="false"
            android:foregroundServiceType="specialUse"
@@ -188,7 +192,7 @@
        </service>

        <service
-            android:name=".service.V2RayProxyOnlyService"
+            android:name=".service.CoreProxyOnlyService"
            android:exported="false"
            android:foregroundServiceType="specialUse"
            android:label="@string/app_name"
@@ -199,9 +203,25 @@
        </service>

        <service
-            android:name=".service.V2RayTestService"
+            android:name=".service.CoreRootService"
            android:exported="false"
-            android:process=":RunSoLibV2RayDaemon" />
+            android:foregroundServiceType="specialUse"
+            android:label="@string/app_name"
+            android:process=":RunSoLibV2RayDaemon">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="proxy" />
+        </service>
+
+        <service
+            android:name=".service.CoreTestService"
+            android:exported="false"
+            android:foregroundServiceType="specialUse"
+            android:process=":RunSoLibV2RayDaemon">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="test" />
+        </service>

        <receiver
            android:name=".receiver.WidgetProvider"
@@ -30,7 +30,8 @@
      "enabled": true,
      "destOverride": [
        "http",
-        "tls"
+        "tls",
+		"quic"
      ]
    }
  }
@@ -73,8 +74,10 @@
  },
  {
    "protocol": "freedom",
-    "settings": {
-      "domainStrategy": "UseIP"
+    "streamSettings": {
+      "sockopt": {
+        "domainStrategy": "UseIP"
+      }
    },
    "tag": "direct"
  },
@@ -30,7 +30,8 @@
      "enabled": true,
      "destOverride": [
        "http",
-        "tls"
+        "tls",
+		"quic"
      ]
    }
  },
@@ -46,7 +47,8 @@
      "enabled": true,
      "destOverride": [
        "http",
-        "tls"
+        "tls",
+		"quic"
      ]
    }
  }
@@ -89,8 +91,10 @@
  },
  {
    "protocol": "freedom",
-    "settings": {
-      "domainStrategy": "UseIP"
+    "streamSettings": {
+      "sockopt": {
+        "domainStrategy": "UseIP"
+      }
    },
    "tag": "direct"
  },
@@ -43,6 +43,7 @@ object AppConfig {
    const val PREF_FRAGMENT_PACKETS = "pref_fragment_packets"
    const val PREF_FRAGMENT_LENGTH = "pref_fragment_length"
    const val PREF_FRAGMENT_INTERVAL = "pref_fragment_interval"
+    const val PREF_FRAGMENT_MAXSPLIT = "pref_fragment_maxsplit"
    const val SUBSCRIPTION_UPDATE_TASK_NAME = "subscription_updater"
    const val SUBSCRIPTION_MIN_INTERVAL_MINUTES = 15L
    const val PREF_SPEED_ENABLED = "pref_speed_enabled"
@@ -55,7 +56,6 @@ object AppConfig {
    const val PREF_IPV6_ENABLED = "pref_ipv6_enabled"
    const val PREF_PREFER_IPV6 = "pref_prefer_ipv6"
    const val PREF_PROXY_SHARING = "pref_proxy_sharing_enabled"
-    const val PREF_ALLOW_INSECURE = "pref_allow_insecure"
    const val PREF_ENABLE_LOCAL_PROXY = "pref_enable_local_proxy"
    const val PREF_SOCKS_PORT = "pref_socks_port"
    const val PREF_DYNAMIC_SOCKS_PORT = "pref_dynamic_socks_port"
@@ -70,6 +70,8 @@ object AppConfig {
    const val PREF_LOGLEVEL = "pref_core_loglevel"
    const val PREF_OUTBOUND_DOMAIN_RESOLVE_METHOD = "pref_outbound_domain_resolve_method"
    const val PREF_MODE = "pref_mode"
+    const val PREF_ROOT_MODE_ENABLE = "pref_root_mode_enabled"
+    const val PREF_ROOT_LAN_SHARING = "pref_root_lan_sharing"
    const val PREF_IS_BOOTED = "pref_is_booted"
    const val PREF_CHECK_UPDATE_PRE_RELEASE = "pref_check_update_pre_release"
    const val PREF_GEO_FILES_SOURCES = "pref_geo_files_sources"
@@ -78,6 +80,7 @@ object AppConfig {
    const val PREF_HEV_TUNNEL_RW_TIMEOUT = "pref_hev_tunnel_rw_timeout_v2"
    const val PREF_AUTO_REMOVE_INVALID_AFTER_TEST = "pref_auto_remove_invalid_after_test"
    const val PREF_AUTO_SORT_AFTER_TEST = "pref_auto_sort_after_test"
+    const val PREF_REAL_PING_CONCURRENCY = "pref_real_ping_concurrency"

    /** Cache keys. */
    const val CACHE_SUBSCRIPTION_ID = "cache_subscription_id"
@@ -104,7 +107,8 @@ object AppConfig {
    const val TAG_FRAGMENT = "fragment"
    const val TAG_DNS = "dns-module"
    const val TAG_DOMESTIC_DNS = "domestic-dns"
-    const val TAG_BALANCER = "proxy-round"
+    const val TAG_BALANCER = "balancer-main"
+    const val TAG_BALANCER_PRE = "balancer"

    /** Network-related constants. */
    const val UPLINK = "uplink"
@@ -164,23 +168,23 @@ object AppConfig {
    const val MSG_STATE_RESTART = 5
    const val MSG_MEASURE_DELAY = 6
    const val MSG_MEASURE_DELAY_SUCCESS = 61
-    const val MSG_MEASURE_CONFIG = 7
-    const val MSG_MEASURE_CONFIG_SUCCESS = 71
-    const val MSG_MEASURE_CONFIG_CANCEL = 72
+    const val MSG_MEASURE_CONFIG_START = 7
+    const val MSG_MEASURE_CONFIG_CANCEL = 71
+    const val MSG_MEASURE_CONFIG_SUCCESS = 72
    const val MSG_MEASURE_CONFIG_NOTIFY = 73
    const val MSG_MEASURE_CONFIG_FINISH = 74

    /** Notification channel IDs and names. */
    const val RAY_NG_CHANNEL_ID = "RAY_NG_M_CH_ID"
    const val RAY_NG_CHANNEL_NAME = "v2rayNG Background Service"
-    const val SUBSCRIPTION_UPDATE_CHANNEL = "subscription_update_channel"
-    const val SUBSCRIPTION_UPDATE_CHANNEL_NAME = "Subscription Update Service"

    /** Protocols Scheme **/
    const val VMESS = "vmess://"
    const val CUSTOM = ""
    const val SHADOWSOCKS = "ss://"
    const val SOCKS = "socks://"
+    const val SOCKS4 = "socks4://"
+    const val SOCKS5 = "socks5://"
    const val HTTP = "http://"
    const val VLESS = "vless://"
    const val TROJAN = "trojan://"
@@ -194,6 +198,28 @@ object AppConfig {
    const val VPN = "VPN"
    const val VPN_MTU = 1500

+    /** Root (system-wide) mode runtime constants. */
+    const val ROOT_RUNTIME_DIR = "root"
+    const val ROOT_IPTABLES_CHAIN = "V2RAY_NG"
+    const val ROOT_FWMARK = 255            // defensive RETURN tag; hev's only upstream socket is loopback (already bypassed)
+    const val ROOT_MARK_ROUTE = 1          // packets we want pushed into the tun device
+    const val ROOT_ROUTE_TABLE = 2024
+    const val ROOT_RULE_PRIORITY = 1000
+    const val ROOT_TUN_NAME = "v2raytun0"
+    const val ROOT_TUN_ADDR_V4 = "198.18.0.1/15"
+    const val ROOT_TUN_ADDR_V6 = "fdfe:dcba:9876::1/64"
+
+    // hev-socks5-tunnel run as a standalone root binary (reuses the same project already
+    // bundled for the VPN hev path; distinct filename from the JNI lib to avoid collision).
+    const val ROOT_TUN2SOCKS_BIN = "libhevsockstun.so"
+    const val ROOT_FWD_CHAIN = "V2RAY_NG_FWD"   // FORWARD chain for LAN/tethering sharing
+    const val ROOT_DNS_CHAIN = "V2RAY_NG_DNS"   // nat chain for tethered-client DNS DNAT
+    const val ROOT_V6_CHAIN = "V2RAY_NG6"       // ip6tables filter/OUTPUT chain: blackhole native IPv6 when it isn't tunneled
+    const val ROOT_V6_FWD_CHAIN = "V2RAY_NG6_FWD" // ip6tables FORWARD chain: route or reject tethered clients' native IPv6
+    const val ROOT_V6_PRE_CHAIN = "V2RAY_NG6_PRE" // ip6tables mangle/PREROUTING chain: mark forwarded clients' IPv6 into the tun
+    const val ROOT_LAN_DNS = "1.1.1.1"          // fallback resolver for tethered clients when no plain-IPv4 DNS is configured
+    const val ROOT_OOM_SCORE = "-1000"          // oom_score_adj that makes the LMK never kill us
+
    /** hev-sock5-tunnel read-write-timeout value */
    const val HEVTUN_RW_TIMEOUT = "300,60"

@@ -202,13 +228,19 @@ object AppConfig {
    const val GOOGLEAPIS_COM_DOMAIN = "googleapis.com"

    // Android Private DNS constants
-    const val DNS_DNSPOD_DOMAIN = "dot.pub"
    const val DNS_ALIDNS_DOMAIN = "dns.alidns.com"
+    const val DNS_CISCO_SSE_DOMAIN = "dns.sse.cisco.com"
+    const val DNS_CISCO_UMBRELLA_DOMAIN = "dns.umbrella.com"
    const val DNS_CLOUDFLARE_ONE_DOMAIN = "one.one.one.one"
+    const val DNS_CLOUDFLARE_ONEDOT_DNS_DOMAIN = "1dot1dot1dot1.cloudflare-dns.com"
    const val DNS_CLOUDFLARE_DNS_COM_DOMAIN = "dns.cloudflare.com"
    const val DNS_CLOUDFLARE_DNS_DOMAIN = "cloudflare-dns.com"
+    const val DNS_CLOUDFLARE_WARP_DOMAIN = "engage.cloudflareclient.com"
+    const val DNS_DNSPOD_DOH_DOMAIN = "doh.pub"
+    const val DNS_DNSPOD_DOT_DOMAIN = "dot.pub"
    const val DNS_GOOGLE_DOMAIN = "dns.google"
    const val DNS_QUAD9_DOMAIN = "dns.quad9.net"
+    const val DNS_SB_DOMAIN = "dns.sb"
    const val DNS_YANDEX_DOMAIN = "common.dot.dns.yandex.net"

    const val DEFAULT_PORT = 443
@@ -222,12 +254,18 @@ object AppConfig {
    const val UNIDENTIFIED_PACKAGE = "__unknown_app__"

    val DNS_ALIDNS_ADDRESSES = arrayListOf("223.5.5.5", "223.6.6.6", "2400:3200::1", "2400:3200:baba::1")
+    val DNS_CISCO_SSE_ADDRESSES = arrayListOf("208.67.220.220", "208.67.222.222", "2620:119:35::35", "2620:119:53::53")
+    val DNS_CISCO_UMBRELLA_ADDRESSES = arrayListOf("208.67.220.220", "208.67.222.222", "2620:119:35::35", "2620:119:53::53")
    val DNS_CLOUDFLARE_ONE_ADDRESSES = arrayListOf("1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001")
-    val DNS_CLOUDFLARE_DNS_COM_ADDRESSES = arrayListOf("104.16.132.229", "104.16.133.229", "2606:4700::6810:84e5", "2606:4700::6810:85e5")
+    val DNS_CLOUDFLARE_ONEDOT_DNS_ADDRESSES = arrayListOf("1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001")
+    val DNS_CLOUDFLARE_DNS_COM_ADDRESSES = arrayListOf("162.159.61.8", "172.64.41.8", "2a06:98c1:52::8", "2803:f800:53::8")
    val DNS_CLOUDFLARE_DNS_ADDRESSES = arrayListOf("104.16.248.249", "104.16.249.249", "2606:4700::6810:f8f9", "2606:4700::6810:f9f9")
-    val DNS_DNSPOD_ADDRESSES = arrayListOf("1.12.12.12", "120.53.53.53")
+    val DNS_CLOUDFLARE_WARP_ADDRESSES = arrayListOf("162.159.192.1", "2606:4700:d0::a29f:c001")
+    val DNS_DNSPOD_DOH_ADDRESSES = arrayListOf("1.12.12.12", "120.53.53.53")
+    val DNS_DNSPOD_DOT_ADDRESSES = arrayListOf("1.12.12.12", "120.53.53.53")
    val DNS_GOOGLE_ADDRESSES = arrayListOf("8.8.8.8", "8.8.4.4", "2001:4860:4860::8888", "2001:4860:4860::8844")
    val DNS_QUAD9_ADDRESSES = arrayListOf("9.9.9.9", "149.112.112.112", "2620:fe::fe", "2620:fe::9")
+    val DNS_SB_ADDRESSES = arrayListOf("45.11.45.11", "185.222.222.222", "2a09::", "2a11::")
    val DNS_YANDEX_ADDRESSES = arrayListOf("77.88.8.8", "77.88.8.1", "2a02:6b8::feed:0ff", "2a02:6b8:0:1::feed:0ff")

    //minimum list https://serverfault.com/a/304791
@@ -1,6 +1,6 @@
 package com.v2ray.ang.contracts

-import com.v2ray.ang.dto.ProfileItem
+import com.v2ray.ang.dto.entities.ProfileItem

 interface MainAdapterListener : BaseAdapterListener {

@@ -0,0 +1,249 @@
+package com.v2ray.ang.core
+
+import android.content.Context
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.dto.CoreConfigContext
+import com.v2ray.ang.dto.entities.ProfileItem
+import com.v2ray.ang.enums.CoreResolvedType
+import com.v2ray.ang.enums.EConfigType
+import com.v2ray.ang.extension.isComplexType
+import com.v2ray.ang.extension.isNotNullEmpty
+import com.v2ray.ang.handler.MmkvManager
+import com.v2ray.ang.handler.SettingsManager
+import com.v2ray.ang.util.LogUtil
+import com.v2ray.ang.util.Utils
+
+/**
+ * Build runtime context from the selected profile.
+ *
+ * All outbound type analysis is completed here for both the selected profile
+ * and routing targets. Custom profiles are returned immediately without
+ * entering the normal analysis flow.
+ */
+object CoreConfigContextBuilder {
+
+    /**
+     * Load one profile and produce a fully analyzed context.
+     *
+     * Null is returned only when the selected profile cannot be loaded.
+     */
+    fun build(context: Context, guid: String): CoreConfigContext? {
+        val config = MmkvManager.decodeServerConfig(guid) ?: return null
+
+        // CUSTOM: return immediately — CoreConfigManager handles this path on its own.
+        if (config.configType == EConfigType.CUSTOM) {
+            return CoreConfigContext(context = context, guid = guid, isCustom = true)
+        }
+
+        // Step 1: Resolve the main outbound (always tag = TAG_PROXY).
+        val primaryResolvedOutbound = resolveOutbound(AppConfig.TAG_PROXY, config) ?: run {
+            LogUtil.e(AppConfig.TAG, "Failed to resolve main outbound for '${config.remarks}'")
+            return null
+        }
+
+        // Step 2: Resolve all non-builtin routing outbound tags.
+        val routingResolvedOutbounds = resolveRoutingOutbounds()
+        val routingDomainRules = collectRoutingDomainRulesForDns()
+
+        return CoreConfigContext(
+            context = context,
+            guid = guid,
+            resolvedOutbounds = listOf(primaryResolvedOutbound) + routingResolvedOutbounds,
+            routingDomainRules = routingDomainRules,
+        )
+    }
+
+    /**
+     * Resolve one outbound target into a normalized outbound entry.
+     *
+     * Custom profiles are ignored at this stage and produce no entry.
+     */
+    private fun resolveOutbound(tag: String, profile: ProfileItem): CoreConfigContext.ResolvedOutbound? {
+        if (profile.configType == EConfigType.CUSTOM) {
+            return null
+        }
+
+        val (resolvedProfiles, resolvedType) = when (profile.configType) {
+            EConfigType.POLICYGROUP -> Pair(
+                resolvePolicyGroupProfiles(profile),
+                CoreResolvedType.POLICYGROUP,
+            )
+
+            EConfigType.PROXYCHAIN -> {
+                val chainProfiles = resolveProxyChainProfiles(profile)
+                val type = if (chainProfiles.size <= 1) CoreResolvedType.NORMAL else CoreResolvedType.PROXYCHAIN
+                Pair(chainProfiles, type)
+            }
+
+            else -> {
+                val chainProfiles = resolveProxyChainProfilesFromGroup(profile)
+                val type = if (chainProfiles.size <= 1) CoreResolvedType.NORMAL else CoreResolvedType.PROXYCHAIN
+                Pair(chainProfiles, type)
+            }
+        }
+
+        return CoreConfigContext.ResolvedOutbound(
+            tag = tag,
+            profile = profile,
+            resolvedProfiles = resolvedProfiles,
+            resolvedType = resolvedType,
+        )
+    }
+
+    /**
+     * Collect and resolve non-builtin routing targets from enabled rules.
+     *
+     * Invalid or empty targets are skipped and handled by fallback logic later.
+     */
+    private fun resolveRoutingOutbounds(): List<CoreConfigContext.ResolvedOutbound> {
+        val rulesetItems = MmkvManager.decodeRoutingRulesets() ?: return emptyList()
+        val resolvedOutbounds = mutableListOf<CoreConfigContext.ResolvedOutbound>()
+        val processedTags = mutableSetOf<String>()
+
+        try {
+            rulesetItems
+                .filter { it.enabled }
+                .mapNotNull { it.outboundTag.takeIf { tag -> tag.isNotBlank() } }
+                .filter { tag -> tag !in AppConfig.BUILTIN_OUTBOUND_TAGS }
+                .distinct()
+                .forEach { tag ->
+                    if (tag in processedTags) {
+                        return@forEach
+                    }
+                    processedTags.add(tag)
+
+                    try {
+                        val profile = SettingsManager.getServerViaRemarks(tag) ?: run {
+                            LogUtil.w(AppConfig.TAG, "Routing tag '$tag' has no matching profile — will fall back to proxy at routing time")
+                            return@forEach
+                        }
+                        val resolvedOutbound = resolveOutbound(tag, profile) ?: run {
+                            LogUtil.w(AppConfig.TAG, "Cannot use CUSTOM profile as routing outbound for tag '$tag', skipping")
+                            return@forEach
+                        }
+                        if (resolvedOutbound.resolvedProfiles.isEmpty()) {
+                            LogUtil.w(AppConfig.TAG, "Routing outbound '$tag' resolved to empty list, skipping")
+                            return@forEach
+                        }
+                        resolvedOutbounds.add(resolvedOutbound)
+                        LogUtil.d(AppConfig.TAG, "Resolved routing outbound: tag='$tag', type='${resolvedOutbound.resolvedType}', profiles=${resolvedOutbound.resolvedProfiles.size}")
+                    } catch (e: Exception) {
+                        LogUtil.e(AppConfig.TAG, "Failed to resolve routing outbound for tag '$tag', skipping", e)
+                    }
+                }
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "Failed to resolve routing outbounds from rulesets", e)
+        }
+
+        return resolvedOutbounds
+    }
+
+    private fun resolvePolicyGroupProfiles(config: ProfileItem): List<ProfileItem> {
+        try {
+            val serverList = MmkvManager.decodeAllServerList()
+            return serverList
+                .asSequence()
+                .mapNotNull { id -> MmkvManager.decodeServerConfig(id) }
+                .filter { profile ->
+                    val subscriptionId = config.policyGroupSubscriptionId
+                    if (subscriptionId.isNullOrBlank()) {
+                        true
+                    } else {
+                        profile.subscriptionId == subscriptionId
+                    }
+                }
+                .filter { profile ->
+                    val filter = config.policyGroupFilter
+                    if (filter.isNullOrBlank()) {
+                        true
+                    } else {
+                        try {
+                            Regex(filter).containsMatchIn(profile.remarks)
+                        } catch (_: Exception) {
+                            profile.remarks.contains(filter)
+                        }
+                    }
+                }
+                .filter { it.server.isNotNullEmpty() }
+                .filter { Utils.isPureIpAddress(it.server!!) || Utils.isValidUrl(it.server!!) }
+                .filter { !it.configType.isComplexType() }
+                .toList()
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "Failed to resolve policy group profiles for '${config.remarks}'", e)
+            return listOf(config)
+        }
+    }
+
+    private fun resolveProxyChainProfiles(config: ProfileItem): List<ProfileItem> {
+        if (config.proxyChainProfiles.isNullOrBlank()) {
+            return listOf(config)
+        }
+
+        try {
+            return config.proxyChainProfiles.orEmpty().split(",")
+                .asSequence()
+                .mapNotNull { remark -> SettingsManager.getServerViaRemarks(remark) }
+                .filter { it.server.isNotNullEmpty() }
+                .filter { Utils.isPureIpAddress(it.server!!) || Utils.isValidUrl(it.server!!) }
+                .filter { !it.configType.isComplexType() }
+                .toList()
+                .reversed()
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "Failed to resolve proxy chain profiles for '${config.remarks}'", e)
+            return listOf(config)
+        }
+    }
+
+    /**
+     * Resolve chain nodes from subscription neighbors in order: next, current, prev.
+     *
+     * When no chain is available, return a single-node result.
+     */
+    private fun resolveProxyChainProfilesFromGroup(config: ProfileItem): List<ProfileItem> {
+        if (config.subscriptionId.isEmpty()) {
+            return listOf(config)
+        }
+
+        try {
+            val subItem = MmkvManager.decodeSubscription(config.subscriptionId) ?: return listOf(config)
+            val resolved = mutableListOf<ProfileItem>()
+            SettingsManager.getServerViaRemarks(subItem.nextProfile)?.let { resolved.add(it) }
+            resolved.add(config)
+            SettingsManager.getServerViaRemarks(subItem.prevProfile)?.let { resolved.add(it) }
+            return resolved
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "Failed to resolve proxy chain from group for '${config.remarks}'", e)
+            return listOf(config)
+        }
+    }
+
+    /**
+     * Collect enabled routing domain rules in original order for DNS segmentation.
+     *
+     * outbounds are normalized into three tags only: proxy / direct / block.
+     */
+    private fun collectRoutingDomainRulesForDns(): List<CoreConfigContext.RoutingDomainRule> {
+        val rulesetItems = MmkvManager.decodeRoutingRulesets() ?: return emptyList()
+        val result = mutableListOf<CoreConfigContext.RoutingDomainRule>()
+
+        rulesetItems
+            .asSequence()
+            .filter { it.enabled }
+            .filter { !it.domain.isNullOrEmpty() }
+            .forEach { rule ->
+                val normalizedOutboundTag = when (rule.outboundTag) {
+                    AppConfig.TAG_DIRECT -> AppConfig.TAG_DIRECT
+                    AppConfig.TAG_BLOCKED -> AppConfig.TAG_BLOCKED
+                    else -> AppConfig.TAG_PROXY
+                }
+                result.add(
+                    CoreConfigContext.RoutingDomainRule(
+                        domain = rule.domain.orEmpty(),
+                        outboundTag = normalizedOutboundTag
+                    )
+                )
+            }
+
+        return result
+    }
+}
@@ -1,4 +1,4 @@
-package com.v2ray.ang.handler
+package com.v2ray.ang.core

 import android.content.Context
 import com.v2ray.ang.AppConfig
@@ -16,7 +16,7 @@ import java.util.concurrent.atomic.AtomicBoolean
 * Thread-safe singleton wrapper for Libv2ray native methods.
 * Provides initialization protection and unified API for V2Ray core operations.
 */
-object V2RayNativeManager {
+object CoreNativeManager {
    private val initialized = AtomicBoolean(false)

    /**
@@ -43,6 +43,15 @@ object V2RayNativeManager {
        }
    }

+    fun reconcileBrowserDialer(dialerAddr: String) {
+        try {
+            Libv2ray.reconcileBrowserDialer(dialerAddr)
+            LogUtil.i(AppConfig.TAG, "Browser dialer reconciled successfully with address: $dialerAddr")
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "Failed to reconcile browser dialer with address: $dialerAddr", e)
+        }
+    }
+

