Merge branch 'main' into feature/share-quota

.github/workflows/release.yml

@@ -126,7 +126,7 @@ jobs:
           cd x-ui/bin
 
           # Download dependencies
-          Xray_URL="https://github.com/XTLS/Xray-core/releases/download/v26.4.17/"
+          Xray_URL="https://github.com/XTLS/Xray-core/releases/download/v26.4.25/"
           if [ "${{ matrix.platform }}" == "amd64" ]; then
             wget -q ${Xray_URL}Xray-linux-64.zip
             unzip Xray-linux-64.zip
@@ -244,7 +244,7 @@ jobs:
           cd x-ui\bin
 
           # Download Xray for Windows
-          $Xray_URL = "https://github.com/XTLS/Xray-core/releases/download/v26.4.17/"
+          $Xray_URL = "https://github.com/XTLS/Xray-core/releases/download/v26.4.25/"
           Invoke-WebRequest -Uri "${Xray_URL}Xray-windows-64.zip" -OutFile "Xray-windows-64.zip"
           Expand-Archive -Path "Xray-windows-64.zip" -DestinationPath .
           Remove-Item "Xray-windows-64.zip"

DockerInit.sh

@@ -27,7 +27,7 @@ case $1 in
 esac
 mkdir -p build/bin
 cd build/bin
-curl -sfLRO "https://github.com/XTLS/Xray-core/releases/download/v26.4.17/Xray-linux-${ARCH}.zip"
+curl -sfLRO "https://github.com/XTLS/Xray-core/releases/download/v26.4.25/Xray-linux-${ARCH}.zip"
 unzip "Xray-linux-${ARCH}.zip"
 rm -f "Xray-linux-${ARCH}.zip" geoip.dat geosite.dat
 mv xray "xray-linux-${FNAME}"

config/version

@@ -1 +1 @@
-2.9.2
+2.9.3

go.mod

@@ -32,7 +32,7 @@ require (
 )
 
 require (
-	github.com/Azure/go-ntlmssp v0.1.0 // indirect
+	github.com/Azure/go-ntlmssp v0.1.1 // indirect
 	github.com/andybalholm/brotli v1.2.1 // indirect
 	github.com/apernet/quic-go v0.59.1-0.20260217092621-db4786c77a22 // indirect
 	github.com/bytedance/gopkg v0.1.4 // indirect
@@ -72,7 +72,7 @@ require (
 	github.com/quic-go/quic-go v0.59.0 // indirect
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
-	github.com/sagernet/sing v0.8.8 // indirect
+	github.com/sagernet/sing v0.8.9 // indirect
 	github.com/sagernet/sing-shadowsocks v0.2.9 // indirect
 	github.com/tklauser/go-sysconf v0.3.16 // indirect
 	github.com/tklauser/numcpus v0.11.0 // indirect
@@ -95,7 +95,7 @@ require (
 	golang.org/x/tools v0.44.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0 // indirect
 	lukechampine.com/blake3 v1.4.1 // indirect

go.sum

@@ -1,5 +1,5 @@
-github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
+github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=
-github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
@@ -156,8 +156,8 @@ github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
-github.com/sagernet/sing v0.8.8 h1:1dRlGJ3wm4d2nwjKI1R/dr/7GKDKgUvXyD4OAWlQyt8=
+github.com/sagernet/sing v0.8.9 h1:iX8FyMrWNl/divVgTe7cLT9n36v6bfzfnCYlcM1cLaU=
-github.com/sagernet/sing v0.8.8/go.mod h1:ARkL0gM13/Iv5VCZmci/NuoOlePoIsW0m7BWfln/Hak=
+github.com/sagernet/sing v0.8.9/go.mod h1:ARkL0gM13/Iv5VCZmci/NuoOlePoIsW0m7BWfln/Hak=
 github.com/sagernet/sing-shadowsocks v0.2.9 h1:Paep5zCszRKsEn8587O0MnhFWKJwDW1Y4zOYYlIxMkM=
 github.com/sagernet/sing-shadowsocks v0.2.9/go.mod h1:TE/Z6401Pi8tgr0nBZcM/xawAI6u3F6TTbz4nH/qw+8=
 github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
@@ -256,8 +256,8 @@ golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+Z
 golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 h1:XF8+t6QQiS0o9ArVan/HW8Q7cycNPGsJf6GA2nXxYAg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
 google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=

main.go

@@ -130,20 +130,22 @@ func runWebServer() {
 }
 
 // resetSetting resets all panel settings to their default values.
-func resetSetting() {
+func resetSetting() error {
 	err := database.InitDB(config.GetDBPath())
 	if err != nil {
 		fmt.Println("Failed to initialize database:", err)
-		return
+		return err
 	}
 
 	settingService := service.SettingService{}
 	err = settingService.ResetSettings()
 	if err != nil {
 		fmt.Println("Failed to reset settings:", err)
+		return err
 	} else {
 		fmt.Println("Settings successfully reset.")
 	}
+	return nil
 }
 
 // showSetting displays the current panel settings if show is true.
@@ -255,11 +257,11 @@ func updateTgbotSetting(tgBotToken string, tgBotChatid string, tgBotRuntime stri
 }
 
 // updateSetting updates various panel settings including port, credentials, base path, listen IP, and two-factor authentication.
-func updateSetting(port int, username string, password string, webBasePath string, listenIP string, resetTwoFactor bool) {
+func updateSetting(port int, username string, password string, webBasePath string, listenIP string, resetTwoFactor bool) error {
 	err := database.InitDB(config.GetDBPath())
 	if err != nil {
 		fmt.Println("Database initialization failed:", err)
-		return
+		return err
 	}
 
 	settingService := service.SettingService{}
@@ -311,6 +313,8 @@ func updateSetting(port int, username string, password string, webBasePath strin
 			fmt.Printf("listen %v set successfully", listenIP)
 		}
 	}
+
+	return nil
 }
 
 // updateCert updates the SSL certificate files for the panel.
@@ -481,9 +485,13 @@ func main() {
 			return
 		}
 		if reset {
-			resetSetting()
+			if err = resetSetting(); err != nil {
+				return
+			}
 		} else {
-			updateSetting(port, username, password, webBasePath, listenIP, resetTwoFactor)
+			if err = updateSetting(port, username, password, webBasePath, listenIP, resetTwoFactor); err != nil {
+				return
+			}
 		}
 		if show {
 			showSetting(show)

web/assets/js/model/inbound.js

@@ -3,12 +3,12 @@ const Protocols = {
     VLESS: 'vless',
     TROJAN: 'trojan',
     SHADOWSOCKS: 'shadowsocks',
-    TUNNEL: 'tunnel',
+    WIREGUARD: 'wireguard',
+    HYSTERIA: 'hysteria',
     MIXED: 'mixed',
     HTTP: 'http',
-    WIREGUARD: 'wireguard',
+    TUNNEL: 'tunnel',
     TUN: 'tun',
-    HYSTERIA: 'hysteria',
 };
 
 const SSMethods = {
@@ -323,7 +323,7 @@ class KcpStreamSettings extends XrayCommonClass {
         uplinkCapacity = 5,
         downlinkCapacity = 20,
         cwndMultiplier = 1,
-        maxSendingWindow = 1350,
+        maxSendingWindow = 2097152,
     ) {
         super();
         this.mtu = mtu;
@@ -1085,11 +1085,15 @@ class UdpMask extends XrayCommonClass {
             case 'header-wireguard':
                 return {};
             case 'header-custom':
-                return { client: [], server: [] };
+                return {
+                    client: Array.isArray(settings.client) ? settings.client : [],
+                    server: Array.isArray(settings.server) ? settings.server : [],
+                };
             case 'noise':
-                return { reset: 0, noise: [] };
+                return {
-            case 'sudoku':
+                    reset: settings.reset ?? 0,
-                return { ascii: '', customTable: '', customTables: [], paddingMin: 0, paddingMax: 0 };
+                    noise: Array.isArray(settings.noise) ? settings.noise : [],
+                };
             default:
                 return settings;
         }
@@ -1103,27 +1107,219 @@ class UdpMask extends XrayCommonClass {
     }
 
     toJson() {
+        const cleanItem = item => {
+            const out = { ...item };
+            if (out.type === 'array') {
+                delete out.packet;
+            } else {
+                delete out.rand;
+                delete out.randRange;
+            }
+            return out;
+        };
+
+        let settings = this.settings;
+        if (this.type === 'noise' && settings && Array.isArray(settings.noise)) {
+            settings = { ...settings, noise: settings.noise.map(cleanItem) };
+        } else if (this.type === 'header-custom' && settings) {
+            settings = {
+                ...settings,
+                client: Array.isArray(settings.client) ? settings.client.map(cleanItem) : settings.client,
+                server: Array.isArray(settings.server) ? settings.server.map(cleanItem) : settings.server,
+            };
+        }
+
         return {
             type: this.type,
-            settings: (this.settings && Object.keys(this.settings).length > 0) ? this.settings : undefined
+            settings: (settings && Object.keys(settings).length > 0) ? settings : undefined
         };
     }
 }
 
-class FinalMaskStreamSettings extends XrayCommonClass {
+class TcpMask extends XrayCommonClass {
-    constructor(udp = []) {
+    constructor(type = 'fragment', settings = {}) {
         super();
-        this.udp = Array.isArray(udp) ? udp.map(u => new UdpMask(u.type, u.settings)) : [new UdpMask(udp.type, udp.settings)];
+        this.type = type;
+        this.settings = this._getDefaultSettings(type, settings);
+    }
+
+    _getDefaultSettings(type, settings = {}) {
+        switch (type) {
+            case 'fragment':
+                return {
+                    packets: settings.packets ?? 'tlshello',
+                    length: settings.length ?? '',
+                    delay: settings.delay ?? '',
+                    maxSplit: settings.maxSplit ?? '',
+                };
+            case 'sudoku':
+                return {
+                    password: settings.password ?? '',
+                    ascii: settings.ascii ?? '',
+                    customTable: settings.customTable ?? '',
+                    customTables: Array.isArray(settings.customTables) ? settings.customTables : [],
+                    paddingMin: settings.paddingMin ?? 0,
+                    paddingMax: settings.paddingMax ?? 0,
+                };
+            case 'header-custom':
+                return {
+                    clients: Array.isArray(settings.clients) ? settings.clients : [],
+                    servers: Array.isArray(settings.servers) ? settings.servers : [],
+                };
+            default:
+                return settings;
+        }
     }
 
     static fromJson(json = {}) {
-        return new FinalMaskStreamSettings(json.udp || []);
+        return new TcpMask(
+            json.type || 'fragment',
+            json.settings || {}
+        );
     }
 
     toJson() {
-        return {
+        const cleanItem = item => {
-            udp: this.udp.map(udp => udp.toJson())
+            const out = { ...item };
+            if (out.type === 'array') {
+                delete out.packet;
+            } else {
+                delete out.rand;
+                delete out.randRange;
+            }
+            return out;
         };
+
+        let settings = this.settings;
+        if (this.type === 'header-custom' && settings) {
+            const cleanGroup = group => Array.isArray(group) ? group.map(cleanItem) : group;
+            settings = {
+                ...settings,
+                clients: Array.isArray(settings.clients) ? settings.clients.map(cleanGroup) : settings.clients,
+                servers: Array.isArray(settings.servers) ? settings.servers.map(cleanGroup) : settings.servers,
+            };
+        }
+
+        return {
+            type: this.type,
+            settings: (settings && Object.keys(settings).length > 0) ? settings : undefined
+        };
+    }
+}
+
+class QuicParams extends XrayCommonClass {
+    constructor(
+        congestion = 'bbr',
+        debug = false,
+        brutalUp = '',
+        brutalDown = '',
+        udpHop = undefined,
+        initStreamReceiveWindow = 8388608,
+        maxStreamReceiveWindow = 8388608,
+        initConnectionReceiveWindow = 20971520,
+        maxConnectionReceiveWindow = 20971520,
+        maxIdleTimeout = 30,
+        keepAlivePeriod = 0,
+        disablePathMTUDiscovery = false,
+        maxIncomingStreams = 1024,
+    ) {
+        super();
+        this.congestion = congestion;
+        this.debug = debug;
+        this.brutalUp = brutalUp;
+        this.brutalDown = brutalDown;
+        this.udpHop = udpHop;
+        this.initStreamReceiveWindow = initStreamReceiveWindow;
+        this.maxStreamReceiveWindow = maxStreamReceiveWindow;
+        this.initConnectionReceiveWindow = initConnectionReceiveWindow;
+        this.maxConnectionReceiveWindow = maxConnectionReceiveWindow;
+        this.maxIdleTimeout = maxIdleTimeout;
+        this.keepAlivePeriod = keepAlivePeriod;
+        this.disablePathMTUDiscovery = disablePathMTUDiscovery;
+        this.maxIncomingStreams = maxIncomingStreams;
+    }
+
+    get hasUdpHop() {
+        return this.udpHop != null;
+    }
+
+    set hasUdpHop(value) {
+        this.udpHop = value ? (this.udpHop || { ports: '20000-50000', interval: '5-10' }) : undefined;
+    }
+
+    static fromJson(json = {}) {
+        if (!json || Object.keys(json).length === 0) return undefined;
+        return new QuicParams(
+            json.congestion,
+            json.debug,
+            json.brutalUp,
+            json.brutalDown,
+            json.udpHop ? { ports: json.udpHop.ports, interval: json.udpHop.interval } : undefined,
+            json.initStreamReceiveWindow,
+            json.maxStreamReceiveWindow,
+            json.initConnectionReceiveWindow,
+            json.maxConnectionReceiveWindow,
+            json.maxIdleTimeout,
+            json.keepAlivePeriod,
+            json.disablePathMTUDiscovery,
+            json.maxIncomingStreams,
+        );
+    }
+
+    toJson() {
+        const result = { congestion: this.congestion };
+        if (this.debug) result.debug = this.debug;
+        if (this.brutalUp) result.brutalUp = this.brutalUp;
+        if (this.brutalDown) result.brutalDown = this.brutalDown;
+        if (this.udpHop) result.udpHop = { ports: this.udpHop.ports, interval: this.udpHop.interval };
+        if (this.initStreamReceiveWindow > 0) result.initStreamReceiveWindow = this.initStreamReceiveWindow;
+        if (this.maxStreamReceiveWindow > 0) result.maxStreamReceiveWindow = this.maxStreamReceiveWindow;
+        if (this.initConnectionReceiveWindow > 0) result.initConnectionReceiveWindow = this.initConnectionReceiveWindow;
+        if (this.maxConnectionReceiveWindow > 0) result.maxConnectionReceiveWindow = this.maxConnectionReceiveWindow;
+        if (this.maxIdleTimeout !== 30 && this.maxIdleTimeout > 0) result.maxIdleTimeout = this.maxIdleTimeout;
+        if (this.keepAlivePeriod > 0) result.keepAlivePeriod = this.keepAlivePeriod;
+        if (this.disablePathMTUDiscovery) result.disablePathMTUDiscovery = this.disablePathMTUDiscovery;
+        if (this.maxIncomingStreams > 0) result.maxIncomingStreams = this.maxIncomingStreams;
+        return result;
+    }
+}
+
+class FinalMaskStreamSettings extends XrayCommonClass {
+    constructor(tcp = [], udp = [], quicParams = undefined) {
+        super();
+        this.tcp = Array.isArray(tcp) ? tcp.map(t => t instanceof TcpMask ? t : new TcpMask(t.type, t.settings)) : [];
+        this.udp = Array.isArray(udp) ? udp.map(u => new UdpMask(u.type, u.settings)) : [new UdpMask(udp.type, udp.settings)];
+        this.quicParams = quicParams instanceof QuicParams ? quicParams : (quicParams ? QuicParams.fromJson(quicParams) : undefined);
+    }
+
+    get enableQuicParams() {
+        return this.quicParams != null;
+    }
+
+    set enableQuicParams(value) {
+        this.quicParams = value ? (this.quicParams || new QuicParams()) : undefined;
+    }
+
+    static fromJson(json = {}) {
+        return new FinalMaskStreamSettings(
+            json.tcp || [],
+            json.udp || [],
+            json.quicParams ? QuicParams.fromJson(json.quicParams) : undefined,
+        );
+    }
+
+    toJson() {
+        const result = {};
+        if (this.tcp && this.tcp.length > 0) {
+            result.tcp = this.tcp.map(t => t.toJson());
+        }
+        if (this.udp && this.udp.length > 0) {
+            result.udp = this.udp.map(udp => udp.toJson());
+        }
+        if (this.quicParams) {
+            result.quicParams = this.quicParams.toJson();
+        }
+        return result;
     }
 }
 
@@ -1160,6 +1356,16 @@ class StreamSettings extends XrayCommonClass {
         this.sockopt = sockopt;
     }
 
+    addTcpMask(type = 'fragment') {
+        this.finalmask.tcp.push(new TcpMask(type));
+    }
+
+    delTcpMask(index) {
+        if (this.finalmask.tcp) {
+            this.finalmask.tcp.splice(index, 1);
+        }
+    }
+
     addUdpMask(type = 'salamander') {
         this.finalmask.udp.push(new UdpMask(type));
     }
@@ -1171,7 +1377,10 @@ class StreamSettings extends XrayCommonClass {
     }
 
     get hasFinalMask() {
-        return this.finalmask.udp && this.finalmask.udp.length > 0;
+        const hasTcp = this.finalmask.tcp && this.finalmask.tcp.length > 0;
+        const hasUdp = this.finalmask.udp && this.finalmask.udp.length > 0;
+        const hasQuicParams = this.finalmask.quicParams != null;
+        return hasTcp || hasUdp || hasQuicParams;
     }
 
     get isTls() {
@@ -1370,6 +1579,50 @@ class Inbound extends XrayCommonClass {
         }
     }
 
+    static hasShareableFinalMaskValue(value) {
+        if (value == null) {
+            return false;
+        }
+        if (Array.isArray(value)) {
+            return value.some(item => Inbound.hasShareableFinalMaskValue(item));
+        }
+        if (typeof value === 'object') {
+            return Object.values(value).some(item => Inbound.hasShareableFinalMaskValue(item));
+        }
+        if (typeof value === 'string') {
+            return value.length > 0;
+        }
+        return true;
+    }
+
+    static serializeFinalMask(finalmask) {
+        if (!finalmask) {
+            return '';
+        }
+        const value = typeof finalmask.toJson === 'function' ? finalmask.toJson() : finalmask;
+        return Inbound.hasShareableFinalMaskValue(value) ? JSON.stringify(value) : '';
+    }
+
+    // Export finalmask with the same compact JSON payload shape that
+    // v2rayN-compatible share links use: fm=<json>.
+    static applyFinalMaskToParams(finalmask, params) {
+        if (!params) return;
+        const payload = Inbound.serializeFinalMask(finalmask);
+        if (payload.length > 0) {
+            params.set("fm", payload);
+        }
+    }
+
+    // VMess links are a base64 JSON object, so keep the same fm payload
+    // under a flat property instead of a URL query string.
+    static applyFinalMaskToObj(finalmask, obj) {
+        if (!obj) return;
+        const payload = Inbound.serializeFinalMask(finalmask);
+        if (payload.length > 0) {
+            obj.fm = payload;
+        }
+    }
+
     get clients() {
         switch (this.protocol) {
             case Protocols.VMESS: return this.settings.vmesses;
@@ -1566,6 +1819,8 @@ class Inbound extends XrayCommonClass {
             }
         } else if (network === 'kcp') {
             const kcp = this.stream.kcp;
+            obj.mtu = kcp.mtu;
+            obj.tti = kcp.tti;
         } else if (network === 'ws') {
             const ws = this.stream.ws;
             obj.path = ws.path;
@@ -1588,6 +1843,8 @@ class Inbound extends XrayCommonClass {
             Inbound.applyXhttpPaddingToObj(xhttp, obj);
         }
 