    /**
     * Get V2Ray core version.
@@ -88,4 +97,4 @@ object V2RayNativeManager {
            throw e
        }
    }
-}
+}
@@ -0,0 +1,690 @@
+package com.v2ray.ang.core
+
+import com.google.gson.JsonArray
+import com.google.gson.JsonObject
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.dto.V2rayConfig.OutboundBean
+import com.v2ray.ang.dto.entities.ProfileItem
+import com.v2ray.ang.enums.EConfigType
+import com.v2ray.ang.enums.NetworkType
+import com.v2ray.ang.extension.isNotNullEmpty
+import com.v2ray.ang.extension.nullIfBlank
+import com.v2ray.ang.handler.MmkvManager
+import com.v2ray.ang.util.HttpUtil
+import com.v2ray.ang.util.JsonUtil
+import com.v2ray.ang.util.LogUtil
+import com.v2ray.ang.util.Utils
+
+/**
+ * Centralizes ProfileItem -> OutboundBean conversion.
+ * Most protocol builders mirror the previous *Fmt.toOutbound behavior.
+ */
+object CoreOutboundBuilder {
+
+    /** Dispatches a profile to protocol-specific outbound builder. */
+    fun convert(profileItem: ProfileItem): OutboundBean? {
+        val outbound = when (profileItem.configType) {
+            EConfigType.VMESS -> toOutboundVmess(profileItem)
+            EConfigType.SHADOWSOCKS -> toOutboundShadowsocks(profileItem)
+            EConfigType.SOCKS -> toOutboundSocks(profileItem)
+            EConfigType.VLESS -> toOutboundVless(profileItem)
+            EConfigType.TROJAN -> toOutboundTrojan(profileItem)
+            EConfigType.WIREGUARD -> toOutboundWireguard(profileItem)
+            EConfigType.HYSTERIA2 -> toOutboundHysteria2(profileItem)
+            EConfigType.HTTP -> toOutboundHttp(profileItem)
+            else -> null
+        }
+
+        outbound ?: return null
+        val ret = updateOutboundWithGlobalSettings(outbound)
+        if (!ret) return null
+        return outbound
+    }
+
+    /** Applies global outbound options (mux, protocol-specific tweaks, etc.). */
+    private fun updateOutboundWithGlobalSettings(outbound: OutboundBean): Boolean {
+        try {
+            var muxEnabled = MmkvManager.decodeSettingsBool(AppConfig.PREF_MUX_ENABLED, false)
+            val protocol = outbound.protocol
+            if (protocol.equals(EConfigType.SHADOWSOCKS.name, true)
+                || protocol.equals(EConfigType.SOCKS.name, true)
+                || protocol.equals(EConfigType.HTTP.name, true)
+                || protocol.equals(EConfigType.TROJAN.name, true)
+                || protocol.equals(EConfigType.WIREGUARD.name, true)
+                || protocol.equals(EConfigType.HYSTERIA2.name, true)
+                || protocol.equals(EConfigType.HYSTERIA.name, true)
+            ) {
+                muxEnabled = false
+            } else if (outbound.streamSettings?.network == NetworkType.XHTTP.type) {
+                muxEnabled = false
+            }
+
+            if (muxEnabled) {
+                outbound.mux?.enabled = true
+                outbound.mux?.concurrency = MmkvManager.decodeSettingsString(AppConfig.PREF_MUX_CONCURRENCY, "8").orEmpty().toInt()
+                outbound.mux?.xudpConcurrency = MmkvManager.decodeSettingsString(AppConfig.PREF_MUX_XUDP_CONCURRENCY, "16").orEmpty().toInt()
+                outbound.mux?.xudpProxyUDP443 = MmkvManager.decodeSettingsString(AppConfig.PREF_MUX_XUDP_QUIC, "reject")
+                if (protocol.equals(EConfigType.VLESS.name, true) && outbound.settings?.vnext?.first()?.users?.first()?.flow?.isNotEmpty() == true) {
+                    outbound.mux?.concurrency = -1
+                }
+            } else {
+                outbound.mux?.enabled = false
+                outbound.mux?.concurrency = -1
+            }
+
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "Failed to update outbound with global settings", e)
+            return false
+        }
+        return true
+    }
+
+    /** Creates an initial outbound template for a protocol type. */
+    fun createInitOutbound(configType: EConfigType): OutboundBean? {
+        return when (configType) {
+            EConfigType.VMESS,
+            EConfigType.VLESS ->
+                return OutboundBean(
+                    protocol = configType.name.lowercase(),
+                    settings = OutboundBean.OutSettingsBean(
+                        vnext = listOf(
+                            OutboundBean.OutSettingsBean.VnextBean(
+                                users = listOf(OutboundBean.OutSettingsBean.VnextBean.UsersBean())
+                            )
+                        )
+                    ),
+                    streamSettings = OutboundBean.StreamSettingsBean()
+                )
+
+            EConfigType.SHADOWSOCKS,
+            EConfigType.SOCKS,
+            EConfigType.HTTP,
+            EConfigType.TROJAN ->
+                return OutboundBean(
+                    protocol = configType.name.lowercase(),
+                    settings = OutboundBean.OutSettingsBean(
+                        servers = listOf(OutboundBean.OutSettingsBean.ServersBean())
+                    ),
+                    streamSettings = OutboundBean.StreamSettingsBean()
+                )
+
+            EConfigType.WIREGUARD ->
+                return OutboundBean(
+                    protocol = configType.name.lowercase(),
+                    settings = OutboundBean.OutSettingsBean(
+                        secretKey = "",
+                        peers = listOf(OutboundBean.OutSettingsBean.WireGuardBean())
+                    )
+                )
+
+            EConfigType.HYSTERIA,
+            EConfigType.HYSTERIA2 ->
+                return OutboundBean(
+                    protocol = EConfigType.HYSTERIA.name.lowercase(),
+                    settings = OutboundBean.OutSettingsBean(
+                        servers = null
+                    ),
+                    streamSettings = OutboundBean.StreamSettingsBean()
+                )
+
+            else -> null
+        }
+    }
+
+    // ── Per-protocol builders — implementations are identical to each *Fmt.toOutbound ──
+
+    private fun toOutboundVmess(profileItem: ProfileItem): OutboundBean? {
+        val outboundBean = createInitOutbound(EConfigType.VMESS)
+
+        outboundBean?.settings?.vnext?.first()?.let { vnext ->
+            vnext.address = getServerAddress(profileItem)
+            vnext.port = profileItem.serverPort.orEmpty().toInt()
+            vnext.users[0].id = profileItem.password.orEmpty()
+            vnext.users[0].security = profileItem.method
+        }
+
+        val sni = outboundBean?.streamSettings?.let {
+            populateTransportSettings(it, profileItem)
+        }
+
+        outboundBean?.streamSettings?.let {
+            populateTlsSettings(it, profileItem, sni)
+        }
+
+        return outboundBean
+    }
+
+    private fun toOutboundVless(profileItem: ProfileItem): OutboundBean? {
+        val outboundBean = createInitOutbound(EConfigType.VLESS)
+
+        outboundBean?.settings?.vnext?.first()?.let { vnext ->
+            vnext.address = getServerAddress(profileItem)
+            vnext.port = profileItem.serverPort.orEmpty().toInt()
+            vnext.users[0].id = profileItem.password.orEmpty()
+            vnext.users[0].encryption = profileItem.method
+            vnext.users[0].flow = profileItem.flow
+        }
+
+        val sni = outboundBean?.streamSettings?.let {
+            populateTransportSettings(it, profileItem)
+        }
+
+        outboundBean?.streamSettings?.let {
+            populateTlsSettings(it, profileItem, sni)
+        }
+
+        return outboundBean
+    }
+
+    private fun toOutboundShadowsocks(profileItem: ProfileItem): OutboundBean? {
+        val outboundBean = createInitOutbound(EConfigType.SHADOWSOCKS)
+
+        outboundBean?.settings?.servers?.first()?.let { server ->
+            server.address = getServerAddress(profileItem)
+            server.port = profileItem.serverPort.orEmpty().toInt()
+            server.password = profileItem.password
+            server.method = profileItem.method
+        }
+
+        val sni = outboundBean?.streamSettings?.let {
+            populateTransportSettings(it, profileItem)
+        }
+
+        outboundBean?.streamSettings?.let {
+            populateTlsSettings(it, profileItem, sni)
+        }
+
+        return outboundBean
+    }
+
+    private fun toOutboundTrojan(profileItem: ProfileItem): OutboundBean? {
+        val outboundBean = createInitOutbound(EConfigType.TROJAN)
+
+        outboundBean?.settings?.servers?.first()?.let { server ->
+            server.address = getServerAddress(profileItem)
+            server.port = profileItem.serverPort.orEmpty().toInt()
+            server.password = profileItem.password
+            server.flow = profileItem.flow
+        }
+
+        val sni = outboundBean?.streamSettings?.let {
+            populateTransportSettings(it, profileItem)
+        }
+
+        outboundBean?.streamSettings?.let {
+            populateTlsSettings(it, profileItem, sni)
+        }
+
+        return outboundBean
+    }
+
+    private fun toOutboundSocks(profileItem: ProfileItem): OutboundBean? {
+        val outboundBean = createInitOutbound(EConfigType.SOCKS)
+
+        outboundBean?.settings?.servers?.first()?.let { server ->
+            server.address = getServerAddress(profileItem)
+            server.port = profileItem.serverPort.orEmpty().toInt()
+            if (profileItem.username.isNotNullEmpty()) {
+                val socksUsersBean = OutboundBean.OutSettingsBean.ServersBean.SocksUsersBean()
+                socksUsersBean.user = profileItem.username.orEmpty()
+                socksUsersBean.pass = profileItem.password.orEmpty()
+                server.users = listOf(socksUsersBean)
+            }
+        }
+
+        return outboundBean
+    }
+
+    private fun toOutboundHttp(profileItem: ProfileItem): OutboundBean? {
+        val outboundBean = createInitOutbound(EConfigType.HTTP)
+
+        outboundBean?.settings?.servers?.first()?.let { server ->
+            server.address = getServerAddress(profileItem)
+            server.port = profileItem.serverPort.orEmpty().toInt()
+            if (profileItem.username.isNotNullEmpty()) {
+                val socksUsersBean = OutboundBean.OutSettingsBean.ServersBean.SocksUsersBean()
+                socksUsersBean.user = profileItem.username.orEmpty()
+                socksUsersBean.pass = profileItem.password.orEmpty()
+                server.users = listOf(socksUsersBean)
+            }
+        }
+
+        return outboundBean
+    }
+
+    private fun toOutboundWireguard(profileItem: ProfileItem): OutboundBean? {
+        val outboundBean = createInitOutbound(EConfigType.WIREGUARD)
+
+        val rawAddresses = profileItem.localAddress
+            ?.split(",")
+            ?.map { it.trim() }
+            ?.filter { it.isNotEmpty() }
+            ?.ifEmpty { null }
+            ?: listOf(AppConfig.WIREGUARD_LOCAL_ADDRESS_V4)
+
+        val addresses = if (MmkvManager.decodeSettingsBool(AppConfig.PREF_IPV6_ENABLED) == true) {
+            rawAddresses
+        } else {
+            val ipv4Addresses = rawAddresses.filter { !it.contains(":") }
+            ipv4Addresses.ifEmpty { listOf(AppConfig.WIREGUARD_LOCAL_ADDRESS_V4) }
+        }
+
+        outboundBean?.settings?.let { wireguard ->
+            wireguard.secretKey = profileItem.secretKey
+            wireguard.address = addresses
+            wireguard.peers?.firstOrNull()?.let { peer ->
+                peer.publicKey = profileItem.publicKey.orEmpty()
+                peer.preSharedKey = profileItem.preSharedKey?.nullIfBlank()
+                peer.endpoint = Utils.getIpv6Address(profileItem.server) + ":${profileItem.serverPort}"
+            }
+            wireguard.mtu = profileItem.mtu
+            wireguard.reserved = profileItem.reserved?.takeIf { it.isNotBlank() }?.split(",")?.filter { it.isNotBlank() }?.map { it.trim().toInt() }
+        }
+
+        return outboundBean
+    }
+
+    private fun toOutboundHysteria2(profileItem: ProfileItem): OutboundBean? {
+        val outboundBean = createInitOutbound(EConfigType.HYSTERIA2) ?: return null
+        profileItem.network = NetworkType.HYSTERIA.type
+        profileItem.alpn = "h3"
+
+        outboundBean.settings?.let { server ->
+            server.address = getServerAddress(profileItem)
+            server.port = profileItem.serverPort.orEmpty().toInt()
+            server.version = 2
+        }
+
+        val sni = outboundBean.streamSettings?.let {
+            populateTransportSettings(it, profileItem)
+        }
+
+        outboundBean.streamSettings?.let {
+            populateTlsSettings(it, profileItem, sni)
+        }
+
+        return outboundBean
+    }
+
+    private fun createTcpHttpRequest(
+        host: String?,
+        path: String?
+    ): OutboundBean.StreamSettingsBean.TcpSettingsBean.HeaderBean.RequestBean {
+        val requestString =
+            """{"version":"1.1","method":"GET","headers":{"User-Agent":["Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.122 Mobile Safari/537.36"],"Accept-Encoding":["gzip, deflate"],"Connection":["keep-alive"],"Pragma":"no-cache"}}"""
+        val request = JsonUtil.fromJson(
+            requestString,
+            OutboundBean.StreamSettingsBean.TcpSettingsBean.HeaderBean.RequestBean::class.java
+        ) ?: OutboundBean.StreamSettingsBean.TcpSettingsBean.HeaderBean.RequestBean()
+
+        val parsedHost = host.orEmpty().split(",").map { it.trim() }.filter { it.isNotEmpty() }
+        request.headers.Host = parsedHost.ifEmpty { null }
+        request.path = path.orEmpty().split(",").map { it.trim() }.filter { it.isNotEmpty() }.ifEmpty { listOf("/") }
+        return request
+    }
+
+    /**
+     * Configures transport settings for an outbound connection.
+     *
+     * Sets up protocol-specific transport options based on the profile settings.
+     *
+     * @param streamSettings The stream settings to configure
+     * @param profileItem The profile containing transport configuration
+     * @return The Server Name Indication (SNI) value to use, or null if not applicable
+     */
+    fun populateTransportSettings(streamSettings: OutboundBean.StreamSettingsBean, profileItem: ProfileItem): String? {
+        val transport = profileItem.network.orEmpty()
+        val headerType = profileItem.headerType
+        val host = profileItem.host
+        val path = profileItem.path
+        val seed = profileItem.seed
+//        val quicSecurity = profileItem.quicSecurity
+//        val key = profileItem.quicKey
+        val mode = profileItem.mode
+        val serviceName = profileItem.serviceName
+        val authority = profileItem.authority
+        val xhttpMode = profileItem.xhttpMode
+        val xhttpExtra = profileItem.xhttpExtra
+        val finalMask = profileItem.finalMask
+        var sni: String? = null
+        streamSettings.network = transport.ifEmpty { NetworkType.TCP.type }
+        when (streamSettings.network) {
+            NetworkType.TCP.type -> {
+                val tcpSetting = OutboundBean.StreamSettingsBean.TcpSettingsBean()
+                if (headerType == AppConfig.HEADER_TYPE_HTTP) {
+                    tcpSetting.header.type = AppConfig.HEADER_TYPE_HTTP
+                    val requestObj = createTcpHttpRequest(host, path)
+                    tcpSetting.header.request = requestObj
+                    sni = requestObj.headers.Host?.getOrNull(0)
+                } else {
+                    tcpSetting.header.type = "none"
+                    sni = host
+                }
+                streamSettings.tcpSettings = tcpSetting
+            }
+
+            NetworkType.KCP.type -> {
+                val kcpSetting = OutboundBean.StreamSettingsBean.KcpSettingsBean()
+                profileItem.kcpMtu?.let { kcpSetting.mtu = it }
+                profileItem.kcpTti?.let { kcpSetting.tti = it }
+                streamSettings.kcpSettings = kcpSetting
+                val udpMaskList =
+                    mutableListOf<OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean>()
+                if (!headerType.isNullOrEmpty() && headerType != "none") {
+                    val kcpHeaderType = when {
+                        headerType == "wechat-video" -> "wechat"
+                        else -> headerType
+                    }
+                    udpMaskList.add(
+                        OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean(
+                            type = "mkcp-legacy",
+                            settings =
+                                OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean.MaskSettingsBean(
+                                    header = kcpHeaderType,
+                                    value = if (headerType == "dns" && !host.isNullOrEmpty()) {
+                                        host
+                                    } else {
+                                        null
+                                    }
+                                )
+                        )
+                    )
+                }
+                if (seed.isNullOrEmpty()) {
+                    udpMaskList.add(
+                        OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean(
+                            type = "mkcp-legacy"
+                        )
+                    )
+                } else {
+                    udpMaskList.add(
+                        OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean(
+                            type = "mkcp-legacy",
+                            settings = OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean.MaskSettingsBean(
+                                value = seed
+                            )
+                        )
+                    )
+                }
+                streamSettings.finalmask = OutboundBean.StreamSettingsBean.FinalMaskBean(
+                    udp = udpMaskList.toList()
+                )
+            }
+
+            NetworkType.WS.type -> {
+                val wssetting = OutboundBean.StreamSettingsBean.WsSettingsBean()
+                wssetting.host = host.orEmpty()
+                sni = host
+                wssetting.path = path ?: "/"
+                streamSettings.wsSettings = wssetting
+            }
+
+            NetworkType.HTTP_UPGRADE.type -> {
+                val httpupgradeSetting = OutboundBean.StreamSettingsBean.HttpupgradeSettingsBean()
+                httpupgradeSetting.host = host.orEmpty()
+                sni = host
+                httpupgradeSetting.path = path ?: "/"
+                streamSettings.httpupgradeSettings = httpupgradeSetting
+            }
+
+            NetworkType.XHTTP.type -> {
+                val xhttpSetting = OutboundBean.StreamSettingsBean.XhttpSettingsBean()
+                xhttpSetting.host = host.orEmpty()
+                sni = host
+                xhttpSetting.path = path ?: "/"
+                xhttpSetting.mode = xhttpMode
+                xhttpSetting.extra = JsonUtil.parseString(xhttpExtra)
+                streamSettings.xhttpSettings = xhttpSetting
+            }
+
+            NetworkType.H2.type, NetworkType.HTTP.type -> {
+                streamSettings.network = NetworkType.H2.type
+                val h2Setting = OutboundBean.StreamSettingsBean.HttpSettingsBean()
+                h2Setting.host = host.orEmpty().split(",").map { it.trim() }.filter { it.isNotEmpty() }
+                sni = h2Setting.host.getOrNull(0)
+                h2Setting.path = path ?: "/"
+                streamSettings.httpSettings = h2Setting
+            }
+
+//                    "quic" -> {
+//                        val quicsetting = QuicSettingBean()
+//                        quicsetting.security = quicSecurity ?: "none"
+//                        quicsetting.key = key.orEmpty()
+//                        quicsetting.header.type = headerType ?: "none"
+//                        quicSettings = quicsetting
+//                    }
+
+            NetworkType.GRPC.type -> {
+                val grpcSetting = OutboundBean.StreamSettingsBean.GrpcSettingsBean()
+                grpcSetting.multiMode = mode == "multi"
+                grpcSetting.serviceName = serviceName.orEmpty()
+                grpcSetting.authority = authority.orEmpty()
+                grpcSetting.idle_timeout = 60
+                grpcSetting.health_check_timeout = 20
+                sni = authority
+                streamSettings.grpcSettings = grpcSetting
+            }
+
+            NetworkType.HYSTERIA.type -> {
+                val hysteriaSetting = OutboundBean.StreamSettingsBean.HysteriaSettingsBean(
+                    version = 2,
+                    auth = profileItem.password.orEmpty(),
+                )
+                val quicParams = OutboundBean.StreamSettingsBean.FinalMaskBean.QuicParamsBean(
+                    brutalUp = profileItem.bandwidthUp?.nullIfBlank(),
+                    brutalDown = profileItem.bandwidthDown?.nullIfBlank(),
+                )
+                quicParams.congestion = if (quicParams.brutalUp != null || quicParams.brutalDown != null) "brutal" else null
+                if (profileItem.portHopping.isNotNullEmpty()) {
+                    val rawInterval = profileItem.portHoppingInterval?.trim().nullIfBlank()
+                    val interval = if (rawInterval == null) {
+                        "30"
+                    } else {
+                        val singleValue = rawInterval.toIntOrNull()
+                        if (singleValue != null) {
+                            if (singleValue < 5) {
+                                "30"
+                            } else {
+                                rawInterval
+                            }
+                        } else {
+                            val parts = rawInterval.split('-')
+                            if (parts.size == 2) {
+                                val start = parts[0].trim().toIntOrNull()
+                                val end = parts[1].trim().toIntOrNull()
+                                if (start != null && end != null) {
+                                    val minStart = maxOf(5, start)
+                                    val minEnd = maxOf(minStart, end)
+                                    "$minStart-$minEnd"
+                                } else {
+                                    "30"
+                                }
+                            } else {
+                                "30"
+                            }
+                        }
+                    }
+                    quicParams.udpHop = OutboundBean.StreamSettingsBean.FinalMaskBean.QuicParamsBean.UdpHopBean(
+                        ports = profileItem.portHopping,
+                        interval = interval
+                    )
+                }
+                val finalmask = OutboundBean.StreamSettingsBean.FinalMaskBean(
+                    quicParams = quicParams
+                )
+                if (profileItem.obfsPassword.isNotNullEmpty()) {
+                    finalmask.udp = listOf(
+                        OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean(
+                            type = "salamander",
+                            settings = OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean.MaskSettingsBean(
+                                password = profileItem.obfsPassword.orEmpty()
+                            )
+                        )
+                    )
+                }
+                streamSettings.hysteriaSettings = hysteriaSetting
+                streamSettings.finalmask = finalmask
+            }
+        }
+        finalMask?.let {
+            val parsedFinalMask = JsonUtil.parseString(finalMask)
+            if (parsedFinalMask != null) {
+                streamSettings.finalmask = parsedFinalMask
+            } else {
+                LogUtil.w("V2rayConfigManager", "Invalid finalMask JSON, keeping previously generated finalmask")
+            }
+        }
+        return sni
+    }
+
+    /**
+     * Configures TLS or REALITY security settings for an outbound connection.
+     *
+     * Sets up security-related parameters like certificates, fingerprints, and SNI.
+     *
+     * @param streamSettings The stream settings to configure
+     * @param profileItem The profile containing security configuration
+     * @param sniExt An external SNI value to use if the profile doesn't specify one
+     */
+    fun populateTlsSettings(streamSettings: OutboundBean.StreamSettingsBean, profileItem: ProfileItem, sniExt: String?) {
+        val streamSecurity = profileItem.security.orEmpty()
+        val allowInsecure = profileItem.insecure == true && profileItem.pinnedCA256.isNullOrEmpty()
+        val sni = if (profileItem.sni.isNullOrEmpty()) {
+            when {
+                sniExt.isNotNullEmpty() && Utils.isDomainName(sniExt) -> sniExt
+                profileItem.server.isNotNullEmpty() && Utils.isDomainName(profileItem.server) -> profileItem.server
+                else -> sniExt
+            }
+        } else {
+            profileItem.sni
+        }
+
+        streamSettings.security = streamSecurity.nullIfBlank()
+        if (streamSettings.security == null) return
+        val tlsSetting = OutboundBean.StreamSettingsBean.TlsSettingsBean(
+            allowInsecure = allowInsecure,
+            serverName = sni.nullIfBlank(),
+            fingerprint = profileItem.fingerPrint.nullIfBlank(),
+            alpn = profileItem.alpn?.split(",")?.map { it.trim() }?.filter { it.isNotEmpty() }.takeIf { !it.isNullOrEmpty() },
+            echConfigList = profileItem.echConfigList.nullIfBlank(),
+            verifyPeerCertByName = profileItem.verifyPeerCertByName.nullIfBlank(),
+            pinnedPeerCertSha256 = profileItem.pinnedCA256.nullIfBlank(),
+            publicKey = profileItem.publicKey.nullIfBlank(),
+            shortId = profileItem.shortId.nullIfBlank(),
+            spiderX = profileItem.spiderX.nullIfBlank(),
+            mldsa65Verify = profileItem.mldsa65Verify.nullIfBlank(),
+        )
+        if (streamSettings.security == AppConfig.TLS) {
+            streamSettings.tlsSettings = tlsSetting
+            streamSettings.realitySettings = null
+        } else if (streamSettings.security == AppConfig.REALITY) {
+            streamSettings.tlsSettings = null
+            streamSettings.realitySettings = tlsSetting
+        }
+
+        if (profileItem.finalMask.isNullOrEmpty()) {
+            updateOutboundFragment(streamSettings)
+        }
+    }
+
+    /**
+     * Updates the outbound with fragment settings for traffic optimization.
+     *
+     * Configures packet fragmentation for TLS and REALITY protocols if enabled.
+     *
+     * @param streamSettings The streamSettings object to be modified
+     * @return true if fragment configuration was successful, false otherwise
+     */
+    private fun updateOutboundFragment(streamSettings: OutboundBean.StreamSettingsBean): Boolean {
+        try {
+            if (MmkvManager.decodeSettingsBool(AppConfig.PREF_FRAGMENT_ENABLED, false) == false) {
+                return true
+            }
+            if (streamSettings.security != AppConfig.TLS
+                && streamSettings.security != AppConfig.REALITY
+            ) {
+                return true
+            }
+            if (streamSettings.sockopt?.dialerProxy.isNotNullEmpty()) {
+                return true
+            }
+
+            var packets =
+                MmkvManager.decodeSettingsString(AppConfig.PREF_FRAGMENT_PACKETS) ?: "tlshello"
+            if (streamSettings.security == AppConfig.REALITY
+                && packets == "tlshello"
+            ) {
+                packets = "1-3"
+            }
+
+            val fragmentMask = OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean(
+                type = "fragment",
+                settings = OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean.MaskSettingsBean(
+                    packets = packets,
+                    length = MmkvManager.decodeSettingsString(AppConfig.PREF_FRAGMENT_LENGTH)
+                        ?: "50-100",
+                    delay = MmkvManager.decodeSettingsString(AppConfig.PREF_FRAGMENT_INTERVAL)
+                        ?: "10-20",
+                    maxSplit = MmkvManager.decodeSettingsString(AppConfig.PREF_FRAGMENT_MAXSPLIT)
+                        ?: "10"
+                )
+            )
+            val noiseMask = OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean(
+                type = "noise",
+                settings = OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean.MaskSettingsBean(
+                    noise = listOf(
+                        OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean.MaskSettingsBean.NoiseMaskBean(
+                            rand = "10-20",
+                            delay = "10-16",
+                        )
+                    )
+                )
+            )
+
+            val finalMaskObj = streamSettings.finalmask?.let { existingFinalMask ->
+                JsonUtil.parseString(JsonUtil.toJson(existingFinalMask))
+            } ?: JsonObject()
+
+            // finalmask.tcp / finalmask.udp are arrays; prepend mask at index 0.
+            fun prependMask(scope: String, mask: OutboundBean.StreamSettingsBean.FinalMaskBean.MaskBean) {
+                val current = finalMaskObj.get(scope)
+                if (current != null && current.isJsonArray && current.asJsonArray.size() > 0) {
+                    return
+                }
+
+                val newArray = JsonArray()
+                newArray.add(JsonUtil.parseString(JsonUtil.toJson(mask)))
+
+                if (current != null && current.isJsonArray) {
+                    current.asJsonArray.forEach { newArray.add(it) }
+                }
+                finalMaskObj.add(scope, newArray)
+            }
+
+            prependMask("tcp", fragmentMask)
+            prependMask("udp", noiseMask)
+            streamSettings.finalmask = finalMaskObj
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "Failed to update outbound fragment", e)
+            return false
+        }
+        return true
+    }
+
+    private fun getServerAddress(profileItem: ProfileItem): String {
+        if (Utils.isPureIpAddress(profileItem.server.orEmpty())) {
+            return profileItem.server.orEmpty()
+        }
+
+        val domain = HttpUtil.toIdnDomain(profileItem.server.orEmpty())
+        if (MmkvManager.decodeSettingsString(AppConfig.PREF_OUTBOUND_DOMAIN_RESOLVE_METHOD, "1") != "2") {
+            return domain
+        }
+        //Resolve and replace domain
+        val resolvedIps = HttpUtil.resolveHostToIP(domain, MmkvManager.decodeSettingsBool(AppConfig.PREF_PREFER_IPV6))
+        if (resolvedIps.isNullOrEmpty()) {
+            return domain
+        }
+        return resolvedIps.first()
+    }
+}
@@ -1,4 +1,4 @@
-package com.v2ray.ang.handler
+package com.v2ray.ang.core

 import android.app.Service
 import android.content.BroadcastReceiver
@@ -13,11 +13,22 @@ import androidx.core.content.ContextCompat
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.R
 import com.v2ray.ang.contracts.ServiceControl
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.enums.EConfigType
+import com.v2ray.ang.dto.OutboundTrafficStat
+import com.v2ray.ang.dto.entities.ProfileItem
+import com.v2ray.ang.extension.isComplexType
 import com.v2ray.ang.extension.toast
-import com.v2ray.ang.service.V2RayProxyOnlyService
-import com.v2ray.ang.service.V2RayVpnService
+import com.v2ray.ang.extension.toastError
+import com.v2ray.ang.handler.MmkvManager
+import com.v2ray.ang.handler.NotificationManager
+import com.v2ray.ang.handler.SettingsManager
+import com.v2ray.ang.handler.SpeedtestManager
+import com.v2ray.ang.root.RootManager
+import com.v2ray.ang.service.CoreProxyOnlyService
+import com.v2ray.ang.service.CoreRootService
+import com.v2ray.ang.service.CoreVpnService
+import com.v2ray.ang.service.DialerNativeService
+import com.v2ray.ang.service.DialerWebviewService
+import com.v2ray.ang.service.IDialerService
 import com.v2ray.ang.util.LogUtil
 import com.v2ray.ang.util.MessageUtil
 import com.v2ray.ang.util.Utils
@@ -30,18 +41,19 @@ import libv2ray.ProcessFinder
 import java.lang.ref.SoftReference
 import java.net.InetSocketAddress

-object V2RayServiceManager {
+object CoreServiceManager {

-    private val coreController: CoreController = V2RayNativeManager.newCoreController(CoreCallback())
+    private val coreController: CoreController = CoreNativeManager.newCoreController(CoreCallback())
    private val mMsgReceive = ReceiveMessageHandler()
    private var currentConfig: ProfileItem? = null
    private var processFinder: XrayProcessFinder? = null
+    private var browserDialer: IDialerService? = null

    var serviceControl: SoftReference<ServiceControl>? = null
        set(value) {
            field = value
            val service = value?.get()?.getService()
-            V2RayNativeManager.initCoreEnv(service)
+            CoreNativeManager.initCoreEnv(service)
            if (service != null && processFinder == null && Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
                processFinder = XrayProcessFinder(service)
                coreController.registerProcessFinder(processFinder)
@@ -58,7 +70,13 @@ object V2RayServiceManager {
            context.toast(R.string.app_tile_first_use)
            return false
        }
-        startContextService(context)
+        try {
+            startContextService(context)
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "StartCore-Manager: ${e.message}", e)
+            context.toast(e.message ?: e.javaClass.simpleName)
+            return false
+        }
        return true
    }

@@ -74,7 +92,12 @@ object V2RayServiceManager {
            MmkvManager.setSelectServer(guid)
        }

-        startContextService(context)
+        try {
+            startContextService(context)
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "StartCore-Manager: ${e.message}", e)
+            context.toast(e.message ?: e.javaClass.simpleName)
+        }
    }

    /**
@@ -102,7 +125,11 @@ object V2RayServiceManager {
     * Starts the context service for V2Ray.
     * Chooses between VPN service or Proxy-only service based on user settings.
     * @param context The context from which the service is started.
+     * @throws IllegalStateException if the core is already running, no server is selected,
+     *   server config cannot be decoded, or server configuration is invalid.
+     * @throws Exception if the foreground service fails to start.
     */
+    @Throws(Exception::class)
    private fun startContextService(context: Context) {
        if (coreController.isRunning) {
            LogUtil.w(AppConfig.TAG, "StartCore-Manager: Core already running")
@@ -110,30 +137,35 @@ object V2RayServiceManager {
        }

        val guid = MmkvManager.getSelectServer()
-        if (guid == null) {
-            LogUtil.e(AppConfig.TAG, "StartCore-Manager: No server selected")
-            return
-        }
+            ?: run {
+                LogUtil.e(AppConfig.TAG, "StartCore-Manager: No server selected")
+                error(context.getString(R.string.app_tile_first_use))
+            }

        val config = MmkvManager.decodeServerConfig(guid)
-        if (config == null) {
-            LogUtil.e(AppConfig.TAG, "StartCore-Manager: Failed to decode server config")
-            return
-        }
+            ?: run {
+                LogUtil.e(AppConfig.TAG, "StartCore-Manager: Failed to decode server config")
+                error(context.getString(R.string.toast_config_file_invalid))
+            }

-        if (config.configType != EConfigType.CUSTOM
-            && config.configType != EConfigType.POLICYGROUP
+        if (!config.configType.isComplexType()
            && !Utils.isValidUrl(config.server)
            && !Utils.isPureIpAddress(config.server.orEmpty())
        ) {
            LogUtil.e(AppConfig.TAG, "StartCore-Manager: Invalid server configuration")
-            return
+            error(context.getString(R.string.toast_config_file_invalid))
        }
+
        // refresh socks port when enabled dynamic socks port
        SettingsManager.refreshRuntimeSocksPort()

 //        val result = V2rayConfigUtil.getV2rayConfig(context, guid)
-//        if (!result.status) return
+//        if (!result.status) error(result.errorMessage.ifBlank { "Failed to get V2Ray config" })
+
+        if (config.insecure == true) {
+            context.toastError(R.string.toast_allow_insecure_deprecated)
+            context.toastError(R.string.toast_allow_insecure_deprecated)
+        }

        if (MmkvManager.decodeSettingsBool(AppConfig.PREF_PROXY_SHARING)) {
            context.toast(R.string.toast_warning_pref_proxysharing_short)
@@ -141,19 +173,36 @@ object V2RayServiceManager {
            context.toast(R.string.toast_services_start)
        }

-        val isVpnMode = SettingsManager.isVpnMode()
-        val intent = if (isVpnMode) {
+        val isRootMode = SettingsManager.isRootMode()
+        if (isRootMode && !RootManager.isRootAvailable()) {
+            LogUtil.e(AppConfig.TAG, "StartCore-Manager: root mode requires root but none available")
+            error(context.getString(R.string.toast_root_required))
+        }
+
+        val intent = if (isRootMode) {
+            LogUtil.i(AppConfig.TAG, "StartCore-Manager: Starting Root service")
+            Intent(context.applicationContext, CoreRootService::class.java)
+        } else if (SettingsManager.isVpnMode()) {
            LogUtil.i(AppConfig.TAG, "StartCore-Manager: Starting VPN service")
-            Intent(context.applicationContext, V2RayVpnService::class.java)
+            Intent(context.applicationContext, CoreVpnService::class.java)
        } else {
            LogUtil.i(AppConfig.TAG, "StartCore-Manager: Starting Proxy service")
-            Intent(context.applicationContext, V2RayProxyOnlyService::class.java)
+            Intent(context.applicationContext, CoreProxyOnlyService::class.java)
        }

        try {
            ContextCompat.startForegroundService(context, intent)
-        } catch (e: Exception) {
-            LogUtil.e(AppConfig.TAG, "StartCore-Manager: Failed to start service", e)
+        } catch (e: SecurityException) {
+            LogUtil.e(AppConfig.TAG, "StartCore-Manager: Missing permission to start foreground service", e)
+            throw IllegalStateException(e.message ?: e.javaClass.simpleName, e)
+        } catch (e: RuntimeException) {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S &&
+                e.javaClass.name == "android.app.ForegroundServiceStartNotAllowedException"
+            ) {
+                LogUtil.e(AppConfig.TAG, "StartCore-Manager: Foreground service start not allowed", e)
+                throw IllegalStateException(e.message ?: e.javaClass.simpleName, e)
+            }
+            throw e
        }
    }

@@ -174,67 +223,70 @@ object V2RayServiceManager {
            return false
        }

-        val guid = MmkvManager.getSelectServer()
-        if (guid == null) {
-            LogUtil.e(AppConfig.TAG, "StartCore-Manager: No server selected")
+        try {
+            doStartCoreLoop(service, vpnInterface)
+            return true
+        } catch (e: Exception) {
+            val message = e.message?.takeUnless { it.isBlank() } ?: e.javaClass.simpleName
+            LogUtil.e(AppConfig.TAG, "StartCore-Manager: $message", e)
+            MessageUtil.sendMsg2UI(service, AppConfig.MSG_STATE_START_FAILURE, message)
+            NotificationManager.cancelNotification()
            return false
        }
+    }

-        val config = MmkvManager.decodeServerConfig(guid)
-        if (config == null) {
-            LogUtil.e(AppConfig.TAG, "StartCore-Manager: Failed to decode server config")
-            return false
-        }
+    @Throws(Exception::class)
+    private fun doStartCoreLoop(service: Service, vpnInterface: ParcelFileDescriptor?) {
+        val guid = MmkvManager.getSelectServer() ?: error("No server selected")
+        val config = MmkvManager.decodeServerConfig(guid) ?: error("Failed to decode server config")

        LogUtil.i(AppConfig.TAG, "StartCore-Manager: Starting core loop for ${config.remarks}")
-        val result = V2rayConfigManager.getV2rayConfig(service, guid)
+        val result = CoreConfigManager.getV2rayConfig(service, guid)
        LogUtil.d(AppConfig.TAG, result.content)
        if (!result.status) {
-            LogUtil.e(AppConfig.TAG, "StartCore-Manager: Failed to get V2Ray config")
-            return false
+            error(result.errorMessage.ifBlank { "Failed to get V2Ray config" })
        }

-        try {
-            val mFilter = IntentFilter(AppConfig.BROADCAST_ACTION_SERVICE)
-            mFilter.addAction(Intent.ACTION_SCREEN_ON)
-            mFilter.addAction(Intent.ACTION_SCREEN_OFF)
-            mFilter.addAction(Intent.ACTION_USER_PRESENT)
-            ContextCompat.registerReceiver(service, mMsgReceive, mFilter, Utils.receiverFlags())
-        } catch (e: Exception) {
-            LogUtil.e(AppConfig.TAG, "StartCore-Manager: Failed to register receiver", e)
-            return false
-        }
+        val mFilter = IntentFilter(AppConfig.BROADCAST_ACTION_SERVICE)
+        mFilter.addAction(Intent.ACTION_SCREEN_ON)
+        mFilter.addAction(Intent.ACTION_SCREEN_OFF)
+        mFilter.addAction(Intent.ACTION_USER_PRESENT)
+        ContextCompat.registerReceiver(service, mMsgReceive, mFilter, Utils.receiverFlags())

        currentConfig = config
        var tunFd = vpnInterface?.fd ?: 0
+        val dialerAddr = if (currentConfig?.browserDialerMode.isNullOrEmpty()) {
+            ""
+        } else {
+            "127.0.0.1:${Utils.findRandomFreePort()}"
+        }
        if (SettingsManager.isUsingHevTun()) {
            tunFd = 0
        }

-        try {
-            NotificationManager.showNotification(currentConfig)
-            coreController.startLoop(result.content, tunFd)
-        } catch (e: Exception) {
-            LogUtil.e(AppConfig.TAG, "StartCore-Manager: Failed to start core loop", e)
-            return false
+        NotificationManager.showNotification(currentConfig)
+        CoreNativeManager.reconcileBrowserDialer(dialerAddr)
+        coreController.startLoop(result.content, tunFd)
+
+        if (!coreController.isRunning) {
+            error("Core failed to start")
        }

-        if (coreController.isRunning == false) {
-            LogUtil.e(AppConfig.TAG, "StartCore-Manager: Core failed to start")
-            MessageUtil.sendMsg2UI(service, AppConfig.MSG_STATE_START_FAILURE, "")
-            NotificationManager.cancelNotification()
-            return false
+        if (browserDialer != null) {
+            browserDialer!!.stop()
+            browserDialer = null
+        }
+        if (config.browserDialerMode == "OkHttp") {
+            browserDialer = DialerNativeService()
+            browserDialer!!.start(service, dialerAddr)
+        } else if (config.browserDialerMode == "WebView") {
+            browserDialer = DialerWebviewService()
+            browserDialer!!.start(service, dialerAddr)
        }

-        try {
-            MessageUtil.sendMsg2UI(service, AppConfig.MSG_STATE_START_SUCCESS, "")
-            NotificationManager.startSpeedNotification(currentConfig)
-            LogUtil.i(AppConfig.TAG, "StartCore-Manager: Core started successfully")
-        } catch (e: Exception) {
-            LogUtil.e(AppConfig.TAG, "StartCore-Manager: Failed to complete startup", e)
-            return false
-        }
-        return true
+        MessageUtil.sendMsg2UI(service, AppConfig.MSG_STATE_START_SUCCESS, "")
+        NotificationManager.startSpeedNotification()
+        LogUtil.i(AppConfig.TAG, "StartCore-Manager: Core started successfully")
    }

    /**
@@ -255,6 +307,13 @@ object V2RayServiceManager {
            }
        }

+        // Close existing browser dialer
+        CoreNativeManager.reconcileBrowserDialer("")
+        if (browserDialer != null) {
+            browserDialer!!.stop()
+            browserDialer = null
+        }
+
        MessageUtil.sendMsg2UI(service, AppConfig.MSG_STATE_STOP_SUCCESS, "")
        NotificationManager.cancelNotification()

@@ -268,13 +327,32 @@ object V2RayServiceManager {
    }

    /**
-     * Queries the statistics for a given tag and link.
-     * @param tag The tag to query.
-     * @param link The link to query.
-     * @return The statistics value.
+     * Queries and resets all outbound traffic counters in one core call.
+     * Go side format: tag,direction,value;tag,direction,value;
     */
-    fun queryStats(tag: String, link: String): Long {
-        return coreController.queryStats(tag, link)
+    fun queryAllOutboundTrafficStats(): List<OutboundTrafficStat> {
+        val payload = coreController.queryAllOutboundTrafficStats()
+
+        val result = ArrayList<OutboundTrafficStat>()
+
+        payload.split(';').forEach { entry ->
+            if (entry.isBlank()) return@forEach
+
+            val parts = entry.split(',', limit = 3)
+            if (parts.size != 3) return@forEach
+
+            val value = parts[2].toLongOrNull() ?: return@forEach
+
+            result.add(
+                OutboundTrafficStat(
+                    tag = parts[0],
+                    direction = parts[1],
+                    value = value,
+                )
+            )
+        }
+//        LogUtil.d(AppConfig.TAG, "Queried outbound traffic stats: $result")
+        return result
    }

    /**
@@ -401,7 +479,7 @@ object V2RayServiceManager {
                //LogUtil.d(AppConfig.TAG, "ProcessFinder: Find $network connection from $srcIP:$srcPort to $destIP:$destPort, uid=$uid,${PackageUidResolver.uidToPackageName(uid.toString())}")

                uid
-            } catch (e: Exception) {
+            } catch (_: Exception) {
                -1L
            }
        }
@@ -457,12 +535,12 @@ object V2RayServiceManager {
            when (intent?.action) {
                Intent.ACTION_SCREEN_OFF -> {
                    LogUtil.i(AppConfig.TAG, "StartCore-Manager: Screen off")
-                    NotificationManager.stopSpeedNotification(currentConfig)
+                    NotificationManager.stopSpeedNotification()
                }

                Intent.ACTION_SCREEN_ON -> {
                    LogUtil.i(AppConfig.TAG, "StartCore-Manager: Screen on")
-                    NotificationManager.startSpeedNotification(currentConfig)
+                    NotificationManager.startSpeedNotification()
                }
            }
        }
@@ -0,0 +1,13 @@
+package com.v2ray.ang.dto
+
+data class CertSha256Request(
+    val address: String = "",
+    val port: Int = 443,
+    val serverName: String? = null,
+    val timeoutMs: Long = 5000L,
+)
+
+data class CertSha256Result(
+    val sha256: String = "",
+    val error: String = "",
+)
@@ -4,5 +4,6 @@ data class ConfigResult(
    var status: Boolean,
    var guid: String? = null,
    var content: String = "",
+    var errorMessage: String = "",
 )

@@ -0,0 +1,25 @@
+package com.v2ray.ang.dto
+
+import android.content.Context
+import com.v2ray.ang.dto.entities.ProfileItem
+import com.v2ray.ang.enums.CoreResolvedType
+
+data class CoreConfigContext(
+    val context: Context,
+    val guid: String,
+    val isCustom: Boolean = false,
+    val resolvedOutbounds: List<ResolvedOutbound> = emptyList(),
+    val routingDomainRules: List<RoutingDomainRule> = emptyList(),
+) {
+    data class ResolvedOutbound(
+        val tag: String,
+        val profile: ProfileItem,
+        val resolvedProfiles: List<ProfileItem>,
+        val resolvedType: CoreResolvedType,
+    )
+
+    data class RoutingDomainRule(
+        val domain: List<String>,
+        val outboundTag: String,
+    )
+}
@@ -0,0 +1,7 @@
+package com.v2ray.ang.dto
+
+data class OutboundTrafficStat(
+    val tag: String,
+    val direction: String,
+    val value: Long,
+)
@@ -0,0 +1,14 @@
+package com.v2ray.ang.dto
+
+sealed class RealPingEvent {
+
+    /** Periodic progress update while the batch is still running. */
+    data class Progress(val text: String) : RealPingEvent()
+
+    /** A single server result is available. */
+    data class Result(val guid: String, val delayMillis: Long) : RealPingEvent()
+
+    /** The entire batch has finished or been cancelled. */
+    data class Finish(val status: String) : RealPingEvent()
+}
+
@@ -0,0 +1,10 @@
+package com.v2ray.ang.dto
+
+data class UrlContentRequest(
+    val url: String?,
+    val timeout: Int = 15000,
+    val httpPort: Int = 0,
+    val proxyUsername: String? = null,
+    val proxyPassword: String? = null,
+    val userAgent: String? = null
+)
@@ -68,7 +68,6 @@ data class V2rayConfig(
        var protocol: String,
        var settings: OutSettingsBean? = null,
        var streamSettings: StreamSettingsBean? = null,
-        val proxySettings: Any? = null,
        val sendThrough: String? = null,
        var mux: MuxBean? = MuxBean(false)
    ) {
@@ -82,7 +81,6 @@ data class V2rayConfig(
            var address: Any? = null,
            var port: Int? = null,
            /*Freedom*/
-            var domainStrategy: String? = null,
            val redirect: String? = null,
            val userLevel: Int? = null,
            /*Loopback*/
@@ -181,7 +179,7 @@ data class V2rayConfig(
                            @SerializedName("Accept-Encoding")
                            val acceptEncoding: List<String>? = null,
                            val Connection: List<String>? = null,
-                            val Pragma: String? = null
+                            val Pragma: Any? = null
                        )
                    }
                }
@@ -199,13 +197,12 @@ data class V2rayConfig(

            data class WsSettingsBean(
                var path: String? = null,
-                var headers: HeadersBean = HeadersBean(),
+                var host: String? = null,
+                var headers: Map<String, String>? = null,
                val maxEarlyData: Int? = null,
                val useBrowserForwarding: Boolean? = null,
                val acceptProxyProtocol: Boolean? = null
-            ) {
-                data class HeadersBean(var Host: String = "")
-            }
+            )

            data class HttpupgradeSettingsBean(
                var path: String? = null,
@@ -256,9 +253,9 @@ data class V2rayConfig(
                val disableSystemRoot: Boolean? = null,
                val enableSessionResumption: Boolean? = null,
                var echConfigList: String? = null,
+                var verifyPeerCertByName: String? = null,
                var pinnedPeerCertSha256: String? = null,
                // REALITY settings
-                val show: Boolean = false,
                var publicKey: String? = null,
                var shortId: String? = null,
                var spiderX: String? = null,
@@ -298,12 +295,13 @@ data class V2rayConfig(
                ) {
                    data class MaskSettingsBean(
                        val password: String? = null,
-                        val domain: String? = null,
+                        val header: String? = null,
+                        val value: String? = null,
                        // fragment
                        val packets: String? = null,
                        val length: String? = null,
                        val delay: String? = null,
-                        // val maxSplit: String? = null,
+                        val maxSplit: String? = null,
                        // noise
                        val reset: Int? = null,
                        val noise: List<NoiseMaskBean>? = null
@@ -344,19 +342,19 @@ data class V2rayConfig(
            if (protocol.equals(EConfigType.VMESS.name, true)
                || protocol.equals(EConfigType.VLESS.name, true)
            ) {
-                return settings?.vnext?.first()?.address
+                return settings?.vnext?.firstOrNull()?.address ?: settings?.address as? String
            } else if (protocol.equals(EConfigType.SHADOWSOCKS.name, true)
                || protocol.equals(EConfigType.SOCKS.name, true)
                || protocol.equals(EConfigType.HTTP.name, true)
                || protocol.equals(EConfigType.TROJAN.name, true)
            ) {
-                return settings?.servers?.first()?.address
+                return settings?.servers?.firstOrNull()?.address
            } else if (protocol.equals(EConfigType.WIREGUARD.name, true)) {
-                return settings?.peers?.first()?.endpoint?.substringBeforeLast(":")
+                return settings?.peers?.firstOrNull()?.endpoint?.substringBeforeLast(":")
            } else if (protocol.equals(EConfigType.HYSTERIA2.name, true)
                || protocol.equals(EConfigType.HYSTERIA.name, true)
            ) {
-                return settings?.address as String?
+                return settings?.address as? String
            }
            return null
        }
@@ -365,15 +363,15 @@ data class V2rayConfig(
            if (protocol.equals(EConfigType.VMESS.name, true)
                || protocol.equals(EConfigType.VLESS.name, true)
            ) {
-                return settings?.vnext?.first()?.port
+                return settings?.vnext?.firstOrNull()?.port ?: settings?.port
            } else if (protocol.equals(EConfigType.SHADOWSOCKS.name, true)
                || protocol.equals(EConfigType.SOCKS.name, true)
                || protocol.equals(EConfigType.HTTP.name, true)
                || protocol.equals(EConfigType.TROJAN.name, true)
            ) {
-                return settings?.servers?.first()?.port
+                return settings?.servers?.firstOrNull()?.port
            } else if (protocol.equals(EConfigType.WIREGUARD.name, true)) {
-                return settings?.peers?.first()?.endpoint?.substringAfterLast(":")?.toInt()
+                return settings?.peers?.firstOrNull()?.endpoint?.substringAfterLast(":")?.toInt()
            } else if (protocol.equals(EConfigType.HYSTERIA2.name, true)
                || protocol.equals(EConfigType.HYSTERIA.name, true)
            ) {
@@ -401,6 +399,7 @@ data class V2rayConfig(
        val clientIp: String? = null,
        val disableCache: Boolean? = null,
        val queryStrategy: String? = null,
+        val enableParallelQuery: Boolean? = null,
        val tag: String? = null
    ) {
        data class ServersBean(
@@ -16,5 +16,7 @@ data class VmessQRCode(
    var sni: String = "",
    var alpn: String = "",
    var fp: String = "",
-    var insecure: String = ""
+    var insecure: String = "",
+    var vcn: String = "",
+    var pcs: String = ""
 )
@@ -1,4 +1,4 @@
-package com.v2ray.ang.dto
+package com.v2ray.ang.dto.entities

 data class AssetUrlCache(
    val guid: String,
@@ -1,4 +1,4 @@
-package com.v2ray.ang.dto
+package com.v2ray.ang.dto.entities

 data class AssetUrlItem(
    var remarks: String = "",
@@ -1,10 +1,6 @@
-package com.v2ray.ang.dto
+package com.v2ray.ang.dto.entities

-import com.v2ray.ang.AppConfig.LOOPBACK
-import com.v2ray.ang.AppConfig.PORT_SOCKS
-import com.v2ray.ang.AppConfig.TAG_BLOCKED
-import com.v2ray.ang.AppConfig.TAG_DIRECT
-import com.v2ray.ang.AppConfig.TAG_PROXY
+import com.v2ray.ang.AppConfig
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.util.Utils

@@ -46,6 +42,7 @@ data class ProfileItem(
    var fingerPrint: String? = null,
    var insecure: Boolean? = null,
    var echConfigList: String? = null,
+    var verifyPeerCertByName: String? = null,
    var pinnedCA256: String? = null,

    var publicKey: String? = null,
@@ -69,6 +66,9 @@ data class ProfileItem(
    var policyGroupType: String? = null,
    var policyGroupSubscriptionId: String? = null,
    var policyGroupFilter: String? = null,
+    var proxyChainProfiles: String? = null,
+
+    var browserDialerMode: String? = null,

    ) {
    companion object {
@@ -77,13 +77,9 @@ data class ProfileItem(
        }
    }

-    fun getAllOutboundTags(): MutableList<String> {
-        return mutableListOf(TAG_PROXY, TAG_DIRECT, TAG_BLOCKED)
-    }
-
    fun getServerAddressAndPort(): String {
        if (server.isNullOrEmpty() && configType == EConfigType.CUSTOM) {
-            return "$LOOPBACK:$PORT_SOCKS"
+            return "${AppConfig.LOOPBACK}:${AppConfig.PORT_SOCKS}"
        }
        return Utils.getIpv6Address(server) + ":" + serverPort
    }
@@ -129,6 +125,7 @@ data class ProfileItem(
                && this.portHopping == obj.portHopping
                && this.portHoppingInterval == obj.portHoppingInterval
                && this.pinnedCA256 == obj.pinnedCA256
+                && this.proxyChainProfiles == obj.proxyChainProfiles
                )
    }
 }
@@ -1,4 +1,4 @@
-package com.v2ray.ang.dto
+package com.v2ray.ang.dto.entities

 data class RulesetItem(
    var remarks: String? = "",
@@ -1,4 +1,4 @@
-package com.v2ray.ang.dto
+package com.v2ray.ang.dto.entities

 data class ServerAffiliationInfo(var testDelayMillis: Long = 0L) {
    fun getTestDelayString(): String {
@@ -7,4 +7,4 @@ data class ServerAffiliationInfo(var testDelayMillis: Long = 0L) {
        }
        return testDelayMillis.toString() + "ms"
    }
-}
+}
@@ -1,4 +1,4 @@
-package com.v2ray.ang.dto
+package com.v2ray.ang.dto.entities

 data class ServersCache(
    val guid: String,
@@ -1,4 +1,4 @@
-package com.v2ray.ang.dto
+package com.v2ray.ang.dto.entities

 data class SubscriptionCache(
    val guid: String,
@@ -1,4 +1,4 @@
-package com.v2ray.ang.dto
+package com.v2ray.ang.dto.entities

 data class SubscriptionItem(
    var remarks: String = "",
@@ -1,4 +1,4 @@
-package com.v2ray.ang.dto
+package com.v2ray.ang.dto.entities

 data class WebDavConfig(
    val baseUrl: String,
@@ -6,4 +6,4 @@ data class WebDavConfig(
    val password: String? = null,
    val remoteBasePath: String = "/",
    val timeoutSeconds: Long = 30
-)
+)
@@ -0,0 +1,26 @@
+package com.v2ray.ang.enums
+
+/**
+ * Load-balancing strategy types supported by xray balancer.
+ *
+ * @param policyGroupType The string value written into the xray config JSON.
+ * @param policyGroupTypeValue The numeric string stored in [com.v2ray.ang.dto.entities.ProfileItem.policyGroupType].
+ * @param requiresBurstObservatory Whether this strategy needs a burstObservatory (leastLoad).
+ * @param requiresObservatory Whether this strategy needs an observatory (leastPing).
+ */
+enum class BalancerStrategyType(
+    val policyGroupType: String,
+    val policyGroupTypeValue: String,
+    val requiresBurstObservatory: Boolean = false,
+    val requiresObservatory: Boolean = false,
+) {
+    LEAST_LOAD("leastLoad", "1", requiresBurstObservatory = true),
+    RANDOM("random", "2"),
+    ROUND_ROBIN("roundRobin", "3"),
+    LEAST_PING("leastPing", "", requiresObservatory = true); // default / else
+
+    companion object {
+        fun from(policyGroupType: String?): BalancerStrategyType =
+            entries.firstOrNull { it.policyGroupTypeValue == policyGroupType } ?: LEAST_PING
+    }
+}
@@ -0,0 +1,8 @@
+package com.v2ray.ang.enums
+
+/** Runtime type used during config assembly only. */
+enum class CoreResolvedType {
+    NORMAL,
+    POLICYGROUP,
+    PROXYCHAIN,
+}
@@ -15,7 +15,8 @@ enum class EConfigType(val value: Int, val protocolScheme: String) {
    HYSTERIA2(9, AppConfig.HYSTERIA2),
    HYSTERIA(900, AppConfig.HYSTERIA),
    HTTP(10, AppConfig.HTTP),
-    POLICYGROUP(101, AppConfig.CUSTOM);
+    POLICYGROUP(101, AppConfig.CUSTOM),
+    PROXYCHAIN(102, AppConfig.CUSTOM);

    companion object {
        fun fromInt(value: Int) = entries.firstOrNull { it.value == value }
@@ -0,0 +1,22 @@
+package com.v2ray.ang.enums
+
+/**
+ * Enum defining different notification channels.
+ * Each channel has a unique channelId, notificationId, and display name.
+ */
+enum class NotificationChannelType(
+    val channelId: String,
+    val channelName: String,
+    val notificationId: Int
+) {
+    SUBSCRIPTION_UPDATE(
+        channelId = "subscription_update_channel",
+        channelName = "Subscription Update Service",
+        notificationId = 13
+    ),
+    CORE_TEST(
+        channelId = "core_test_channel",
+        channelName = "Core Test Service",
+        notificationId = 12
+    )
+}
@@ -13,21 +13,16 @@ enum class PermissionType {
        override fun getPermission(): String = Manifest.permission.CAMERA
    },

-    /** Read storage / media permission (adapts to Android version) */
-    READ_STORAGE {
-        override fun getPermission(): String {
-            return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
-                Manifest.permission.READ_MEDIA_IMAGES
-            } else {
-                Manifest.permission.READ_EXTERNAL_STORAGE
-            }
-        }
-    },
-
    /** Notification permission (Android 13+) */
    POST_NOTIFICATIONS {
        @RequiresApi(Build.VERSION_CODES.TIRAMISU)
        override fun getPermission(): String = Manifest.permission.POST_NOTIFICATIONS
+    },
+
+    /** Local network access permission (Android 17+) */
+    ACCESS_LOCAL_NETWORK {
+        @RequiresApi(Build.VERSION_CODES.CINNAMON_BUN)
+        override fun getPermission(): String = Manifest.permission.ACCESS_LOCAL_NETWORK
    };

    /** Return the actual Android permission string */
@@ -37,8 +32,8 @@ enum class PermissionType {
    fun getLabel(): String {
        return when (this) {
            CAMERA -> "Camera"
-            READ_STORAGE -> "Storage"
            POST_NOTIFICATIONS -> "Notification"
+            ACCESS_LOCAL_NETWORK -> "Local Network"
        }
    }
 }
@@ -8,6 +8,7 @@ import android.os.Build
 import android.os.Bundle
 import android.widget.Toast
 import com.v2ray.ang.AngApplication
+import com.v2ray.ang.enums.EConfigType
 import es.dmoral.toasty.Toasty
 import java.io.Serializable
 import java.net.URI
@@ -200,4 +201,22 @@ fun String.matchesPattern(regex: Regex?, keyword: String?, ignoreCase: Boolean =
    }
    return regex?.containsMatchIn(this)
        ?: this.contains(keyword, ignoreCase = ignoreCase)
-}
+}
+
+/**
+ * Checks if the config type is a group type (PolicyGroup or ProxyChain).
+ *
+ * @return True if the config type is PolicyGroup or ProxyChain, false otherwise.
+ */
+fun EConfigType.isGroupType(): Boolean {
+    return this == EConfigType.POLICYGROUP || this == EConfigType.PROXYCHAIN
+}
+
+/**
+ * Checks if the config type is a complex type (Custom, PolicyGroup, or ProxyChain).
+ *
+ * @return True if the config type is Custom, PolicyGroup, or ProxyChain, false otherwise.
+ */
+fun EConfigType.isComplexType(): Boolean {
+    return this == EConfigType.CUSTOM || this == EConfigType.POLICYGROUP || this == EConfigType.PROXYCHAIN
+}
@@ -1,7 +1,7 @@
 package com.v2ray.ang.fmt

-import com.v2ray.ang.dto.ProfileItem
 import com.v2ray.ang.dto.V2rayConfig
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.util.JsonUtil

@@ -20,7 +20,7 @@ object CustomFmt : FmtBase() {

        config.remarks = fullConfig?.remarks ?: System.currentTimeMillis().toString()
        config.server = outbound?.getServerAddress()
-        config.serverPort = outbound?.getServerPort().toString()
+        config.serverPort = outbound?.getServerPort()?.toString()

        return config
    }
@@ -1,10 +1,9 @@
 package com.v2ray.ang.fmt

 import com.v2ray.ang.AppConfig
-import com.v2ray.ang.dto.ProfileItem
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.NetworkType
 import com.v2ray.ang.extension.nullIfBlank
-import com.v2ray.ang.handler.MmkvManager
 import com.v2ray.ang.util.HttpUtil
 import com.v2ray.ang.util.Utils
 import java.net.URI
@@ -51,9 +50,8 @@ open class FmtBase {
     *
     * @param config the ProfileItem object to populate
     * @param queryParam the query parameters to use for populating the ProfileItem
-     * @param allowInsecure whether to allow insecure connections
     */
-    fun getItemFormQuery(config: ProfileItem, queryParam: Map<String, String>, allowInsecure: Boolean) {
+    fun getItemFormQuery(config: ProfileItem, queryParam: Map<String, String>) {
        config.network = queryParam["type"] ?: NetworkType.TCP.type
        config.headerType = queryParam["headerType"]
        config.host = queryParam["host"]
@@ -80,12 +78,13 @@ open class FmtBase {
        config.insecure = when {
            allowInsecureKeys.any { queryParam[it] == "1" } -> true
            allowInsecureKeys.any { queryParam[it] == "0" } -> false
-            else -> allowInsecure
+            else -> false
        }
        config.sni = queryParam["sni"]
        config.fingerPrint = queryParam["fp"]
        config.alpn = queryParam["alpn"]
        config.echConfigList = queryParam["ech"]
+        config.verifyPeerCertByName = queryParam["vcn"]
        config.pinnedCA256 = queryParam["pcs"]
        config.publicKey = queryParam["pbk"]
        config.shortId = queryParam["sid"]
@@ -106,6 +105,7 @@ open class FmtBase {
        config.sni?.nullIfBlank()?.let { dicQuery["sni"] = it }
        config.alpn?.nullIfBlank()?.let { dicQuery["alpn"] = it }
        config.echConfigList?.nullIfBlank()?.let { dicQuery["ech"] = it }
+        config.verifyPeerCertByName?.nullIfBlank()?.let { dicQuery["vcn"] = it }
        config.pinnedCA256?.nullIfBlank()?.let { dicQuery["pcs"] = it }
        config.fingerPrint?.nullIfBlank()?.let { dicQuery["fp"] = it }
        config.publicKey?.nullIfBlank()?.let { dicQuery["pbk"] = it }
@@ -172,21 +172,4 @@ open class FmtBase {

        return dicQuery
    }
-
-    fun getServerAddress(profileItem: ProfileItem): String {
-        if (Utils.isPureIpAddress(profileItem.server.orEmpty())) {
-            return profileItem.server.orEmpty()
-        }
-
-        val domain = HttpUtil.toIdnDomain(profileItem.server.orEmpty())
-        if (MmkvManager.decodeSettingsString(AppConfig.PREF_OUTBOUND_DOMAIN_RESOLVE_METHOD, "1") != "2") {
-            return domain
-        }
-        //Resolve and replace domain
-        val resolvedIps = HttpUtil.resolveHostToIP(domain, MmkvManager.decodeSettingsBool(AppConfig.PREF_PREFER_IPV6))
-        if (resolvedIps.isNullOrEmpty()) {
-            return domain
-        }
-        return resolvedIps.first()
-    }
 }
@@ -1,32 +0,0 @@
-package com.v2ray.ang.fmt
-
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.V2rayConfig.OutboundBean
-import com.v2ray.ang.enums.EConfigType
-import com.v2ray.ang.extension.isNotNullEmpty
-import com.v2ray.ang.handler.V2rayConfigManager
-
-object HttpFmt : FmtBase() {
-    /**
-     * Converts a ProfileItem object to an OutboundBean object.
-     *
-     * @param profileItem the ProfileItem object to convert
-     * @return the converted OutboundBean object, or null if conversion fails
-     */
-    fun toOutbound(profileItem: ProfileItem): OutboundBean? {
-        val outboundBean = V2rayConfigManager.createInitOutbound(EConfigType.HTTP)
-
-        outboundBean?.settings?.servers?.first()?.let { server ->
-            server.address = getServerAddress(profileItem)
-            server.port = profileItem.serverPort.orEmpty().toInt()
-            if (profileItem.username.isNotNullEmpty()) {
-                val socksUsersBean = OutboundBean.OutSettingsBean.ServersBean.SocksUsersBean()
-                socksUsersBean.user = profileItem.username.orEmpty()
-                socksUsersBean.pass = profileItem.password.orEmpty()
-                server.users = listOf(socksUsersBean)
-            }
-        }
-
-        return outboundBean
-    }
-}
@@ -1,15 +1,12 @@
 package com.v2ray.ang.fmt

 import com.v2ray.ang.AppConfig
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.V2rayConfig.OutboundBean
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.enums.NetworkType
 import com.v2ray.ang.extension.idnHost
 import com.v2ray.ang.extension.isNotNullEmpty
 import com.v2ray.ang.extension.nullIfBlank
-import com.v2ray.ang.handler.MmkvManager
-import com.v2ray.ang.handler.V2rayConfigManager
 import com.v2ray.ang.util.Utils
 import java.net.URI

@@ -21,7 +18,6 @@ object Hysteria2Fmt : FmtBase() {
     * @return the parsed ProfileItem object, or null if parsing fails
     */
    fun parse(str: String): ProfileItem {
-        var allowInsecure = MmkvManager.decodeSettingsBool(AppConfig.PREF_ALLOW_INSECURE, false)
        val config = ProfileItem.create(EConfigType.HYSTERIA2)

        val uri = URI(Utils.fixIllegalUrl(str))
@@ -35,7 +31,7 @@ object Hysteria2Fmt : FmtBase() {
        if (!uri.rawQuery.isNullOrEmpty()) {
            val queryParam = getQueryParam(uri)

-            getItemFormQuery(config, queryParam, allowInsecure)
+            getItemFormQuery(config, queryParam)

            config.security = queryParam["security"] ?: AppConfig.TLS
            config.obfsPassword = queryParam["obfs-password"]
@@ -110,32 +106,4 @@ object Hysteria2Fmt : FmtBase() {

        return toUri(config, config.password, dicQuery)
    }
-
-    /**
-     * Converts a ProfileItem object to an OutboundBean object.
-     *
-     * @param profileItem the ProfileItem object to convert
-     * @return the converted OutboundBean object, or null if conversion fails
-     */
-    fun toOutbound(profileItem: ProfileItem): OutboundBean? {
-        val outboundBean = V2rayConfigManager.createInitOutbound(EConfigType.HYSTERIA2) ?: return null
-        profileItem.network = NetworkType.HYSTERIA.type
-        profileItem.alpn = "h3"
-
-        outboundBean.settings?.let { server ->
-            server.address = getServerAddress(profileItem)
-            server.port = profileItem.serverPort.orEmpty().toInt()
-            server.version = 2
-        }
-
-        val sni = outboundBean.streamSettings?.let {
-            V2rayConfigManager.populateTransportSettings(it, profileItem)
-        }
-
-        outboundBean.streamSettings?.let {
-            V2rayConfigManager.populateTlsSettings(it, profileItem, sni)
-        }
-
-        return outboundBean
-    }
 }
@@ -1,12 +1,10 @@
 package com.v2ray.ang.fmt

 import com.v2ray.ang.AppConfig
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.V2rayConfig.OutboundBean
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.enums.NetworkType
 import com.v2ray.ang.extension.idnHost
-import com.v2ray.ang.handler.V2rayConfigManager
 import com.v2ray.ang.util.LogUtil
 import com.v2ray.ang.util.Utils
 import java.net.URI
@@ -124,31 +122,4 @@ object ShadowsocksFmt : FmtBase() {

        return toUri(config, Utils.encode(pw, true), null)
    }
-
-    /**
-     * Converts a ProfileItem object to an OutboundBean object.
-     *
-     * @param profileItem the ProfileItem object to convert
-     * @return the converted OutboundBean object, or null if conversion fails
-     */
-    fun toOutbound(profileItem: ProfileItem): OutboundBean? {
-        val outboundBean = V2rayConfigManager.createInitOutbound(EConfigType.SHADOWSOCKS)
-
-        outboundBean?.settings?.servers?.first()?.let { server ->
-            server.address = getServerAddress(profileItem)
-            server.port = profileItem.serverPort.orEmpty().toInt()
-            server.password = profileItem.password
-            server.method = profileItem.method
-        }
-
-        val sni = outboundBean?.streamSettings?.let {
-            V2rayConfigManager.populateTransportSettings(it, profileItem)
-        }
-
-        outboundBean?.streamSettings?.let {
-            V2rayConfigManager.populateTlsSettings(it, profileItem, sni)
-        }
-
-        return outboundBean
-    }
 }
@@ -1,11 +1,9 @@
 package com.v2ray.ang.fmt

-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.V2rayConfig.OutboundBean
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.extension.idnHost
 import com.v2ray.ang.extension.isNotNullEmpty
-import com.v2ray.ang.handler.V2rayConfigManager
 import com.v2ray.ang.util.Utils
 import java.net.URI

@@ -28,7 +26,11 @@ object SocksFmt : FmtBase() {
        config.serverPort = uri.port.toString()

        if (uri.userInfo?.isEmpty() == false) {
-            val result = Utils.decode(uri.userInfo).split(":", limit = 2)
+            val result = if (uri.userInfo.contains(":")) {
+                uri.userInfo.split(":", limit = 2)
+            } else {
+                Utils.decode(uri.userInfo).split(":", limit = 2)
+            }
            if (result.count() == 2) {
                config.username = result.first()
                config.password = result.last()
@@ -53,27 +55,4 @@ object SocksFmt : FmtBase() {

        return toUri(config, Utils.encode(pw, true), null)
    }
-
-    /**
-     * Converts a ProfileItem object to an OutboundBean object.
-     *
-     * @param profileItem the ProfileItem object to convert
-     * @return the converted OutboundBean object, or null if conversion fails
-     */
-    fun toOutbound(profileItem: ProfileItem): OutboundBean? {
-        val outboundBean = V2rayConfigManager.createInitOutbound(EConfigType.SOCKS)
-
-        outboundBean?.settings?.servers?.first()?.let { server ->
-            server.address = getServerAddress(profileItem)
-            server.port = profileItem.serverPort.orEmpty().toInt()
-            if (profileItem.username.isNotNullEmpty()) {
-                val socksUsersBean = OutboundBean.OutSettingsBean.ServersBean.SocksUsersBean()
-                socksUsersBean.user = profileItem.username.orEmpty()
-                socksUsersBean.pass = profileItem.password.orEmpty()
-                server.users = listOf(socksUsersBean)
-            }
-        }
-
-        return outboundBean
-    }
 }
@@ -1,13 +1,10 @@
 package com.v2ray.ang.fmt

 import com.v2ray.ang.AppConfig
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.V2rayConfig.OutboundBean
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.enums.NetworkType
 import com.v2ray.ang.extension.idnHost
-import com.v2ray.ang.handler.MmkvManager
-import com.v2ray.ang.handler.V2rayConfigManager
 import com.v2ray.ang.util.Utils
 import java.net.URI

@@ -19,7 +16,6 @@ object TrojanFmt : FmtBase() {
     * @return the parsed ProfileItem object, or null if parsing fails
     */
    fun parse(str: String): ProfileItem {
-        var allowInsecure = MmkvManager.decodeSettingsBool(AppConfig.PREF_ALLOW_INSECURE, false)
        val config = ProfileItem.create(EConfigType.TROJAN)

        val uri = URI(Utils.fixIllegalUrl(str))
@@ -31,11 +27,11 @@ object TrojanFmt : FmtBase() {
        if (uri.rawQuery.isNullOrEmpty()) {
            config.network = NetworkType.TCP.type
            config.security = AppConfig.TLS
-            config.insecure = allowInsecure
+            config.insecure = false
        } else {
            val queryParam = getQueryParam(uri)

-            getItemFormQuery(config, queryParam, allowInsecure)
+            getItemFormQuery(config, queryParam)
            config.security = queryParam["security"] ?: AppConfig.TLS
        }

@@ -53,31 +49,4 @@ object TrojanFmt : FmtBase() {

        return toUri(config, config.password, dicQuery)
    }
-
-    /**
-     * Converts a ProfileItem object to an OutboundBean object.
-     *
-     * @param profileItem the ProfileItem object to convert
-     * @return the converted OutboundBean object, or null if conversion fails
-     */
-    fun toOutbound(profileItem: ProfileItem): OutboundBean? {
-        val outboundBean = V2rayConfigManager.createInitOutbound(EConfigType.TROJAN)
-
-        outboundBean?.settings?.servers?.first()?.let { server ->
-            server.address = getServerAddress(profileItem)
-            server.port = profileItem.serverPort.orEmpty().toInt()
-            server.password = profileItem.password
-            server.flow = profileItem.flow
-        }
-
-        val sni = outboundBean?.streamSettings?.let {
-            V2rayConfigManager.populateTransportSettings(it, profileItem)
-        }
-
-        outboundBean?.streamSettings?.let {
-            V2rayConfigManager.populateTlsSettings(it, profileItem, sni)
-        }
-
-        return outboundBean
-    }
 }
@@ -1,12 +1,8 @@
 package com.v2ray.ang.fmt

-import com.v2ray.ang.AppConfig
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.V2rayConfig.OutboundBean
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.extension.idnHost
-import com.v2ray.ang.handler.MmkvManager
-import com.v2ray.ang.handler.V2rayConfigManager
 import com.v2ray.ang.util.Utils
 import java.net.URI

@@ -19,7 +15,6 @@ object VlessFmt : FmtBase() {
     * @return the parsed ProfileItem object, or null if parsing fails
     */
    fun parse(str: String): ProfileItem? {
-        var allowInsecure = MmkvManager.decodeSettingsBool(AppConfig.PREF_ALLOW_INSECURE, false)
        val config = ProfileItem.create(EConfigType.VLESS)

        val uri = URI(Utils.fixIllegalUrl(str))
@@ -32,7 +27,7 @@ object VlessFmt : FmtBase() {
        config.password = uri.userInfo
        config.method = queryParam["encryption"] ?: "none"

-        getItemFormQuery(config, queryParam, allowInsecure)
+        getItemFormQuery(config, queryParam)

        return config
    }
@@ -50,31 +45,4 @@ object VlessFmt : FmtBase() {
        return toUri(config, config.password, dicQuery)
    }

-    /**
-     * Converts a ProfileItem object to an OutboundBean object.
-     *
-     * @param profileItem the ProfileItem object to convert
-     * @return the converted OutboundBean object, or null if conversion fails
-     */
-    fun toOutbound(profileItem: ProfileItem): OutboundBean? {
-        val outboundBean = V2rayConfigManager.createInitOutbound(EConfigType.VLESS)
-
-        outboundBean?.settings?.vnext?.first()?.let { vnext ->
-            vnext.address = getServerAddress(profileItem)
-            vnext.port = profileItem.serverPort.orEmpty().toInt()
-            vnext.users[0].id = profileItem.password.orEmpty()
-            vnext.users[0].encryption = profileItem.method
-            vnext.users[0].flow = profileItem.flow
-        }
-
-        val sni = outboundBean?.streamSettings?.let {
-            V2rayConfigManager.populateTransportSettings(it, profileItem)
-        }
-
-        outboundBean?.streamSettings?.let {
-            V2rayConfigManager.populateTlsSettings(it, profileItem, sni)
-        }
-
-        return outboundBean
-    }
 }
@@ -2,15 +2,12 @@ package com.v2ray.ang.fmt

 import android.text.TextUtils
 import com.v2ray.ang.AppConfig
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.V2rayConfig.OutboundBean
 import com.v2ray.ang.dto.VmessQRCode
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.enums.NetworkType
 import com.v2ray.ang.extension.idnHost
 import com.v2ray.ang.extension.nullIfBlank
-import com.v2ray.ang.handler.MmkvManager
-import com.v2ray.ang.handler.V2rayConfigManager
 import com.v2ray.ang.util.JsonUtil
 import com.v2ray.ang.util.LogUtil
 import com.v2ray.ang.util.Utils
@@ -28,7 +25,6 @@ object VmessFmt : FmtBase() {
            return parseVmessStd(str)
        }

-        val allowInsecure = MmkvManager.decodeSettingsBool(AppConfig.PREF_ALLOW_INSECURE, false)
        val config = ProfileItem.create(EConfigType.VMESS)

        var result = str.replace(EConfigType.VMESS.protocolScheme, "")
@@ -89,8 +85,11 @@ object VmessFmt : FmtBase() {
        config.insecure = when (vmessQRCode.insecure) {
            "1" -> true
            "0" -> false
-            else -> allowInsecure
+            else -> false
        }
+        config.verifyPeerCertByName = vmessQRCode.vcn
+        config.pinnedCA256 = vmessQRCode.pcs
+
        return config
    }

@@ -144,6 +143,8 @@ object VmessFmt : FmtBase() {
            false -> "0"
            else -> ""
        }
+        vmessQRCode.vcn = config.verifyPeerCertByName.orEmpty()
+        vmessQRCode.pcs = config.pinnedCA256.orEmpty()

        val json = JsonUtil.toJson(vmessQRCode)
        return Utils.encode(json)
@@ -156,7 +157,6 @@ object VmessFmt : FmtBase() {
     * @return the parsed ProfileItem object, or null if parsing fails
     */
    fun parseVmessStd(str: String): ProfileItem? {
-        val allowInsecure = MmkvManager.decodeSettingsBool(AppConfig.PREF_ALLOW_INSECURE, false)
        val config = ProfileItem.create(EConfigType.VMESS)

        val uri = URI(Utils.fixIllegalUrl(str))
@@ -169,36 +169,10 @@ object VmessFmt : FmtBase() {
        config.password = uri.userInfo
        config.method = AppConfig.DEFAULT_SECURITY

-        getItemFormQuery(config, queryParam, allowInsecure)
+        getItemFormQuery(config, queryParam)

        return config
    }

-    /**
-     * Converts a ProfileItem object to an OutboundBean object.
-     *
-     * @param profileItem the ProfileItem object to convert
-     * @return the converted OutboundBean object, or null if conversion fails
-     */
-    fun toOutbound(profileItem: ProfileItem): OutboundBean? {
-        val outboundBean = V2rayConfigManager.createInitOutbound(EConfigType.VMESS)
-
-        outboundBean?.settings?.vnext?.first()?.let { vnext ->
-            vnext.address = getServerAddress(profileItem)
-            vnext.port = profileItem.serverPort.orEmpty().toInt()
-            vnext.users[0].id = profileItem.password.orEmpty()
-            vnext.users[0].security = profileItem.method
-        }
-
-        val sni = outboundBean?.streamSettings?.let {
-            V2rayConfigManager.populateTransportSettings(it, profileItem)
-        }
-
-        outboundBean?.streamSettings?.let {
-            V2rayConfigManager.populateTlsSettings(it, profileItem, sni)
-        }
-
-        return outboundBean
-    }

 }
@@ -1,14 +1,11 @@
 package com.v2ray.ang.fmt

 import com.v2ray.ang.AppConfig
-import com.v2ray.ang.AppConfig.WIREGUARD_LOCAL_ADDRESS_V4
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.V2rayConfig.OutboundBean
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.extension.idnHost
 import com.v2ray.ang.extension.nullIfBlank
 import com.v2ray.ang.extension.removeWhiteSpace
-import com.v2ray.ang.handler.V2rayConfigManager
 import com.v2ray.ang.util.Utils
 import java.net.URI

@@ -31,7 +28,7 @@ object WireguardFmt : FmtBase() {
        config.serverPort = uri.port.toString()

        config.secretKey = uri.userInfo.orEmpty()
-        config.localAddress = queryParam["address"] ?: WIREGUARD_LOCAL_ADDRESS_V4
+        config.localAddress = queryParam["address"] ?: AppConfig.WIREGUARD_LOCAL_ADDRESS_V4
        config.publicKey = queryParam["publickey"].orEmpty()
        config.preSharedKey = queryParam["presharedkey"]?.nullIfBlank()
        config.mtu = Utils.parseInt(queryParam["mtu"] ?: AppConfig.WIREGUARD_LOCAL_MTU)
@@ -82,7 +79,7 @@ object WireguardFmt : FmtBase() {

        config.secretKey = interfaceParams["privatekey"].orEmpty()
        config.remarks = System.currentTimeMillis().toString()
-        config.localAddress = interfaceParams["address"] ?: WIREGUARD_LOCAL_ADDRESS_V4
+        config.localAddress = interfaceParams["address"] ?: AppConfig.WIREGUARD_LOCAL_ADDRESS_V4
        config.mtu = Utils.parseInt(interfaceParams["mtu"] ?: AppConfig.WIREGUARD_LOCAL_MTU)
        config.publicKey = peerParams["publickey"].orEmpty()
        config.preSharedKey = peerParams["presharedkey"]?.nullIfBlank()
@@ -100,29 +97,6 @@ object WireguardFmt : FmtBase() {
        return config
    }

-    /**
-     * Converts a ProfileItem object to an OutboundBean object.
-     *
-     * @param profileItem the ProfileItem object to convert
-     * @return the converted OutboundBean object, or null if conversion fails
-     */
-    fun toOutbound(profileItem: ProfileItem): OutboundBean? {
-        val outboundBean = V2rayConfigManager.createInitOutbound(EConfigType.WIREGUARD)
-
-        outboundBean?.settings?.let { wireguard ->
-            wireguard.secretKey = profileItem.secretKey
-            wireguard.address = (profileItem.localAddress ?: WIREGUARD_LOCAL_ADDRESS_V4).split(",")
-            wireguard.peers?.firstOrNull()?.let { peer ->
-                peer.publicKey = profileItem.publicKey.orEmpty()
-                peer.preSharedKey = profileItem.preSharedKey?.nullIfBlank()
-                peer.endpoint = Utils.getIpv6Address(profileItem.server) + ":${profileItem.serverPort}"
-            }
-            wireguard.mtu = profileItem.mtu
-            wireguard.reserved = profileItem.reserved?.takeIf { it.isNotBlank() }?.split(",")?.filter { it.isNotBlank() }?.map { it.trim().toInt() }
-        }
-
-        return outboundBean
-    }

    /**
     * Converts a ProfileItem object to a URI string.
@@ -4,12 +4,13 @@ import android.content.Context
 import android.graphics.Bitmap
 import android.text.TextUtils
 import com.v2ray.ang.AppConfig
-import com.v2ray.ang.AppConfig.HY2
 import com.v2ray.ang.R
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.SubscriptionCache
-import com.v2ray.ang.dto.SubscriptionItem
+import com.v2ray.ang.core.CoreConfigManager
 import com.v2ray.ang.dto.SubscriptionUpdateResult
+import com.v2ray.ang.dto.UrlContentRequest
+import com.v2ray.ang.dto.entities.ProfileItem
+import com.v2ray.ang.dto.entities.SubscriptionCache
+import com.v2ray.ang.dto.entities.SubscriptionItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.extension.isNotNullEmpty
 import com.v2ray.ang.fmt.CustomFmt
@@ -29,6 +30,21 @@ import java.net.URI

 object AngConfigManager {

+    // Parser mapping for different config types (lazy initialized)
+    private val configFmtParsers: Map<String, (String) -> ProfileItem?> by lazy {
+        mapOf(
+            EConfigType.VMESS.protocolScheme to VmessFmt::parse,
+            EConfigType.SHADOWSOCKS.protocolScheme to ShadowsocksFmt::parse,
+            EConfigType.SOCKS.protocolScheme to SocksFmt::parse,
+            AppConfig.SOCKS4 to SocksFmt::parse,
+            AppConfig.SOCKS5 to SocksFmt::parse,
+            EConfigType.TROJAN.protocolScheme to TrojanFmt::parse,
+            EConfigType.VLESS.protocolScheme to VlessFmt::parse,
+            EConfigType.WIREGUARD.protocolScheme to WireguardFmt::parse,
+            EConfigType.HYSTERIA2.protocolScheme to Hysteria2Fmt::parse,
+            AppConfig.HY2 to Hysteria2Fmt::parse
+        )
+    }

    /**
     * Shares the configuration to the clipboard.
@@ -111,7 +127,7 @@ object AngConfigManager {
    fun shareFullContent2Clipboard(context: Context, guid: String?): Int {
        try {
            if (guid == null) return -1
-            val result = V2rayConfigManager.getV2rayConfig(context, guid)
+            val result = CoreConfigManager.getV2rayConfig(context, guid)
            if (result.status) {
                Utils.setClipboard(context, result.content)
            } else {
@@ -136,15 +152,12 @@ object AngConfigManager {

            return config.configType.protocolScheme + when (config.configType) {
                EConfigType.VMESS -> VmessFmt.toUri(config)
-                EConfigType.CUSTOM -> ""
                EConfigType.SHADOWSOCKS -> ShadowsocksFmt.toUri(config)
                EConfigType.SOCKS -> SocksFmt.toUri(config)
-                EConfigType.HTTP -> ""
                EConfigType.VLESS -> VlessFmt.toUri(config)
                EConfigType.TROJAN -> TrojanFmt.toUri(config)
                EConfigType.WIREGUARD -> WireguardFmt.toUri(config)
                EConfigType.HYSTERIA2 -> Hysteria2Fmt.toUri(config)
-                EConfigType.POLICYGROUP -> ""
                else -> {}
            }
        } catch (e: Exception) {
@@ -221,15 +234,8 @@ object AngConfigManager {
            if (servers == null) {
                return 0
            }
-            //  Find the currently selected server that matches the subscription ID
-            val removedSelected = if (subid.isNotBlank() && !append) {
-                MmkvManager.getSelectServer()
-                    .takeIf { it?.isNotBlank() == true }
-                    ?.let { MmkvManager.decodeServerConfig(it) }
-                    ?.takeIf { it.subscriptionId == subid }
-            } else {
-                null
-            }
+            // Find the currently selected server that belongs to the same subscription before replacement.
+            val removedSelected = getRemovedSelectedProfile(subid, append)

            val subItem = MmkvManager.decodeSubscription(subid)

@@ -275,7 +281,6 @@ object AngConfigManager {

        // Read serverList once
        val serverList = MmkvManager.decodeServerList(subid)
-        var needSetSelected = MmkvManager.getSelectServer().isNullOrBlank()

        configs.forEach { config ->
            val key = Utils.getUuid()
@@ -284,10 +289,6 @@ object AngConfigManager {

            if (!serverList.contains(key)) {
                serverList.add(0, key)
-                if (needSetSelected) {
-                    MmkvManager.setSelectServer(key)
-                    needSetSelected = false
-                }
            }
            keyToProfile[key] = config
        }
@@ -310,7 +311,18 @@ object AngConfigManager {
     * @return Matched key or null
     */
    private fun findMatchedProfileKey(keyToProfile: Map<String, ProfileItem>, target: ProfileItem?): String? {
-        if (keyToProfile.isEmpty() || target == null) return null
+        if (keyToProfile.isEmpty()) return null
+        if (target == null) return null
+
+        // Level 0: Full match (remarks + server + port + password)
+        if (target.remarks.isNotBlank()) {
+            keyToProfile.entries.firstOrNull { (_, saved) ->
+                isSameText(saved.remarks, target.remarks) &&
+                        isSameText(saved.server, target.server) &&
+                        isSameText(saved.serverPort, target.serverPort) &&
+                        isSameText(saved.password, target.password)
+            }?.key?.let { return it }
+        }

        // Level 1: Match by remarks
        if (target.remarks.isNotBlank()) {
@@ -337,7 +349,20 @@ object AngConfigManager {
            isSameText(saved.server, target.server)
        }?.key?.let { return it }

-        return null
+        // If old selected node cannot be matched, fall back to the first imported config.
+        return keyToProfile.keys.firstOrNull()
+    }
+
+    /**
+     * Returns the currently selected profile if it belongs to the target subscription and will be replaced.
+     */
+    private fun getRemovedSelectedProfile(subid: String, append: Boolean): ProfileItem? {
+        if (subid.isBlank() || append) return null
+
+        return MmkvManager.getSelectServer()
+            .takeIf { it?.isNotBlank() == true }
+            ?.let { MmkvManager.decodeServerConfig(it) }
+            ?.takeIf { it.subscriptionId == subid }
    }

    /**
@@ -373,18 +398,25 @@ object AngConfigManager {
                    JsonUtil.fromJson(server, Array<Any>::class.java) ?: arrayOf()

                if (serverList.isNotEmpty()) {
+                    val removedSelected = getRemovedSelectedProfile(subid, append)
                    if (!append) {
                        MmkvManager.removeServerViaSubid(subid)
                    }
                    var count = 0
+                    val keyToProfile = mutableMapOf<String, ProfileItem>()
                    for (srv in serverList.reversed()) {
                        val config = CustomFmt.parse(JsonUtil.toJson(srv)) ?: continue
                        config.subscriptionId = subid
                        config.description = generateDescription(config)
                        val key = MmkvManager.encodeServerConfig("", config)
                        MmkvManager.encodeServerRaw(key, JsonUtil.toJsonPretty(srv) ?: "")
+                        keyToProfile[key] = config
                        count += 1
                    }
+                    if (count > 0) {
+                        val matchKey = findMatchedProfileKey(keyToProfile, removedSelected)
+                        matchKey?.let { MmkvManager.setSelectServer(it) }
+                    }
                    return count
                }
            } catch (e: Exception) {
@@ -444,22 +476,8 @@ object AngConfigManager {
                return null
            }