+        Inbound.applyFinalMaskToObj(this.stream.finalmask, obj);
+
         if (tls === 'tls') {
             if (!ObjectUtil.isEmpty(this.stream.tls.sni)) {
                 obj.sni = this.stream.tls.sni;
@@ -1626,6 +1883,8 @@ class Inbound extends XrayCommonClass {
                 break;
             case "kcp":
                 const kcp = this.stream.kcp;
+                params.set("mtu", kcp.mtu);
+                params.set("tti", kcp.tti);
                 break;
             case "ws":
                 const ws = this.stream.ws;
@@ -1654,6 +1913,8 @@ class Inbound extends XrayCommonClass {
                 break;
         }
 
+        Inbound.applyFinalMaskToParams(this.stream.finalmask, params);
+
         if (security === 'tls') {
             params.set("security", "tls");
             if (this.stream.isTls) {
@@ -1727,6 +1988,8 @@ class Inbound extends XrayCommonClass {
                 break;
             case "kcp":
                 const kcp = this.stream.kcp;
+                params.set("mtu", kcp.mtu);
+                params.set("tti", kcp.tti);
                 break;
             case "ws":
                 const ws = this.stream.ws;
@@ -1755,6 +2018,8 @@ class Inbound extends XrayCommonClass {
                 break;
         }
 
+        Inbound.applyFinalMaskToParams(this.stream.finalmask, params);
+
         if (security === 'tls') {
             params.set("security", "tls");
             if (this.stream.isTls) {
@@ -1804,6 +2069,8 @@ class Inbound extends XrayCommonClass {
                 break;
             case "kcp":
                 const kcp = this.stream.kcp;
+                params.set("mtu", kcp.mtu);
+                params.set("tti", kcp.tti);
                 break;
             case "ws":
                 const ws = this.stream.ws;
@@ -1832,6 +2099,8 @@ class Inbound extends XrayCommonClass {
                 break;
         }
 
+        Inbound.applyFinalMaskToParams(this.stream.finalmask, params);
+
         if (security === 'tls') {
             params.set("security", "tls");
             if (this.stream.isTls) {
@@ -1899,6 +2168,8 @@ class Inbound extends XrayCommonClass {
             }
         }
 
+        Inbound.applyFinalMaskToParams(this.stream.finalmask, params);
+
         const url = new URL(link);
         for (const [key, value] of params) {
             url.searchParams.set(key, value);
@@ -1907,7 +2178,7 @@ class Inbound extends XrayCommonClass {
         return url.toString();
     }
 
-    getWireguardLink(address, port, remark, peerId) {
+    getWireguardTxt(address, port, remark, peerId) {
         let txt = `[Interface]\n`
         txt += `PrivateKey = ${this.settings.peers[peerId].privateKey}\n`
         txt += `Address = ${this.settings.peers[peerId].allowedIPs[0]}\n`
@@ -1929,6 +2200,48 @@ class Inbound extends XrayCommonClass {
         return txt;
     }
 
+    getWireguardLink(address, port, remark, peerId) {
+        const peer = this.settings?.peers?.[peerId];
+        if (!peer) return '';
+
+        const link = `wireguard://${address}:${port}`;
+        const url = new URL(link);
+        url.username = peer.privateKey || '';
+
+        if (this.settings?.pubKey) {
+            url.searchParams.set("publickey", this.settings.pubKey);
+        }
+        if (Array.isArray(peer.allowedIPs) && peer.allowedIPs.length > 0 && peer.allowedIPs[0]) {
+            url.searchParams.set("address", peer.allowedIPs[0]);
+        }
+        if (this.settings?.mtu) {
+            url.searchParams.set("mtu", this.settings.mtu);
+        }
+
+        url.hash = encodeURIComponent(remark);
+        return url.toString();
+    }
+
+    genWireguardLinks(remark = '', remarkModel = '-ieo') {
+        const addr = !ObjectUtil.isEmpty(this.listen) && this.listen !== "0.0.0.0" ? this.listen : location.hostname;
+        const separationChar = remarkModel.charAt(0);
+        let links = [];
+        this.settings.peers.forEach((p, index) => {
+            links.push(this.getWireguardLink(addr, this.port, remark + separationChar + (index + 1), index));
+        });
+        return links.join('\r\n');
+    }
+
+    genWireguardConfigs(remark = '', remarkModel = '-ieo') {
+        const addr = !ObjectUtil.isEmpty(this.listen) && this.listen !== "0.0.0.0" ? this.listen : location.hostname;
+        const separationChar = remarkModel.charAt(0);
+        let links = [];
+        this.settings.peers.forEach((p, index) => {
+            links.push(this.getWireguardTxt(addr, this.port, remark + separationChar + (index + 1), index));
+        });
+        return links.join('\r\n');
+    }
+
     genLink(address = '', port = this.port, forceTls = 'same', remark = '', client) {
         switch (this.protocol) {
             case Protocols.VMESS:
@@ -1989,11 +2302,7 @@ class Inbound extends XrayCommonClass {
         } else {
             if (this.protocol == Protocols.SHADOWSOCKS && !this.isSSMultiUser) return this.genSSLink(addr, this.port, 'same', remark);
             if (this.protocol == Protocols.WIREGUARD) {
-                let links = [];
+                return this.genWireguardConfigs(remark, remarkModel);
-                this.settings.peers.forEach((p, index) => {
-                    links.push(this.getWireguardLink(addr, this.port, remark + remarkModel.charAt(0) + (index + 1), index));
-                });
-                return links.join('\r\n');
             }
             return '';
         }

web/assets/js/model/outbound.js

@@ -97,6 +97,74 @@ const Address_Port_Strategy = {
     TxtPortAndAddress: "txtportandaddress"
 };
 
+const DNSRuleActions = ['direct', 'drop', 'reject', 'hijack'];
+
+function normalizeDNSRuleField(value) {
+    if (value === null || value === undefined) {
+        return '';
+    }
+    if (Array.isArray(value)) {
+        return value.map(item => item.toString().trim()).filter(item => item.length > 0).join(',');
+    }
+    return value.toString().trim();
+}
+
+function normalizeDNSRuleAction(action) {
+    action = ObjectUtil.isEmpty(action) ? 'direct' : action.toString().toLowerCase().trim();
+    return DNSRuleActions.includes(action) ? action : 'direct';
+}
+
+function parseLegacyDNSBlockTypes(blockTypes) {
+    if (blockTypes === null || blockTypes === undefined || blockTypes === '') {
+        return [];
+    }
+
+    if (Array.isArray(blockTypes)) {
+        return blockTypes
+            .map(item => Number(item))
+            .filter(item => Number.isInteger(item) && item >= 0 && item <= 65535);
+    }
+
+    if (typeof blockTypes === 'number') {
+        return Number.isInteger(blockTypes) && blockTypes >= 0 && blockTypes <= 65535 ? [blockTypes] : [];
+    }
+
+    return blockTypes
+        .toString()
+        .split(',')
+        .map(item => item.trim())
+        .filter(item => /^\d+$/.test(item))
+        .map(item => Number(item))
+        .filter(item => item >= 0 && item <= 65535);
+}
+
+function buildLegacyDNSRules(nonIPQuery, blockTypes) {
+    const mode = ['reject', 'drop', 'skip'].includes(nonIPQuery) ? nonIPQuery : 'reject';
+    const rules = [];
+    const parsedBlockTypes = parseLegacyDNSBlockTypes(blockTypes);
+
+    if (parsedBlockTypes.length > 0) {
+        rules.push(new Outbound.DNSRule(mode === 'reject' ? 'reject' : 'drop', parsedBlockTypes.join(',')));
+    }
+
+    rules.push(new Outbound.DNSRule('hijack', '1,28'));
+    rules.push(new Outbound.DNSRule(mode === 'skip' ? 'direct' : mode));
+
+    return rules;
+}
+
+function getDNSRulesFromJson(json = {}) {
+    if (Array.isArray(json.rules) && json.rules.length > 0) {
+        return json.rules.map(rule => Outbound.DNSRule.fromJson(rule));
+    }
+
+    if (json.nonIPQuery !== undefined || json.blockTypes !== undefined) {
+        return buildLegacyDNSRules(json.nonIPQuery, json.blockTypes);
+    }
+
+    return [];
+}
+
 Object.freeze(Protocols);
 Object.freeze(SSMethods);
 Object.freeze(TLS_FLOW_CONTROL);
@@ -107,6 +175,7 @@ Object.freeze(WireguardDomainStrategy);
 Object.freeze(USERS_SECURITY);
 Object.freeze(MODE_OPTION);
 Object.freeze(Address_Port_Strategy);
+Object.freeze(DNSRuleActions);
 
 class CommonClass {
 
@@ -586,11 +655,23 @@ class UdpMask extends CommonClass {
             case 'header-wireguard':
                 return {}; // No settings needed
             case 'header-custom':
-                return { client: [], server: [] };
+                return {
+                    client: Array.isArray(settings.client) ? settings.client : [],
+                    server: Array.isArray(settings.server) ? settings.server : [],
+                };
             case 'noise':
-                return { reset: 0, noise: [] };
+                return {
+                    reset: settings.reset ?? 0,
+                    noise: Array.isArray(settings.noise) ? settings.noise : [],
+                };
             case 'sudoku':
-                return { ascii: '', customTable: '', customTables: [], paddingMin: 0, paddingMax: 0 };
+                return {
+                    ascii: settings.ascii || '',
+                    customTable: settings.customTable || '',
+                    customTables: Array.isArray(settings.customTables) ? settings.customTables : [],
+                    paddingMin: settings.paddingMin ?? 0,
+                    paddingMax: settings.paddingMax ?? 0
+                };
             default:
                 return settings;
         }
@@ -604,28 +685,187 @@ class UdpMask extends CommonClass {
     }
 
     toJson() {
+        const cleanItem = item => {
+            const out = { ...item };
+            if (out.type === 'array') {
+                delete out.packet;
+            } else {
+                delete out.rand;
+                delete out.randRange;
+            }
+            return out;
+        };
+
+        let settings = this.settings;
+        if (this.type === 'noise' && settings && Array.isArray(settings.noise)) {
+            settings = { ...settings, noise: settings.noise.map(cleanItem) };
+        } else if (this.type === 'header-custom' && settings) {
+            settings = {
+                ...settings,
+                client: Array.isArray(settings.client) ? settings.client.map(cleanItem) : settings.client,
+                server: Array.isArray(settings.server) ? settings.server.map(cleanItem) : settings.server,
+            };
+        }
+
         return {
             type: this.type,
-            settings: (this.settings && Object.keys(this.settings).length > 0) ? this.settings : undefined
+            settings: (settings && Object.keys(settings).length > 0) ? settings : undefined
         };
     }
 }
 