-            val config = if (str.startsWith(EConfigType.VMESS.protocolScheme)) {
-                VmessFmt.parse(str)
-            } else if (str.startsWith(EConfigType.SHADOWSOCKS.protocolScheme)) {
-                ShadowsocksFmt.parse(str)
-            } else if (str.startsWith(EConfigType.SOCKS.protocolScheme)) {
-                SocksFmt.parse(str)
-            } else if (str.startsWith(EConfigType.TROJAN.protocolScheme)) {
-                TrojanFmt.parse(str)
-            } else if (str.startsWith(EConfigType.VLESS.protocolScheme)) {
-                VlessFmt.parse(str)
-            } else if (str.startsWith(EConfigType.WIREGUARD.protocolScheme)) {
-                WireguardFmt.parse(str)
-            } else if (str.startsWith(EConfigType.HYSTERIA2.protocolScheme) || str.startsWith(HY2)) {
-                Hysteria2Fmt.parse(str)
-            } else {
-                null
+            val config = configFmtParsers.firstNotNullOfOrNull { (scheme, parser) ->
+                if (str.startsWith(scheme)) parser(str) else null
            }

            if (config == null) {
@@ -537,14 +555,28 @@ object AngConfigManager {

            var configText = try {
                val httpPort = SettingsManager.getHttpPort()
-                HttpUtil.getUrlContentWithUserAgent(url, userAgent, 15000, httpPort, proxyUsername, proxyPassword)
+                HttpUtil.getUrlContentWithUserAgent(
+                    UrlContentRequest(
+                        url = url,
+                        userAgent = userAgent,
+                        timeout = 15000,
+                        httpPort = httpPort,
+                        proxyUsername = proxyUsername,
+                        proxyPassword = proxyPassword
+                    )
+                )
            } catch (e: Exception) {
                LogUtil.e(AppConfig.ANG_PACKAGE, "Update subscription: proxy not ready or other error", e)
                ""
            }
            if (configText.isEmpty()) {
                configText = try {
-                    HttpUtil.getUrlContentWithUserAgent(url, userAgent)
+                    HttpUtil.getUrlContentWithUserAgent(
+                        UrlContentRequest(
+                            url = url,
+                            userAgent = userAgent
+                        )
+                    )
                } catch (e: Exception) {
                    LogUtil.e(AppConfig.TAG, "Update subscription: Failed to get URL content with user agent", e)
                    ""
@@ -0,0 +1,79 @@
+package com.v2ray.ang.handler
+
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.dto.CertSha256Request
+import com.v2ray.ang.dto.CertSha256Result
+import com.v2ray.ang.dto.entities.ProfileItem
+import com.v2ray.ang.enums.EConfigType
+import com.v2ray.ang.util.HttpUtil
+import com.v2ray.ang.util.JsonUtil
+import com.v2ray.ang.util.LogUtil
+import com.v2ray.ang.util.Utils
+import libv2ray.Libv2ray
+
+object CertificateFingerprintManager {
+    private const val TIMEOUT_MS = 5000L
+
+    fun fetchForManualFill(profile: ProfileItem): String? {
+        val request = buildRequest(profile) ?: return null
+        val result = if (profile.configType == EConfigType.HYSTERIA2) {
+            fetch("quic", request) { Libv2ray.fetchQuicCertSha256(it) }
+        } else {
+            fetch("tls", request) { Libv2ray.fetchTlsCertSha256(it) }
+        }
+
+        return result
+            ?.takeIf { it.error.isBlank() }
+            ?.sha256
+            ?.takeIf { it.isNotBlank() }
+    }
+
+    private fun buildRequest(profile: ProfileItem): CertSha256Request? {
+        if (!isFetchable(profile)) return null
+
+        val server = profile.server?.trim()?.takeIf { it.isNotEmpty() } ?: return null
+        val port = profile.serverPort?.toIntOrNull()?.takeIf { it > 0 } ?: AppConfig.DEFAULT_PORT
+
+        return CertSha256Request(
+            address = resolveDialAddress(server),
+            port = port,
+            serverName = inferServerName(profile),
+            timeoutMs = TIMEOUT_MS,
+        )
+    }
+
+    private fun isFetchable(profile: ProfileItem): Boolean {
+        return profile.configType == EConfigType.HYSTERIA2 || profile.security == AppConfig.TLS
+    }
+
+    private fun fetch(
+        type: String,
+        request: CertSha256Request,
+        fetcher: (String) -> String,
+    ): CertSha256Result? {
+        return try {
+            JsonUtil.fromJsonSafe(fetcher(JsonUtil.toJson(request)), CertSha256Result::class.java)
+        } catch (e: UnsatisfiedLinkError) {
+            LogUtil.e(AppConfig.TAG, "Fetch $type cert SHA-256 API missing in libv2ray", e)
+            null
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "Fetch $type cert SHA-256 failed", e)
+            null
+        }
+    }
+
+    private fun resolveDialAddress(server: String): String {
+        if (Utils.isPureIpAddress(server) || !Utils.isDomainName(server)) return server
+
+        val preferIpv6 = MmkvManager.decodeSettingsBool(AppConfig.PREF_PREFER_IPV6, false)
+        return HttpUtil.resolveHostToIP(server, preferIpv6)
+            ?.firstOrNull()
+            ?.takeIf { it.isNotBlank() }
+            ?: server
+    }
+
+    private fun inferServerName(profile: ProfileItem): String? {
+        val sni = profile.sni?.takeIf { it.isNotBlank() }
+        return sni?.takeUnless { Utils.isPureIpAddress(it) }
+    }
+}
@@ -4,14 +4,14 @@ import com.tencent.mmkv.MMKV
 import com.v2ray.ang.AppConfig.DEFAULT_SUBSCRIPTION_ID
 import com.v2ray.ang.AppConfig.PREF_IS_BOOTED
 import com.v2ray.ang.AppConfig.PREF_ROUTING_RULESET
-import com.v2ray.ang.dto.AssetUrlCache
-import com.v2ray.ang.dto.AssetUrlItem
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.RulesetItem
-import com.v2ray.ang.dto.ServerAffiliationInfo
-import com.v2ray.ang.dto.SubscriptionCache
-import com.v2ray.ang.dto.SubscriptionItem
-import com.v2ray.ang.dto.WebDavConfig
+import com.v2ray.ang.dto.entities.AssetUrlCache
+import com.v2ray.ang.dto.entities.AssetUrlItem
+import com.v2ray.ang.dto.entities.ProfileItem
+import com.v2ray.ang.dto.entities.RulesetItem
+import com.v2ray.ang.dto.entities.ServerAffiliationInfo
+import com.v2ray.ang.dto.entities.SubscriptionCache
+import com.v2ray.ang.dto.entities.SubscriptionItem
+import com.v2ray.ang.dto.entities.WebDavConfig
 import com.v2ray.ang.util.JsonUtil
 import com.v2ray.ang.util.Utils

@@ -102,7 +102,7 @@ object MmkvManager {
        return if (json.isNullOrBlank()) {
            mutableListOf()
        } else {
-            JsonUtil.fromJson(json, Array<String>::class.java)?.toMutableList() ?: mutableListOf()
+            JsonUtil.fromJsonSafe(json, Array<String>::class.java)?.toMutableList() ?: mutableListOf()
        }
    }

@@ -144,7 +144,7 @@ object MmkvManager {
        if (json.isNullOrBlank()) {
            return null
        }
-        return JsonUtil.fromJson(json, ProfileItem::class.java)
+        return JsonUtil.fromJsonSafe(json, ProfileItem::class.java)
    }


@@ -247,7 +247,7 @@ object MmkvManager {
        if (json.isNullOrBlank()) {
            return null
        }
-        return JsonUtil.fromJson(json, ServerAffiliationInfo::class.java)
+        return JsonUtil.fromJsonSafe(json, ServerAffiliationInfo::class.java)
    }

    /**
@@ -286,9 +286,13 @@ object MmkvManager {
     */
    fun removeAllServer(): Int {
        val count = profileFullStorage.allKeys()?.count() ?: 0
-        mainStorage.clearAll()
        profileFullStorage.clearAll()
        serverAffStorage.clearAll()
+        serverRawStorage.clearAll()
+
+        decodeSubscriptions().forEach { sub ->
+            encodeServerList(mutableListOf(), sub.guid)
+        }
        return count
    }

@@ -374,7 +378,7 @@ object MmkvManager {
        decodeSubsList().forEach { key ->
            val json = subStorage.decodeString(key)
            if (!json.isNullOrBlank()) {
-                val item = JsonUtil.fromJson(json, SubscriptionItem::class.java) ?: SubscriptionItem()
+                val item = JsonUtil.fromJsonSafe(json, SubscriptionItem::class.java) ?: SubscriptionItem()
                subscriptions.add(SubscriptionCache(key, item))
            }
        }
@@ -420,7 +424,7 @@ object MmkvManager {
     */
    fun decodeSubscription(subscriptionId: String): SubscriptionItem? {
        val json = subStorage.decodeString(subscriptionId) ?: return null
-        return JsonUtil.fromJson(json, SubscriptionItem::class.java)
+        return JsonUtil.fromJsonSafe(json, SubscriptionItem::class.java)
    }

    /**
@@ -442,7 +446,7 @@ object MmkvManager {
        return if (json.isNullOrBlank()) {
            mutableListOf()
        } else {
-            JsonUtil.fromJson(json, Array<String>::class.java)?.toMutableList() ?: mutableListOf()
+            JsonUtil.fromJsonSafe(json, Array<String>::class.java)?.toMutableList() ?: mutableListOf()
        }
    }

@@ -460,7 +464,7 @@ object MmkvManager {
        assetStorage.allKeys()?.forEach { key ->
            val json = assetStorage.decodeString(key)
            if (!json.isNullOrBlank()) {
-                val item = JsonUtil.fromJson(json, AssetUrlItem::class.java) ?: AssetUrlItem()
+                val item = JsonUtil.fromJsonSafe(json, AssetUrlItem::class.java) ?: AssetUrlItem()
                assetUrlItems.add(AssetUrlCache(key, item))
            }
        }
@@ -495,7 +499,7 @@ object MmkvManager {
     */
    fun decodeAsset(assetid: String): AssetUrlItem? {
        val json = assetStorage.decodeString(assetid) ?: return null
-        return JsonUtil.fromJson(json, AssetUrlItem::class.java)
+        return JsonUtil.fromJsonSafe(json, AssetUrlItem::class.java)
    }

    //endregion
@@ -510,7 +514,7 @@ object MmkvManager {
    fun decodeRoutingRulesets(): MutableList<RulesetItem>? {
        val ruleset = settingsStorage.decodeString(PREF_ROUTING_RULESET)
        if (ruleset.isNullOrEmpty()) return null
-        return JsonUtil.fromJson(ruleset, Array<RulesetItem>::class.java)?.toMutableList() ?: mutableListOf()
+        return JsonUtil.fromJsonSafe(ruleset, Array<RulesetItem>::class.java)?.toMutableList() ?: mutableListOf()
    }

    /**
@@ -714,7 +718,7 @@ object MmkvManager {
     */
    fun decodeWebDavConfig(): WebDavConfig? {
        val json = mainStorage.decodeString(KEY_WEBDAV_CONFIG) ?: return null
-        return JsonUtil.fromJson(json, WebDavConfig::class.java)
+        return JsonUtil.fromJsonSafe(json, WebDavConfig::class.java)
    }

    //endregion
@@ -13,7 +13,8 @@ import androidx.annotation.RequiresApi
 import androidx.core.app.NotificationCompat
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.R
-import com.v2ray.ang.dto.ProfileItem
+import com.v2ray.ang.core.CoreServiceManager
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.extension.toSpeedString
 import com.v2ray.ang.ui.MainActivity
 import com.v2ray.ang.util.LogUtil
@@ -42,53 +43,15 @@ object NotificationManager {
     * Starts the speed notification.
     * @param currentConfig The current profile configuration.
     */
-    fun startSpeedNotification(currentConfig: ProfileItem?) {
+    fun startSpeedNotification() {
        if (MmkvManager.decodeSettingsBool(AppConfig.PREF_SPEED_ENABLED) != true) return
-        if (speedNotificationJob != null || V2RayServiceManager.isRunning() == false) return
+        if (speedNotificationJob != null || CoreServiceManager.isRunning() == false) return

        var lastZeroSpeed = false
-        val outboundTags = currentConfig?.getAllOutboundTags()
-        outboundTags?.remove(AppConfig.TAG_DIRECT)

        speedNotificationJob = CoroutineScope(Dispatchers.IO).launch {
            while (isActive) {
-                val queryTime = System.currentTimeMillis()
-                val sinceLastQueryIn = (queryTime - lastQueryTime)
-
-                // If the query interval is too short, skip this round to avoid excessive CPU usage
-                if (sinceLastQueryIn < QUERY_INTERVAL_MS) {
-                    LogUtil.w(AppConfig.TAG, "Query interval too short: ${sinceLastQueryIn}ms, skipping")
-                    lastQueryTime = queryTime
-                    delay(QUERY_INTERVAL_MS)
-                    continue
-                }
-                val sinceLastQueryInSeconds = sinceLastQueryIn / 1000.0
-
-                var proxyTotal = 0L
-                val text = StringBuilder()
-                outboundTags?.forEach {
-                    val up = V2RayServiceManager.queryStats(it, AppConfig.UPLINK)
-                    val down = V2RayServiceManager.queryStats(it, AppConfig.DOWNLINK)
-                    if (up + down > 0) {
-                        appendSpeedString(text, it, up / sinceLastQueryInSeconds, down / sinceLastQueryInSeconds)
-                        proxyTotal += up + down
-                    }
-                }
-                val directUplink = V2RayServiceManager.queryStats(AppConfig.TAG_DIRECT, AppConfig.UPLINK)
-                val directDownlink = V2RayServiceManager.queryStats(AppConfig.TAG_DIRECT, AppConfig.DOWNLINK)
-                val zeroSpeed = proxyTotal == 0L && directUplink == 0L && directDownlink == 0L
-                if (!zeroSpeed || !lastZeroSpeed) {
-                    if (proxyTotal == 0L) {
-                        appendSpeedString(text, outboundTags?.firstOrNull(), 0.0, 0.0)
-                    }
-                    appendSpeedString(
-                        text, AppConfig.TAG_DIRECT, directUplink / sinceLastQueryInSeconds,
-                        directDownlink / sinceLastQueryInSeconds
-                    )
-                    updateNotification(text.toString(), proxyTotal, directDownlink + directUplink)
-                }
-                lastZeroSpeed = zeroSpeed
-                lastQueryTime = queryTime
+                lastZeroSpeed = updateSpeedNotificationOnce(lastZeroSpeed)
                delay(QUERY_INTERVAL_MS)
            }
        }
@@ -142,7 +105,7 @@ object NotificationManager {
                stopV2RayPendingIntent
            )
            .addAction(
-                R.drawable.ic_delete_24dp,
+                R.drawable.ic_restore_24dp,
                service.getString(R.string.title_service_restart),
                restartV2RayPendingIntent
            )
@@ -167,13 +130,12 @@ object NotificationManager {

    /**
     * Stops the speed notification.
-     * @param currentConfig The current profile configuration.
     */
-    fun stopSpeedNotification(currentConfig: ProfileItem?) {
+    fun stopSpeedNotification() {
        speedNotificationJob?.let {
            it.cancel()
            speedNotificationJob = null
-            updateNotification(currentConfig?.remarks, 0, 0)
+            updateNotification("", 0, 0)
        }
    }

@@ -246,11 +208,74 @@ object NotificationManager {
        text.append("•  ${up.toLong().toSpeedString()}↑  ${down.toLong().toSpeedString()}↓\n")
    }

+    /**
+     * Updates the speed notification once.
+     * Queries traffic stats, separates proxy and direct, and updates the notification.
+     * @param lastZeroSpeed The previous zero speed state.
+     * @return The current zero speed state.
+     */
+    private fun updateSpeedNotificationOnce(lastZeroSpeed: Boolean): Boolean {
+        val queryTime = System.currentTimeMillis()
+        val sinceLastQueryIn = (queryTime - lastQueryTime)
+
+        // If the query interval is too short, skip this round to avoid excessive CPU usage
+        if (sinceLastQueryIn < QUERY_INTERVAL_MS) {
+            LogUtil.w(AppConfig.TAG, "Query interval too short: ${sinceLastQueryIn}ms, skipping")
+            lastQueryTime = queryTime
+            return lastZeroSpeed
+        }
+        val sinceLastQueryInSeconds = sinceLastQueryIn / 1000.0
+
+        var proxyUplink = 0L
+        var proxyDownlink = 0L
+        var directUplink = 0L
+        var directDownlink = 0L
+
+        CoreServiceManager.queryAllOutboundTrafficStats().forEach { stat ->
+            when {
+                stat.tag == AppConfig.TAG_DIRECT -> {
+                    when (stat.direction) {
+                        AppConfig.UPLINK -> directUplink += stat.value
+                        AppConfig.DOWNLINK -> directDownlink += stat.value
+                    }
+                }
+
+                stat.tag.startsWith(AppConfig.TAG_PROXY) -> {
+                    when (stat.direction) {
+                        AppConfig.UPLINK -> proxyUplink += stat.value
+                        AppConfig.DOWNLINK -> proxyDownlink += stat.value
+                    }
+                }
+            }
+        }
+
+        val proxyTotal = proxyUplink + proxyDownlink
+        val directTotal = directUplink + directDownlink
+        val zeroSpeed = proxyTotal + directTotal == 0L
+        if (!zeroSpeed || !lastZeroSpeed) {
+            val text = StringBuilder()
+            appendSpeedString(
+                text, AppConfig.TAG_PROXY,
+                proxyUplink / sinceLastQueryInSeconds,
+                proxyDownlink / sinceLastQueryInSeconds
+            )
+
+            appendSpeedString(
+                text, AppConfig.TAG_DIRECT,
+                directUplink / sinceLastQueryInSeconds,
+                directDownlink / sinceLastQueryInSeconds
+            )
+            updateNotification(text.toString(), proxyTotal, directTotal)
+        }
+        lastQueryTime = queryTime
+        return zeroSpeed
+    }
+
    /**
     * Gets the service instance.
     * @return The service instance.
     */
    private fun getService(): Service? {
-        return V2RayServiceManager.serviceControl?.get()?.getService()
+        return CoreServiceManager.serviceControl?.get()?.getService()
    }
 }
@@ -12,10 +12,10 @@ import com.v2ray.ang.AppConfig.GEOIP_PRIVATE
 import com.v2ray.ang.AppConfig.GEOSITE_PRIVATE
 import com.v2ray.ang.AppConfig.TAG_DIRECT
 import com.v2ray.ang.AppConfig.VPN
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.RulesetItem
-import com.v2ray.ang.dto.SubscriptionItem
 import com.v2ray.ang.dto.V2rayConfig
+import com.v2ray.ang.dto.entities.ProfileItem
+import com.v2ray.ang.dto.entities.RulesetItem
+import com.v2ray.ang.dto.entities.SubscriptionItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.enums.Language
 import com.v2ray.ang.enums.RoutingType
@@ -73,7 +73,7 @@ object SettingsManager {
            return null
        }

-        return JsonUtil.fromJson(assets, Array<RulesetItem>::class.java)?.toMutableList()
+        return JsonUtil.fromJsonSafe(assets, Array<RulesetItem>::class.java)?.toMutableList()
    }

    /**
@@ -97,7 +97,7 @@ object SettingsManager {
        }

        try {
-            val rulesetList = JsonUtil.fromJson(content, Array<RulesetItem>::class.java)?.toMutableList()
+            val rulesetList = JsonUtil.fromJsonSafe(content, Array<RulesetItem>::class.java)?.toMutableList()
            if (rulesetList.isNullOrEmpty()) {
                return false
            }
@@ -191,7 +191,7 @@ object SettingsManager {
        val config = decodeServerConfig(guid) ?: return false
        if (config.configType == EConfigType.CUSTOM) {
            val raw = MmkvManager.decodeServerRaw(guid) ?: return false
-            val v2rayConfig = JsonUtil.fromJson(raw, V2rayConfig::class.java)
+            val v2rayConfig = JsonUtil.fromJsonSafe(raw, V2rayConfig::class.java)
            val exist = v2rayConfig?.routing?.rules?.filter { it.outboundTag == TAG_DIRECT }?.any {
                it.domain?.contains(GEOSITE_PRIVATE) == true || it.ip?.contains(GEOIP_PRIVATE) == true
            }
@@ -246,6 +246,20 @@ object SettingsManager {
            .firstOrNull { it.remarks == remarks }
    }

+    /**
+     * Collects non-empty profile remarks while excluding specific config types.
+     */
+    fun getProfileRemarks(excludeConfigTypes: Set<EConfigType> = setOf(EConfigType.CUSTOM)): List<String> {
+        return decodeAllServerList()
+            .asSequence()
+            .mapNotNull { guid -> decodeServerConfig(guid) }
+            .filter { profile -> profile.configType !in excludeConfigTypes }
+            .map { it.remarks.trim() }
+            .filter { it.isNotEmpty() }
+            .distinct()
+            .toList()
+    }
+
    /**
     * Removes the subscription.
     * If there are no remaining subscriptions,
@@ -393,6 +407,15 @@ object SettingsManager {
        }
    }

+    /**
+     * Get real ping concurrency.
+     * @return The number of concurrent real-ping tests (clamped to 1..64).
+     */
+    fun getRealPingConcurrency(): Int {
+        val value = MmkvManager.decodeSettingsString(AppConfig.PREF_REAL_PING_CONCURRENCY)?.toIntOrNull() ?: 16
+        return value.coerceIn(1, 128)
+    }
+
    /**
     * Get the locale.
     * @return The locale.
@@ -464,6 +487,13 @@ object SettingsManager {
        return mode == null || mode == VPN
    }

+    /**
+     * Check if a root (system-wide) run mode is selected.
+     */
+    fun isRootMode(): Boolean {
+        return MmkvManager.decodeSettingsBool(AppConfig.PREF_ROOT_MODE_ENABLE, false)
+    }
+
    /**
     *  Check if process routing can be used.
     */
@@ -504,6 +534,7 @@ object SettingsManager {
        ensureDefaultValue(AppConfig.PREF_MUX_XUDP_CONCURRENCY, "8")
        ensureDefaultValue(AppConfig.PREF_FRAGMENT_LENGTH, "50-100")
        ensureDefaultValue(AppConfig.PREF_FRAGMENT_INTERVAL, "10-20")
+        ensureDefaultValue(AppConfig.PREF_FRAGMENT_MAXSPLIT, "10")
    }

    private fun ensureDefaultValue(key: String, default: String) {
@@ -562,7 +593,7 @@ object SettingsManager {
            return
        }

-        val guids = JsonUtil.fromJson(oldJson, Array<String>::class.java) ?: run {
+        val guids = JsonUtil.fromJsonSafe(oldJson, Array<String>::class.java) ?: run {
            MmkvManager.encodeSettings(migrationKey, true)
            return
        }
@@ -1,14 +1,11 @@
 package com.v2ray.ang.handler

-import android.os.SystemClock
 import com.v2ray.ang.AppConfig
-import com.v2ray.ang.R
 import com.v2ray.ang.dto.IPAPIInfo
+import com.v2ray.ang.dto.UrlContentRequest
 import com.v2ray.ang.util.HttpUtil
 import com.v2ray.ang.util.JsonUtil
 import com.v2ray.ang.util.LogUtil
-import kotlinx.coroutines.currentCoroutineContext
-import kotlinx.coroutines.isActive
 import java.io.IOException
 import java.net.InetSocketAddress
 import java.net.Socket
@@ -16,29 +13,6 @@ import java.net.UnknownHostException

 object SpeedtestManager {

-    private val tcpTestingSockets = ArrayList<Socket?>()
-
-    /**
-     * Measures the TCP connection time to a given URL and port.
-     *
-     * @param url The URL to connect to.
-     * @param port The port to connect to.
-     * @return The connection time in milliseconds, or -1 if the connection failed.
-     */
-    suspend fun tcping(url: String, port: Int): Long {
-        var time = -1L
-        for (k in 0 until 2) {
-            val one = socketConnectTime(url, port)
-            if (!currentCoroutineContext().isActive) {
-                break
-            }
-            if (one != -1L && (time == -1L || one < time)) {
-                time = one
-            }
-        }
-        return time
-    }
-
    /**
     * Measures the time taken to establish a TCP connection to a given URL and port.
     *
@@ -46,42 +20,34 @@ object SpeedtestManager {
     * @param port The port to connect to.
     * @return The connection time in milliseconds, or -1 if the connection failed.
     */
-    fun socketConnectTime(url: String, port: Int): Long {
+    fun socketConnectTime(url: String, port: Int, timeoutMs: Int = 1500): Long {
+        var socket: Socket? = null
+        val start = System.currentTimeMillis()
+
        try {
-            val socket = Socket()
-            synchronized(this) {
-                tcpTestingSockets.add(socket)
-            }
-            val start = System.currentTimeMillis()
-            socket.connect(InetSocketAddress(url, port), 3000)
-            val time = System.currentTimeMillis() - start
-            synchronized(this) {
-                tcpTestingSockets.remove(socket)
-            }
-            socket.close()
-            return time
+            socket = Socket()
+            socket.connect(InetSocketAddress(url, port), timeoutMs)
+
+            return System.currentTimeMillis() - start
        } catch (e: UnknownHostException) {
            LogUtil.e(AppConfig.TAG, "Unknown host: $url", e)
        } catch (e: IOException) {
-            LogUtil.e(AppConfig.TAG, "socketConnectTime IOException: $e")
+            LogUtil.e(AppConfig.TAG, "socketConnectTime IOException: ${e.message}")
        } catch (e: Exception) {
            LogUtil.e(AppConfig.TAG, "Failed to establish socket connection to $url:$port", e)
+        } finally {
+            socket?.let { s ->
+                try {
+                    if (!s.isClosed) {
+                        s.close()
+                    }
+                } catch (closeEx: IOException) {
+                }
+            }
        }
        return -1
    }

-    /**
-     * Closes all TCP sockets that are currently being tested.
-     */
-    fun closeAllTcpSockets() {
-        synchronized(this) {
-            tcpTestingSockets.forEach {
-                it?.close()
-            }
-            tcpTestingSockets.clear()
-        }
-    }
-
    fun getRemoteIPInfo(): String? {
        val url = MmkvManager.decodeSettingsString(AppConfig.PREF_IP_API_URL)
            .takeIf { !it.isNullOrBlank() } ?: AppConfig.IP_API_URL
@@ -90,8 +56,16 @@ object SpeedtestManager {
        val proxyPassword = SettingsManager.getSocksPassword()
        val httpPort = SettingsManager.getHttpPort()
        if (httpPort == 0) return null
-        val content = HttpUtil.getUrlContent(url, 5000, httpPort, proxyUsername, proxyPassword) ?: return null
-        val ipInfo = JsonUtil.fromJson(content, IPAPIInfo::class.java) ?: return null
+        val content = HttpUtil.getUrlContent(
+            UrlContentRequest(
+                url = url,
+                timeout = 5000,
+                httpPort = httpPort,
+                proxyUsername = proxyUsername,
+                proxyPassword = proxyPassword
+            )
+        ) ?: return null
+        val ipInfo = JsonUtil.fromJsonSafe(content, IPAPIInfo::class.java) ?: return null

        val ip = listOf(
            ipInfo.ip,
@@ -1,12 +1,7 @@
 package com.v2ray.ang.handler

 import android.annotation.SuppressLint
-import android.app.NotificationChannel
-import android.app.NotificationManager
 import android.content.Context
-import android.os.Build
-import androidx.core.app.NotificationCompat
-import androidx.core.app.NotificationManagerCompat
 import androidx.work.Constraints
 import androidx.work.CoroutineWorker
 import androidx.work.ExistingPeriodicWorkPolicy
@@ -18,8 +13,10 @@ import androidx.work.workDataOf
 import com.v2ray.ang.AngApplication
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.R
-import com.v2ray.ang.dto.SubscriptionCache
+import com.v2ray.ang.dto.entities.SubscriptionCache
+import com.v2ray.ang.enums.NotificationChannelType
 import com.v2ray.ang.util.LogUtil
+import com.v2ray.ang.util.NotificationHelper
 import java.util.concurrent.TimeUnit

 object SubscriptionUpdater {
@@ -140,7 +137,7 @@ object SubscriptionUpdater {
        LogUtil.i(
            AppConfig.TAG,
            "SubscriptionUpdater: scheduled [$subId] interval=${intervalMinutes}min " +
-                "initialDelay=${initialDelayMillis / 1000}s policy=$existingWorkPolicy"
+                    "initialDelay=${initialDelayMillis / 1000}s policy=$existingWorkPolicy"
        )
    }

@@ -153,16 +150,6 @@ object SubscriptionUpdater {
    class UpdateTask(context: Context, params: WorkerParameters) :
        CoroutineWorker(context, params) {

-        private val notificationManager = NotificationManagerCompat.from(applicationContext)
-        private val notification =
-            NotificationCompat.Builder(applicationContext, AppConfig.SUBSCRIPTION_UPDATE_CHANNEL)
-                .setWhen(0)
-                .setTicker("Update")
-                .setContentTitle(applicationContext.getString(R.string.title_pref_auto_update_subscription))
-                .setSmallIcon(R.drawable.ic_stat_name)
-                .setCategory(NotificationCompat.CATEGORY_SERVICE)
-                .setPriority(NotificationCompat.PRIORITY_DEFAULT)
-
        @SuppressLint("MissingPermission")
        override suspend fun doWork(): Result {
            val subId = inputData.getString(KEY_SUB_ID)
@@ -173,7 +160,6 @@ object SubscriptionUpdater {
                return Result.success()
            }

-
            val subItem = MmkvManager.decodeSubscription(subId)
            if (subItem == null) {
                LogUtil.w(AppConfig.TAG, "SubscriptionUpdater: no subscription found for $subId")
@@ -187,22 +173,20 @@ object SubscriptionUpdater {

            val sub = SubscriptionCache(subId, subItem)

-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-                notificationManager.createNotificationChannel(
-                    NotificationChannel(
-                        AppConfig.SUBSCRIPTION_UPDATE_CHANNEL,
-                        AppConfig.SUBSCRIPTION_UPDATE_CHANNEL_NAME,
-                        NotificationManager.IMPORTANCE_MIN
-                    )
-                )
-            }
+            // Notify about update start
+            NotificationHelper.notify(
+                NotificationChannelType.SUBSCRIPTION_UPDATE,
+                applicationContext,
+                applicationContext.getString(R.string.title_pref_auto_update_subscription),
+                "Updating ${sub.subscription.remarks}"
+            )

-            notificationManager.notify(3, notification.build())
            LogUtil.i(AppConfig.TAG, "SubscriptionUpdater automatic update: ---${sub.subscription.remarks}")
            AngConfigManager.updateConfigViaSub(sub)
-            notification.setContentText("Updating ${sub.subscription.remarks}")

-            notificationManager.cancel(3)
+            // Clear notification
+            NotificationHelper.cancel(NotificationChannelType.SUBSCRIPTION_UPDATE, applicationContext)
+
            return Result.success()
        }
    }
@@ -1,19 +1,17 @@
 package com.v2ray.ang.handler

-import android.content.Context
 import android.os.Build
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.BuildConfig
 import com.v2ray.ang.dto.CheckUpdateResult
 import com.v2ray.ang.dto.GitHubRelease
+import com.v2ray.ang.dto.UrlContentRequest
 import com.v2ray.ang.extension.concatUrl
 import com.v2ray.ang.util.HttpUtil
 import com.v2ray.ang.util.JsonUtil
 import com.v2ray.ang.util.LogUtil
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
-import java.io.File
-import java.io.FileOutputStream

 object UpdateCheckerManager {
    suspend fun checkForUpdate(includePreRelease: Boolean = false): CheckUpdateResult = withContext(Dispatchers.IO) {
@@ -26,19 +24,32 @@ object UpdateCheckerManager {
        val proxyUsername = SettingsManager.getSocksUsername()
        val proxyPassword = SettingsManager.getSocksPassword()

-        var response = HttpUtil.getUrlContent(url, 5000)
+        var response = HttpUtil.getUrlContent(
+            UrlContentRequest(
+                url = url,
+                timeout = 5000
+            )
+        )
        if (response.isNullOrEmpty()) {
            val httpPort = SettingsManager.getHttpPort()
-            response = HttpUtil.getUrlContent(url, 5000, httpPort, proxyUsername, proxyPassword)
+            response = HttpUtil.getUrlContent(
+                UrlContentRequest(
+                    url = url,
+                    timeout = 5000,
+                    httpPort = httpPort,
+                    proxyUsername = proxyUsername,
+                    proxyPassword = proxyPassword
+                )
+            )
                ?: throw IllegalStateException("Failed to get response")
        }

        val latestRelease = if (includePreRelease) {
-            JsonUtil.fromJson(response, Array<GitHubRelease>::class.java)
+            JsonUtil.fromJsonSafe(response, Array<GitHubRelease>::class.java)
                ?.firstOrNull()
                ?: throw IllegalStateException("No pre-release found")
        } else {
-            JsonUtil.fromJson(response, GitHubRelease::class.java)
+            JsonUtil.fromJsonSafe(response, GitHubRelease::class.java)
        }
        if (latestRelease == null) {
            return@withContext CheckUpdateResult(hasUpdate = false)
@@ -1,7 +1,7 @@
 package com.v2ray.ang.handler

 import com.v2ray.ang.AppConfig
-import com.v2ray.ang.dto.WebDavConfig
+import com.v2ray.ang.dto.entities.WebDavConfig
 import com.v2ray.ang.util.LogUtil
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
@@ -4,9 +4,9 @@ import android.content.BroadcastReceiver
 import android.content.Context
 import android.content.Intent
 import com.v2ray.ang.AppConfig
+import com.v2ray.ang.core.CoreServiceManager
 import com.v2ray.ang.handler.MmkvManager
 import com.v2ray.ang.handler.SubscriptionUpdater
-import com.v2ray.ang.handler.V2RayServiceManager
 import com.v2ray.ang.util.LogUtil

 class BootReceiver : BroadcastReceiver() {
@@ -37,7 +37,7 @@ class BootReceiver : BroadcastReceiver() {
        }

        LogUtil.i(AppConfig.TAG, "BootReceiver: Starting V2Ray service")
-        V2RayServiceManager.startVService(context)
+        CoreServiceManager.startVService(context)
        SubscriptionUpdater.sync(context)
    }
 }
@@ -5,7 +5,7 @@ import android.content.Context
 import android.content.Intent
 import android.text.TextUtils
 import com.v2ray.ang.AppConfig
-import com.v2ray.ang.handler.V2RayServiceManager
+import com.v2ray.ang.core.CoreServiceManager
 import com.v2ray.ang.util.LogUtil

 class TaskerReceiver : BroadcastReceiver() {
@@ -28,12 +28,12 @@ class TaskerReceiver : BroadcastReceiver() {
                return
            } else if (switch) {
                if (guid == AppConfig.TASKER_DEFAULT_GUID) {
-                    V2RayServiceManager.startVServiceFromToggle(context)
+                    CoreServiceManager.startVServiceFromToggle(context)
                } else {
-                    V2RayServiceManager.startVService(context, guid)
+                    CoreServiceManager.startVService(context, guid)
                }
            } else {
-                V2RayServiceManager.stopVService(context)
+                CoreServiceManager.stopVService(context)
            }
        } catch (e: Exception) {
            LogUtil.e(AppConfig.TAG, "Error processing Tasker broadcast", e)
@@ -9,7 +9,7 @@ import android.content.Intent
 import android.widget.RemoteViews
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.R
-import com.v2ray.ang.handler.V2RayServiceManager
+import com.v2ray.ang.core.CoreServiceManager

 class WidgetProvider : AppWidgetProvider() {
    /**
@@ -22,7 +22,7 @@ class WidgetProvider : AppWidgetProvider() {
     */
    override fun onUpdate(context: Context, appWidgetManager: AppWidgetManager, appWidgetIds: IntArray) {
        super.onUpdate(context, appWidgetManager, appWidgetIds)
-        updateWidgetBackground(context, appWidgetManager, appWidgetIds, V2RayServiceManager.isRunning())
+        updateWidgetBackground(context, appWidgetManager, appWidgetIds, CoreServiceManager.isRunning())
    }

    /**
@@ -67,10 +67,10 @@ class WidgetProvider : AppWidgetProvider() {
    override fun onReceive(context: Context, intent: Intent) {
        super.onReceive(context, intent)
        if (AppConfig.BROADCAST_ACTION_WIDGET_CLICK == intent.action) {
-            if (V2RayServiceManager.isRunning()) {
-                V2RayServiceManager.stopVService(context)
+            if (CoreServiceManager.isRunning()) {
+                CoreServiceManager.stopVService(context)
            } else {
-                V2RayServiceManager.startVServiceFromToggle(context)
+                CoreServiceManager.startVServiceFromToggle(context)
            }
        } else if (AppConfig.BROADCAST_ACTION_ACTIVITY == intent.action) {
            AppWidgetManager.getInstance(context)?.let { manager ->
@@ -0,0 +1,50 @@
+package com.v2ray.ang.root
+
+import android.content.Context
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.handler.MmkvManager
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.cancelAndJoin
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
+
+
+object RootLanSharing {
+
+    private var lanSharingStarted = false
+    private var lanShareJob: Job? = null
+
+    /**
+     * Optional root feature: share the proxy with tethered LAN/USB clients while the
+     * device itself stays on the VpnService. Runs a dedicated client hev-socks5-tunnel
+     * off the main thread so the su calls don't block service startup.
+     * The cheap, usually-false preference is checked first so the common path
+     * short-circuits before touching root state.
+     */
+    fun startClientSharing(context: Context): Boolean {
+        if (MmkvManager.decodeSettingsBool(AppConfig.PREF_ROOT_LAN_SHARING) && RootManager.cachedRoot()) {
+            if (lanShareJob != null) return false
+
+            lanSharingStarted = true
+            lanShareJob = CoroutineScope(Dispatchers.IO).launch { RootProxyManager.startClientSharing(context) }
+        }
+
+        return true
+    }
+
+    /**
+     * Remove LAN/tethering sharing rules + helper before stopping the core. Wait for the
+     * async setup to finish first, otherwise a stop during setup tears down before the
+     * rules are installed and they leak (orphan FORWARD/policy-routing rules + client tun).
+     */
+    fun stopClientSharing(context: Context) {
+        if (!lanSharingStarted) return
+
+        lanSharingStarted = false
+        runBlocking { lanShareJob?.cancelAndJoin() }
+        lanShareJob = null
+        RootProxyManager.stop(context)
+    }
+}
@@ -0,0 +1,64 @@
+package com.v2ray.ang.root
+
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.root.RootManager.isRootAvailable
+import com.v2ray.ang.root.RootManager.refresh
+import com.v2ray.ang.util.LogUtil
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import java.util.concurrent.TimeUnit
+
+/**
+ * Detects whether the device grants root (`su`) access.
+ *
+ * The result is cached after the first successful probe. Probing spawns `su` and
+ * blocks, so [refresh] (a suspending call on [Dispatchers.IO]) should be used from UI
+ * code; [isRootAvailable] may block and must not be called on the main thread the first time.
+ */
+object RootManager {
+
+    @Volatile
+    private var cached: Boolean? = null
+
+    /** Last known result without probing. Defaults to false when never probed. */
+    fun cachedRoot(): Boolean = cached ?: false
+
+    /**
+     * Returns whether root is available, probing once if unknown.
+     * May block while `su` is spawned; avoid calling on the main thread before a probe.
+     */
+    fun isRootAvailable(forceRefresh: Boolean = false): Boolean {
+        if (!forceRefresh) cached?.let { return it }
+        val result = probe()
+        cached = result
+        return result
+    }
+
+    /** Probes root off the main thread, updates the cache, and returns the result. */
+    suspend fun refresh(): Boolean = withContext(Dispatchers.IO) {
+        val result = probe()
+        cached = result
+        result
+    }
+
+    private fun probe(): Boolean {
+        return try {
+            val process = ProcessBuilder("su", "-c", "id -u")
+                .redirectErrorStream(true)
+                .start()
+            val output = process.inputStream.bufferedReader().use { it.readText() }.trim()
+            val finished = process.waitFor(10, TimeUnit.SECONDS)
+            if (!finished) {
+                process.destroy()
+                LogUtil.w(AppConfig.TAG, "RootManager: su probe timed out")
+                return false
+            }
+            val isRoot = process.exitValue() == 0 && output.lineSequence().lastOrNull()?.trim() == "0"
+            LogUtil.i(AppConfig.TAG, "RootManager: root available = $isRoot")
+            isRoot
+        } catch (e: Exception) {
+            LogUtil.w(AppConfig.TAG, "RootManager: no root access (${e.message})")
+            false
+        }
+    }
+}
@@ -0,0 +1,469 @@
+package com.v2ray.ang.root
+
+import android.content.Context
+import android.os.Process
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.handler.MmkvManager
+import com.v2ray.ang.handler.SettingsManager
+import com.v2ray.ang.root.RootProxyManager.TABLE
+import com.v2ray.ang.root.RootProxyManager.TUN
+import com.v2ray.ang.root.RootProxyManager.teardown
+import com.v2ray.ang.util.LogUtil
+import com.v2ray.ang.util.PackageUidResolver
+import com.v2ray.ang.util.Utils
+import java.io.File
+
+/**
+ * Installs and removes the iptables / ip-rule routing that pushes system-wide traffic
+ *
+ * A bundled `hev-socks5-tunnel` binary (run as root) creates a tun device and forwards it to
+ * the in-process core's SOCKS inbound; a mangle MARK chain plus a dedicated routing table /
+ * ip rule steer all traffic into the tun. Full TCP + UDP.
+ *
+ * All rules live in dedicated chains ([AppConfig.ROOT_IPTABLES_CHAIN] in the mangle
+ * table, [AppConfig.ROOT_FWD_CHAIN] for LAN sharing) plus a dedicated routing table, so
+ * [teardown] is a clean, bounded flush. Teardown runs before every setup (to clear stale
+ * rules) and on every stop path — leaving rules behind after the core dies would break
+ * the device's connectivity.
+ */
+object RootProxyManager {
+
+    private const val CHAIN = AppConfig.ROOT_IPTABLES_CHAIN
+    private const val TUN = AppConfig.ROOT_TUN_NAME
+    private const val TABLE = AppConfig.ROOT_ROUTE_TABLE
+    private const val PRIORITY = AppConfig.ROOT_RULE_PRIORITY
+    private const val FWMARK = AppConfig.ROOT_FWMARK
+    private const val MARK = AppConfig.ROOT_MARK_ROUTE
+
+    // Local / private / multicast destinations that must never be proxied.
+    private val bypassCidrs = listOf(
+        "0.0.0.0/8", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16",
+        "172.16.0.0/12", "192.168.0.0/16", "224.0.0.0/4", "240.0.0.0/4"
+    )
+
+    // IPv6 equivalents (loopback, link-local, ULA/private, multicast). Feeding the v4 list
+    // above to ip6tables silently fails, so the v6 chain needs its own.
+    private val bypassCidrsV6 = listOf(
+        "::1/128", "fe80::/10", "fc00::/7", "ff00::/8"
+    )
+
+    fun start(context: Context): Boolean {
+        teardown(context)
+        val script = buildTun2socksSetup(context) ?: return false
+        val result = RootShell.runScript(context, "setup_rules.sh", script)
+        if (!result.success) {
+            LogUtil.e(AppConfig.TAG, "RootProxyManager: setup failed, rolling back:\n${result.output}")
+            teardown(context)
+            return false
+        }
+        return true
+    }
+
+    /**
+     * Set up LAN/tethering sharing while the device itself uses another mode (e.g. VPN
+     * mode). Runs a dedicated client tun2socks into the in-process core's SOCKS inbound
+     * and forwards tethered clients into it, WITHOUT capturing the device's own traffic
+     * (that keeps flowing through the VpnService). Requires root.
+     */
+    fun startClientSharing(context: Context): Boolean {
+        teardown(context)
+        val script = buildTun2socksSetup(context, captureDeviceTraffic = false, forceLanShare = true)
+            ?: return false
+        val result = RootShell.runScript(context, "setup_rules.sh", script)
+        if (!result.success) {
+            LogUtil.e(AppConfig.TAG, "RootProxyManager: client sharing setup failed:\n${result.output}")
+            teardown(context)
+            return false
+        }
+        LogUtil.i(AppConfig.TAG, "RootProxyManager: LAN client sharing installed")
+        return true
+    }
+
+    /** Remove all rules and stop helper processes. Safe to call repeatedly. */
+    fun stop(context: Context) {
+        teardown(context)
+        LogUtil.i(AppConfig.TAG, "RootProxyManager: rules removed")
+    }
+
+    private fun teardown(context: Context) {
+        RootShell.runScript(context, "teardown_rules.sh", buildTeardown(context))
+    }
+
+    // --------------------------------------------------------------- TUN2SOCKS
+
+    /**
+     * @param captureDeviceTraffic when true (Root mode) the device's own OUTPUT traffic is
+     *   marked into the tun. When false (VPN-mode LAN sharing) the device keeps using the
+     *   VpnService and only forwarded clients are routed into this tun.
+     * @param forceLanShare force the LAN/tethering forward rules on regardless of the pref
+     *   (used by VPN-mode sharing, where the whole point is forwarding clients).
+     */
+    private fun buildTun2socksSetup(
+        context: Context,
+        captureDeviceTraffic: Boolean = true,
+        forceLanShare: Boolean = false,
+    ): String? {
+        val bin = File(context.applicationInfo.nativeLibraryDir, AppConfig.ROOT_TUN2SOCKS_BIN)
+        if (!bin.exists()) {
+            LogUtil.e(AppConfig.TAG, "RootProxyManager: hev-socks5-tunnel binary missing at ${bin.absolutePath}")
+            return null
+        }
+        val appUid = context.applicationInfo.uid
+        val port = SettingsManager.getSocksPort()
+        val runDir = File(context.filesDir, AppConfig.ROOT_RUNTIME_DIR).apply { mkdirs() }
+        val pidFile = File(runDir, "tun2socks.pid").absolutePath
+        val logFile = File(runDir, "tun2socks.log").absolutePath
+        val cfgFile = File(runDir, "tun2socks.yml").absolutePath
+        val oomGuardPid = File(runDir, "oomguard.pid").absolutePath
+        val ipv6 = MmkvManager.decodeSettingsBool(AppConfig.PREF_IPV6_ENABLED)
+        val lanShare = forceLanShare || MmkvManager.decodeSettingsBool(AppConfig.PREF_ROOT_LAN_SHARING)
+        val corePid = Process.myPid()
+
+        // Per-app proxy/bypass (mirrors what VpnService does via allowed/disallowed apps).
+        val perAppEnabled = MmkvManager.decodeSettingsBool(AppConfig.PREF_PER_APP_PROXY)
+        val bypassApps = MmkvManager.decodeSettingsBool(AppConfig.PREF_BYPASS_APPS)
+        val selectedUids = if (perAppEnabled) {
+            val pkgs = MmkvManager.decodeSettingsStringSet(AppConfig.PREF_PER_APP_PROXY_SET)?.toList().orEmpty()
+            if (pkgs.isNotEmpty()) PackageUidResolver.packageNamesToUids(context, pkgs) else emptyList()
+        } else {
+            emptyList()
+        }
+
+        return buildString {
+            appendLine("set -e")
+            appendLine("BIN='${bin.absolutePath}'")
+            // Protect the core (this app process) from the Android low-memory killer.
+            // system_server keeps recomputing oom_score_adj for app processes, so a single
+            // write would be reverted — re-pin it from a small root loop instead.
+            appendLine("nohup sh -c 'while true; do echo ${AppConfig.ROOT_OOM_SCORE} > /proc/$corePid/oom_score_adj 2>/dev/null; sleep 5; done' >/dev/null 2>&1 &")
+            appendLine("echo \$! > '$oomGuardPid'")
+            // tun device node
+            appendLine("if [ ! -e /dev/net/tun ]; then mkdir -p /dev/net; mknod /dev/net/tun c 10 200; chmod 666 /dev/net/tun; fi")
+            // hev-socks5-tunnel config: it creates the tun ($TUN) itself and forwards it to the
+            // in-process core's SOCKS inbound on loopback. MTU comes from the existing VPN MTU
+            // setting. No fwmark on hev's sockets: its only upstream connection is to 127.0.0.1
+            // (loopback, already RETURNed by the 127.0.0.0/8 bypass) and the core's real outbound
+            // runs as the app uid (RETURNed by the uid-owner rule), so traffic can't loop.
+            appendLine("cat > '$cfgFile' <<'HEVCFG'")
+            append(buildHevConfig(port, ipv6))
+            appendLine("HEVCFG")
+            appendLine("nohup \"\$BIN\" '$cfgFile' >'$logFile' 2>&1 &")
+            appendLine("T2S_PID=\$!")
+            appendLine("echo \$T2S_PID > '$pidFile'")
+            appendLine("echo ${AppConfig.ROOT_OOM_SCORE} > /proc/\$T2S_PID/oom_score_adj 2>/dev/null || true")
+            // wait for the interface hev creates to appear
+            appendLine("i=0; while [ \$i -lt 20 ]; do ip link show $TUN >/dev/null 2>&1 && break; sleep 0.3; i=\$((i+1)); done")
+            appendLine("ip link show $TUN >/dev/null 2>&1 || { echo 'tun device did not come up'; cat '$logFile' 2>/dev/null; exit 1; }")
+            // relax reverse-path filtering for the tun
+            appendLine("echo 0 > /proc/sys/net/ipv4/conf/$TUN/rp_filter 2>/dev/null || true")
+            appendLine("echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter 2>/dev/null || true")
+            // address + default route in a dedicated table
+            appendLine("ip addr add ${AppConfig.ROOT_TUN_ADDR_V4} dev $TUN 2>/dev/null || true")
+            appendLine("ip link set dev $TUN up")
+            appendLine("ip route replace default dev $TUN table $TABLE")
+            appendLine("ip rule add fwmark $MARK table $TABLE priority $PRIORITY")
+            // mark the device's own packets into the tun (Root mode only)
+            if (captureDeviceTraffic) {
+                append(buildMangleMarking("iptables", appUid, perAppEnabled, bypassApps, selectedUids))
+            }
+            // optionally route hotspot / USB-tethered clients through the tun too
+            if (lanShare) {
+                append(buildLanShareSetup(captureDeviceTraffic, ipv6))
+            }
+            if (captureDeviceTraffic) {
+                // IPv6 is best-effort: never fail the (working) IPv4 setup over it.
+                appendLine("set +e")
+                if (ipv6) {
+                    // route the device's v6 into the tun, same as v4
+                    appendLine("ip -6 addr add ${AppConfig.ROOT_TUN_ADDR_V6} dev $TUN 2>/dev/null || true")
+                    appendLine("ip -6 route replace default dev $TUN table $TABLE 2>/dev/null || true")
+                    appendLine("ip -6 rule add fwmark $MARK table $TABLE priority $PRIORITY 2>/dev/null || true")
+                    append(buildMangleMarking("ip6tables", appUid, perAppEnabled, bypassApps, selectedUids))
+                } else {
+                    // v6 disabled: blackhole native v6 egress for the captured apps so they
+                    // fall back to v4-through-proxy, matching what a v4-only VpnService does.
+                    append(buildV6Blackhole(appUid, perAppEnabled, bypassApps, selectedUids))
+                }
+            }
+        }
+    }
+
+    /**
+     * hev-socks5-tunnel YAML config. hev creates the tun device named [TUN] itself, assigns it
+     * the tun addresses, and forwards everything it receives to the core's SOCKS inbound on
+     * loopback (TCP + UDP). MTU is taken from the existing VPN MTU setting. v6 is only given a
+     * tun address when IPv6 is enabled; whether v6 actually flows in is decided separately by
+     * the v6 route into [TABLE].
+     */
+    private fun buildHevConfig(socksPort: Int, ipv6: Boolean): String {
+        val v4 = AppConfig.ROOT_TUN_ADDR_V4.substringBefore("/")
+        val v6 = AppConfig.ROOT_TUN_ADDR_V6.substringBefore("/")
+        return buildString {
+            appendLine("tunnel:")
+            appendLine("  name: '$TUN'")
+            appendLine("  mtu: ${SettingsManager.getVpnMtu()}")
+            appendLine("  multi-queue: true")
+            appendLine("  ipv4: '$v4'")
+            if (ipv6) appendLine("  ipv6: '$v6'")
+            appendLine("socks5:")
+            appendLine("  port: $socksPort")
+            appendLine("  address: '${AppConfig.LOOPBACK}'")
+            appendLine("  udp: 'udp'")
+            appendLine("  tcp-fastopen: true")
+        }
+    }
+
+    /**
+     * mangle OUTPUT marking chain (ipv4/ipv6). Mirrors VpnService's capture behavior:
+     * - all-apps (no per-app): mark EVERY remaining uid (incl uid 0 + all system uids), so
+     *   nothing is missed;
+     * - bypass mode: the selected apps go fully direct, everything else is captured;
+     * - proxy mode: only the selected apps are captured.
+     */
+    private fun buildMangleMarking(
+        cmd: String,
+        appUid: Int,
+        perAppEnabled: Boolean,
+        bypassApps: Boolean,
+        selectedUids: List<String>,
+    ): String {
+        val allowMode = perAppEnabled && !bypassApps
+        val bypassSelected = perAppEnabled && bypassApps && selectedUids.isNotEmpty()
+        return buildString {
+            appendLine("$cmd -t mangle -N $CHAIN 2>/dev/null || true")
+            appendLine("$cmd -t mangle -F $CHAIN")
+            // the app's own core traffic (the real outbound) must not loop back into the tun.
+            // The $FWMARK RETURN is kept defensively (hev itself only talks to loopback, which
+            // the 127.0.0.0/8 bypass below already RETURNs).
+            appendLine("$cmd -t mangle -A $CHAIN -m mark --mark $FWMARK -j RETURN")
+            appendLine("$cmd -t mangle -A $CHAIN -m owner --uid-owner $appUid -j RETURN")
+            // bypass mode: selected apps go fully direct (incl their DNS)
+            if (bypassSelected) {
+                selectedUids.forEach { appendLine("$cmd -t mangle -A $CHAIN -m owner --uid-owner $it -j RETURN") }
+            }
+            // Route DNS through the core for ALL modes, with no uid filter. On Android the
+            // DNS query is sent by netd (a shared system uid) on behalf of the app, not under
+            // the app's own uid, so it can't be attributed to a selected uid via owner-match.
+            // This MUST also run before the LAN-bypass RETURNs below, otherwise a query to a
+            // LAN/router resolver (192.168.x / 10.x) would be returned direct and resolved by
+            // the local ISP resolver (DNS leak + CDN mis-resolution, e.g. Instagram media).
+            // The MARK survives a later RETURN, so the marked query still routes into the tun.
+            appendLine("$cmd -t mangle -A $CHAIN -p udp --dport 53 -j MARK --set-xmark $MARK")
+            appendLine("$cmd -t mangle -A $CHAIN -p tcp --dport 53 -j MARK --set-xmark $MARK")
+            // keep LAN / private destinations direct (per-family CIDR list)
+            val cidrs = if (cmd == "ip6tables") bypassCidrsV6 else bypassCidrs
+            cidrs.forEach { appendLine("$cmd -t mangle -A $CHAIN -d $it -j RETURN") }
+            if (allowMode) {
+                // Proxy ONLY the explicitly selected apps. If nothing resolved (e.g. the
+                // selected packages failed to resolve to uids at early boot), mark nothing
+                // instead of falling through to the catch-all below: a fail-open here would
+                // tunnel every unselected app — both a privacy leak and the "per-app proxies
+                // everything after a reboot" bug.
+                selectedUids.forEach { appendLine("$cmd -t mangle -A $CHAIN -m owner --uid-owner $it -j MARK --set-xmark $MARK") }
+            } else {
+                // all-apps mode (per-app off) or bypass mode: capture EVERY remaining uid
+                // (incl uid 0 + system uids)
+                appendLine("$cmd -t mangle -A $CHAIN -j MARK --set-xmark $MARK")
+            }
+            appendLine("$cmd -t mangle -D OUTPUT -j $CHAIN 2>/dev/null || true")
+            appendLine("$cmd -t mangle -A OUTPUT -j $CHAIN")
+        }
+    }
+
+    /**
+     * Blackhole native IPv6 egress for the captured app population when IPv6 is NOT routed
+     * into the tun. A v4-only VpnService has no v6 route, so the kernel rejects apps' v6 and
+     * they fall back to IPv4; Root mode has to reproduce that explicitly, otherwise v6-capable
+     * apps reach destinations natively, bypassing the proxy / leaking. REJECT (not DROP) gives
+     * an instant failure so happy-eyeballs falls back to v4 without a timeout.
+     *
+     * Exemptions mirror the v4 chain: the tun2socks helper (fwmark), the app's own core (uid),
+     * loopback, link-local / multicast (NDP/RA/MLD) and ULA/LAN destinations. Per-app selection
+     * is honored: in bypass mode the bypassed apps keep native v6; in proxy mode only the
+     * selected apps lose v6 (everything else stays fully direct).
+     */
+    private fun buildV6Blackhole(
+        appUid: Int,
+        perAppEnabled: Boolean,
+        bypassApps: Boolean,
+        selectedUids: List<String>,
+    ): String {
+        val chain = AppConfig.ROOT_V6_CHAIN
+        val allowMode = perAppEnabled && !bypassApps
+        val bypassSelected = perAppEnabled && bypassApps && selectedUids.isNotEmpty()
+        val reject = "-j REJECT --reject-with icmp6-adm-prohibited"
+        return buildString {
+            appendLine("ip6tables -t filter -N $chain 2>/dev/null || true")
+            appendLine("ip6tables -t filter -F $chain")
+            // never touch the helper, the core, loopback, NDP/link-local/multicast or LAN
+            appendLine("ip6tables -t filter -A $chain -m mark --mark $FWMARK -j RETURN")
+            appendLine("ip6tables -t filter -A $chain -m owner --uid-owner $appUid -j RETURN")
+            appendLine("ip6tables -t filter -A $chain -o lo -j RETURN")
+            bypassCidrsV6.forEach { appendLine("ip6tables -t filter -A $chain -d $it -j RETURN") }
+            // bypass mode: bypassed apps keep their native v6
+            if (bypassSelected) {
+                selectedUids.forEach { appendLine("ip6tables -t filter -A $chain -m owner --uid-owner $it -j RETURN") }
+            }
+            if (allowMode) {
+                // proxy mode: only the selected apps lose v6 (so they fall back to v4-via-proxy).
+                // None resolved -> reject nothing, mirroring the v4 chain's fail-closed handling.
+                selectedUids.forEach { appendLine("ip6tables -t filter -A $chain -m owner --uid-owner $it $reject") }
+            } else {
+                // all-apps / bypass: reject everyone left
+                appendLine("ip6tables -t filter -A $chain $reject")
+            }
+            appendLine("ip6tables -t filter -D OUTPUT -j $chain 2>/dev/null || true")
+            appendLine("ip6tables -t filter -A OUTPUT -j $chain")
+        }
+    }
+
+    // -------------------------------------------------- LAN / tethering sharing
+
+    /**
+     * Route Wi-Fi-hotspot / USB-tethered clients through the tun as well (ipv4).
+     * Best-effort: wrapped in `set +e` so a failure here never breaks the working proxy.
+     * Mirrors Magic_V2Ray's hotspot rules (FORWARD accept, DNS DNAT, source-based policy
+     * routing for private client ranges, MSS clamp).
+     */
+    private fun buildLanShareSetup(captureDeviceTraffic: Boolean, ipv6: Boolean): String {
+        val fwd = AppConfig.ROOT_FWD_CHAIN
+        val dnsChain = AppConfig.ROOT_DNS_CHAIN
+        val v6fwd = AppConfig.ROOT_V6_FWD_CHAIN
+        val v6pre = AppConfig.ROOT_V6_PRE_CHAIN
+        // Use the app's configured remote DNS (first plain IPv4) as the DNAT target for
+        // tethered clients; fall back to the default when it's a DoH/DoT/IPv6 value that
+        // can't be a DNAT target.
+        val dns = SettingsManager.getRemoteDnsServers()
+            .firstOrNull { Utils.isPureIpAddress(it) && !it.contains(":") }
+            ?: AppConfig.ROOT_LAN_DNS
+        val lanCidrs = listOf("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
+        return buildString {
+            appendLine("set +e")
+            appendLine("echo 1 > /proc/sys/net/ipv4/ip_forward 2>/dev/null || true")
+            // forward traffic to/from the tun
+            appendLine("iptables -N $fwd 2>/dev/null || true")
+            appendLine("iptables -F $fwd")
+            appendLine("iptables -A $fwd -i $TUN -j ACCEPT")
+            appendLine("iptables -A $fwd -o $TUN -j ACCEPT")
+            appendLine("iptables -D FORWARD -j $fwd 2>/dev/null || true")
+            appendLine("iptables -I FORWARD -j $fwd")
+            // clamp MSS to avoid TLS fragmentation overhead through the tunnel
+            appendLine("iptables -t mangle -D FORWARD -o $TUN -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1350 2>/dev/null || true")
+            appendLine("iptables -t mangle -A FORWARD -o $TUN -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1350")
+            // hijack tethered clients' DNS into a dedicated chain so it resolves through the
+            // tunnel; the chain keeps teardown independent of the resolver IP
+            appendLine("iptables -t nat -N $dnsChain 2>/dev/null || true")
+            appendLine("iptables -t nat -F $dnsChain")
+            lanCidrs.forEach {
+                appendLine("iptables -t nat -A $dnsChain ! -i $TUN -d $it -p udp --dport 53 -j DNAT --to $dns")
+            }
+            appendLine("iptables -t nat -D PREROUTING -j $dnsChain 2>/dev/null || true")
+            appendLine("iptables -t nat -A PREROUTING -j $dnsChain")
+            // policy routing: return-path via main, LAN direct, the rest via the tun table
+            appendLine("ip rule add iif lo goto 6000 pref 5000 2>/dev/null || true")
+            appendLine("ip rule add iif $TUN lookup main suppress_prefixlength 0 pref 5010 2>/dev/null || true")
+            appendLine("ip rule add iif $TUN goto 6000 pref 5020 2>/dev/null || true")
+            appendLine("ip rule add to 10.0.0.0/8 lookup main pref 5025 2>/dev/null || true")
+            appendLine("ip rule add to 172.16.0.0/12 lookup main pref 5026 2>/dev/null || true")
+            appendLine("ip rule add to 192.168.0.0/16 lookup main pref 5027 2>/dev/null || true")
+            appendLine("ip rule add from 10.0.0.0/8 lookup $TABLE pref 5030 2>/dev/null || true")
+            appendLine("ip rule add from 172.16.0.0/12 lookup $TABLE pref 5040 2>/dev/null || true")
+            appendLine("ip rule add from 192.168.0.0/16 lookup $TABLE pref 5050 2>/dev/null || true")
+            appendLine("ip rule add nop pref 6000 2>/dev/null || true")
+
+            // ---------------------------------------------------------- IPv6 clients
+            // Tethered/hotspot clients get a native (RA-assigned) global IPv6. The IPv4 rules
+            // above don't touch it, so it egresses the upstream interface directly, bypassing
+            // the proxy = IPv6 leak. Handle it explicitly (mirrors vincentng295/Magic_V2Ray
+            // cae4f7f): route it through the tun when v6 is enabled, reject it when it isn't.
+            appendLine("ip6tables -N $v6fwd 2>/dev/null || true")
+            appendLine("ip6tables -F $v6fwd")
+            appendLine("ip6tables -D FORWARD -j $v6fwd 2>/dev/null || true")
+            appendLine("ip6tables -I FORWARD -j $v6fwd")
+            if (ipv6) {
+                // When the device itself isn't capturing v6 (VPN-mode sharing) the tun table
+                // has no v6 default and the tun has no v6 address — add them so marked client
+                // v6 has somewhere to go. In Root mode the device-capture block already did.
+                if (!captureDeviceTraffic) {
+                    appendLine("ip -6 addr add ${AppConfig.ROOT_TUN_ADDR_V6} dev $TUN 2>/dev/null || true")
+                    appendLine("ip -6 route replace default dev $TUN table $TABLE 2>/dev/null || true")
+                    appendLine("ip -6 rule add fwmark $MARK table $TABLE priority $PRIORITY 2>/dev/null || true")
+                }
+                // allow forwarding to/from the tun
+                appendLine("ip6tables -A $v6fwd -i $TUN -j ACCEPT")
+                appendLine("ip6tables -A $v6fwd -o $TUN -j ACCEPT")
+                // mark forwarded (non-locally-sourced) client v6 into the tun table. DNS first
+                // so a query to a LAN/router resolver is still tunneled (MARK survives RETURN);
+                // keep loopback, link-local (NDP/RA) and ULA/multicast direct.
+                appendLine("ip6tables -t mangle -N $v6pre 2>/dev/null || true")
+                appendLine("ip6tables -t mangle -F $v6pre")
+                appendLine("ip6tables -t mangle -A $v6pre ! -i $TUN -p udp --dport 53 -j MARK --set-xmark $MARK")
+                appendLine("ip6tables -t mangle -A $v6pre ! -i $TUN -p tcp --dport 53 -j MARK --set-xmark $MARK")
+                bypassCidrsV6.forEach { appendLine("ip6tables -t mangle -A $v6pre ! -i $TUN -d $it -j RETURN") }
+                appendLine("ip6tables -t mangle -A $v6pre ! -i $TUN -j MARK --set-xmark $MARK")
+                appendLine("ip6tables -t mangle -D PREROUTING -j $v6pre 2>/dev/null || true")
+                appendLine("ip6tables -t mangle -A PREROUTING -j $v6pre")
+                // fail closed: any forwarded v6 that wasn't marked into the tun (e.g. the
+                // addrtype match is unavailable, or marking failed) is rejected rather than
+                // leaked straight out the upstream interface.
+                appendLine("ip6tables -A $v6fwd -j REJECT --reject-with icmp6-no-route")
+            } else {
+                // v6 disabled: reject forwarded clients' native v6 so it can't leak past the
+                // proxy (the device's own v6 is blackholed separately in OUTPUT).
+                appendLine("ip6tables -A $v6fwd -j REJECT --reject-with icmp6-no-route")
+            }
+        }
+    }
+
+    // ---------------------------------------------------------------- teardown
+
+    private fun buildTeardown(context: Context): String {
+        val runDir = File(context.filesDir, AppConfig.ROOT_RUNTIME_DIR)
+        val pidFile = File(runDir, "tun2socks.pid").absolutePath
+        val oomGuardPid = File(runDir, "oomguard.pid").absolutePath
+        val corePid = Process.myPid()
+        return buildString {
+            // mangle (TUN2SOCKS), both families
+            for (cmd in listOf("iptables", "ip6tables")) {
+                appendLine("$cmd -t mangle -D OUTPUT -j $CHAIN 2>/dev/null || true")
+                appendLine("$cmd -t mangle -F $CHAIN 2>/dev/null || true")
+                appendLine("$cmd -t mangle -X $CHAIN 2>/dev/null || true")
+            }
+            // IPv6 blackhole chain (only set up when v6 is disabled; harmless if absent)
+            appendLine("ip6tables -t filter -D OUTPUT -j ${AppConfig.ROOT_V6_CHAIN} 2>/dev/null || true")
+            appendLine("ip6tables -t filter -F ${AppConfig.ROOT_V6_CHAIN} 2>/dev/null || true")
+            appendLine("ip6tables -t filter -X ${AppConfig.ROOT_V6_CHAIN} 2>/dev/null || true")
+            // routing rule + table
+            appendLine("ip rule del fwmark $MARK table $TABLE priority $PRIORITY 2>/dev/null || true")
+            appendLine("ip -6 rule del fwmark $MARK table $TABLE priority $PRIORITY 2>/dev/null || true")
+            appendLine("ip route flush table $TABLE 2>/dev/null || true")
+            appendLine("ip -6 route flush table $TABLE 2>/dev/null || true")
+            // LAN / tethering sharing (always cleaned, harmless if it was never set up)
+            appendLine("iptables -D FORWARD -j ${AppConfig.ROOT_FWD_CHAIN} 2>/dev/null || true")
+            appendLine("iptables -F ${AppConfig.ROOT_FWD_CHAIN} 2>/dev/null || true")
+            appendLine("iptables -X ${AppConfig.ROOT_FWD_CHAIN} 2>/dev/null || true")
+            appendLine("iptables -t mangle -D FORWARD -o $TUN -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1350 2>/dev/null || true")
+            appendLine("iptables -t nat -D PREROUTING -j ${AppConfig.ROOT_DNS_CHAIN} 2>/dev/null || true")
+            appendLine("iptables -t nat -F ${AppConfig.ROOT_DNS_CHAIN} 2>/dev/null || true")
+            appendLine("iptables -t nat -X ${AppConfig.ROOT_DNS_CHAIN} 2>/dev/null || true")
+            // IPv6 LAN-sharing chains (forward accept/reject + forwarded-client marking)
+            appendLine("ip6tables -D FORWARD -j ${AppConfig.ROOT_V6_FWD_CHAIN} 2>/dev/null || true")
+            appendLine("ip6tables -F ${AppConfig.ROOT_V6_FWD_CHAIN} 2>/dev/null || true")
+            appendLine("ip6tables -X ${AppConfig.ROOT_V6_FWD_CHAIN} 2>/dev/null || true")
+            appendLine("ip6tables -t mangle -D PREROUTING -j ${AppConfig.ROOT_V6_PRE_CHAIN} 2>/dev/null || true")
+            appendLine("ip6tables -t mangle -F ${AppConfig.ROOT_V6_PRE_CHAIN} 2>/dev/null || true")
+            appendLine("ip6tables -t mangle -X ${AppConfig.ROOT_V6_PRE_CHAIN} 2>/dev/null || true")
+            for (pref in listOf(5000, 5010, 5020, 5025, 5026, 5027, 5030, 5040, 5050, 6000)) {
+                appendLine("ip rule del pref $pref 2>/dev/null || true")
+            }
+            // tun device down + helper process
+            appendLine("ip link set dev $TUN down 2>/dev/null || true")
+            appendLine("[ -f '$pidFile' ] && kill \$(cat '$pidFile') 2>/dev/null || true")
+            appendLine("rm -f '$pidFile'")
+            // stop the OOM re-pin loop and restore the core process's LMK priority
+            appendLine("[ -f '$oomGuardPid' ] && kill \$(cat '$oomGuardPid') 2>/dev/null || true")
+            appendLine("rm -f '$oomGuardPid'")
+            appendLine("echo 0 > /proc/$corePid/oom_score_adj 2>/dev/null || true")
+        }
+    }
+}
@@ -0,0 +1,54 @@
+package com.v2ray.ang.root
+
+import android.content.Context
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.util.LogUtil
+import java.io.File
+import java.util.concurrent.TimeUnit
+
+/**
+ * Minimal root command runner backed by the `su` binary.
+ *
+ * Scripts are written to the app's private root runtime dir and executed with
+ * `su -c sh <file>` so shell quoting stays simple. stderr is merged into stdout to
+ * avoid pipe-buffer deadlocks.
+ */
+object RootShell {
+
+    data class Result(val code: Int, val output: String) {
+        val success: Boolean get() = code == 0
+    }
+
+    /** Write [script] to `<filesDir>/root/<name>` and run it as root. */
+    fun runScript(context: Context, name: String, script: String): Result {
+        val dir = File(context.filesDir, AppConfig.ROOT_RUNTIME_DIR).apply { mkdirs() }
+        val file = File(dir, name).apply {
+            writeText(script)
+            setExecutable(true, false)
+        }
+        return exec("sh ${file.absolutePath}")
+    }
+
+    fun exec(command: String, timeoutSeconds: Long = 30): Result {
+        return try {
+            val process = ProcessBuilder("su", "-c", command)
+                .redirectErrorStream(true)
+                .start()
+            val output = process.inputStream.bufferedReader().use { it.readText() }
+            val finished = process.waitFor(timeoutSeconds, TimeUnit.SECONDS)
+            if (!finished) {
+                process.destroy()
+                LogUtil.e(AppConfig.TAG, "RootShell: timed out: $command")
+                return Result(-1, output)
+            }
+            val result = Result(process.exitValue(), output)
+            if (!result.success) {
+                LogUtil.w(AppConfig.TAG, "RootShell: '$command' exited ${result.code}: ${output.trim()}")
+            }
+            result
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "RootShell: failed to run '$command'", e)
+            Result(-1, e.message ?: e.javaClass.simpleName)
+        }
+    }
+}
@@ -6,20 +6,20 @@ import android.content.Intent
 import android.os.IBinder
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.contracts.ServiceControl
+import com.v2ray.ang.core.CoreServiceManager
 import com.v2ray.ang.handler.SettingsManager
-import com.v2ray.ang.handler.V2RayServiceManager
 import com.v2ray.ang.util.LogUtil
 import com.v2ray.ang.util.MyContextWrapper
 import java.lang.ref.SoftReference

-class V2RayProxyOnlyService : Service(), ServiceControl {
+class CoreProxyOnlyService : Service(), ServiceControl {
    /**
     * Initializes the service.
     */
    override fun onCreate() {
        super.onCreate()
        LogUtil.i(AppConfig.TAG, "StartCore-Proxy: Service created")
-        V2RayServiceManager.serviceControl = SoftReference(this)
+        CoreServiceManager.serviceControl = SoftReference(this)
    }

    /**
@@ -31,7 +31,7 @@ class V2RayProxyOnlyService : Service(), ServiceControl {
     */
    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
        LogUtil.i(AppConfig.TAG, "StartCore-Proxy: Service command received")
-        V2RayServiceManager.startCoreLoop(null)
+        CoreServiceManager.startCoreLoop(null)
        return START_STICKY
    }

@@ -40,7 +40,7 @@ class V2RayProxyOnlyService : Service(), ServiceControl {
     */
    override fun onDestroy() {
        super.onDestroy()
-        V2RayServiceManager.stopCoreLoop()
+        CoreServiceManager.stopCoreLoop()
    }