-class FinalMaskStreamSettings extends CommonClass {
+class TcpMask extends CommonClass {
-    constructor(udp = []) {
+    constructor(type = 'fragment', settings = {}) {
         super();
-        this.udp = Array.isArray(udp) ? udp.map(u => new UdpMask(u.type, u.settings)) : [new UdpMask(udp.type, udp.settings)];
+        this.type = type;
+        this.settings = this._getDefaultSettings(type, settings);
+    }
+
+    _getDefaultSettings(type, settings = {}) {
+        switch (type) {
+            case 'fragment':
+                return {
+                    packets: settings.packets ?? 'tlshello',
+                    length: settings.length ?? '',
+                    delay: settings.delay ?? '',
+                    maxSplit: settings.maxSplit ?? '',
+                };
+            case 'sudoku':
+                return {
+                    password: settings.password ?? '',
+                    ascii: settings.ascii ?? '',
+                    customTable: settings.customTable ?? '',
+                    customTables: Array.isArray(settings.customTables) ? settings.customTables : [],
+                    paddingMin: settings.paddingMin ?? 0,
+                    paddingMax: settings.paddingMax ?? 0,
+                };
+            case 'header-custom':
+                return {
+                    clients: Array.isArray(settings.clients) ? settings.clients : [],
+                    servers: Array.isArray(settings.servers) ? settings.servers : [],
+                };
+            default:
+                return settings;
+        }
     }
 
     static fromJson(json = {}) {
-        return new FinalMaskStreamSettings(json.udp || []);
+        return new TcpMask(
+            json.type || 'fragment',
+            json.settings || {}
+        );
     }
 
     toJson() {
-        return {
+        const cleanItem = item => {
-            udp: this.udp.map(udp => udp.toJson())
+            const out = { ...item };
+            if (out.type === 'array') {
+                delete out.packet;
+            } else {
+                delete out.rand;
+                delete out.randRange;
+            }
+            return out;
         };
 
+        let settings = this.settings;
+        if (this.type === 'header-custom' && settings) {
+            const cleanGroup = group => Array.isArray(group) ? group.map(cleanItem) : group;
+            settings = {
+                ...settings,
+                clients: Array.isArray(settings.clients) ? settings.clients.map(cleanGroup) : settings.clients,
+                servers: Array.isArray(settings.servers) ? settings.servers.map(cleanGroup) : settings.servers,
+            };
+        }
+
+        return {
+            type: this.type,
+            settings: (settings && Object.keys(settings).length > 0) ? settings : undefined
+        };
+    }
+}
+
+class QuicParams extends CommonClass {
+    constructor(
+        congestion = 'bbr',
+        debug = false,
+        brutalUp = '',
+        brutalDown = '',
+        udpHop = undefined,
+    ) {
+        super();
+        this.congestion = congestion;
+        this.debug = debug;
+        this.brutalUp = brutalUp;
+        this.brutalDown = brutalDown;
+        this.udpHop = udpHop;
+    }
+
+    get hasUdpHop() {
+        return this.udpHop != null;
+    }
+
+    set hasUdpHop(value) {
+        this.udpHop = value ? (this.udpHop || { ports: '20000-50000', interval: '5-10' }) : undefined;
+    }
+
+    static fromJson(json = {}) {
+        if (!json || Object.keys(json).length === 0) return undefined;
+        return new QuicParams(
+            json.congestion,
+            json.debug,
+            json.brutalUp,
+            json.brutalDown,
+            json.udpHop ? { ports: json.udpHop.ports, interval: json.udpHop.interval } : undefined,
+        );
+    }
+
+    toJson() {
+        const result = { congestion: this.congestion };
+        if (this.debug) result.debug = this.debug;
+        if (this.brutalUp) result.brutalUp = this.brutalUp;
+        if (this.brutalDown) result.brutalDown = this.brutalDown;
+        if (this.udpHop) result.udpHop = { ports: this.udpHop.ports, interval: this.udpHop.interval };
+        return result;
+    }
+}
+
+class FinalMaskStreamSettings extends CommonClass {
+    constructor(tcp = [], udp = [], quicParams = undefined) {
+        super();
+        this.tcp = Array.isArray(tcp) ? tcp.map(t => t instanceof TcpMask ? t : new TcpMask(t.type, t.settings)) : [];
+        this.udp = Array.isArray(udp) ? udp.map(u => new UdpMask(u.type, u.settings)) : [new UdpMask(udp.type, udp.settings)];
+        this.quicParams = quicParams instanceof QuicParams ? quicParams : (quicParams ? QuicParams.fromJson(quicParams) : undefined);
+    }
+
+    get enableQuicParams() {
+        return this.quicParams != null;
+    }
+
+    set enableQuicParams(value) {
+        this.quicParams = value ? (this.quicParams || new QuicParams()) : undefined;
+    }
+
+    static fromJson(json = {}) {
+        return new FinalMaskStreamSettings(
+            json.tcp || [],
+            json.udp || [],
+            json.quicParams ? QuicParams.fromJson(json.quicParams) : undefined,
+        );
+    }
+
+    toJson() {
+        const result = {};
+        if (this.tcp && this.tcp.length > 0) {
+            result.tcp = this.tcp.map(t => t.toJson());
+        }
+        if (this.udp && this.udp.length > 0) {
+            result.udp = this.udp.map(udp => udp.toJson());
+        }
+        if (this.quicParams) {
+            result.quicParams = this.quicParams.toJson();
+        }
+        return result;
     }
 }
 
@@ -661,6 +901,16 @@ class StreamSettings extends CommonClass {
         this.sockopt = sockopt;
     }
 
+    addTcpMask(type = 'fragment') {
+        this.finalmask.tcp.push(new TcpMask(type));
+    }
+
+    delTcpMask(index) {
+        if (this.finalmask.tcp) {
+            this.finalmask.tcp.splice(index, 1);
+        }
+    }
+
     addUdpMask(type = 'salamander') {
         this.finalmask.udp.push(new UdpMask(type));
     }
@@ -672,7 +922,10 @@ class StreamSettings extends CommonClass {
     }
 
     get hasFinalMask() {
-        return this.finalmask.udp && this.finalmask.udp.length > 0;
+        const hasTcp = this.finalmask.tcp && this.finalmask.tcp.length > 0;
+        const hasUdp = this.finalmask.udp && this.finalmask.udp.length > 0;
+        const hasQuicParams = this.finalmask.quicParams != null;
+        return hasTcp || hasUdp || hasQuicParams;
     }
 
     get isTls() {
@@ -923,6 +1176,10 @@ class Outbound extends CommonClass {
             stream.kcp = new KcpStreamSettings();
             stream.type = json.type;
             stream.seed = json.path;
+            const mtu = Number(json.mtu);
+            if (Number.isFinite(mtu) && mtu > 0) stream.kcp.mtu = mtu;
+            const tti = Number(json.tti);
+            if (Number.isFinite(tti) && tti > 0) stream.kcp.tti = tti;
         } else if (network === 'ws') {
             stream.ws = new WsStreamSettings(json.path, json.host);
         } else if (network === 'grpc') {
@@ -960,6 +1217,7 @@ class Outbound extends CommonClass {
         let headerType = url.searchParams.get('headerType') ?? undefined;
         let host = url.searchParams.get('host') ?? undefined;
         let path = url.searchParams.get('path') ?? undefined;
+        let seed = url.searchParams.get('seed') ?? path ?? undefined;
         let mode = url.searchParams.get('mode') ?? undefined;
 
         if (type === 'tcp' || type === 'none') {
@@ -967,7 +1225,11 @@ class Outbound extends CommonClass {
         } else if (type === 'kcp') {
             stream.kcp = new KcpStreamSettings();
             stream.kcp.type = headerType ?? 'none';
-            stream.kcp.seed = path;
+            stream.kcp.seed = seed;
+            const mtu = Number(url.searchParams.get('mtu'));
+            if (Number.isFinite(mtu) && mtu > 0) stream.kcp.mtu = mtu;
+            const tti = Number(url.searchParams.get('tti'));
+            if (Number.isFinite(tti) && tti > 0) stream.kcp.tti = tti;
         } else if (type === 'ws') {
             stream.ws = new WsStreamSettings(path, host);
         } else if (type === 'grpc') {
@@ -1277,20 +1539,69 @@ Outbound.BlackholeSettings = class extends CommonClass {
         };
     }
 };
+
+Outbound.DNSRule = class extends CommonClass {
+    constructor(action = 'direct', qtype = '', domain = '') {
+        super();
+        this.action = action;
+        this.qtype = qtype;
+        this.domain = domain;
+    }
+
+    static fromJson(json = {}) {
+        return new Outbound.DNSRule(
+            json.action,
+            normalizeDNSRuleField(json.qtype),
+            normalizeDNSRuleField(json.domain),
+        );
+    }
+
+    toJson() {
+        const rule = {
+            action: normalizeDNSRuleAction(this.action),
+        };
+
+        const qtype = normalizeDNSRuleField(this.qtype);
+        if (!ObjectUtil.isEmpty(qtype)) {
+            if (/^\d+$/.test(qtype)) {
+                rule.qtype = Number(qtype);
+            } else {
+                rule.qtype = qtype;
+            }
+        }
+
+        const domains = normalizeDNSRuleField(this.domain)
+            .split(',')
+            .map(d => d.trim())
+            .filter(d => d.length > 0);
+        if (domains.length > 0) {
+            rule.domain = domains;
+        }
+
+        return rule;
+    }
+};
+
 Outbound.DNSSettings = class extends CommonClass {
     constructor(
         network = 'udp',
         address = '',
         port = 53,
-        nonIPQuery = 'reject',
+        rules = []
-        blockTypes = []
     ) {
         super();
         this.network = network;
         this.address = address;
         this.port = port;
-        this.nonIPQuery = nonIPQuery;
+        this.rules = Array.isArray(rules) ? rules.map(rule => rule instanceof Outbound.DNSRule ? rule : Outbound.DNSRule.fromJson(rule)) : [];
-        this.blockTypes = blockTypes;
+    }
+
+    addRule(action = 'direct') {
+        this.rules.push(new Outbound.DNSRule(action));
+    }
+
+    delRule(index) {
+        this.rules.splice(index, 1);
     }
 