    /**
@@ -0,0 +1,96 @@
+package com.v2ray.ang.service
+
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.os.IBinder
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.contracts.ServiceControl
+import com.v2ray.ang.core.CoreServiceManager
+import com.v2ray.ang.handler.SettingsManager
+import com.v2ray.ang.root.RootProxyManager
+import com.v2ray.ang.util.LogUtil
+import com.v2ray.ang.util.MyContextWrapper
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.cancelAndJoin
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
+import java.lang.ref.SoftReference
+
+/**
+ * Foreground service for the root (system-wide) run modes. Unlike [CoreVpnService] it
+ * does not use Android VpnService — traffic is routed by iptables instead
+ * (see [RootProxyManager]).
+ *
+ * The in-process core is started first (so its listener is up and the foreground
+ * notification is posted promptly), then the root routing rules are installed off the
+ * main thread. On teardown the rules are removed before the core stops.
+ */
+class CoreRootService : Service(), ServiceControl {
+
+    private var setupJob: Job? = null
+
+    override fun onCreate() {
+        super.onCreate()
+        LogUtil.i(AppConfig.TAG, "StartCore-Root: Service created")
+        CoreServiceManager.serviceControl = SoftReference(this)
+    }
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        LogUtil.i(AppConfig.TAG, "StartCore-Root: command received")
+
+        // Start the in-process core first (this also posts the foreground notification),
+        // then install the root routing off the main thread.
+        if (!CoreServiceManager.startCoreLoop(null)) {
+            LogUtil.e(AppConfig.TAG, "StartCore-Root: core failed to start")
+            stopService()
+            return START_NOT_STICKY
+        }
+
+        setupJob = CoroutineScope(Dispatchers.IO).launch {
+            if (!RootProxyManager.start(this@CoreRootService)) {
+                LogUtil.e(AppConfig.TAG, "StartCore-Root: failed to start root mode, stopping")
+                stopService()
+            }
+        }
+
+        return START_STICKY
+    }
+
+    override fun onDestroy() {
+        super.onDestroy()
+        // Wait for any in-flight async setup to finish before tearing down. The rules are
+        // installed off the main thread and can take seconds (the setup script waits for the
+        // tun to appear); if a stop arrives during that window, teardown would run first and
+        // the setup would then re-install the rules + tun pointing at a now-dead core,
+        // blackholing all traffic until the next start/stop cycle clears it.
+        runBlocking { setupJob?.cancelAndJoin() }
+        // Remove routing rules BEFORE stopping the core so traffic is never redirected
+        // to a dead listener. Synchronous on purpose — leaving rules behind breaks the net.
+        RootProxyManager.stop(this)
+        CoreServiceManager.stopCoreLoop()
+    }
+
+    override fun getService(): Service = this
+
+    override fun startService() {
+        // do nothing
+    }
+
+    override fun stopService() {
+        stopSelf()
+    }
+
+    override fun vpnProtect(socket: Int): Boolean = true
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    override fun attachBaseContext(newBase: Context?) {
+        val context = newBase?.let {
+            MyContextWrapper.wrap(newBase, SettingsManager.getLocale())
+        }
+        super.attachBaseContext(context)
+    }
+}
@@ -0,0 +1,144 @@
+package com.v2ray.ang.service
+
+import android.app.Service
+import android.content.Intent
+import android.os.IBinder
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.R
+import com.v2ray.ang.core.CoreNativeManager
+import com.v2ray.ang.dto.RealPingEvent
+import com.v2ray.ang.dto.TestServiceMessage
+import com.v2ray.ang.enums.NotificationChannelType
+import com.v2ray.ang.extension.serializable
+import com.v2ray.ang.handler.MmkvManager
+import com.v2ray.ang.util.LogUtil
+import com.v2ray.ang.util.MessageUtil
+import com.v2ray.ang.util.NotificationHelper
+import java.util.Collections
+
+class CoreTestService : Service() {
+
+    // manage active batch workers so each batch is independent and cancellable
+    private val activeWorkers = Collections.synchronizedList(mutableListOf<RealPingWorkerService>())
+
+    /**
+     * Initializes the V2Ray environment.
+     */
+    override fun onCreate() {
+        super.onCreate()
+        CoreNativeManager.initCoreEnv(this)
+    }
+
+    /**
+     * Binds the service.
+     * @param intent The intent.
+     * @return The binder.
+     */
+    override fun onBind(intent: Intent?): IBinder? {
+        return null
+    }
+
+    /**
+     * Cleans up resources when the service is destroyed.
+     */
+    override fun onDestroy() {
+        LogUtil.i(AppConfig.TAG, "CoreTestService is being destroyed, cancelling ${activeWorkers.size} active workers")
+        // cancel any active workers
+        val snapshot = ArrayList(activeWorkers)
+        snapshot.forEach { it.cancel() }
+        activeWorkers.clear()
+        NotificationHelper.stopForeground(this)
+        super.onDestroy()
+    }
+
+    /**
+     * Handles the start command for the service.
+     * @param intent The intent.
+     * @param flags The flags.
+     * @param startId The start ID.
+     * @return The start mode.
+     */
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        val message = intent?.serializable<TestServiceMessage>("content")
+        if (message == null) {
+            stopSelf(startId)
+            return START_NOT_STICKY
+        }
+
+        when (message.key) {
+            AppConfig.MSG_MEASURE_CONFIG_START -> handleMeasureStart(message, startId)
+            AppConfig.MSG_MEASURE_CONFIG_CANCEL -> handleMeasureCancel()
+            else -> {
+                NotificationHelper.stopForeground(this); stopSelf(startId)
+            }
+        }
+        return START_NOT_STICKY
+    }
+
+    private fun handleMeasureStart(message: TestServiceMessage, startId: Int) {
+        LogUtil.i(AppConfig.TAG, "CoreTestService starting worker   subscription ${message.subscriptionId}")
+
+        NotificationHelper.startForeground(
+            this,
+            NotificationChannelType.CORE_TEST,
+            getString(R.string.app_name),
+            getString(R.string.title_real_ping_all_server)
+        )
+
+        val guidsList = when {
+            message.serverGuids.isNotEmpty() -> message.serverGuids
+            message.subscriptionId.isNotEmpty() -> MmkvManager.decodeServerList(message.subscriptionId)
+            else -> MmkvManager.decodeAllServerList()
+        }
+
+        if (guidsList.isNotEmpty()) {
+            lateinit var worker: RealPingWorkerService
+            worker = RealPingWorkerService(
+                context = this,
+                guids = guidsList,
+                onEvent = { event -> handleWorkerEvent(event) { activeWorkers.remove(worker) } }
+            )
+            activeWorkers.add(worker)
+            worker.start()
+        } else {
+            NotificationHelper.stopForeground(this)
+            stopSelf(startId)
+        }
+    }
+
+    private fun handleWorkerEvent(event: RealPingEvent, onWorkerDone: () -> Unit) {
+        when (event) {
+            is RealPingEvent.Progress -> {
+                NotificationHelper.updateNotification(
+                    channelType = NotificationChannelType.CORE_TEST,
+                    context = this,
+                    content = getString(R.string.connection_runing_task_left, event.text)
+                )
+                MessageUtil.sendMsg2UI(this, AppConfig.MSG_MEASURE_CONFIG_NOTIFY, event.text)
+            }
+
+            is RealPingEvent.Result -> {
+                MmkvManager.encodeServerTestDelayMillis(event.guid, event.delayMillis)
+                MessageUtil.sendMsg2UI(this, AppConfig.MSG_MEASURE_CONFIG_SUCCESS, event.guid)
+            }
+
+            is RealPingEvent.Finish -> {
+                MessageUtil.sendMsg2UI(this, AppConfig.MSG_MEASURE_CONFIG_FINISH, event.status)
+                onWorkerDone()
+                if (activeWorkers.isEmpty()) {
+                    NotificationHelper.stopForeground(this)
+                    stopSelf()
+                }
+            }
+        }
+    }
+
+    private fun handleMeasureCancel() {
+        LogUtil.i(AppConfig.TAG, "CoreTestService received cancel message, cancelling ${activeWorkers.size} active workers")
+        val snapshot = ArrayList(activeWorkers)
+        snapshot.forEach { it.cancel() }
+        activeWorkers.clear()
+        NotificationHelper.stopForeground(this)
+        stopSelf()
+    }
+}
@@ -20,17 +20,18 @@ import com.v2ray.ang.AppConfig.LOOPBACK
 import com.v2ray.ang.BuildConfig
 import com.v2ray.ang.contracts.ServiceControl
 import com.v2ray.ang.contracts.Tun2SocksControl
+import com.v2ray.ang.core.CoreServiceManager
 import com.v2ray.ang.handler.MmkvManager
 import com.v2ray.ang.handler.NotificationManager
 import com.v2ray.ang.handler.SettingsManager
-import com.v2ray.ang.handler.V2RayServiceManager
+import com.v2ray.ang.root.RootLanSharing
 import com.v2ray.ang.util.LogUtil
 import com.v2ray.ang.util.MyContextWrapper
 import com.v2ray.ang.util.Utils
 import java.lang.ref.SoftReference

@SuppressLint("VpnServicePolicy")
-class V2RayVpnService : VpnService(), ServiceControl {
+class CoreVpnService : VpnService(), ServiceControl {
    private lateinit var mInterface: ParcelFileDescriptor
    private var isRunning = false
    private var tun2SocksService: Tun2SocksControl? = null
@@ -77,7 +78,7 @@ class V2RayVpnService : VpnService(), ServiceControl {
        LogUtil.i(AppConfig.TAG, "StartCore-VPN: Service created")
        val policy = StrictMode.ThreadPolicy.Builder().permitAll().build()
        StrictMode.setThreadPolicy(policy)
-        V2RayServiceManager.serviceControl = SoftReference(this)
+        CoreServiceManager.serviceControl = SoftReference(this)
    }

    override fun onRevoke() {
@@ -113,6 +114,7 @@ class V2RayVpnService : VpnService(), ServiceControl {

    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
        LogUtil.i(AppConfig.TAG, "StartCore-VPN: Service command received")
+        NotificationManager.showNotification(null)
        setupVpnService()
        startService()
        return START_STICKY
@@ -128,11 +130,14 @@ class V2RayVpnService : VpnService(), ServiceControl {
            LogUtil.e(AppConfig.TAG, "StartCore-VPN: Interface not initialized")
            return
        }
-        if (!V2RayServiceManager.startCoreLoop(mInterface)) {
+        if (!CoreServiceManager.startCoreLoop(mInterface)) {
            LogUtil.e(AppConfig.TAG, "StartCore-VPN: Failed to start core loop")
            stopAllService()
            return
        }
+
+        // Start LAN sharing if enabled in settings
+        RootLanSharing.startClientSharing(this)
    }

    override fun stopService() {
@@ -361,7 +366,9 @@ class V2RayVpnService : VpnService(), ServiceControl {
        tun2SocksService?.stopTun2Socks()
        tun2SocksService = null

-        V2RayServiceManager.stopCoreLoop()
+        RootLanSharing.stopClientSharing(this)
+
+        CoreServiceManager.stopCoreLoop()

        if (isForced) {
            //stopSelf has to be called ahead of mInterface.close(). otherwise v2ray core cannot be stooped
@@ -0,0 +1,774 @@
+package com.v2ray.ang.service
+
+import android.content.Context
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.util.LogUtil
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+import okhttp3.Call
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
+import okhttp3.Response
+import okhttp3.WebSocket
+import okhttp3.WebSocketListener
+import okio.Buffer
+import okio.ByteString
+import okio.ByteString.Companion.toByteString
+import org.json.JSONArray
+import org.json.JSONObject
+import java.io.EOFException
+import java.net.SocketException
+import java.net.URI
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicBoolean
+import java.util.concurrent.atomic.AtomicInteger
+import java.util.concurrent.atomic.AtomicLong
+
+// This class is responsible for forwarding xray's HTTP/WS requests through okhttp,
+// so that its TLS and traffic characteristics are okhttp instead of golang/utls.
+// Only WS and xhttp package-up are supported for now.
+// ws:
+// DialerNativeService connects to the control WebSocket provided by the xray core.
+// Then xray sends a task message with method "WS" and the server URL to the control WebSocket.
+// DialerNativeService opens a WebSocket connection to the server URL, and forwards messages between the control WebSocket and the target WebSocket.
+// xhttp(package-up):
+// A task message with streaming down (method == "GET" and streamResponse == true), let's call it Task A.
+// A task message with unary down (streamResponse == false), let's call it Task B.
+// 1. DialerNativeService connects to the control WebSocket provided by the xray core.
+// 2. Xray sends Task A, DialerNativeService sends "ok" and connects to the target URL, then sends the "GET" request to the server; let's call this "Connection A".
+// 3. Xray sends a Task B, called B_1. DialerNativeService sends "ok" and sends the data body to the target URL. Whatever the response is, DialerNativeService sends "ok" or "fail" back to the control WebSocket and closes the connection for Task B_1.
+// 4. The server returns the response for Task B_1 through Connection A, and DialerNativeService forwards the response body to the control WebSocket.
+// 5. Xray sends another Task B, called B_2.
+// ...
+// Finally, the xray client core sends all data through the B_1, B_2, ... tasks.
+// The server closes Connection A, and DialerNativeService closes Task A.
+// The above is a complete cycle.
+class DialerNativeService : IDialerService {
+    companion object {
+        private const val DEBUG_LOG = false
+        private val NEXT_SOCKET_ID = AtomicLong(0L)
+
+        private const val CONTROL_SOCKET_IDLE = 0
+        private const val CONTROL_SOCKET_OPENING = 1
+        private const val CONTROL_LOOP_DELAY_MS = 1000L
+        private const val UNARY_BODY_WAIT_TIMEOUT_MS = 15_000L
+        private val TOKEN_REGEX = Regex("""/websocket\?token=([^"'\s]+)""")
+        private val METHODS_WITHOUT_BODY = setOf("GET", "HEAD")
+        private val HEADERS_BLACKLIST = hashSetOf(
+            // AI suggest:
+            "host",
+            "content-length",
+            "transfer-encoding",
+            "content-encoding",
+            "connection",
+            "upgrade",
+            "sec-websocket-key",
+            "sec-websocket-version",
+            "sec-websocket-protocol",
+            "Timing-Allow-Origin",
+            // xray
+            "Set-Cookie",
+            "Cookie",
+            "Origin",
+            "Sec-CH-UA",
+            "Sec-CH-UA-Mobile",
+            "Sec-CH-UA-Platform",
+            "DNT",
+            "User-Agent",
+            "Accept-Language",
+            "Cache-Control",
+            "Upgrade-Insecure-Requests",
+            "Sec-Fetch-Site",
+            "Sec-Fetch-Mode",
+            "Sec-Fetch-User",
+            "Sec-Fetch-Dest",
+            "Referer",
+            "Accept",
+            "Priority",
+            "Pragma",
+            "Access-Control-Allow-Origin",
+            "Access-Control-Allow-Credentials",
+            "Access-Control-Allow-Methods",
+            "Access-Control-Allow-Headers",
+            "Access-Control-Expose-Headers",
+            "Access-Control-Max-Age",
+        )
+    }
+
+    @Volatile
+    private var serviceJob = SupervisorJob()
+
+    @Volatile
+    private var scope = CoroutineScope(serviceJob + Dispatchers.IO)
+    private val running = AtomicBoolean(false)
+    private val controlSocketState = AtomicInteger(CONTROL_SOCKET_IDLE)
+    private val controlSockets = ConcurrentHashMap.newKeySet<WebSocket>()
+
+    @Volatile
+    private var controlUrl: String? = null
+    private var loopJob: Job? = null
+    private var client: OkHttpClient? = null
+
+    @Suppress("UNUSED_PARAMETER")
+    override fun start(context: Context, dialerAddr: String) {
+        stop()
+        serviceJob = SupervisorJob()
+        scope = CoroutineScope(serviceJob + Dispatchers.IO)
+        if (dialerAddr.isEmpty()) return
+
+        val nativeClient = OkHttpClient.Builder()
+            .retryOnConnectionFailure(true)
+            .pingInterval(25, TimeUnit.SECONDS)
+            .connectTimeout(30, TimeUnit.SECONDS)
+            .writeTimeout(60, TimeUnit.SECONDS)
+            .readTimeout(0, TimeUnit.SECONDS)  // Disable read timeout for long-running streams
+            .build()
+
+        client = nativeClient
+        running.set(true)
+        loopJob = scope.launch {
+            val resolvedControlUrl = resolveControlWsUrl(dialerAddr, nativeClient)
+            if (resolvedControlUrl == null) {
+                debug(
+                    "BrowserDialer: failed to resolve control url from dialer endpoint: $dialerAddr"
+                )
+                running.set(false)
+                return@launch
+            }
+            controlUrl = resolvedControlUrl
+            debug("BrowserDialer: started dialerAddr=$dialerAddr controlUrl=$resolvedControlUrl idleGate=${controlSocketState.get()}")
+            maintainControlSocketPool()
+            while (isActive && running.get()) {
+                maintainControlSocketPool()
+                delay(CONTROL_LOOP_DELAY_MS)
+            }
+        }
+    }
+
+    override fun stop() {
+        running.set(false)
+        loopJob?.cancel()
+        loopJob = null
+        serviceJob.cancel()
+
+        debug("BrowserDialer: stopping ${poolState()} controlUrl=$controlUrl")
+
+        controlSockets.toTypedArray().forEach { socket ->
+            runCatching { socket.close(1000, "stopped") }
+        }
+        controlSockets.clear()
+
+        controlSocketState.set(CONTROL_SOCKET_IDLE)
+        controlUrl = null
+
+        serviceJob = SupervisorJob()
+        scope = CoroutineScope(serviceJob + Dispatchers.IO)
+
+        val oldClient = client
+        client = null
+        oldClient?.dispatcher?.cancelAll()
+        oldClient?.connectionPool?.evictAll()
+    }
+
+    private fun maintainControlSocketPool() {
+        debug("BrowserDialer: maintaining single idle control socket ${poolState()}")
+        openControlSocket()
+    }
+
+    private fun openControlSocket(): Boolean {
+        val localClient = client ?: return false
+        if (!running.get()) return false
+        val url = controlUrl ?: return false
+        if (!controlSocketState.compareAndSet(
+                CONTROL_SOCKET_IDLE,
+                CONTROL_SOCKET_OPENING
+            )
+        ) return false
+
+        val request = Request.Builder().url(url).build()
+        return runCatching {
+            val socket = localClient.newWebSocket(request, ControlSocketListener(url))
+            controlSockets.add(socket)
+            debug("BrowserDialer: opening control socket url=$url ${poolState()}")
+            true
+        }.getOrElse {
+            controlSocketState.set(CONTROL_SOCKET_IDLE)
+            debug("BrowserDialer: failed to open control socket", it)
+            false
+        }
+    }
+
+    private fun poolState(): String {
+        return "idleGate=${controlSocketState.get()} liveSockets=${controlSockets.size}"
+    }
+
+    private fun debug(message: String, throwable: Throwable? = null) {
+        @Suppress("KotlinConstantConditions")
+        if (!DEBUG_LOG) return
+        if (throwable == null) {
+            LogUtil.d(AppConfig.TAG, message)
+        } else {
+            LogUtil.d(AppConfig.TAG, message, throwable)
+        }
+    }
+
+    private fun resolveControlWsUrl(rawAddr: String, probeClient: OkHttpClient): String? {
+        val uri = parseDialerUri(rawAddr) ?: return null
+        val probeUrl = buildDialerProbeUrl(rawAddr) ?: return null
+        val request = Request.Builder().url(probeUrl).get().build()
+        val token = runCatching {
+            probeClient.newCall(request).execute().use { response ->
+                if (!response.isSuccessful) return null
+                extractControlToken(response.body.string())
+            }
+        }.getOrNull() ?: return null
+        val host = uri.host ?: return null
+        return URI(
+            "ws",
+            uri.userInfo,
+            host,
+            uri.port,
+            "/websocket",
+            "token=$token",
+            null
+        ).toString()
+    }
+
+    private fun buildDialerProbeUrl(rawAddr: String): String? {
+        val normalized = rawAddr.trim()
+        if (normalized.isEmpty()) return null
+
+        val uri = parseDialerUri(normalized) ?: return null
+        val host = uri.host ?: return null
+        val probeScheme = when (uri.scheme?.lowercase()) {
+            "https", "wss" -> "https"
+            else -> "http"
+        }
+        return URI(probeScheme, uri.userInfo, host, uri.port, "/", null, null).toString()
+    }
+
+    private fun parseDialerUri(rawAddr: String): URI? {
+        val normalized = rawAddr.trim()
+        if (normalized.isEmpty()) return null
+        return runCatching {
+            if (normalized.contains("://")) URI(normalized) else URI("http://$normalized")
+        }.getOrNull()
+    }
+
+    private fun extractControlToken(html: String): String? {
+        val match = TOKEN_REGEX.find(html) ?: return null
+        return match.groupValues.getOrNull(1)?.takeIf { it.isNotBlank() }
+    }
+
+    private inner class ControlSocketListener(
+        private val controlUrl: String
+    ) : WebSocketListener() {
+        private val socketId = if (DEBUG_LOG) NEXT_SOCKET_ID.incrementAndGet() else 0L
+        private val taskAccepted = AtomicBoolean(false)
+        private val closed = AtomicBoolean(false)
+        private val taskStartedAtMs = AtomicLong(0L)
+
+        @Volatile
+        private var taskKind = "none"
+        private var upstreamSocket: WebSocket? = null
+        private var upstreamCall: Call? = null
+        private var timeoutJob: Job? = null
+        private var binaryHandler: ((ByteArray) -> Unit)? = null
+        private var textHandler: ((String) -> Unit)? = null
+
+        override fun onOpen(webSocket: WebSocket, response: Response) {
+            debug("BrowserDialer: control socket opened socketId=$socketId url=$controlUrl ${poolState()}")
+        }
+
+        override fun onMessage(webSocket: WebSocket, text: String) {
+            if (taskAccepted.compareAndSet(false, true)) {
+                controlSocketState.set(CONTROL_SOCKET_IDLE)
+                debug(
+                    "BrowserDialer: control socket accepted task socketId=$socketId url=$controlUrl textSize=${text.length} ${poolState()}"
+                )
+                tryOpenNextControlSocket()
+                handleTask(webSocket, BrowserDialerTask.parse(text))
+                return
+            }
+            textHandler?.invoke(text)
+        }
+
+        override fun onMessage(webSocket: WebSocket, bytes: ByteString) {
+            if (!taskAccepted.get()) {
+                failAndClose(webSocket, 1002, "task must be text json")
+                return
+            }
+            binaryHandler?.invoke(bytes.toByteArray())
+        }
+
+        override fun onClosed(webSocket: WebSocket, code: Int, reason: String) {
+            cleanup(webSocket)
+        }
+
+        override fun onFailure(webSocket: WebSocket, t: Throwable, response: Response?) {
+            val status = response?.code?.toString() ?: "no-http-response"
+            val stateText = "${poolState()} accepted=${taskAccepted.get()} closed=${closed.get()}"
+            if (isExpectedControlFailure(t, status)) {
+                debug(
+                    "BrowserDialer: control socket closed socketId=$socketId url=$controlUrl status=$status cause=${t.javaClass.simpleName} $stateText"
+                )
+                debug(
+                    "BrowserDialer: control socket failure detail socketId=$socketId url=$controlUrl status=$status $stateText",
+                    t
+                )
+            } else {
+                debug(
+                    "BrowserDialer: control socket failure socketId=$socketId url=$controlUrl status=$status $stateText",
+                    t
+                )
+            }
+            cleanup(webSocket)
+        }
+
+        private fun isExpectedControlFailure(t: Throwable, status: String): Boolean {
+            if (!running.get() || closed.get()) return true
+            if (status != "no-http-response") return false
+            if (t is EOFException) return true
+            if (t is SocketException) {
+                val message = t.message.orEmpty().lowercase()
+                if ("socket closed" in message || "software caused connection abort" in message) {
+                    return true
+                }
+            }
+            val message = t.message.orEmpty().lowercase()
+            return "canceled" in message || "cancelled" in message
+        }
+
+
+        private fun tryOpenNextControlSocket() {
+            scope.launch {
+                if (running.get()) maintainControlSocketPool()
+            }
+        }
+
+        private fun cleanup(webSocket: WebSocket) {
+            if (!closed.compareAndSet(false, true)) return
+            val removed = controlSockets.remove(webSocket)
+            if (!taskAccepted.get()) {
+                controlSocketState.set(CONTROL_SOCKET_IDLE)
+                tryOpenNextControlSocket()
+            }
+            val started = taskStartedAtMs.get()
+            val duration =
+                if (started > 0L) (System.currentTimeMillis() - started).coerceAtLeast(0L) else -1L
+            debug(
+                "BrowserDialer: cleanup socketId=$socketId url=$controlUrl task=$taskKind taskAccepted=${taskAccepted.get()} removed=$removed durationMs=$duration ${poolState()}"
+            )
+            binaryHandler = null
+            textHandler = null
+            timeoutJob?.cancel()
+            timeoutJob = null
+            upstreamCall?.cancel()
+            upstreamCall = null
+            upstreamSocket?.close(1000, "control closed")
+            upstreamSocket = null
+            taskKind = "closed"
+            taskStartedAtMs.set(0L)
+        }
+
+        private fun handleTask(webSocket: WebSocket, task: BrowserDialerTask?) {
+            if (task == null) {
+                failAndClose(webSocket, 1007, "invalid task")
+                return
+            }
+
+            taskStartedAtMs.set(System.currentTimeMillis())
+            taskKind = when {
+                task.method == "WS" -> "ws"
+                task.method == "GET" && task.streamResponse -> "streaming_get"
+                !task.streamResponse -> "unary_${task.method.lowercase()}"
+                else -> "unsupported"
+            }
+
+            when {
+                task.method == "WS" -> handleWsTask(webSocket, task)
+                task.method == "GET" && task.streamResponse -> handleStreamingGetTask(
+                    webSocket,
+                    task
+                )
+
+                !task.streamResponse -> handleUnaryTask(webSocket, task)
+                else -> {
+                    failAndClose(webSocket, 1003, "unsupported task")
+                }
+            }
+        }
+
+        private fun handleWsTask(controlSocket: WebSocket, task: BrowserDialerTask) {
+            val localClient = client ?: run {
+                failAndClose(controlSocket, 1011, "client unavailable")
+                return
+            }
+            debug("BrowserDialer: handling WS task socketId=$socketId url=${task.url} protocols=${task.extra.protocols.size}")
+            val requestBuilder = Request.Builder().url(task.url)
+            if (task.extra.protocols.isNotEmpty()) {
+                requestBuilder.header(
+                    "Sec-WebSocket-Protocol",
+                    task.extra.protocols.joinToString(",")
+                )
+            }
+
+            val opened = AtomicBoolean(false)
+            upstreamSocket =
+                localClient.newWebSocket(requestBuilder.build(), object : WebSocketListener() {
+                    override fun onOpen(webSocket: WebSocket, response: Response) {
+                        opened.set(true)
+                        try {
+                            controlSocket.send("ok")
+                        } catch (e: Exception) {
+                            debug(
+                                "BrowserDialer: failed to send ok for WS task",
+                                e
+                            )
+                            webSocket.close(1000, "control failed")
+                        }
+                    }
+
+                    override fun onMessage(webSocket: WebSocket, text: String) {
+                        try {
+                            controlSocket.send(text)
+                        } catch (e: Exception) {
+                            debug(
+                                "BrowserDialer: control socket closed during WS message transfer socketId=$socketId",
+                                e
+                            )
+                            webSocket.close(1000, "control closed")
+                        }
+                    }
+
+                    override fun onMessage(webSocket: WebSocket, bytes: ByteString) {
+                        try {
+                            controlSocket.send(bytes)
+                        } catch (e: Exception) {
+                            debug(
+                                "BrowserDialer: control socket closed during WS binary transfer socketId=$socketId",
+                                e
+                            )
+                            webSocket.close(1000, "control closed")
+                        }
+                    }
+
+                    override fun onClosed(webSocket: WebSocket, code: Int, reason: String) {
+                        try {
+                            controlSocket.close(1000, "upstream closed")
+                        } catch (_: Exception) {
+                            debug("BrowserDialer: control socket already closed")
+                        }
+                    }
+
+                    override fun onFailure(
+                        webSocket: WebSocket,
+                        t: Throwable,
+                        response: Response?
+                    ) {
+                        if (!opened.get()) {
+                            try {
+                                controlSocket.send("fail")
+                            } catch (e: Exception) {
+                                debug(
+                                    "BrowserDialer: control socket send failed socketId=$socketId",
+                                    e
+                                )
+                            }
+                        }
+                        try {
+                            controlSocket.close(1011, "upstream failure")
+                        } catch (_: Exception) {
+                            debug(
+                                "BrowserDialer: control socket already closed socketId=$socketId"
+                            )
+                        }
+                    }
+                })
+
+            textHandler = { message ->
+                try {
+                    upstreamSocket?.send(message)
+                } catch (e: Exception) {
+                    debug(
+                        "BrowserDialer: upstream socket send failed socketId=$socketId",
+                        e
+                    )
+                }
+            }
+            binaryHandler = { data ->
+                try {
+                    upstreamSocket?.send(data.toByteString())
+                } catch (e: Exception) {
+                    debug(
+                        "BrowserDialer: upstream socket binary send failed socketId=$socketId",
+                        e
+                    )
+                }
+            }
+        }
+
+        private fun handleStreamingGetTask(controlSocket: WebSocket, task: BrowserDialerTask) {
+            val localClient = client ?: run {
+                failAndClose(controlSocket, 1011, "client unavailable")
+                return
+            }
+            debug("BrowserDialer: handling streaming GET task socketId=$socketId url=${task.url}")
+            val request = buildRequest(task, null)
+
+            try {
+                controlSocket.send("ok")
+            } catch (e: Exception) {
+                debug(
+                    "BrowserDialer: failed to send ok for streaming GET socketId=$socketId",
+                    e
+                )
+                return
+            }
+
+            scope.launch {
+                val call = localClient.newCall(request)
+                upstreamCall = call
+                try {
+                    call.execute().use { response ->
+                        val source = response.body.source()
+                        val buffer = Buffer()
+                        while (running.get() && !closed.get()) {
+                            try {
+                                val read = source.read(buffer, DEFAULT_BUFFER_SIZE.toLong())
+                                if (read < 0) break
+
+                                // Send data, catch exception if WebSocket is closed
+                                try {
+                                    controlSocket.send(buffer.readByteString())
+                                } catch (e: Exception) {
+                                    debug(
+                                        "BrowserDialer: WebSocket send failed during streaming, stopping stream socketId=$socketId",
+                                        e
+                                    )
+                                    break
+                                }
+                            } catch (_: Exception) {
+                                // Error reading from source, stop streaming
+                                break
+                            }
+                        }
+                    }
+                } catch (e: Exception) {
+                    debug(
+                        "BrowserDialer: streaming GET failed socketId=$socketId",
+                        e
+                    )
+                    try {
+                        controlSocket.send("fail")
+                    } catch (_: Exception) {
+                        // WebSocket may already be closed
+                    }
+                } finally {
+                    upstreamCall = null
+                    try {
+                        controlSocket.close(1000, "streaming done")
+                    } catch (_: Exception) {
+                        debug(
+                            "BrowserDialer: WebSocket already closed socketId=$socketId"
+                        )
+                    }
+                }
+            }
+        }
+
+        private fun handleUnaryTask(controlSocket: WebSocket, task: BrowserDialerTask) {
+            val localClient = client ?: run {
+                failAndClose(controlSocket, 1011, "client unavailable")
+                return
+            }
+            debug("BrowserDialer: handling unary task socketId=$socketId method=${task.method} url=${task.url}")
+
+            try {
+                controlSocket.send("ok")
+            } catch (e: Exception) {
+                debug(
+                    "BrowserDialer: failed to send ok for unary task socketId=$socketId",
+                    e
+                )
+                return
+            }
+
+            val done = AtomicBoolean(false)
+
+            timeoutJob = scope.launch {
+                delay(UNARY_BODY_WAIT_TIMEOUT_MS)
+                if (done.compareAndSet(false, true)) {
+                    binaryHandler = null
+                    textHandler = null
+                    debug("BrowserDialer: unary task timed out waiting for payload socketId=$socketId method=${task.method} url=${task.url}")
+                    failAndClose(controlSocket, 1000, "unary payload timeout")
+                }
+            }
+
+            val executeRequest: (ByteArray?) -> Unit = { payload ->
+                if (done.compareAndSet(false, true)) {
+                    timeoutJob?.cancel()
+                    timeoutJob = null
+                    binaryHandler = null
+                    textHandler = null
+                    scope.launch {
+                        val request = buildRequest(task, payload)
+                        val call = localClient.newCall(request)
+                        upstreamCall = call
+                        try {
+                            call.execute().use { response ->
+                                try {
+                                    controlSocket.send(if (response.isSuccessful) "ok" else "fail")
+                                } catch (e: Exception) {
+                                    debug(
+                                        "BrowserDialer: WebSocket send failed for unary response socketId=$socketId",
+                                        e
+                                    )
+                                }
+                            }
+                        } catch (e: Exception) {
+                            debug(
+                                "BrowserDialer: unary request failed socketId=$socketId",
+                                e
+                            )
+                            try {
+                                controlSocket.send("fail")
+                            } catch (_: Exception) {
+                                // WebSocket may already be closed
+                            }
+                        } finally {
+                            upstreamCall = null
+                            try {
+                                controlSocket.close(1000, "request done")
+                            } catch (_: Exception) {
+                                debug(
+                                    "BrowserDialer: WebSocket already closed socketId=$socketId"
+                                )
+                            }
+                        }
+                    }
+                }
+            }
+
+            binaryHandler = { body -> executeRequest(body.takeIf { it.isNotEmpty() }) }
+            textHandler = { body -> executeRequest(body.toByteArray().takeIf { it.isNotEmpty() }) }
+        }
+
+        private fun buildRequest(task: BrowserDialerTask, payload: ByteArray?): Request {
+            val requestBuilder = Request.Builder().url(task.url)
+            // task.extra.headers.forEach { (key, value) -> requestBuilder.header(key, value) }
+            // Just set no cache headers
+            requestBuilder.header("Cache-Control", "no-cache, no-store, must-revalidate")
+            task.extra.referrer?.takeIf { it.isNotBlank() }
+                ?.let { requestBuilder.header("Referer", it) }
+            val taskHeaders = task.extra.headers.filterKeys { key ->
+                val lowerKey = key.lowercase()
+                !HEADERS_BLACKLIST.any { blackKey -> blackKey.equals(lowerKey, ignoreCase = true) }
+            }
+            taskHeaders.forEach { (key, value) -> requestBuilder.header(key, value) }
+
+            val method = task.method.uppercase()
+            val methodAllowsBody = method !in METHODS_WITHOUT_BODY
+            val body = when {
+                methodAllowsBody && payload != null && payload.isNotEmpty() -> payload.toRequestBody(null)
+                methodAllowsBody -> ByteArray(0).toRequestBody(null)
+                else -> null
+            }
+            requestBuilder.method(method, body)
+            return requestBuilder.build()
+        }
+
+        private fun failAndClose(socket: WebSocket, code: Int, reason: String) {
+            try {
+                socket.send("fail")
+            } catch (e: Exception) {
+                debug("BrowserDialer: failed to send fail message", e)
+            }
+            try {
+                socket.close(code, reason)
+            } catch (e: Exception) {
+                debug("BrowserDialer: failed to close socket", e)
+            }
+        }
+    }
+
+    private data class BrowserDialerTask(
+        val method: String,
+        val url: String,
+        val streamResponse: Boolean,
+        val extra: Extra
+    ) {
+        data class Extra(
+            val headers: Map<String, String> = emptyMap(),
+            // val cookies: Map<String, String> = emptyMap(),
+            val protocols: List<String> = emptyList(),
+            val referrer: String? = null
+        )
+
+        companion object {
+            fun parse(payload: String): BrowserDialerTask? {
+                return runCatching {
+                    val root = JSONObject(payload)
+                    val method = root.optString("method")
+                    val url = root.optString("url")
+                    if (method.isBlank() || url.isBlank()) return null
+
+                    val streamResponse = root.optBoolean("streamResponse", false)
+                    val extraObject = root.optJSONObject("extra")
+                    val headers = extraObject.optStringMap("headers")
+                    // val cookies = extraObject.optStringMap("cookies")
+                    val referrer = extraObject?.optString("referrer")?.takeIf { it.isNotBlank() }
+                    val protocols = extraObject.optProtocols()
+
+                    BrowserDialerTask(
+                        method = method,
+                        url = url,
+                        streamResponse = streamResponse,
+                        extra = Extra(
+                            headers = headers,
+                            // cookies = cookies,
+                            protocols = protocols,
+                            referrer = referrer
+                        )
+                    )
+                }.getOrNull()
+            }
+
+            private fun JSONObject?.optStringMap(name: String): Map<String, String> {
+                val child = this?.optJSONObject(name) ?: return emptyMap()
+                val map = LinkedHashMap<String, String>()
+                val iter = child.keys()
+                while (iter.hasNext()) {
+                    val key = iter.next()
+                    map[key] = child.optString(key)
+                }
+                return map
+            }
+
+            private fun JSONObject?.optProtocols(): List<String> {
+                val raw = this?.opt("protocol") ?: return emptyList()
+                return when (raw) {
+                    is String -> raw.takeIf { it.isNotBlank() }?.let { listOf(it) } ?: emptyList()
+                    is JSONArray -> buildList {
+                        for (i in 0 until raw.length()) {
+                            val item = raw.optString(i)
+                            if (item.isNotBlank()) {
+                                add(item)
+                            }
+                        }
+                    }
+
+                    else -> emptyList()
+                }
+            }
+        }
+    }
+}
@@ -0,0 +1,73 @@
+package com.v2ray.ang.service
+
+import android.annotation.SuppressLint
+import android.content.Context
+import android.os.Handler
+import android.os.Looper
+import android.webkit.WebSettings
+import android.webkit.WebView
+import android.webkit.WebViewClient
+
+class DialerWebviewService : IDialerService {
+    private var webView: WebView? = null
+    private val handler = Handler(Looper.getMainLooper())
+    private val keepAliveInterval = 30_000L // 30 seconds
+
+    private val keepAliveRunnable = object : Runnable {
+        override fun run() {
+            webView?.let {
+                it.resumeTimers()
+                it.onResume()
+            }
+            handler.postDelayed(this, keepAliveInterval)
+        }
+    }
+
+
+    /**
+     * Starts the WebView.
+     * @param context Service context
+     */
+    @SuppressLint("SetJavaScriptEnabled")
+    override fun start(context: Context, dialerAddr: String) {
+        if (webView != null) stop()
+        if (dialerAddr.isEmpty()) return
+        val dialerUrl = "http://$dialerAddr/"
+
+        webView = WebView(context.applicationContext).apply {
+            settings.apply {
+                javaScriptEnabled = true
+                domStorageEnabled = true
+                // Allow JS to run even if not triggered by user
+                mediaPlaybackRequiresUserGesture = false
+                // Prevent aggressive caching issues
+                cacheMode = WebSettings.LOAD_DEFAULT
+            }
+
+            webViewClient = object : WebViewClient() {
+                override fun onPageFinished(view: WebView?, url: String?) {
+                    super.onPageFinished(view, url)
+                    view?.onResume()
+                    view?.resumeTimers()
+                }
+            }
+
+            loadUrl(dialerUrl)
+        }
+
+        handler.post(keepAliveRunnable)
+    }
+
+    override fun stop() {
+        handler.removeCallbacks(keepAliveRunnable)
+        webView?.apply {
+            stopLoading()
+            pauseTimers()
+            // Important to call onPause to stop internal Chromium threads properly
+            onPause()
+            destroy()
+        }
+        webView = null
+    }
+
+}
@@ -0,0 +1,8 @@
+package com.v2ray.ang.service
+
+import android.content.Context
+
+interface IDialerService {
+    fun start(context: Context, dialerAddr: String)
+    fun stop()
+}
@@ -10,7 +10,7 @@ import android.service.quicksettings.TileService
 import androidx.core.content.ContextCompat
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.R
-import com.v2ray.ang.handler.V2RayServiceManager
+import com.v2ray.ang.core.CoreServiceManager
 import com.v2ray.ang.util.LogUtil
 import com.v2ray.ang.util.MessageUtil
 import com.v2ray.ang.util.Utils
@@ -29,7 +29,7 @@ class QSTileService : TileService() {
            qsTile?.label = getString(R.string.app_name)
        } else if (state == Tile.STATE_ACTIVE) {
            qsTile?.state = Tile.STATE_ACTIVE
-            qsTile?.label = V2RayServiceManager.getRunningServerName()
+            qsTile?.label = CoreServiceManager.getRunningServerName()
        }

        qsTile?.updateTile()
@@ -42,7 +42,7 @@ class QSTileService : TileService() {
    override fun onStartListening() {
        super.onStartListening()