     static fromJson(json = {}) {
@@ -1298,10 +1609,23 @@ Outbound.DNSSettings = class extends CommonClass {
             json.network,
             json.address,
             json.port,
-            json.nonIPQuery,
+            getDNSRulesFromJson(json),
-            json.blockTypes,
         );
     }
+
+    toJson() {
+        const json = {
+            network: this.network,
+            address: this.address,
+            port: this.port,
+        };
+
+        if (this.rules.length > 0) {
+            json.rules = Outbound.DNSRule.toJsonArray(this.rules);
+        }
+
+        return json;
+    }
 };
 Outbound.VmessSettings = class extends CommonClass {
     constructor(address, port, id, security) {

web/assets/js/util/index.js

@@ -152,6 +152,12 @@ class RandomUtil {
         return Base64.alternativeEncode(String.fromCharCode(...array));
     }
 
+    static randomBase64(length = 16) {
+        const array = new Uint8Array(length);
+        window.crypto.getRandomValues(array);
+        return Base64.alternativeEncode(String.fromCharCode(...array));
+    }
+
     static randomBase32String(length = 16) {
         const array = new Uint8Array(length);
 

web/controller/server.go

@@ -22,6 +22,7 @@ type ServerController struct {
 
 	serverService  service.ServerService
 	settingService service.SettingService
+	panelService   service.PanelService
 
 	lastStatus *service.Status
 
@@ -43,6 +44,7 @@ func (a *ServerController) initRouter(g *gin.RouterGroup) {
 	g.GET("/status", a.status)
 	g.GET("/cpuHistory/:bucket", a.getCpuHistoryBucket)
 	g.GET("/getXrayVersion", a.getXrayVersion)
+	g.GET("/getPanelUpdateInfo", a.getPanelUpdateInfo)
 	g.GET("/getConfigJson", a.getConfigJson)
 	g.GET("/getDb", a.getDb)
 	g.GET("/getNewUUID", a.getNewUUID)
@@ -54,6 +56,7 @@ func (a *ServerController) initRouter(g *gin.RouterGroup) {
 	g.POST("/stopXrayService", a.stopXrayService)
 	g.POST("/restartXrayService", a.restartXrayService)
 	g.POST("/installXray/:version", a.installXray)
+	g.POST("/updatePanel", a.updatePanel)
 	g.POST("/updateGeofile", a.updateGeofile)
 	g.POST("/updateGeofile/:fileName", a.updateGeofile)
 	g.POST("/logs/:count", a.getLogs)
@@ -131,6 +134,16 @@ func (a *ServerController) getXrayVersion(c *gin.Context) {
 	jsonObj(c, versions, nil)
 }
 
+// getPanelUpdateInfo retrieves the current and latest panel version.
+func (a *ServerController) getPanelUpdateInfo(c *gin.Context) {
+	info, err := a.panelService.GetUpdateInfo()
+	if err != nil {
+		jsonMsg(c, I18nWeb(c, "pages.index.panelUpdateCheckPopover"), err)
+		return
+	}
+	jsonObj(c, info, nil)
+}
+
 // installXray installs or updates Xray to the specified version.
 func (a *ServerController) installXray(c *gin.Context) {
 	version := c.Param("version")
@@ -138,6 +151,12 @@ func (a *ServerController) installXray(c *gin.Context) {
 	jsonMsg(c, I18nWeb(c, "pages.index.xraySwitchVersionPopover"), err)
 }
 
+// updatePanel starts a panel self-update to the latest release.
+func (a *ServerController) updatePanel(c *gin.Context) {
+	err := a.panelService.StartUpdate()
+	jsonMsg(c, I18nWeb(c, "pages.index.panelUpdateStartedPopover"), err)
+}
+
 // updateGeofile updates the specified geo file for Xray.
 func (a *ServerController) updateGeofile(c *gin.Context) {
 	fileName := c.Param("fileName")

web/html/component/aThemeSwitch.html

@@ -40,7 +40,8 @@
 {{define "component/aThemeSwitch"}}
 <script>
   function createThemeSwitcher() {
-    const isDarkTheme = localStorage.getItem('dark-mode') === 'true';
+    const darkModePreference = localStorage.getItem('dark-mode');
+    const isDarkTheme = darkModePreference === null ? true : darkModePreference === 'true';
     const isUltra = localStorage.getItem('isUltraDarkThemeEnabled') === 'true';
     if (isUltra) {
       document.documentElement.setAttribute('data-theme', 'ultra-dark');

web/html/form/outbound.html

@@ -190,22 +190,73 @@
             >
           </a-select>
         </a-form-item>
-        <a-form-item label="non-IP queries">
+        <a-form-item label="Rules">
-          <a-select
+          <a-button
-            v-model="outbound.settings.nonIPQuery"
+            icon="plus"
-            :dropdown-class-name="themeSwitcher.currentTheme"
+            type="primary"
-          >
+            size="small"
-            <a-select-option v-for="s in ['reject','drop','skip']" :value="s"
+            @click="outbound.settings.addRule()"
-              >[[ s ]]</a-select-option
+          ></a-button>
-            >
-          </a-select>
         </a-form-item>
-        <a-form-item
+
-          v-if="outbound.settings.nonIPQuery === 'skip'"
+        <a-form
-          label="Block Types"
+          v-for="(rule, index) in outbound.settings.rules"
+          :colon="false"
+          :label-col="{ md: {span:8} }"
+          :wrapper-col="{ md: {span:14} }"
         >
-          <a-input v-model.number="outbound.settings.blockTypes"></a-input>
+          <a-divider :style="{ margin: '0' }">
-        </a-form-item>
+            Rule [[ index + 1 ]]
+            <a-icon
+              type="delete"
+              @click="() => outbound.settings.delRule(index)"
+              :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
+            ></a-icon>
+          </a-divider>
+
+          <a-form-item label="Action">
+            <a-select
+              v-model="rule.action"
+              :dropdown-class-name="themeSwitcher.currentTheme"
+            >
+              <a-select-option v-for="action in DNSRuleActions" :value="action"
+                >[[ action ]]</a-select-option
+              >
+            </a-select>
+          </a-form-item>
+
+          <a-form-item>
+            <template slot="label">
+              <a-tooltip>
+                <template slot="title">
+                  <span>Single qtype (e.g. 28) or list/range (e.g. 1,3,23-24)</span>
+                </template>
+                QType
+                <a-icon type="question-circle"></a-icon>
+              </a-tooltip>
+            </template>
+            <a-input
+              v-model.trim="rule.qtype"
+              placeholder="1,3,23-24"
+            ></a-input>
+          </a-form-item>
+
+          <a-form-item>
+            <template slot="label">
+              <a-tooltip>
+                <template slot="title">
+                  <span>Comma-separated domain rules, e.g. domain:example.com,full:example.com</span>
+                </template>
+                Domain
+                <a-icon type="question-circle"></a-icon>
+              </a-tooltip>
+            </template>
+            <a-input
+              v-model.trim="rule.domain"
+              placeholder="domain:example.com,full:example.com"
+            ></a-input>
+          </a-form-item>
+        </a-form>
       </template>
 
       <!-- wireguard settings -->
@@ -791,7 +842,7 @@
               :max="60"
             ></a-input-number>
           </a-form-item>
-          <a-form-item label="Disable Path MTU">
+          <a-form-item label="Disable Path MTU Dis">
             <a-switch
               v-model="outbound.stream.hysteria.disablePathMTUDiscovery"
             ></a-switch>
@@ -801,6 +852,184 @@
 