-        if (V2RayServiceManager.isRunning()) {
+        if (CoreServiceManager.isRunning()) {
            setState(Tile.STATE_ACTIVE)
        } else {
            setState(Tile.STATE_INACTIVE)
@@ -75,11 +75,11 @@ class QSTileService : TileService() {
        super.onClick()
        when (qsTile.state) {
            Tile.STATE_INACTIVE -> {
-                V2RayServiceManager.startVServiceFromToggle(this)
+                CoreServiceManager.startVServiceFromToggle(this)
            }

            Tile.STATE_ACTIVE -> {
-                V2RayServiceManager.stopVService(this)
+                CoreServiceManager.stopVService(this)
            }
        }
    }
@@ -1,11 +1,15 @@
 package com.v2ray.ang.service

 import android.content.Context
-import com.v2ray.ang.AppConfig
+import com.v2ray.ang.core.CoreConfigManager
+import com.v2ray.ang.core.CoreNativeManager
+import com.v2ray.ang.dto.RealPingEvent
+import com.v2ray.ang.enums.EConfigType
+import com.v2ray.ang.extension.isComplexType
+import com.v2ray.ang.extension.isNotNullEmpty
+import com.v2ray.ang.handler.MmkvManager
 import com.v2ray.ang.handler.SettingsManager
-import com.v2ray.ang.handler.V2RayNativeManager
-import com.v2ray.ang.handler.V2rayConfigManager
-import com.v2ray.ang.util.MessageUtil
+import com.v2ray.ang.handler.SpeedtestManager
 import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.CoroutineName
 import kotlinx.coroutines.CoroutineScope
@@ -23,11 +27,11 @@ import java.util.concurrent.atomic.AtomicInteger
 class RealPingWorkerService(
    private val context: Context,
    private val guids: List<String>,
-    private val onFinish: (status: String) -> Unit = {}
+    private val onEvent: (RealPingEvent) -> Unit = {}
 ) {
    private val job = SupervisorJob()
-    private val cpu = Runtime.getRuntime().availableProcessors().coerceAtLeast(1)
-    private val dispatcher = Executors.newFixedThreadPool(cpu * 4).asCoroutineDispatcher()
+    private val concurrency = SettingsManager.getRealPingConcurrency()
+    private val dispatcher = Executors.newFixedThreadPool(concurrency).asCoroutineDispatcher()
    private val scope = CoroutineScope(job + dispatcher + CoroutineName("RealPingBatchWorker"))

    private val runningCount = AtomicInteger(0)
@@ -40,11 +44,13 @@ class RealPingWorkerService(
                runningCount.incrementAndGet()
                try {
                    val result = startRealPing(guid)
-                    MessageUtil.sendMsg2UI(context, AppConfig.MSG_MEASURE_CONFIG_SUCCESS, Pair(guid, result))
+                    onEvent(RealPingEvent.Result(guid, result))
+                } catch (_: Throwable) {
+                    // ignore
                } finally {
                    val count = totalCount.decrementAndGet()
                    val left = runningCount.decrementAndGet()
-                    MessageUtil.sendMsg2UI(context, AppConfig.MSG_MEASURE_CONFIG_NOTIFY, "$left / $count")
+                    onEvent(RealPingEvent.Progress("$left / $count"))
                }
            }
        }
@@ -52,9 +58,9 @@ class RealPingWorkerService(
        scope.launch {
            try {
                joinAll(*jobs.toTypedArray())
-                onFinish("0")
+                onEvent(RealPingEvent.Finish("0"))
            } catch (_: CancellationException) {
-                onFinish("-1")
+                onEvent(RealPingEvent.Finish("-1"))
            } finally {
                close()
            }
@@ -75,11 +81,25 @@ class RealPingWorkerService(

    private fun startRealPing(guid: String): Long {
        val retFailure = -1L
-        val configResult = V2rayConfigManager.getV2rayConfig4Speedtest(context, guid)
+
+        val config = MmkvManager.decodeServerConfig(guid) ?: return retFailure
+        if (!config.configType.isComplexType()
+            && config.configType != EConfigType.HYSTERIA2
+            && config.server.isNotNullEmpty()
+            && config.serverPort?.toIntOrNull() != null
+        ) {
+            val url = config.server.orEmpty()
+            val port = config.serverPort.orEmpty().toInt()
+            val tcpTime = SpeedtestManager.socketConnectTime(url, port, 1000)
+            if (tcpTime <= -1L) {
+                return retFailure
+            }
+        }
+
+        val configResult = CoreConfigManager.getV2rayConfig4Speedtest(context, guid)
        if (!configResult.status) {
            return retFailure
        }
-        return V2RayNativeManager.measureOutboundDelay(configResult.content, SettingsManager.getDelayTestUrl())
+        return CoreNativeManager.measureOutboundDelay(configResult.content, SettingsManager.getDelayTestUrl())
    }
 }
-
@@ -1,89 +0,0 @@
-package com.v2ray.ang.service
-
-import android.app.Service
-import android.content.Intent
-import android.os.IBinder
-import com.v2ray.ang.AppConfig
-import com.v2ray.ang.AppConfig.MSG_MEASURE_CONFIG
-import com.v2ray.ang.AppConfig.MSG_MEASURE_CONFIG_CANCEL
-import com.v2ray.ang.dto.TestServiceMessage
-import com.v2ray.ang.extension.serializable
-import com.v2ray.ang.handler.MmkvManager
-import com.v2ray.ang.handler.V2RayNativeManager
-import com.v2ray.ang.util.MessageUtil
-import java.util.Collections
-
-class V2RayTestService : Service() {
-
-    // manage active batch workers so each batch is independent and cancellable
-    private val activeWorkers = Collections.synchronizedList(mutableListOf<RealPingWorkerService>())
-
-    /**
-     * Initializes the V2Ray environment.
-     */
-    override fun onCreate() {
-        super.onCreate()
-        V2RayNativeManager.initCoreEnv(this)
-    }
-
-    /**
-     * Binds the service.
-     * @param intent The intent.
-     * @return The binder.
-     */
-    override fun onBind(intent: Intent?): IBinder? {
-        return null
-    }
-
-    /**
-     * Cleans up resources when the service is destroyed.
-     */
-    override fun onDestroy() {
-        super.onDestroy()
-        // cancel any active workers
-        val snapshot = ArrayList(activeWorkers)
-        snapshot.forEach { it.cancel() }
-        activeWorkers.clear()
-    }
-
-    /**
-     * Handles the start command for the service.
-     * @param intent The intent.
-     * @param flags The flags.
-     * @param startId The start ID.
-     * @return The start mode.
-     */
-    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-        val message = intent?.serializable<TestServiceMessage>("content") ?: return super.onStartCommand(intent, flags, startId)
-        when (message.key) {
-            MSG_MEASURE_CONFIG -> {
-                val guidsList = if (message.serverGuids.isNotEmpty()) {
-                    message.serverGuids
-                } else if (message.subscriptionId.isNotEmpty()) {
-                    MmkvManager.decodeServerList(message.subscriptionId)
-                } else {
-                    MmkvManager.decodeAllServerList()
-                }
-
-                if (guidsList.isNotEmpty()) {
-                    lateinit var worker: RealPingWorkerService
-                    worker = RealPingWorkerService(this, guidsList) { status ->
-                        // notify UI and remove the worker from active list when finished
-                        MessageUtil.sendMsg2UI(this@V2RayTestService, AppConfig.MSG_MEASURE_CONFIG_FINISH, status)
-                        activeWorkers.remove(worker)
-                    }
-                    activeWorkers.add(worker)
-                    worker.start()
-                }
-            }
-
-            MSG_MEASURE_CONFIG_CANCEL -> {
-                // cancel all running batch workers independently
-                val snapshot = ArrayList(activeWorkers)
-                snapshot.forEach { it.cancel() }
-                activeWorkers.clear()
-            }
-        }
-        return super.onStartCommand(intent, flags, startId)
-    }
-}
@@ -4,8 +4,8 @@ import android.os.Bundle
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.BuildConfig
 import com.v2ray.ang.R
+import com.v2ray.ang.core.CoreNativeManager
 import com.v2ray.ang.databinding.ActivityAboutBinding
-import com.v2ray.ang.handler.V2RayNativeManager
 import com.v2ray.ang.util.Utils

 class AboutActivity : BaseActivity() {
@@ -42,7 +42,7 @@ class AboutActivity : BaseActivity() {
            Utils.openUri(this, AppConfig.APP_PRIVACY_POLICY)
        }

-        "v${BuildConfig.VERSION_NAME} (${V2RayNativeManager.getLibVersion()})".also {
+        "v${BuildConfig.VERSION_NAME} (${CoreNativeManager.getLibVersion()})".also {
            binding.tvVersion.text = it
        }
        BuildConfig.APPLICATION_ID.also {
@@ -14,7 +14,6 @@ import com.v2ray.ang.databinding.ActivityAppPickerBinding
 import com.v2ray.ang.dto.AppInfo
 import com.v2ray.ang.util.AppManagerUtil
 import com.v2ray.ang.util.LogUtil
-import com.v2ray.ang.util.PackageUidResolver
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
@@ -12,7 +12,7 @@ import com.v2ray.ang.BuildConfig
 import com.v2ray.ang.R
 import com.v2ray.ang.databinding.ActivityBackupBinding
 import com.v2ray.ang.databinding.DialogWebdavBinding
-import com.v2ray.ang.dto.WebDavConfig
+import com.v2ray.ang.dto.entities.WebDavConfig
 import com.v2ray.ang.extension.toastError
 import com.v2ray.ang.extension.toastSuccess
 import com.v2ray.ang.handler.MmkvManager
@@ -6,6 +6,7 @@ import androidx.lifecycle.lifecycleScope
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.BuildConfig
 import com.v2ray.ang.R
+import com.v2ray.ang.core.CoreNativeManager
 import com.v2ray.ang.databinding.ActivityCheckUpdateBinding
 import com.v2ray.ang.dto.CheckUpdateResult
 import com.v2ray.ang.extension.toast
@@ -13,7 +14,6 @@ import com.v2ray.ang.extension.toastError
 import com.v2ray.ang.extension.toastSuccess
 import com.v2ray.ang.handler.MmkvManager
 import com.v2ray.ang.handler.UpdateCheckerManager
-import com.v2ray.ang.handler.V2RayNativeManager
 import com.v2ray.ang.util.LogUtil
 import com.v2ray.ang.util.Utils
 import kotlinx.coroutines.launch
@@ -36,7 +36,7 @@ class CheckUpdateActivity : BaseActivity() {
        }
        binding.checkPreRelease.isChecked = MmkvManager.decodeSettingsBool(AppConfig.PREF_CHECK_UPDATE_PRE_RELEASE, false)

-        "v${BuildConfig.VERSION_NAME} (${V2RayNativeManager.getLibVersion()})".also {
+        "v${BuildConfig.VERSION_NAME} (${CoreNativeManager.getLibVersion()})".also {
            binding.tvVersion.text = it
        }

@@ -5,6 +5,7 @@ import android.os.Bundle
 import android.view.LayoutInflater
 import android.view.View
 import android.view.ViewGroup
+import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AlertDialog
 import androidx.fragment.app.activityViewModels
 import androidx.lifecycle.lifecycleScope
@@ -16,13 +17,15 @@ import com.v2ray.ang.R
 import com.v2ray.ang.contracts.MainAdapterListener
 import com.v2ray.ang.databinding.FragmentGroupServerBinding
 import com.v2ray.ang.databinding.ItemQrcodeBinding
-import com.v2ray.ang.dto.ProfileItem
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
+import com.v2ray.ang.extension.isComplexType
 import com.v2ray.ang.extension.toast
 import com.v2ray.ang.extension.toastError
 import com.v2ray.ang.extension.toastSuccess
 import com.v2ray.ang.handler.AngConfigManager
 import com.v2ray.ang.handler.MmkvManager
+import com.v2ray.ang.handler.SettingsChangeManager
 import com.v2ray.ang.helper.SimpleItemTouchHelperCallback
 import com.v2ray.ang.util.LogUtil
 import com.v2ray.ang.viewmodel.MainViewModel
@@ -44,6 +47,11 @@ class GroupServerFragment : BaseFragment<FragmentGroupServerBinding>(),
    private val share_method_more: Array<out String> by lazy {
        ownerActivity.resources.getStringArray(R.array.share_method_more)
    }
+    private val launcher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) {
+        if (SettingsChangeManager.consumeRestartService() && mainViewModel.isRunning.value == true) {
+            ownerActivity.restartV2Ray()
+        }
+    }

    companion object {
        private const val ARG_SUB_ID = "subscriptionId"
@@ -168,23 +176,20 @@ class GroupServerFragment : BaseFragment<FragmentGroupServerBinding>(),
     * @param profile The server configuration
     */
    private fun editServer(guid: String, profile: ProfileItem) {
-        val intent = Intent().putExtra("guid", guid)
+        val activityClass = when (profile.configType) {
+            EConfigType.CUSTOM -> ServerCustomConfigActivity::class.java
+            EConfigType.POLICYGROUP -> ServerGroupActivity::class.java
+            EConfigType.PROXYCHAIN -> ServerProxyChainActivity::class.java
+            else -> ServerActivity::class.java
+        }
+
+        val intent = Intent(ownerActivity, activityClass)
+            .putExtra("guid", guid)
            .putExtra("isRunning", mainViewModel.isRunning.value)
            .putExtra("createConfigType", profile.configType.value)
            .putExtra("subscriptionId", subId)
-        when (profile.configType) {
-            EConfigType.CUSTOM -> {
-                ownerActivity.startActivity(intent.setClass(ownerActivity, ServerCustomConfigActivity::class.java))
-            }

-            EConfigType.POLICYGROUP -> {
-                ownerActivity.startActivity(intent.setClass(ownerActivity, ServerGroupActivity::class.java))
-            }
-
-            else -> {
-                ownerActivity.startActivity(intent.setClass(ownerActivity, ServerActivity::class.java))
-            }
-        }
+        launcher.launch(intent)
    }

    /**
@@ -221,6 +226,7 @@ class GroupServerFragment : BaseFragment<FragmentGroupServerBinding>(),
    private fun removeServerSub(guid: String, position: Int) {
        mainViewModel.removeServer(guid)
        adapter.removeServerSub(guid, position)
+        ownerActivity.refreshGroupTabTitles()
    }

    /**
@@ -265,7 +271,7 @@ class GroupServerFragment : BaseFragment<FragmentGroupServerBinding>(),
        }

        override fun onShare(guid: String, profile: ProfileItem, position: Int, more: Boolean) {
-            val isCustom = profile.configType == EConfigType.CUSTOM || profile.configType == EConfigType.POLICYGROUP
+            val isCustom = profile.configType.isComplexType()

            val (shareOptions, skip) = if (more) {
                val options = if (isCustom) share_method_more.asList().takeLast(3) else share_method_more.asList()
@@ -56,9 +56,7 @@ abstract class HelperBaseActivity : BaseActivity() {
        mimeType: String = "*/*",
        onResult: (Uri?) -> Unit
    ) {
-        checkAndRequestPermission(PermissionType.READ_STORAGE) {
-            fileChooser.launch(mimeType, onResult)
-        }
+        fileChooser.launch(mimeType, onResult)
    }

    /**
@@ -1,11 +1,14 @@
 package com.v2ray.ang.ui

 import android.annotation.SuppressLint
+import android.content.ClipData
+import android.content.Intent
 import android.os.Bundle
 import android.view.Menu
 import android.view.MenuItem
 import androidx.activity.viewModels
 import androidx.appcompat.widget.SearchView
+import androidx.core.content.FileProvider
 import androidx.lifecycle.lifecycleScope
 import androidx.recyclerview.widget.LinearLayoutManager
 import androidx.swiperefreshlayout.widget.SwipeRefreshLayout
@@ -18,6 +21,10 @@ import com.v2ray.ang.viewmodel.LogcatViewModel
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
+import java.io.File
+import java.text.SimpleDateFormat
+import java.util.Date
+import java.util.Locale

 class LogcatActivity : BaseActivity(), SwipeRefreshLayout.OnRefreshListener {
    private val binding by lazy { ActivityLogcatBinding.inflate(layoutInflater) }
@@ -45,6 +52,55 @@ class LogcatActivity : BaseActivity(), SwipeRefreshLayout.OnRefreshListener {
        return true
    }

+    private fun shareLogcat() {
+        lifecycleScope.launch(Dispatchers.IO) {
+            val logText = viewModel.getAll().joinToString("\n")
+
+            val result = try {
+                val shareDir = File(cacheDir, "shared_logs").apply {
+                    mkdirs()
+                }
+
+                shareDir.listFiles()?.forEach { it.delete() }
+
+                val timestamp = SimpleDateFormat("yyyy-MM-dd_HH-mm-ss", Locale.US).format(Date())
+                val logFile = File(shareDir, "v2rayNG_logcat_$timestamp.txt")
+                logFile.writeText(logText, Charsets.UTF_8)
+
+                val uri = FileProvider.getUriForFile(
+                    this@LogcatActivity,
+                    "${packageName}.cache",
+                    logFile
+                )
+
+                uri to logFile.name
+            } catch (e: Exception) {
+                withContext(Dispatchers.Main) {
+                    toast(e.localizedMessage ?: e.toString())
+                }
+                return@launch
+            }
+
+            withContext(Dispatchers.Main) {
+                val shareIntent = Intent(Intent.ACTION_SEND).apply {
+                    type = "text/plain"
+                    putExtra(Intent.EXTRA_STREAM, result.first)
+                    putExtra(Intent.EXTRA_SUBJECT, result.second)
+                    putExtra(Intent.EXTRA_TITLE, result.second)
+                    addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
+                    clipData = ClipData.newUri(contentResolver, result.second, result.first)
+                }
+
+                startActivity(
+                    Intent.createChooser(
+                        shareIntent,
+                        getString(R.string.logcat_share)
+                    )
+                )
+            }
+        }
+    }
+
    override fun onCreateOptionsMenu(menu: Menu): Boolean {
        menuInflater.inflate(R.menu.menu_logcat, menu)

@@ -78,6 +134,11 @@ class LogcatActivity : BaseActivity(), SwipeRefreshLayout.OnRefreshListener {
            true
        }

+        R.id.share_all -> {
+            shareLogcat()
+            true
+        }
+
        R.id.clear_all -> {
            lifecycleScope.launch(Dispatchers.IO) {
                viewModel.clearLogcat()
@@ -4,6 +4,7 @@ import android.content.Intent
 import android.content.res.ColorStateList
 import android.net.Uri
 import android.net.VpnService
+import android.os.Build
 import android.os.Bundle
 import android.view.KeyEvent
 import android.view.Menu
@@ -22,6 +23,7 @@ import com.google.android.material.navigation.NavigationView
 import com.google.android.material.tabs.TabLayoutMediator
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.R
+import com.v2ray.ang.core.CoreServiceManager
 import com.v2ray.ang.databinding.ActivityMainBinding
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.enums.PermissionType
@@ -32,7 +34,6 @@ import com.v2ray.ang.handler.MmkvManager
 import com.v2ray.ang.handler.SettingsChangeManager
 import com.v2ray.ang.handler.SettingsManager
 import com.v2ray.ang.handler.SubscriptionUpdater
-import com.v2ray.ang.handler.V2RayServiceManager
 import com.v2ray.ang.util.LogUtil
 import com.v2ray.ang.util.Utils
 import com.v2ray.ang.viewmodel.MainViewModel
@@ -76,23 +77,7 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
        binding.viewPager.isUserInputEnabled = true

        // setup navigation drawer
-        val toggle = ActionBarDrawerToggle(
-            this, binding.drawerLayout, binding.toolbar, R.string.navigation_drawer_open, R.string.navigation_drawer_close
-        )
-        binding.drawerLayout.addDrawerListener(toggle)
-        toggle.syncState()
-        binding.navView.setNavigationItemSelectedListener(this)
-        onBackPressedDispatcher.addCallback(this, object : OnBackPressedCallback(true) {
-            override fun handleOnBackPressed() {
-                if (binding.drawerLayout.isDrawerOpen(GravityCompat.START)) {
-                    binding.drawerLayout.closeDrawer(GravityCompat.START)
-                } else {
-                    isEnabled = false
-                    onBackPressedDispatcher.onBackPressed()
-                    isEnabled = true
-                }
-            }
-        })
+        setupNavigationDrawer()

        binding.fab.setOnClickListener { handleFabAction() }
        binding.layoutTest.setOnClickListener { handleLayoutTestClick() }
@@ -106,6 +91,31 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
        }
    }

+    private fun setupNavigationDrawer() {
+        val toggle = ActionBarDrawerToggle(
+            this,
+            binding.drawerLayout,
+            binding.toolbar,
+            R.string.navigation_drawer_open,
+            R.string.navigation_drawer_close
+        )
+        binding.drawerLayout.addDrawerListener(toggle)
+        toggle.syncState()
+        binding.navView.setNavigationItemSelectedListener(this)
+
+        onBackPressedDispatcher.addCallback(this, object : OnBackPressedCallback(true) {
+            override fun handleOnBackPressed() {
+                if (binding.drawerLayout.isDrawerOpen(GravityCompat.START)) {
+                    binding.drawerLayout.closeDrawer(GravityCompat.START)
+                } else {
+                    isEnabled = false
+                    onBackPressedDispatcher.onBackPressed()
+                    isEnabled = true
+                }
+            }
+        })
+    }
+
    private fun setupViewModel() {
        mainViewModel.updateTestResultAction.observe(this) { setTestState(it) }
        mainViewModel.isRunning.observe(this) { isRunning ->
@@ -131,13 +141,33 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
        binding.viewPager.setCurrentItem(targetIndex, false)

        binding.tabGroup.isVisible = groups.size > 1
+        refreshGroupTabTitles(true)
+    }
+
+    fun refreshGroupTabTitles(refreshAll: Boolean = false) {
+        val groupsToRefresh = if (refreshAll || mainViewModel.subscriptionId.isEmpty()) {
+            groupPagerAdapter.groups
+        } else {
+            groupPagerAdapter.groups.filter { it.id == mainViewModel.subscriptionId }
+        }
+
+        groupsToRefresh.forEach { group ->
+            if (group.id.isEmpty()) {
+                return@forEach
+            }
+            val tabIndex = groupPagerAdapter.groups.indexOfFirst { it.id == group.id }
+            if (tabIndex >= 0) {
+                val count = MmkvManager.decodeServerList(group.id).size
+                binding.tabGroup.getTabAt(tabIndex)?.text = "${group.remarks} ($count)"
+            }
+        }
    }

    private fun handleFabAction() {
        applyRunningState(isLoading = true, isRunning = false)

        if (mainViewModel.isRunning.value == true) {
-            V2RayServiceManager.stopVService(this)
+            CoreServiceManager.stopVService(this)
        } else if (SettingsManager.isVpnMode()) {
            val intent = VpnService.prepare(this)
            if (intent == null) {
@@ -164,12 +194,17 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
            toast(R.string.title_file_chooser)
            return
        }
-        V2RayServiceManager.startVService(this)
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.CINNAMON_BUN && MmkvManager.decodeSettingsBool(AppConfig.PREF_PROXY_SHARING)) {
+            checkAndRequestPermission(PermissionType.ACCESS_LOCAL_NETWORK) {}
+        }
+
+        CoreServiceManager.startVService(this)
    }

    fun restartV2Ray() {
        if (mainViewModel.isRunning.value == true) {
-            V2RayServiceManager.stopVService(this)
+            CoreServiceManager.stopVService(this)
        }
        lifecycleScope.launch {
            delay(500)
@@ -254,6 +289,11 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
            true
        }

+        R.id.import_manually_proxy_chain -> {
+            importManually(EConfigType.PROXYCHAIN.value)
+            true
+        }
+
        R.id.import_manually_vmess -> {
            importManually(EConfigType.VMESS.value)
            true
@@ -299,12 +339,6 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
            true
        }

-        R.id.ping_all -> {
-            toast(getString(R.string.connection_test_testing_count, mainViewModel.serversCache.count()))
-            mainViewModel.testAllTcping()
-            true
-        }
-
        R.id.real_ping_all -> {
            toast(getString(R.string.connection_test_testing_count, mainViewModel.serversCache.count()))
            mainViewModel.testAllRealPing()
@@ -356,6 +390,12 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
                    .putExtra("subscriptionId", mainViewModel.subscriptionId)
                    .setClass(this, ServerGroupActivity::class.java)
            )
+        } else if (createConfigType == EConfigType.PROXYCHAIN.value) {
+            startActivity(
+                Intent()
+                    .putExtra("subscriptionId", mainViewModel.subscriptionId)
+                    .setClass(this, ServerProxyChainActivity::class.java)
+            )
        } else {
            startActivity(
                Intent()
@@ -405,6 +445,7 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
                        count > 0 -> {
                            toast(getString(R.string.title_import_config_count, count))
                            mainViewModel.reloadServerList()
+                            refreshGroupTabTitles()
                        }

                        countSub > 0 -> setupGroupTab()
@@ -460,6 +501,7 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
                }
                if (result.configCount > 0) {
                    mainViewModel.reloadServerList()
+                    refreshGroupTabTitles()
                }
                hideLoading()
            }
@@ -489,6 +531,7 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
                    val ret = mainViewModel.removeAllServer()
                    launch(Dispatchers.Main) {
                        mainViewModel.reloadServerList()
+                        refreshGroupTabTitles()
                        toast(getString(R.string.title_del_config_count, ret))
                        hideLoading()
                    }
@@ -508,6 +551,7 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
                    val ret = mainViewModel.removeDuplicateServer()
                    launch(Dispatchers.Main) {
                        mainViewModel.reloadServerList()
+                        refreshGroupTabTitles()
                        toast(getString(R.string.title_del_duplicate_config_count, ret))
                        hideLoading()
                    }
@@ -527,6 +571,7 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
                    val ret = mainViewModel.removeInvalidServer()
                    launch(Dispatchers.Main) {
                        mainViewModel.reloadServerList()
+                        refreshGroupTabTitles()
                        toast(getString(R.string.title_del_config_count, ret))
                        hideLoading()
                    }
@@ -12,8 +12,9 @@ import com.v2ray.ang.R
 import com.v2ray.ang.contracts.MainAdapterListener
 import com.v2ray.ang.databinding.ItemRecyclerFooterBinding
 import com.v2ray.ang.databinding.ItemRecyclerMainBinding
-import com.v2ray.ang.dto.ProfileItem
-import com.v2ray.ang.dto.ServersCache
+import com.v2ray.ang.dto.entities.ProfileItem
+import com.v2ray.ang.dto.entities.ServersCache
+import com.v2ray.ang.extension.isComplexType
 import com.v2ray.ang.extension.nullIfBlank
 import com.v2ray.ang.handler.AngConfigManager
 import com.v2ray.ang.handler.MmkvManager
@@ -58,7 +59,7 @@ class MainRecyclerAdapter(
            //Name address
            holder.itemMainBinding.tvName.text = profile.remarks
            holder.itemMainBinding.tvStatistics.text = getAddress(profile)
-            holder.itemMainBinding.tvType.text = profile.configType.name
+            holder.itemMainBinding.tvType.text = getProtocolDescription(profile)

            //TestResult
            val aff = MmkvManager.decodeServerAffiliationInfo(guid)
@@ -140,6 +141,35 @@ class MainRecyclerAdapter(
        return subRemarks?.toString() ?: ""
    }

+    private fun getProtocolDescription(profile: ProfileItem): String {
+        if (profile.configType.isComplexType()) {
+            return profile.configType.name
+        }
+
+        val parts = mutableListOf<String>()
+        parts.add(profile.configType.name)
+
+        // Transport: hide tcp or blank
+        profile.network?.let { net ->
+            if (net.isNotBlank() && !net.equals("tcp", ignoreCase = true)) {
+                parts.add(net)
+            }
+        }
+
+        // Security: hide blank or tls
+        profile.security?.let { sec ->
+            if (sec.isNotBlank()) {
+                if (profile.insecure == true && sec.equals("tls", ignoreCase = true)) {
+                    parts.add("$sec insecure") // TODO
+                } else {
+                    parts.add(sec)
+                }
+            }
+        }
+
+        return parts.joinToString(" / ")
+    }
+
    fun removeServerSub(guid: String, position: Int) {
        val idx = data.indexOfFirst { it.guid == guid }
        if (idx >= 0) {
@@ -203,4 +233,4 @@ class MainRecyclerAdapter(

    override fun onItemDismiss(position: Int) {
    }
-}
+}
@@ -14,6 +14,7 @@ import com.v2ray.ang.AppConfig.ANG_PACKAGE
 import com.v2ray.ang.R
 import com.v2ray.ang.databinding.ActivityBypassListBinding
 import com.v2ray.ang.dto.AppInfo
+import com.v2ray.ang.dto.UrlContentRequest
 import com.v2ray.ang.extension.toast
 import com.v2ray.ang.extension.toastSuccess
 import com.v2ray.ang.extension.v2RayApplication
@@ -189,12 +190,25 @@ class PerAppProxyActivity : BaseActivity() {

        val url = AppConfig.ANDROID_PACKAGE_NAME_LIST_URL
        lifecycleScope.launch(Dispatchers.IO) {
-            var content = HttpUtil.getUrlContent(url, 5000)
+            var content = HttpUtil.getUrlContent(
+                UrlContentRequest(
+                    url = url,
+                    timeout = 5000
+                )
+            )
            if (content.isNullOrEmpty()) {
                val proxyUsername = SettingsManager.getSocksUsername()
                val proxyPassword = SettingsManager.getSocksPassword()
                val httpPort = SettingsManager.getHttpPort()
-                content = HttpUtil.getUrlContent(url, 5000, httpPort, proxyUsername, proxyPassword) ?: ""
+                content = HttpUtil.getUrlContent(
+                    UrlContentRequest(
+                        url = url,
+                        timeout = 5000,
+                        httpPort = httpPort,
+                        proxyUsername = proxyUsername,
+                        proxyPassword = proxyPassword
+                    )
+                ) ?: ""
            }
            launch(Dispatchers.Main) {
                //LogUtil.i(AppConfig.TAG, content)
@@ -11,11 +11,10 @@ import com.v2ray.ang.AppConfig.BUILTIN_OUTBOUND_TAGS
 import com.v2ray.ang.AppConfig.TAG_PROXY
 import com.v2ray.ang.R
 import com.v2ray.ang.databinding.ActivityRoutingEditBinding
-import com.v2ray.ang.dto.RulesetItem
+import com.v2ray.ang.dto.entities.RulesetItem
 import com.v2ray.ang.extension.nullIfBlank
 import com.v2ray.ang.extension.toast
 import com.v2ray.ang.extension.toastSuccess
-import com.v2ray.ang.handler.MmkvManager
 import com.v2ray.ang.handler.SettingsManager
 import com.v2ray.ang.util.Utils
 import kotlinx.coroutines.Dispatchers
@@ -78,9 +77,7 @@ class RoutingEditActivity : BaseActivity() {
     * The dropdown button triggers showing the full list without typing.
     */
    private fun setupOutboundTagInput() {
-        val profileRemarks = MmkvManager.decodeAllServerList()
-            .mapNotNull { id -> MmkvManager.decodeServerConfig(id)?.remarks }
-            .filter { it.isNotBlank() }
+        val profileRemarks = SettingsManager.getProfileRemarks()

        val suggestions = (BUILTIN_OUTBOUND_TAGS.toList() + profileRemarks).distinct()
        val adapter = ArrayAdapter(this, android.R.layout.simple_dropdown_item_1line, suggestions)
@@ -2,7 +2,7 @@ package com.v2ray.ang.ui

 import android.os.Bundle
 import com.v2ray.ang.R
-import com.v2ray.ang.handler.V2RayServiceManager
+import com.v2ray.ang.core.CoreServiceManager

 class ScStartActivity : BaseActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
@@ -11,8 +11,8 @@ class ScStartActivity : BaseActivity() {

        setContentView(R.layout.activity_none)

-        if (!V2RayServiceManager.isRunning()) {
-            V2RayServiceManager.startVServiceFromToggle(this)
+        if (!CoreServiceManager.isRunning()) {
+            CoreServiceManager.startVServiceFromToggle(this)
        }
        finish()
    }
@@ -2,7 +2,7 @@ package com.v2ray.ang.ui

 import android.os.Bundle
 import com.v2ray.ang.R
-import com.v2ray.ang.handler.V2RayServiceManager
+import com.v2ray.ang.core.CoreServiceManager

 class ScStopActivity : BaseActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
@@ -11,8 +11,8 @@ class ScStopActivity : BaseActivity() {

        setContentView(R.layout.activity_none)

-        if (V2RayServiceManager.isRunning()) {
-            V2RayServiceManager.stopVService(this)
+        if (CoreServiceManager.isRunning()) {
+            CoreServiceManager.stopVService(this)
        }
        finish()
    }
@@ -2,7 +2,7 @@ package com.v2ray.ang.ui

 import android.os.Bundle
 import com.v2ray.ang.R
-import com.v2ray.ang.handler.V2RayServiceManager
+import com.v2ray.ang.core.CoreServiceManager

 class ScSwitchActivity : BaseActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
@@ -11,10 +11,10 @@ class ScSwitchActivity : BaseActivity() {

        setContentView(R.layout.activity_none)

-        if (V2RayServiceManager.isRunning()) {
-            V2RayServiceManager.stopVService(this)
+        if (CoreServiceManager.isRunning()) {
+            CoreServiceManager.stopVService(this)
        } else {
-            V2RayServiceManager.startVServiceFromToggle(this)
+            CoreServiceManager.startVServiceFromToggle(this)
        }
        finish()
    }
@@ -7,20 +7,21 @@ import android.view.MenuItem
 import android.view.View
 import android.widget.AdapterView
 import android.widget.ArrayAdapter
+import android.widget.Button
 import android.widget.EditText
 import android.widget.LinearLayout
 import android.widget.Spinner
 import android.widget.TextView
 import androidx.appcompat.app.AlertDialog
+import androidx.lifecycle.lifecycleScope
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.AppConfig.DEFAULT_PORT
-import com.v2ray.ang.AppConfig.PREF_ALLOW_INSECURE
 import com.v2ray.ang.AppConfig.REALITY
 import com.v2ray.ang.AppConfig.TLS
 import com.v2ray.ang.AppConfig.WIREGUARD_LOCAL_ADDRESS_V4
 import com.v2ray.ang.AppConfig.WIREGUARD_LOCAL_MTU
 import com.v2ray.ang.R
-import com.v2ray.ang.dto.ProfileItem
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.enums.NetworkType
 import com.v2ray.ang.extension.isNotNullEmpty
@@ -28,9 +29,14 @@ import com.v2ray.ang.extension.nullIfBlank
 import com.v2ray.ang.extension.toast
 import com.v2ray.ang.extension.toastSuccess
 import com.v2ray.ang.handler.AngConfigManager
+import com.v2ray.ang.handler.CertificateFingerprintManager
 import com.v2ray.ang.handler.MmkvManager
+import com.v2ray.ang.handler.SettingsChangeManager
 import com.v2ray.ang.util.JsonUtil
 import com.v2ray.ang.util.Utils
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext

 class ServerActivity : BaseActivity() {

@@ -84,6 +90,9 @@ class ServerActivity : BaseActivity() {
    private val xhttpMode: Array<out String> by lazy {
        resources.getStringArray(R.array.xhttp_mode)
    }
+    private val browserDialerModes: Array<out String> by lazy {
+        resources.getStringArray(R.array.browser_dialer_mode)
+    }


    // Kotlin synthetics was used, but since it is removed in 1.8. We switch to old manual approach.
@@ -137,8 +146,13 @@ class ServerActivity : BaseActivity() {
    private val layout_extra: LinearLayout? by lazy { findViewById(R.id.layout_extra) }
    private val et_ech_config_list: EditText? by lazy { findViewById(R.id.et_ech_config_list) }
    private val container_ech_config_list: LinearLayout? by lazy { findViewById(R.id.lay_ech_config_list) }
+    private val et_verify_peer_cert_by_name: EditText? by lazy { findViewById(R.id.et_verify_peer_cert_by_name) }
+    private val container_verify_peer_cert_by_name: LinearLayout? by lazy { findViewById(R.id.lay_verify_peer_cert_by_name) }
    private val et_pinned_ca256: EditText? by lazy { findViewById(R.id.et_pinned_ca256) }
+    private val btn_pinned_ca256_action: Button? by lazy { findViewById(R.id.btn_pinned_ca256_action) }
    private val container_pinned_ca256: LinearLayout? by lazy { findViewById(R.id.lay_pinned_ca256) }
+    private val layout_browser_dialer: LinearLayout? by lazy { findViewById(R.id.layout_browser_dialer) }
+    private val sp_browser_dialer_mode: Spinner? by lazy { findViewById(R.id.sp_browser_dialer_mode) }


    override fun onCreate(savedInstanceState: Bundle?) {
@@ -148,14 +162,12 @@ class ServerActivity : BaseActivity() {

        val layoutId = when (config?.configType ?: createConfigType) {
            EConfigType.VMESS -> R.layout.activity_server_vmess
-            EConfigType.CUSTOM -> null
            EConfigType.SHADOWSOCKS -> R.layout.activity_server_shadowsocks
            EConfigType.SOCKS, EConfigType.HTTP -> R.layout.activity_server_socks
            EConfigType.VLESS -> R.layout.activity_server_vless
            EConfigType.TROJAN -> R.layout.activity_server_trojan
            EConfigType.WIREGUARD -> R.layout.activity_server_wireguard
            EConfigType.HYSTERIA2 -> R.layout.activity_server_hysteria2
-            EConfigType.POLICYGROUP -> null
            else -> null
        } ?: return
        setContentViewWithToolbar(layoutId, showHomeAsUp = true, title = (config?.configType ?: createConfigType).toString())
@@ -256,6 +268,13 @@ class ServerActivity : BaseActivity() {
                        NetworkType.XHTTP.type -> View.VISIBLE
                        else -> View.GONE
                    }
+
+                layout_browser_dialer?.visibility =
+                    when (networks[position]) {
+                        NetworkType.WS.type -> View.VISIBLE
+                        NetworkType.XHTTP.type -> View.VISIBLE
+                        else -> View.GONE
+                    }
            }

            override fun onNothingSelected(parent: AdapterView<*>?) {
@@ -285,6 +304,7 @@ class ServerActivity : BaseActivity() {
                            container_spider_x,
                            container_mldsa65_verify,
                            container_ech_config_list,
+                            container_verify_peer_cert_by_name,
                            container_pinned_ca256
                        ).forEach { it?.visibility = View.GONE }
                    }
@@ -297,6 +317,7 @@ class ServerActivity : BaseActivity() {
                            container_alpn,
                            container_allow_insecure,
                            container_ech_config_list,
+                            container_verify_peer_cert_by_name,
                            container_pinned_ca256
                        ).forEach { it?.visibility = View.VISIBLE }
                        listOf(
@@ -317,6 +338,7 @@ class ServerActivity : BaseActivity() {
                            container_alpn,
                            container_allow_insecure,
                            container_ech_config_list,
+                            container_verify_peer_cert_by_name,
                            container_pinned_ca256
                        ).forEach { it?.visibility = View.GONE }
                        listOf(
@@ -333,6 +355,9 @@ class ServerActivity : BaseActivity() {
                // do nothing
            }
        }
+        btn_pinned_ca256_action?.setOnClickListener {
+            fetchPinnedCA256ForCurrentConfig()
+        }
        if (config != null) {
            bindingServer(config)
        } else {
@@ -400,6 +425,7 @@ class ServerActivity : BaseActivity() {
                    sp_allow_insecure?.setSelection(allowinsecure)
                }
                et_ech_config_list?.text = Utils.getEditable(config.echConfigList)
+                et_verify_peer_cert_by_name?.text = Utils.getEditable(config.verifyPeerCertByName)
                et_pinned_ca256?.text = Utils.getEditable(config.pinnedCA256)
            } else if (config.security == REALITY) {
                et_public_key?.text = Utils.getEditable(config.publicKey.orEmpty())
@@ -413,6 +439,12 @@ class ServerActivity : BaseActivity() {
        if (network >= 0) {
            sp_network?.setSelection(network)
        }
+
+        val browserDialerMode = Utils.arrayFind(browserDialerModes, config.browserDialerMode.orEmpty())
+        if (browserDialerMode >= 0) {
+            sp_browser_dialer_mode?.setSelection(browserDialerMode)
+        }
+
        return true
    }