       <!-- finalmask settings -->
       <template v-if="outbound.canEnableStream()">
+        <!-- TCP Masks – for raw/tcp/httpupgrade/ws/grpc/xhttp -->
+        <a-form-item
+          label="TCP Masks"
+          v-if="['raw', 'tcp', 'httpupgrade', 'ws', 'grpc', 'xhttp'].includes(outbound.stream.network)"
+        >
+          <a-button
+            icon="plus"
+            type="primary"
+            size="small"
+            @click="outbound.stream.addTcpMask('fragment')"
+          ></a-button>
+        </a-form-item>
+        <template v-if="outbound.stream.finalmask.tcp && outbound.stream.finalmask.tcp.length > 0">
+          <a-form
+            v-for="(mask, index) in outbound.stream.finalmask.tcp"
+            :key="index"
+            :colon="false"
+            :label-col="{ md: {span:8} }"
+            :wrapper-col="{ md: {span:14} }"
+          >
+            <a-divider :style="{ margin: '0' }">
+              TCP Mask [[ index + 1 ]]
+              <a-icon
+                type="delete"
+                @click="() => outbound.stream.delTcpMask(index)"
+                :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
+              ></a-icon>
+            </a-divider>
+            <a-form-item label="Type">
+              <a-select
+                v-model="mask.type"
+                @change="(type) => { mask.settings = mask._getDefaultSettings(type, {}); }"
+                :dropdown-class-name="themeSwitcher.currentTheme"
+              >
+                <a-select-option value="fragment">Fragment</a-select-option>
+                <a-select-option value="header-custom">Header Custom</a-select-option>
+                <a-select-option value="sudoku">Sudoku</a-select-option>
+              </a-select>
+            </a-form-item>
+
+            <!-- Fragment -->
+            <template v-if="mask.type === 'fragment'">
+              <a-form-item label="Packets">
+                <a-select v-model="mask.settings.packets" :dropdown-class-name="themeSwitcher.currentTheme">
+                  <a-select-option value="tlshello">tlshello</a-select-option>
+                  <a-select-option value="1-3">1-3</a-select-option>
+                  <a-select-option value="1-5">1-5</a-select-option>
+                </a-select>
+              </a-form-item>
+              <a-form-item label="Length">
+                <a-input v-model.trim="mask.settings.length" placeholder="e.g. 100-200" />
+              </a-form-item>
+              <a-form-item label="Delay">
+                <a-input v-model.trim="mask.settings.delay" placeholder="e.g. 10-20" />
+              </a-form-item>
+              <a-form-item label="Max Split">
+                <a-input v-model.trim="mask.settings.maxSplit" placeholder="e.g. 3-6" />
+              </a-form-item>
+            </template>
+
+            <!-- Sudoku (TCP) -->
+            <template v-if="mask.type === 'sudoku'">
+              <a-form-item label="Password">
+                <a-input v-model.trim="mask.settings.password" placeholder="Obfuscation password" />
+              </a-form-item>
+              <a-form-item label="ASCII">
+                <a-input v-model.trim="mask.settings.ascii" placeholder="ASCII" />
+              </a-form-item>
+              <a-form-item label="Custom Table">
+                <a-input v-model.trim="mask.settings.customTable" placeholder="Custom Table" />
+              </a-form-item>
+              <a-form-item label="Custom Tables">
+                <a-input v-model.trim="mask.settings.customTables" placeholder="Custom Tables" />
+              </a-form-item>
+              <a-form-item label="Padding Min">
+                <a-input-number v-model.number="mask.settings.paddingMin" :min="0" />
+              </a-form-item>
+              <a-form-item label="Padding Max">
+                <a-input-number v-model.number="mask.settings.paddingMax" :min="0" />
+              </a-form-item>
+            </template>
+
+            <!-- Header Custom (TCP) – clients/servers are 2D arrays of groups -->
+            <template v-if="mask.type === 'header-custom'">
+              <!-- Clients -->
+              <a-form-item label="Clients">
+                <a-button
+                  icon="plus"
+                  type="primary"
+                  size="small"
+                  @click="mask.settings.clients.push([{delay: 0, rand: 0, randRange: '0-255', type: 'array', packet: []}])"
+                ></a-button>
+              </a-form-item>
+              <template v-for="(group, gi) in mask.settings.clients" :key="'cg'+gi">
+                <a-divider :style="{ margin: '0' }">
+                  Clients Group [[ gi + 1 ]]
+                  <a-icon
+                    type="delete"
+                    @click="mask.settings.clients.splice(gi, 1)"
+                    :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer', marginLeft: '8px' }"
+                  ></a-icon>
+                </a-divider>
+                <template v-for="(item, ii) in group" :key="'ci'+ii">
+                  <a-form-item label='{{ i18n "pages.xray.outbound.type" }}'>
+                    <a-select v-model="item.type" :dropdown-class-name="themeSwitcher.currentTheme"
+                      @change="t => { if(t === 'array') { item.rand = 0; item.packet = []; } else { item.packet = ''; } }">
+                      <a-select-option value="array">Array</a-select-option>
+                      <a-select-option value="str">String</a-select-option>
+                      <a-select-option value="hex">Hex</a-select-option>
+                      <a-select-option value="base64">Base64</a-select-option>
+                    </a-select>
+                  </a-form-item>
+                  <a-form-item label="Delay (ms)">
+                    <a-input-number v-model.number="item.delay" :min="0" />
+                  </a-form-item>
+                  <template v-if="item.type === 'array'">
+                    <a-form-item label="Rand">
+                      <a-input-number v-model.number="item.rand" :min="0" />
+                    </a-form-item>
+                    <a-form-item label="Rand Range">
+                      <a-input v-model.trim="item.randRange" placeholder="0-255" />
+                    </a-form-item>
+                  </template>
+                  <a-form-item v-else label="Packet">
+                    <a-input v-model.trim="item.packet" placeholder="binary data" />
+                  </a-form-item>
+                </template>
+              </template>
+
+              <!-- Servers -->
+              <a-form-item label="Servers">
+                <a-button
+                  icon="plus"
+                  type="primary"
+                  size="small"
+                  @click="mask.settings.servers.push([{delay: 0, rand: 0, randRange: '0-255', type: 'array', packet: []}])"
+                ></a-button>
+              </a-form-item>
+              <template v-for="(group, gi) in mask.settings.servers" :key="'sg'+gi">
+                <a-divider :style="{ margin: '0' }">
+                  Servers Group [[ gi + 1 ]]
+                  <a-icon
+                    type="delete"
+                    @click="mask.settings.servers.splice(gi, 1)"
+                    :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer', marginLeft: '8px' }"
+                  ></a-icon>
+                </a-divider>
+                <template v-for="(item, ii) in group" :key="'si'+ii">
+                  <a-form-item label='{{ i18n "pages.xray.outbound.type" }}'>
+                    <a-select v-model="item.type" :dropdown-class-name="themeSwitcher.currentTheme"
+                      @change="t => { if(t === 'array') { item.rand = 0; item.packet = []; } else { item.packet = ''; } }">
+                      <a-select-option value="array">Array</a-select-option>
+                      <a-select-option value="str">String</a-select-option>
+                      <a-select-option value="hex">Hex</a-select-option>
+                      <a-select-option value="base64">Base64</a-select-option>
+                    </a-select>
+                  </a-form-item>
+                  <a-form-item label="Delay (ms)">
+                    <a-input-number v-model.number="item.delay" :min="0" />
+                  </a-form-item>
+                  <template v-if="item.type === 'array'">
+                    <a-form-item label="Rand">
+                      <a-input-number v-model.number="item.rand" :min="0" />
+                    </a-form-item>
+                    <a-form-item label="Rand Range">
+                      <a-input v-model.trim="item.randRange" placeholder="0-255" />
+                    </a-form-item>
+                  </template>
+                <a-form-item label="Packet" v-else>
+                  <a-input v-model.trim="item.packet" placeholder="binary data" />
+                </a-form-item>
+                </template>
+              </template>
+            </template>
+
+          </a-form>
+        </template>
+
         <a-form-item
           label="UDP Masks"
           v-if="outbound.stream.network === 'kcp' || outbound.protocol === Protocols.Hysteria"
@@ -869,17 +1098,14 @@
                   >
                   <a-select-option value="xdns">xDNS</a-select-option>
                   <a-select-option value="xicmp">xICMP</a-select-option>
-                  <a-select-option value="header-custom"
+                  <a-select-option value="header-custom">Header Custom</a-select-option>
-                    >Header Custom</a-select-option
-                  >
                   <a-select-option value="noise">Noise</a-select-option>
-                  <a-select-option value="sudoku">Sudoku</a-select-option>
                 </template>
               </a-select>
             </a-form-item>
             <a-form-item
               label="Password"
-              v-if="['salamander', 'mkcp-aes128gcm', 'sudoku'].includes(mask.type)"
+              v-if="['salamander', 'mkcp-aes128gcm'].includes(mask.type)"
             >
               <a-input
                 v-model.trim="mask.settings.password"
@@ -903,134 +1129,17 @@
                 ></a-select>
               </a-form-item>
             </template>
-            <template v-if="mask.type === 'header-custom'">
-              <a-form-item label="Client">
-                <a-icon
-                  type="plus"
-                  type="primary"
-                  size="small"
-                  @click="mask.settings.client.push({rand: 0, randRange: '0-255', type: 'array', packet: []})"
-                />
-              </a-form-item>
-              <template v-for="(c, index) in mask.settings.client" :key="index">
-                <a-divider :style="{ margin: '0' }">
-                  Client [[ index + 1 ]]
-                  <a-icon
-                    type="delete"
-                    @click="() => mask.settings.client.splice(index, 1)"
-                    :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
-                  ></a-icon>
-                </a-divider>
-                <a-form-item label="Rand">
-                  <a-input-number
-                    v-model.number="c.rand"
-                    :min="0"
-                  ></a-input-number>
-                </a-form-item>
-                <a-form-item label="Rand Range">
-                  <a-input
-                    v-model.trim="c.randRange"
-                    placeholder="0-255"
-                  ></a-input>
-                </a-form-item>
-                <a-form-item label="Type">
-                  <a-select
-                    v-model="c.type"
-                    :dropdown-class-name="themeSwitcher.currentTheme"
-                  >
-                    <a-select-option value="array">Array</a-select-option>
-                    <a-select-option value="str">String</a-select-option>
-                    <a-select-option value="hex">Hex</a-select-option>
-                    <a-select-option value="base64">Base64</a-select-option>
-                  </a-select>
-                </a-form-item>
-                <a-form-item label="Packet">
-                  <a-input v-model.trim="c.packet" placeholder="binary data" />
-                </a-form-item>
-              </template>
-              <a-divider :style="{ margin: '0' }"></a-divider>
-              <a-form-item label="Server">
-                <a-icon
-                  type="plus"
-                  type="primary"
-                  size="small"
-                  @click="mask.settings.server.push({rand: 0, randRange: '0-255', type: 'array', packet: []})"
-                />
-              </a-form-item>
-              <template v-for="(s, index) in mask.settings.server" :key="index">
-                <a-divider :style="{ margin: '0' }">
-                  Server [[ index + 1 ]]
-                  <a-icon
-                    type="delete"
-                    @click="() => mask.settings.server.splice(index, 1)"
-                    :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
-                  ></a-icon>
-                </a-divider>
-                <a-form-item label="Rand">
-                  <a-input-number
-                    v-model.number="s.rand"
-                    :min="0"
-                  ></a-input-number>
-                </a-form-item>
-                <a-form-item label="Rand Range">
-                  <a-input
-                    v-model.trim="s.randRange"
-                    placeholder="0-255"
-                  ></a-input>
-                </a-form-item>
-                <a-form-item label="Type">
-                  <a-select
-                    v-model="s.type"
-                    :dropdown-class-name="themeSwitcher.currentTheme"
-                  >
-                    <a-select-option value="array">Array</a-select-option>
-                    <a-select-option value="str">String</a-select-option>
-                    <a-select-option value="hex">Hex</a-select-option>
-                    <a-select-option value="base64">Base64</a-select-option>
-                  </a-select>
-                </a-form-item>
-                <a-form-item label="Packet">
-                  <a-input v-model.trim="s.packet" placeholder="binary data" />
-                </a-form-item>
-              </template>
-            </template>
-            <template v-if="mask.type === 'sudoku'">
-              <a-form-item label="ASCII">
-                <a-input
-                  v-model.trim="mask.settings.ascii"
-                  placeholder="ASCII"
-                ></a-input>
-              </a-form-item>
-              <a-form-item label="Custom Table">
-                <a-input
-                  v-model.trim="mask.settings.customTable"
-                  placeholder="Custom Table"
-                ></a-input>
-              </a-form-item>
-              <a-form-item label="Custom Tables">
-                <a-input
-                  v-model.trim="mask.settings.customTables"
-                  placeholder="Custom Tables"
-                ></a-input>
-              </a-form-item>
-              <a-form-item label="Padding Min">
-                <a-input-number
-                  v-model.number="mask.settings.paddingMin"
-                  :min="0"
-                ></a-input-number>
-              </a-form-item>
-            </template>
             <template v-if="mask.type === 'noise'">
               <a-form-item label="Reset">
                 <a-input-number v-model.number="mask.settings.reset" :min="0" />
               </a-form-item>
               <a-form-item label="Noise">
-                <a-icon
+                <a-button
-                  type="plus"
+                  icon="plus"
                   type="primary"
                   size="small"
-                  @click="mask.settings.noise.push({rand: '1-8192', randRange: '0-255', type: 'array', packet: '', delay: ''})"
+                  @click="mask.settings.noise.push({rand: 0, randRange: '0-255', type: 'array', packet: [], delay: ''})"
-                />
+                ></a-button>
               </a-form-item>
               <template v-for="(n, index) in mask.settings.noise" :key="index">
                 <a-divider :style="{ margin: '0' }">
@@ -1041,22 +1150,11 @@
                     :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
                   ></a-icon>
                 </a-divider>
-                <a-form-item label="Rand">
-                  <a-input-number
-                    v-model.number="n.rand"
-                    :min="0"
-                  ></a-input-number>
-                </a-form-item>
-                <a-form-item label="Rand Range">
-                  <a-input
-                    v-model.trim="n.randRange"
-                    placeholder="0-255"
-                  ></a-input>
-                </a-form-item>
                 <a-form-item label="Type">
                   <a-select
                     v-model="n.type"
                     :dropdown-class-name="themeSwitcher.currentTheme"
+                    @change="t => { if(t === 'array') n.packet = []; else n.packet = ''; }"
                   >
                     <a-select-option value="array">Array</a-select-option>
                     <a-select-option value="str">String</a-select-option>
@@ -1064,7 +1162,18 @@
                     <a-select-option value="base64">Base64</a-select-option>
                   </a-select>
                 </a-form-item>
-                <a-form-item label="Packet">
+                <template v-if="n.type === 'array'">
+                  <a-form-item label="Rand">
+                    <a-input v-model.trim="n.rand" placeholder="0 or 1-8192" />
+                  </a-form-item>
+                  <a-form-item label="Rand Range">
+                    <a-input
+                      v-model.trim="n.randRange"
+                      placeholder="0-255"
+                    ></a-input>
+                  </a-form-item>
+                </template>
+                <a-form-item label="Packet" v-else>
                   <a-input v-model.trim="n.packet" placeholder="binary data" />
                 </a-form-item>
                 <a-form-item label="Delay">
@@ -1072,6 +1181,91 @@
                 </a-form-item>
               </template>
             </template>
+            <template v-if="mask.type === 'header-custom'">
+              <a-form-item label="Client">
+                <a-button
+                  icon="plus"
+                  type="primary"
+                  size="small"
+                  @click="mask.settings.client.push({rand: 0, randRange: '0-255', type: 'array', packet: []})"
+                ></a-button>
+              </a-form-item>
+              <template v-for="(c, index) in mask.settings.client" :key="index">
+                <a-divider :style="{ margin: '0' }">
+                  Client [[ index + 1 ]]
+                  <a-icon
+                    type="delete"
+                    @click="mask.settings.client.splice(index, 1)"
+                    :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
+                  ></a-icon>
+                </a-divider>
+                <a-form-item label="Type">
+                  <a-select
+                    v-model="c.type"
+                    :dropdown-class-name="themeSwitcher.currentTheme"
+                    @change="t => { if(t === 'array') c.packet = []; else c.packet = ''; }"
+                  >
+                    <a-select-option value="array">Array</a-select-option>
+                    <a-select-option value="str">String</a-select-option>
+                    <a-select-option value="hex">Hex</a-select-option>
+                    <a-select-option value="base64">Base64</a-select-option>
+                  </a-select>
+                </a-form-item>
+                <template v-if="c.type === 'array'">
+                  <a-form-item label="Rand">
+                    <a-input-number v-model.number="c.rand" :min="0"></a-input-number>
+                  </a-form-item>
+                  <a-form-item label="Rand Range">
+                    <a-input v-model.trim="c.randRange" placeholder="0-255"></a-input>
+                  </a-form-item>
+                </template>
+                <a-form-item label="Packet" v-else>
+                  <a-input v-model.trim="c.packet" placeholder="binary data" />
+                </a-form-item>
+              </template>
+              <a-divider :style="{ margin: '0' }"></a-divider>
+              <a-form-item label="Server">
+                <a-button
+                  icon="plus"
+                  type="primary"
+                  size="small"
+                  @click="mask.settings.server.push({rand: 0, randRange: '0-255', type: 'array', packet: []})"
+                ></a-button>
+              </a-form-item>
+              <template v-for="(s, index) in mask.settings.server" :key="index">
+                <a-divider :style="{ margin: '0' }">
+                  Server [[ index + 1 ]]
+                  <a-icon
+                    type="delete"
+                    @click="mask.settings.server.splice(index, 1)"
+                    :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
+                  ></a-icon>
+                </a-divider>
+                <a-form-item label="Type">
+                  <a-select
+                    v-model="s.type"
+                    :dropdown-class-name="themeSwitcher.currentTheme"
+                    @change="t => { if(t === 'array') s.packet = []; else s.packet = ''; }"
+                  >
+                    <a-select-option value="array">Array</a-select-option>
+                    <a-select-option value="str">String</a-select-option>
+                    <a-select-option value="hex">Hex</a-select-option>
+                    <a-select-option value="base64">Base64</a-select-option>
+                  </a-select>
+                </a-form-item>
+                <template v-if="s.type === 'array'">
+                  <a-form-item label="Rand">
+                    <a-input-number v-model.number="s.rand" :min="0"></a-input-number>
+                  </a-form-item>
+                  <a-form-item label="Rand Range">
+                    <a-input v-model.trim="s.randRange" placeholder="0-255"></a-input>
+                  </a-form-item>
+                </template>
+                <a-form-item label="Packet" v-else>
+                  <a-input v-model.trim="s.packet" placeholder="binary data" />
+                </a-form-item>
+              </template>
+            </template>
             <template v-if="mask.type === 'xicmp'">
               <a-form-item label="IP">
                 <a-input
@@ -1088,6 +1282,72 @@
             </template>
           </a-form>
         </template>
+
+        <!-- quicParams – only for xhttp H3 and hysteria -->
+        <template v-if="outbound.stream.network === 'xhttp' || outbound.protocol === Protocols.Hysteria">
+          <a-form-item label="QUIC Params">
+            <a-switch v-model="outbound.stream.finalmask.enableQuicParams"></a-switch>
+          </a-form-item>
+          <template v-if="outbound.stream.finalmask.enableQuicParams">
+            <a-form-item label="Congestion">
+              <a-select
+                v-model="outbound.stream.finalmask.quicParams.congestion"
+                :dropdown-class-name="themeSwitcher.currentTheme"
+              >
+                <a-select-option value="reno">Reno</a-select-option>
+                <a-select-option value="bbr">BBR</a-select-option>
+                <a-select-option value="brutal">Brutal</a-select-option>
+                <a-select-option value="force-brutal">Force Brutal</a-select-option>
+              </a-select>
+            </a-form-item>
+            <a-form-item label="Debug">
+              <a-switch v-model="outbound.stream.finalmask.quicParams.debug"></a-switch>
+            </a-form-item>
+            <template v-if="['brutal','force-brutal'].includes(outbound.stream.finalmask.quicParams.congestion)">
+              <a-form-item label="Brutal Up">
+                <a-input v-model.trim="outbound.stream.finalmask.quicParams.brutalUp" placeholder="e.g. 60 mbps" />
+              </a-form-item>
+              <a-form-item label="Brutal Down">
+                <a-input v-model.trim="outbound.stream.finalmask.quicParams.brutalDown" placeholder="e.g. 60 mbps" />
+              </a-form-item>
+            </template>
+            <a-form-item label="UDP Hop">
+              <a-switch v-model="outbound.stream.finalmask.quicParams.hasUdpHop"></a-switch>
+            </a-form-item>
+            <template v-if="outbound.stream.finalmask.quicParams.hasUdpHop">
+              <a-form-item label="Hop Ports">
+                <a-input v-model.trim="outbound.stream.finalmask.quicParams.udpHop.ports" placeholder="e.g. 20000-50000" />
+              </a-form-item>
+              <a-form-item label="Hop Interval (s)">
+                <a-input-number v-model.number="outbound.stream.finalmask.quicParams.udpHop.interval" :min="5" />
+              </a-form-item>
+            </template>
+            <a-form-item label="Max Idle Timeout (s)">
+              <a-input-number v-model.number="outbound.stream.finalmask.quicParams.maxIdleTimeout" :min="4" :max="120" />
+            </a-form-item>
+            <a-form-item label="Keep Alive Period (s)">
+              <a-input-number v-model.number="outbound.stream.finalmask.quicParams.keepAlivePeriod" :min="0" :max="60" />
+            </a-form-item>
+            <a-form-item label="Disable Path MTU Dis">
+              <a-switch v-model="outbound.stream.finalmask.quicParams.disablePathMTUDiscovery"></a-switch>
+            </a-form-item>
+            <a-form-item label="Max Incoming Streams">
+              <a-input-number v-model.number="outbound.stream.finalmask.quicParams.maxIncomingStreams" :min="0" placeholder="0 = default" />
+            </a-form-item>
+            <a-form-item label="Init Stream Window">
+              <a-input-number v-model.number="outbound.stream.finalmask.quicParams.initStreamReceiveWindow" :min="0" placeholder="0 = default" />
+            </a-form-item>
+            <a-form-item label="Max Stream Window">
+              <a-input-number v-model.number="outbound.stream.finalmask.quicParams.maxStreamReceiveWindow" :min="0" placeholder="0 = default" />
+            </a-form-item>
+            <a-form-item label="Init Conn Window">
+              <a-input-number v-model.number="outbound.stream.finalmask.quicParams.initConnectionReceiveWindow" :min="0" placeholder="0 = default" />
+            </a-form-item>
+            <a-form-item label="Max Conn Window">
+              <a-input-number v-model.number="outbound.stream.finalmask.quicParams.maxConnectionReceiveWindow" :min="0" placeholder="0 = default" />
+            </a-form-item>
+          </template>
+        </template>
       </template>
 