@@ -441,6 +473,7 @@ class ServerActivity : BaseActivity() {
        et_local_address?.text =
            Utils.getEditable(WIREGUARD_LOCAL_ADDRESS_V4)
        et_local_mtu?.text = Utils.getEditable(WIREGUARD_LOCAL_MTU)
+        sp_browser_dialer_mode?.setSelection(0)
        return true
    }

@@ -509,6 +542,9 @@ class ServerActivity : BaseActivity() {
        }
        //LogUtil.i(AppConfig.TAG, JsonUtil.toJsonPretty(config) ?: "")
        MmkvManager.encodeServerConfig(editGuid, config)
+        if (isRunning) {
+            SettingsChangeManager.makeRestartService()
+        }
        toastSuccess(R.string.toast_success)
        finish()
        return true
@@ -570,6 +606,16 @@ class ServerActivity : BaseActivity() {
        profileItem.finalMask = et_fm?.text?.toString()?.trim()?.nullIfBlank()
        profileItem.kcpMtu = et_kcp_mtu?.text?.toString()?.toIntOrNull()
        profileItem.kcpTti = et_kcp_tti?.text?.toString()?.toIntOrNull()
+        if (networks[network] == NetworkType.WS.type || networks[network] == NetworkType.XHTTP.type) {
+            val browserDialerMode = browserDialerModes[sp_browser_dialer_mode?.selectedItemPosition ?: 0]
+            if (browserDialerMode != browserDialerModes[0]) {
+                profileItem.browserDialerMode = browserDialerMode
+            } else {
+                profileItem.browserDialerMode = null
+            }
+        } else {
+            profileItem.browserDialerMode = null
+        }
    }

    private fun saveTls(config: ProfileItem) {
@@ -583,11 +629,12 @@ class ServerActivity : BaseActivity() {
        val spiderX = et_spider_x?.text?.toString()
        val mldsa65Verify = et_mldsa65_verify?.text?.toString()
        val echConfigList = et_ech_config_list?.text?.toString()
+        val verifyPeerCertByName = et_verify_peer_cert_by_name?.text?.toString()
        val pinnedCA256 = et_pinned_ca256?.text?.toString()

        val allowInsecure =
            if (allowInsecureField == null || allowinsecures[allowInsecureField].isBlank()) {
-                MmkvManager.decodeSettingsBool(PREF_ALLOW_INSECURE)
+                false
            } else {
                allowinsecures[allowInsecureField].toBoolean()
            }
@@ -602,9 +649,51 @@ class ServerActivity : BaseActivity() {
        config.spiderX = spiderX
        config.mldsa65Verify = mldsa65Verify
        config.echConfigList = echConfigList
+        config.verifyPeerCertByName = verifyPeerCertByName
        config.pinnedCA256 = pinnedCA256
    }

+    private fun fetchPinnedCA256ForCurrentConfig() {
+        val config = buildCurrentProfileForCertificateFetch() ?: return
+
+        lifecycleScope.launch {
+            btn_pinned_ca256_action?.isEnabled = false
+            try {
+                val sha256 = withContext(Dispatchers.IO) {
+                    CertificateFingerprintManager.fetchForManualFill(config)
+                }
+                if (sha256.isNullOrBlank()) {
+                    toast(R.string.toast_fetch_cert_sha256_failed)
+                } else {
+                    et_pinned_ca256?.text = Utils.getEditable(sha256)
+                    toastSuccess(R.string.toast_fetch_cert_sha256_success)
+                }
+            } finally {
+                btn_pinned_ca256_action?.isEnabled = true
+            }
+        }
+    }
+
+    private fun buildCurrentProfileForCertificateFetch(): ProfileItem? {
+        if (TextUtils.isEmpty(et_address.text.toString())) {
+            toast(R.string.server_lab_address)
+            return null
+        }
+
+        val configType = MmkvManager.decodeServerConfig(editGuid)?.configType ?: createConfigType
+        if (configType != EConfigType.HYSTERIA2 && Utils.parseInt(et_port.text.toString()) <= 0) {
+            toast(R.string.server_lab_port)
+            return null
+        }
+
+        val config = ProfileItem.create(configType)
+        saveCommon(config)
+        saveStreamSettings(config)
+        saveTls(config)
+
+        return config
+    }
+
    private fun transportTypes(network: String?): Array<out String> {
        return when (network) {
            NetworkType.TCP.type -> {
@@ -658,17 +747,9 @@ class ServerActivity : BaseActivity() {

    override fun onCreateOptionsMenu(menu: Menu): Boolean {
        menuInflater.inflate(R.menu.action_server, menu)
-        val delButton = menu.findItem(R.id.del_config)
-        val saveButton = menu.findItem(R.id.save_config)

-        if (editGuid.isNotEmpty()) {
-            if (isRunning) {
-                delButton?.isVisible = false
-                saveButton?.isVisible = false
-            }
-        } else {
-            delButton?.isVisible = false
-        }
+        val delButton = menu.findItem(R.id.del_config)
+        delButton?.isVisible = editGuid.isNotEmpty() && !isRunning

        return super.onCreateOptionsMenu(menu)
    }
@@ -10,13 +10,14 @@ import com.blacksquircle.ui.language.json.JsonLanguage
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.R
 import com.v2ray.ang.databinding.ActivityServerCustomConfigBinding
-import com.v2ray.ang.dto.ProfileItem
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.extension.toast
 import com.v2ray.ang.extension.toastSuccess
 import com.v2ray.ang.fmt.CustomFmt
 import com.v2ray.ang.handler.AngConfigManager
 import com.v2ray.ang.handler.MmkvManager
+import com.v2ray.ang.handler.SettingsChangeManager
 import com.v2ray.ang.util.LogUtil
 import com.v2ray.ang.util.Utils

@@ -94,6 +95,9 @@ class ServerCustomConfigActivity : BaseActivity() {

        MmkvManager.encodeServerConfig(editGuid, config)
        MmkvManager.encodeServerRaw(editGuid, binding.editor.text.toString())
+        if (isRunning) {
+            SettingsChangeManager.makeRestartService()
+        }
        toastSuccess(R.string.toast_success)
        finish()
        return true
@@ -119,17 +123,9 @@ class ServerCustomConfigActivity : BaseActivity() {

    override fun onCreateOptionsMenu(menu: Menu): Boolean {
        menuInflater.inflate(R.menu.action_server, menu)
-        val delButton = menu.findItem(R.id.del_config)
-        val saveButton = menu.findItem(R.id.save_config)

-        if (editGuid.isNotEmpty()) {
-            if (isRunning) {
-                delButton?.isVisible = false
-                saveButton?.isVisible = false
-            }
-        } else {
-            delButton?.isVisible = false
-        }
+        val delButton = menu.findItem(R.id.del_config)
+        delButton?.isVisible = editGuid.isNotEmpty() && !isRunning

        return super.onCreateOptionsMenu(menu)
    }
@@ -8,12 +8,13 @@ import android.widget.ArrayAdapter
 import androidx.appcompat.app.AlertDialog
 import com.v2ray.ang.R
 import com.v2ray.ang.databinding.ActivityServerGroupBinding
-import com.v2ray.ang.dto.ProfileItem
+import com.v2ray.ang.dto.entities.ProfileItem
 import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.extension.isNotNullEmpty
 import com.v2ray.ang.extension.toast
 import com.v2ray.ang.extension.toastSuccess
 import com.v2ray.ang.handler.MmkvManager
+import com.v2ray.ang.handler.SettingsChangeManager
 import com.v2ray.ang.util.Utils

 class ServerGroupActivity : BaseActivity() {
@@ -100,6 +101,9 @@ class ServerGroupActivity : BaseActivity() {
        config.description = "${binding.spPolicyGroupType.selectedItem} - ${binding.spPolicyGroupSubId.selectedItem} - ${config.policyGroupFilter}"

        MmkvManager.encodeServerConfig(editGuid, config)
+        if (isRunning) {
+            SettingsChangeManager.makeRestartService()
+        }
        toastSuccess(R.string.toast_success)
        finish()
        return true
@@ -143,17 +147,9 @@ class ServerGroupActivity : BaseActivity() {

    override fun onCreateOptionsMenu(menu: Menu): Boolean {
        menuInflater.inflate(R.menu.action_server, menu)
-        val delButton = menu.findItem(R.id.del_config)
-        val saveButton = menu.findItem(R.id.save_config)

-        if (editGuid.isNotEmpty()) {
-            if (isRunning) {
-                delButton?.isVisible = false
-                saveButton?.isVisible = false
-            }
-        } else {
-            delButton?.isVisible = false
-        }
+        val delButton = menu.findItem(R.id.del_config)
+        delButton?.isVisible = editGuid.isNotEmpty() && !isRunning

        return super.onCreateOptionsMenu(menu)
    }
@@ -0,0 +1,217 @@
+package com.v2ray.ang.ui
+
+import android.os.Bundle
+import android.text.TextUtils
+import android.view.Menu
+import android.view.MenuItem
+import androidx.appcompat.app.AlertDialog
+import androidx.recyclerview.widget.ItemTouchHelper
+import androidx.recyclerview.widget.LinearLayoutManager
+import com.v2ray.ang.AppConfig
+import com.v2ray.ang.R
+import com.v2ray.ang.contracts.BaseAdapterListener
+import com.v2ray.ang.databinding.ActivityServerProxyChainBinding
+import com.v2ray.ang.dto.entities.ProfileItem
+import com.v2ray.ang.enums.EConfigType
+import com.v2ray.ang.extension.isComplexType
+import com.v2ray.ang.extension.toast
+import com.v2ray.ang.extension.toastSuccess
+import com.v2ray.ang.handler.MmkvManager
+import com.v2ray.ang.handler.SettingsChangeManager
+import com.v2ray.ang.handler.SettingsManager
+import com.v2ray.ang.helper.SimpleItemTouchHelperCallback
+import com.v2ray.ang.util.Utils
+
+class ServerProxyChainActivity : BaseActivity() {
+    private val binding by lazy { ActivityServerProxyChainBinding.inflate(layoutInflater) }
+    private val editGuid by lazy { intent.getStringExtra("guid").orEmpty() }
+    private val isRunning by lazy {
+        intent.getBooleanExtra("isRunning", false)
+                && editGuid.isNotEmpty()
+                && editGuid == MmkvManager.getSelectServer()
+    }
+    private val subscriptionId by lazy {
+        intent.getStringExtra("subscriptionId")
+    }
+    private lateinit var memberAdapter: ServerProxyChainMemberAdapter
+
+    private var allRemarks: List<String> = emptyList()
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        setContentViewWithToolbar(binding.root, showHomeAsUp = true, title = EConfigType.PROXYCHAIN.toString())
+
+        loadAvailableRemarks()
+        setupRecycler()
+        binding.fabAddProxyChainMember.setOnClickListener {
+            addMemberRow()
+        }
+
+        val config = MmkvManager.decodeServerConfig(editGuid)
+        if (config != null) {
+            bindingServer(config)
+        } else {
+            clearServer()
+        }
+    }
+
+    private fun loadAvailableRemarks() {
+        allRemarks = SettingsManager.getProfileRemarks(
+            excludeConfigTypes = setOf(
+                EConfigType.CUSTOM,
+                EConfigType.POLICYGROUP,
+                EConfigType.PROXYCHAIN,
+            )
+        )
+    }
+
+    private fun setupRecycler() {
+        memberAdapter = ServerProxyChainMemberAdapter(
+            members = mutableListOf(),
+            suggestions = allRemarks,
+            adapterListener = ActivityAdapterListener()
+        )
+        binding.recyclerProxyChainMembers.layoutManager = LinearLayoutManager(this)
+        binding.recyclerProxyChainMembers.adapter = memberAdapter
+        ItemTouchHelper(SimpleItemTouchHelperCallback(memberAdapter)).attachToRecyclerView(binding.recyclerProxyChainMembers)
+    }
+
+    private fun bindingServer(config: ProfileItem): Boolean {
+        binding.etRemarks.text = Utils.getEditable(config.remarks)
+        val rows = parseChainMembers(config.proxyChainProfiles)
+        memberAdapter.replaceAll(rows)
+        if (rows.isEmpty()) {
+            memberAdapter.addRow()
+        }
+        return true
+    }
+
+    private fun clearServer(): Boolean {
+        binding.etRemarks.text = null
+        memberAdapter.replaceAll(listOf("", ""))
+        return true
+    }
+
+    private fun saveServer(): Boolean {
+        if (TextUtils.isEmpty(binding.etRemarks.text.toString())) {
+            toast(R.string.server_lab_remarks)
+            return false
+        }
+
+        val chainMembers = memberAdapter.getMembers().map { it.trim() }.filter { it.isNotEmpty() }
+        if (chainMembers.size != memberAdapter.getMembers().size) {
+            toast(R.string.server_proxy_chain_members_unselected)
+            return false
+        }
+        if (chainMembers.size < 2) {
+            toast(R.string.server_proxy_chain_members_insufficient)
+            return false
+        }
+
+        val invalidMembers = chainMembers.filter { member ->
+            val profile = SettingsManager.getServerViaRemarks(member)
+            profile == null || profile.configType.isComplexType()
+        }
+        if (invalidMembers.isNotEmpty()) {
+            toast(getString(R.string.server_proxy_chain_members_invalid, invalidMembers.joinToString(", ")))
+            return false
+        }
+
+        val config = MmkvManager.decodeServerConfig(editGuid) ?: ProfileItem.create(EConfigType.PROXYCHAIN)
+        config.remarks = binding.etRemarks.text.toString().trim()
+        config.proxyChainProfiles = chainMembers.joinToString(",")
+        config.description = chainMembers.joinToString(" -> ")
+
+        if (config.subscriptionId.isEmpty() && !subscriptionId.isNullOrEmpty()) {
+            config.subscriptionId = subscriptionId.orEmpty()
+        }
+
+        MmkvManager.encodeServerConfig(editGuid, config)
+        if (isRunning) {
+            SettingsChangeManager.makeRestartService()
+        }
+        toastSuccess(R.string.toast_success)
+        finish()
+        return true
+    }
+
+    private fun deleteServer(): Boolean {
+        if (editGuid.isNotEmpty()) {
+            if (editGuid != MmkvManager.getSelectServer()) {
+                if (MmkvManager.decodeSettingsBool(AppConfig.PREF_CONFIRM_REMOVE)) {
+                    AlertDialog.Builder(this).setMessage(R.string.del_config_comfirm)
+                        .setPositiveButton(android.R.string.ok) { _, _ ->
+                            MmkvManager.removeServer(editGuid)
+                            finish()
+                        }
+                        .setNegativeButton(android.R.string.cancel) { _, _ ->
+                            // do nothing
+                        }
+                        .show()
+                } else {
+                    MmkvManager.removeServer(editGuid)
+                    finish()
+                }
+            } else {
+                toast(R.string.toast_action_not_allowed)
+            }
+        }
+        return true
+    }
+
+    private fun addMemberRow() {
+        if (allRemarks.isEmpty()) {
+            toast(R.string.toast_none_data)
+            return
+        }
+        memberAdapter.addRow()
+    }
+
+    private fun parseChainMembers(raw: String?): List<String> {
+        return raw.orEmpty()
+            .split(",")
+            .map { it.trim() }
+            .filter { it.isNotEmpty() }
+    }
+
+    private inner class ActivityAdapterListener : BaseAdapterListener {
+        override fun onEdit(guid: String, position: Int) {
+            // Row selection is handled directly by AutoCompleteTextView in the adapter.
+        }
+
+        override fun onRemove(guid: String, position: Int) {
+            memberAdapter.removeRow(position)
+        }
+
+        override fun onShare(url: String) {
+        }
+
+        override fun onRefreshData() {
+        }
+    }
+
+    override fun onCreateOptionsMenu(menu: Menu): Boolean {
+        menuInflater.inflate(R.menu.action_server, menu)
+
+        val delButton = menu.findItem(R.id.del_config)
+        delButton?.isVisible = editGuid.isNotEmpty() && !isRunning
+
+        return super.onCreateOptionsMenu(menu)
+    }
+
+    override fun onOptionsItemSelected(item: MenuItem) = when (item.itemId) {
+        R.id.del_config -> {
+            deleteServer()
+            true
+        }
+
+        R.id.save_config -> {
+            saveServer()
+            true
+        }
+
+        else -> super.onOptionsItemSelected(item)
+    }
+}
+
+
@@ -0,0 +1,136 @@
+package com.v2ray.ang.ui
+
+import android.graphics.Color
+import android.view.LayoutInflater
+import android.view.View
+import android.view.ViewGroup
+import android.widget.ArrayAdapter
+import androidx.recyclerview.widget.RecyclerView
+import com.v2ray.ang.contracts.BaseAdapterListener
+import com.v2ray.ang.databinding.ItemRecyclerProxyChainMemberBinding
+import com.v2ray.ang.helper.ItemTouchHelperAdapter
+import com.v2ray.ang.helper.ItemTouchHelperViewHolder
+import java.util.Collections
+
+class ServerProxyChainMemberAdapter(
+    private val members: MutableList<String>,
+    private val suggestions: List<String>,
+    private val adapterListener: BaseAdapterListener?
+) : RecyclerView.Adapter<ServerProxyChainMemberAdapter.MemberViewHolder>(), ItemTouchHelperAdapter {
+
+    override fun getItemCount(): Int = members.size
+
+    override fun onCreateViewHolder(parent: ViewGroup, viewType: Int): MemberViewHolder {
+        return MemberViewHolder(
+            ItemRecyclerProxyChainMemberBinding.inflate(
+                LayoutInflater.from(parent.context),
+                parent,
+                false
+            )
+        )
+    }
+
+    override fun onBindViewHolder(holder: MemberViewHolder, position: Int) {
+        val adapterPos = holder.bindingAdapterPosition.takeIf { it != RecyclerView.NO_POSITION } ?: position
+        val value = members[position]
+        holder.binding.tvMemberIndex.text = (position + 1).toString()
+
+        val dropdownAdapter = ArrayAdapter(
+            holder.itemView.context,
+            android.R.layout.simple_dropdown_item_1line,
+            suggestions
+        )
+        holder.binding.spMemberRemark.setAdapter(dropdownAdapter)
+        holder.binding.spMemberRemark.threshold = 0
+        holder.binding.spMemberRemark.setText(value, false)
+
+        holder.binding.spMemberRemark.setOnItemClickListener { _, _, selectedIndex, _ ->
+            if (adapterPos in members.indices) {
+                members[adapterPos] = suggestions[selectedIndex].trim()
+                adapterListener?.onRefreshData()
+            }
+        }
+        holder.binding.spMemberRemark.onFocusChangeListener = View.OnFocusChangeListener { _, hasFocus ->
+            if (hasFocus) return@OnFocusChangeListener
+            val text = holder.binding.spMemberRemark.text?.toString().orEmpty().trim()
+            if (adapterPos in members.indices && members[adapterPos] != text) {
+                members[adapterPos] = text
+                adapterListener?.onRefreshData()
+            }
+        }
+        holder.binding.spMemberRemark.setOnClickListener { holder.binding.spMemberRemark.showDropDown() }
+        holder.binding.btnMemberDropdown.setOnClickListener {
+            holder.binding.spMemberRemark.requestFocus()
+            holder.binding.spMemberRemark.showDropDown()
+        }
+        holder.itemView.setOnClickListener { holder.binding.spMemberRemark.showDropDown() }
+
+        holder.binding.layoutRemove.setOnClickListener {
+            val removePos = holder.bindingAdapterPosition
+            if (removePos != RecyclerView.NO_POSITION) {
+                adapterListener?.onRemove("", removePos)
+            }
+        }
+    }
+
+    fun addRow() {
+        members.add("")
+        notifyItemInserted(members.lastIndex)
+        adapterListener?.onRefreshData()
+    }
+
+    fun removeRow(position: Int) {
+        if (position < 0 || position >= members.size) return
+        members.removeAt(position)
+        notifyItemRemoved(position)
+        notifyItemRangeChanged(position, members.size - position)
+        adapterListener?.onRefreshData()
+    }
+
+    fun setRemark(position: Int, remark: String) {
+        if (position < 0 || position >= members.size) return
+        members[position] = remark
+        notifyItemChanged(position)
+        adapterListener?.onRefreshData()
+    }
+
+    fun replaceAll(newMembers: List<String>) {
+        members.clear()
+        members.addAll(newMembers)
+        notifyDataSetChanged()
+        adapterListener?.onRefreshData()
+    }
+
+    fun getMembers(): List<String> = members.toList()
+
+    override fun onItemMove(fromPosition: Int, toPosition: Int): Boolean {
+        if (fromPosition == toPosition) return true
+        Collections.swap(members, fromPosition, toPosition)
+        notifyItemMoved(fromPosition, toPosition)
+        notifyItemChanged(fromPosition)
+        notifyItemChanged(toPosition)
+        return true
+    }
+
+    override fun onItemMoveCompleted() {
+        adapterListener?.onRefreshData()
+    }
+
+    override fun onItemDismiss(position: Int) {
+        // Swipe-to-dismiss disabled for this adapter.
+    }
+
+    class MemberViewHolder(val binding: ItemRecyclerProxyChainMemberBinding) :
+        BaseViewHolder(binding.root), ItemTouchHelperViewHolder
+
+    open class BaseViewHolder(itemView: View) : RecyclerView.ViewHolder(itemView) {
+        fun onItemSelected() {
+            itemView.setBackgroundColor(Color.LTGRAY)
+        }
+
+        fun onItemClear() {
+            itemView.setBackgroundColor(Color.TRANSPARENT)
+        }
+    }
+}
+
@@ -2,6 +2,7 @@ package com.v2ray.ang.ui

 import android.os.Bundle
 import android.view.View
+import androidx.lifecycle.lifecycleScope
 import androidx.preference.CheckBoxPreference
 import androidx.preference.EditTextPreference
 import androidx.preference.ListPreference
@@ -9,9 +10,12 @@ import androidx.preference.PreferenceFragmentCompat
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.AppConfig.VPN
 import com.v2ray.ang.R
+import com.v2ray.ang.extension.toastError
 import com.v2ray.ang.handler.MmkvManager
 import com.v2ray.ang.helper.MmkvPreferenceDataStore
+import com.v2ray.ang.root.RootManager
 import com.v2ray.ang.util.Utils
+import kotlinx.coroutines.launch

 class SettingsActivity : BaseActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
@@ -40,8 +44,11 @@ class SettingsActivity : BaseActivity() {
        private val fragmentPackets by lazy { findPreference<ListPreference>(AppConfig.PREF_FRAGMENT_PACKETS) }
        private val fragmentLength by lazy { findPreference<EditTextPreference>(AppConfig.PREF_FRAGMENT_LENGTH) }
        private val fragmentInterval by lazy { findPreference<EditTextPreference>(AppConfig.PREF_FRAGMENT_INTERVAL) }
+        private val fragmentMaxSplit by lazy { findPreference<EditTextPreference>(AppConfig.PREF_FRAGMENT_MAXSPLIT) }

        private val mode by lazy { findPreference<ListPreference>(AppConfig.PREF_MODE) }
+        private val enableRootMode by lazy { findPreference<CheckBoxPreference>(AppConfig.PREF_ROOT_MODE_ENABLE) }
+        private val lanSharing by lazy { findPreference<CheckBoxPreference>(AppConfig.PREF_ROOT_LAN_SHARING) }

        private val hevTunLogLevel by lazy { findPreference<ListPreference>(AppConfig.PREF_HEV_TUNNEL_LOGLEVEL) }
        private val hevTunRwTimeout by lazy { findPreference<EditTextPreference>(AppConfig.PREF_HEV_TUNNEL_RW_TIMEOUT) }
@@ -96,6 +103,7 @@ class SettingsActivity : BaseActivity() {
                updateMode(valueStr)
                true
            }
+
            mode?.dialogLayoutResource = R.layout.preference_with_help_link

            useHevTun?.setOnPreferenceChangeListener { _, newValue ->
@@ -112,6 +120,33 @@ class SettingsActivity : BaseActivity() {
                updateDynamicSocksPort(newValue as Boolean)
                true
            }
+
+            enableRootMode?.setOnPreferenceChangeListener { _, newValue ->
+                if (newValue == true && !RootManager.cachedRoot()) {
+                    lifecycleScope.launch {
+                        if (checkAndRequestRoot()) {
+                            enableRootMode?.isChecked = true
+                        }
+                    }
+                    false
+                } else {
+                    true
+                }
+            }
+
+            lanSharing?.setOnPreferenceChangeListener { _, newValue ->
+                if (newValue == true && !RootManager.cachedRoot()) {
+                    lifecycleScope.launch {
+                        if (checkAndRequestRoot()) {
+                            lanSharing?.isChecked = true
+                        }
+                    }
+                    false
+                } else {
+                    true
+                }
+            }
+
        }

        private fun initPreferenceSummaries() {
@@ -160,6 +195,15 @@ class SettingsActivity : BaseActivity() {
            preferenceScreen?.let { traverse(it) }
        }

+        private suspend fun checkAndRequestRoot(): Boolean {
+            val hasRoot = RootManager.refresh()
+            if (!isAdded) return false
+            if (!hasRoot) {
+                context?.toastError(R.string.toast_root_required)
+            }
+            return hasRoot
+        }
+
        override fun onStart() {
            super.onStart()
            updateHevTunSettings(MmkvManager.decodeSettingsBool(AppConfig.PREF_USE_HEV_TUNNEL, true))
@@ -243,6 +287,7 @@ class SettingsActivity : BaseActivity() {
            fragmentPackets?.isEnabled = enabled
            fragmentLength?.isEnabled = enabled
            fragmentInterval?.isEnabled = enabled
+            fragmentMaxSplit?.isEnabled = enabled
        }

        private fun updateDynamicSocksPort(enabled: Boolean) {
@@ -4,12 +4,16 @@ import android.os.Bundle
 import android.text.TextUtils
 import android.view.Menu
 import android.view.MenuItem
+import android.widget.ArrayAdapter
+import android.widget.AutoCompleteTextView
+import android.widget.ImageButton
 import androidx.appcompat.app.AlertDialog
 import androidx.lifecycle.lifecycleScope
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.R
 import com.v2ray.ang.databinding.ActivitySubEditBinding
-import com.v2ray.ang.dto.SubscriptionItem
+import com.v2ray.ang.dto.entities.SubscriptionItem
+import com.v2ray.ang.enums.EConfigType
 import com.v2ray.ang.extension.toast
 import com.v2ray.ang.extension.toastSuccess
 import com.v2ray.ang.handler.MmkvManager
@@ -33,6 +37,7 @@ class SubEditActivity : BaseActivity() {
        //setContentView(binding.root)
        setContentViewWithToolbar(binding.root, showHomeAsUp = true, title = getString(R.string.title_sub_setting))

+        setupProfileRemarkInputs()
        SettingsChangeManager.makeSetupGroupTab()
        val subItem = MmkvManager.decodeSubscription(editSubId)
        if (subItem != null) {
@@ -73,6 +78,37 @@ class SubEditActivity : BaseActivity() {
        return true
    }

+    private fun setupProfileRemarkInputs() {
+        val suggestions = SettingsManager.getProfileRemarks(
+            excludeConfigTypes = setOf(
+                EConfigType.CUSTOM,
+                EConfigType.POLICYGROUP,
+                EConfigType.PROXYCHAIN,
+            )
+        )
+
+        setupProfileRemarkInput(binding.etPreProfile, binding.btnPreProfileDropdown, suggestions)
+        setupProfileRemarkInput(binding.etNextProfile, binding.btnNextProfileDropdown, suggestions)
+    }
+
+    private fun setupProfileRemarkInput(
+        input: AutoCompleteTextView,
+        dropdownButton: ImageButton,
+        suggestions: List<String>
+    ) {
+        val adapter = ArrayAdapter(this, android.R.layout.simple_dropdown_item_1line, suggestions)
+        input.setAdapter(adapter)
+        input.threshold = 0
+
+        dropdownButton.setOnClickListener {
+            input.requestFocus()
+            input.showDropDown()
+        }
+        input.setOnClickListener {
+            input.showDropDown()
+        }
+    }
+
    /**
     * save server config
     */
@@ -15,7 +15,7 @@ import com.v2ray.ang.AppConfig
 import com.v2ray.ang.R
 import com.v2ray.ang.contracts.BaseAdapterListener
 import com.v2ray.ang.databinding.ActivityUserAssetBinding
-import com.v2ray.ang.dto.AssetUrlItem
+import com.v2ray.ang.dto.entities.AssetUrlItem
 import com.v2ray.ang.extension.toast
 import com.v2ray.ang.extension.toastError
 import com.v2ray.ang.extension.toastSuccess
@@ -8,7 +8,7 @@ import androidx.appcompat.app.AlertDialog
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.R
 import com.v2ray.ang.databinding.ActivityUserAssetUrlBinding
-import com.v2ray.ang.dto.AssetUrlItem
+import com.v2ray.ang.dto.entities.AssetUrlItem
 import com.v2ray.ang.extension.toast
 import com.v2ray.ang.extension.toastSuccess
 import com.v2ray.ang.handler.MmkvManager
@@ -3,6 +3,10 @@ package com.v2ray.ang.util
 import com.v2ray.ang.AppConfig
 import com.v2ray.ang.AppConfig.LOOPBACK
 import com.v2ray.ang.BuildConfig
+import com.v2ray.ang.dto.UrlContentRequest
+import okhttp3.Credentials
+import okhttp3.OkHttpClient
+import okhttp3.Request
 import java.io.File
 import java.io.IOException
 import java.net.IDN
@@ -14,9 +18,6 @@ import java.net.Proxy
 import java.net.URI
 import java.net.URL
 import java.util.concurrent.TimeUnit
-import okhttp3.Credentials
-import okhttp3.OkHttpClient
-import okhttp3.Request

 object HttpUtil {

@@ -108,20 +109,15 @@ object HttpUtil {
     * @param httpPort The HTTP port to use.
     * @return The content of the URL as a string.
     */
-    fun getUrlContent(
-        url: String,
-        timeout: Int,
-        httpPort: Int = 0,
-        proxyUsername: String? = null,
-        proxyPassword: String? = null
-    ): String? {
-        val client = buildOkHttpClient(timeout, httpPort, proxyUsername, proxyPassword, followRedirects = true)
+    fun getUrlContent(request: UrlContentRequest): String? {
+        val url = request.url ?: return null
+        val client = buildOkHttpClient(request.timeout, request.httpPort, request.proxyUsername, request.proxyPassword, followRedirects = true)
        val requestBuilder = Request.Builder()
            .url(url)
            .get()
            .header("Connection", "close")
-        if (httpPort != 0 && !proxyUsername.isNullOrBlank() && !proxyPassword.isNullOrBlank()) {
-            requestBuilder.header("Proxy-Authorization", Credentials.basic(proxyUsername, proxyPassword))
+        if (request.httpPort != 0 && !request.proxyUsername.isNullOrBlank() && !request.proxyPassword.isNullOrBlank()) {
+            requestBuilder.header("Proxy-Authorization", Credentials.basic(request.proxyUsername, request.proxyPassword))
        }
        try {
            client.newCall(requestBuilder.build()).execute().use { response ->
@@ -147,33 +143,29 @@ object HttpUtil {
     * @throws IOException If an I/O error occurs.
     */
    @Throws(IOException::class)
-    fun getUrlContentWithUserAgent(
-        url: String?,
-        userAgent: String?,
-        timeout: Int = 15000,
-        httpPort: Int = 0,
-        proxyUsername: String? = null,
-        proxyPassword: String? = null
-    ): String {
-        var currentUrl = url
+    fun getUrlContentWithUserAgent(request: UrlContentRequest): String {
+        var currentUrl = request.url
        var redirects = 0
        val maxRedirects = 3

        while (redirects++ < maxRedirects) {
            if (currentUrl == null) continue
-            val client = buildOkHttpClient(timeout, httpPort, proxyUsername, proxyPassword, followRedirects = false)
-            val finalUserAgent = if (userAgent.isNullOrBlank()) {
+            val client = buildOkHttpClient(request.timeout, request.httpPort, request.proxyUsername, request.proxyPassword, followRedirects = false)
+            val finalUserAgent = if (request.userAgent.isNullOrBlank()) {
                "v2rayNG/${BuildConfig.VERSION_NAME}"
            } else {
-                userAgent
+                request.userAgent
            }
            val requestBuilder = Request.Builder()
                .url(currentUrl)
                .get()
                .header("User-agent", finalUserAgent)
                .header("Connection", "close")
-            if (httpPort != 0 && !proxyUsername.isNullOrBlank() && !proxyPassword.isNullOrBlank()) {
-                requestBuilder.header("Proxy-Authorization", Credentials.basic(proxyUsername, proxyPassword))
+
+            applyEmbeddedBasicAuthHeader(currentUrl, requestBuilder)
+
+            if (request.httpPort != 0 && !request.proxyUsername.isNullOrBlank() && !request.proxyPassword.isNullOrBlank()) {
+                requestBuilder.header("Proxy-Authorization", Credentials.basic(request.proxyUsername, request.proxyPassword))
            }

            client.newCall(requestBuilder.build()).execute().use { response ->
@@ -203,6 +195,20 @@ object HttpUtil {
        throw IOException("Too many redirects")
    }

+    private fun applyEmbeddedBasicAuthHeader(rawUrl: String, requestBuilder: Request.Builder) {
+        val parsed = runCatching { URL(rawUrl) }.getOrNull() ?: return
+        parsed.userInfo?.let { userInfo ->
+            val colon = userInfo.indexOf(':')
+            val user = runCatching {
+                Utils.decodeURIComponent(if (colon >= 0) userInfo.substring(0, colon) else userInfo)
+            }.getOrDefault(if (colon >= 0) userInfo.substring(0, colon) else userInfo)
+            val pass = runCatching {
+                Utils.decodeURIComponent(if (colon >= 0) userInfo.substring(colon + 1) else "")
+            }.getOrDefault(if (colon >= 0) userInfo.substring(colon + 1) else "")
+            requestBuilder.header("Authorization", Credentials.basic(user, pass))
+        }
+    }
+
    private fun buildOkHttpClient(
        timeout: Int,
        httpPort: Int,
@@ -254,20 +260,17 @@ object HttpUtil {
    }

    fun downloadToFile(
-        url: String,
-        targetFile: File,
-        timeout: Int = 15000,
-        httpPort: Int = 0,
-        proxyUsername: String? = null,
-        proxyPassword: String? = null
+        request: UrlContentRequest,
+        targetFile: File
    ): Boolean {
-        val client = buildOkHttpClient(timeout, httpPort, proxyUsername, proxyPassword, followRedirects = true)
+        val url = request.url ?: return false
+        val client = buildOkHttpClient(request.timeout, request.httpPort, request.proxyUsername, request.proxyPassword, followRedirects = true)
        val requestBuilder = Request.Builder()
            .url(url)
            .get()
            .header("Connection", "close")
-        if (httpPort != 0 && !proxyUsername.isNullOrBlank() && !proxyPassword.isNullOrBlank()) {
-            requestBuilder.header("Proxy-Authorization", Credentials.basic(proxyUsername, proxyPassword))
+        if (request.httpPort != 0 && !request.proxyUsername.isNullOrBlank() && !request.proxyPassword.isNullOrBlank()) {
+            requestBuilder.header("Proxy-Authorization", Credentials.basic(request.proxyUsername, request.proxyPassword))
        }

        return try {
@@ -290,4 +293,3 @@ object HttpUtil {
        }
    }
 }
-
@@ -35,6 +35,23 @@ object JsonUtil {
        return gson.fromJson(src, cls)
    }

+    /**
+     * Safely parses a JSON string into an object of the specified class.
+     * Returns null if parsing fails instead of throwing an exception.
+     *
+     * @param src The JSON string to parse.
+     * @param cls The class of the object to parse into.
+     * @return The parsed object, or null if parsing fails.
+     */
+    fun <T> fromJsonSafe(src: String, cls: Class<T>): T? {
+        return try {
+            gson.fromJson(src, cls)
+        } catch (e: Exception) {
+            LogUtil.e(AppConfig.TAG, "Failed to parse JSON", e)
+            null
+        }
+    }
+
    /**
     * Converts an object to its pretty-printed JSON representation.
     *