       <!-- tls settings -->

web/html/form/stream/stream_finalmask.html

@@ -3,9 +3,199 @@
   :colon="false"
   :label-col="{ md: {span:8} }"
   :wrapper-col="{ md: {span:14} }"
-  v-if="inbound.protocol == Protocols.HYSTERIA || inbound.stream.network == 'kcp'"
+  v-if="inbound.protocol == Protocols.HYSTERIA || ['kcp', 'xhttp', 'raw', 'tcp', 'httpupgrade', 'ws', 'grpc'].includes(inbound.stream.network)"
 >
   <a-divider :style="{ margin: '5px 0 0' }"></a-divider>
+
+  <!-- TCP Masks – for raw/tcp/httpupgrade/ws/grpc/xhttp -->
+  <template v-if="['raw', 'tcp', 'httpupgrade', 'ws', 'grpc', 'xhttp'].includes(inbound.stream.network)">
+  <a-form-item label="TCP Masks">
+    <a-button
+      icon="plus"
+      type="primary"
+      size="small"
+      @click="inbound.stream.addTcpMask('fragment')"
+    ></a-button>
+  </a-form-item>
+  <template v-if="inbound.stream.finalmask.tcp && inbound.stream.finalmask.tcp.length > 0">
+    <a-form
+      v-for="(mask, index) in inbound.stream.finalmask.tcp"
+      :key="index"
+      :colon="false"
+      :label-col="{ md: {span:8} }"
+      :wrapper-col="{ md: {span:14} }"
+    >
+      <a-divider :style="{ margin: '0' }">
+        TCP Mask [[ index + 1 ]]
+        <a-icon
+          type="delete"
+          @click="() => inbound.stream.delTcpMask(index)"
+          :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
+        ></a-icon>
+      </a-divider>
+      <a-form-item label='{{ i18n "pages.xray.outbound.type" }}'>
+        <a-select
+          v-model="mask.type"
+          @change="(type) => { mask.settings = mask._getDefaultSettings(type, {}); }"
+          :dropdown-class-name="themeSwitcher.currentTheme"
+        >
+          <a-select-option value="fragment">Fragment</a-select-option>
+          <a-select-option value="header-custom">Header Custom</a-select-option>
+          <a-select-option value="sudoku">Sudoku</a-select-option>
+        </a-select>
+      </a-form-item>
+
+      <!-- Fragment settings -->
+      <template v-if="mask.type === 'fragment'">
+        <a-form-item label="Packets">
+          <a-select
+            v-model="mask.settings.packets"
+            :dropdown-class-name="themeSwitcher.currentTheme"
+          >
+            <a-select-option value="tlshello">tlshello</a-select-option>
+            <a-select-option value="1-3">1-3</a-select-option>
+            <a-select-option value="1-5">1-5</a-select-option>
+          </a-select>
+        </a-form-item>
+        <a-form-item label="Length">
+          <a-input v-model.trim="mask.settings.length" placeholder="e.g. 100-200" />
+        </a-form-item>
+        <a-form-item label="Delay">
+          <a-input v-model.trim="mask.settings.delay" placeholder="e.g. 10-20" />
+        </a-form-item>
+        <a-form-item label="Max Split">
+          <a-input v-model.trim="mask.settings.maxSplit" placeholder="e.g. 3-6" />
+        </a-form-item>
+      </template>
+
+      <!-- Sudoku settings (TCP) -->
+      <template v-if="mask.type === 'sudoku'">
+        <a-form-item label="Password">
+          <a-input v-model.trim="mask.settings.password" placeholder="Obfuscation password" />
+        </a-form-item>
+        <a-form-item label="ASCII">
+          <a-input v-model.trim="mask.settings.ascii" placeholder="ASCII" />
+        </a-form-item>
+        <a-form-item label="Custom Table">
+          <a-input v-model.trim="mask.settings.customTable" placeholder="Custom Table" />
+        </a-form-item>
+        <a-form-item label="Custom Tables">
+          <a-input v-model.trim="mask.settings.customTables" placeholder="Custom Tables" />
+        </a-form-item>
+        <a-form-item label="Padding Min">
+          <a-input-number v-model.number="mask.settings.paddingMin" :min="0" />
+        </a-form-item>
+        <a-form-item label="Padding Max">
+          <a-input-number v-model.number="mask.settings.paddingMax" :min="0" />
+        </a-form-item>
+      </template>
+
+      <!-- Header Custom (TCP) – clients/servers/errors are 2D arrays of groups -->
+      <template v-if="mask.type === 'header-custom'">
+        <!-- Clients -->
+        <a-form-item label="Clients">
+          <a-button
+            icon="plus"
+            type="primary"
+            size="small"
+            @click="mask.settings.clients.push([{delay: 0, rand: 0, randRange: '0-255', type: 'array', packet: []}])"
+          ></a-button>
+        </a-form-item>
+        <template v-for="(group, gi) in mask.settings.clients" :key="'cg'+gi">
+          <a-divider :style="{ margin: '0' }">
+            Clients Group [[ gi + 1 ]]
+            <a-icon
+              type="delete"
+              @click="mask.settings.clients.splice(gi, 1)"
+              :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer', marginLeft: '8px' }"
+            ></a-icon>
+          </a-divider>
+          <template v-for="(item, ii) in group" :key="'ci'+ii">
+            <a-form-item label='{{ i18n "pages.xray.outbound.type" }}'>
+              <a-select v-model="item.type" :dropdown-class-name="themeSwitcher.currentTheme"
+                @change="t => { if(t === 'base64') item.packet = RandomUtil.randomBase64(); else if(t === 'array') { item.rand = 0; item.packet = []; } else { item.packet = ''; } }">
+                <a-select-option value="array">Array</a-select-option>
+                <a-select-option value="str">String</a-select-option>
+                <a-select-option value="hex">Hex</a-select-option>
+                <a-select-option value="base64">Base64</a-select-option>
+              </a-select>
+            </a-form-item>
+            <a-form-item label="Delay (ms)">
+              <a-input-number v-model.number="item.delay" :min="0" />
+            </a-form-item>
+            <template v-if="item.type === 'array'">
+              <a-form-item label="Rand">
+                <a-input-number v-model.number="item.rand" :min="0" />
+              </a-form-item>
+              <a-form-item label="Rand Range">
+                <a-input v-model.trim="item.randRange" placeholder="0-255" />
+              </a-form-item>
+            </template>
+            <a-form-item v-else label="Packet">
+              <a-input-group compact v-if="item.type === 'base64'">
+                <a-input v-model.trim="item.packet" placeholder="binary data" :style="{ width: 'calc(100% - 32px)' }" />
+                <a-button icon="reload" @click="item.packet = RandomUtil.randomBase64()" />
+              </a-input-group>
+              <a-input v-else v-model.trim="item.packet" placeholder="binary data" />
+            </a-form-item>
+          </template>
+        </template>
+
+        <!-- Servers -->
+        <a-form-item label="Servers">
+          <a-button
+            icon="plus"
+            type="primary"
+            size="small"
+            @click="mask.settings.servers.push([{delay: 0, rand: 0, randRange: '0-255', type: 'array', packet: []}])"
+          ></a-button>
+        </a-form-item>
+        <template v-for="(group, gi) in mask.settings.servers" :key="'sg'+gi">
+          <a-divider :style="{ margin: '0' }">
+            Servers Group [[ gi + 1 ]]
+            <a-icon
+              type="delete"
+              @click="mask.settings.servers.splice(gi, 1)"
+              :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer', marginLeft: '8px' }"
+            ></a-icon>
+          </a-divider>
+          <template v-for="(item, ii) in group" :key="'si'+ii">
+            <a-form-item label='{{ i18n "pages.xray.outbound.type" }}'>
+              <a-select v-model="item.type" :dropdown-class-name="themeSwitcher.currentTheme"
+                @change="t => { if(t === 'base64') item.packet = RandomUtil.randomBase64(); else if(t === 'array') { item.rand = 0; item.packet = []; } else { item.packet = ''; } }">
+                <a-select-option value="array">Array</a-select-option>
+                <a-select-option value="str">String</a-select-option>
+                <a-select-option value="hex">Hex</a-select-option>
+                <a-select-option value="base64">Base64</a-select-option>
+              </a-select>
+            </a-form-item>
+            <a-form-item label="Delay (ms)">
+              <a-input-number v-model.number="item.delay" :min="0" />
+            </a-form-item>
+            <template v-if="item.type === 'array'">
+              <a-form-item label="Rand">
+                <a-input-number v-model.number="item.rand" :min="0" />
+              </a-form-item>
+              <a-form-item label="Rand Range">
+                <a-input v-model.trim="item.randRange" placeholder="0-255" />
+              </a-form-item>
+            </template>
+            <a-form-item v-else label="Packet">
+              <a-input-group compact v-if="item.type === 'base64'">
+                <a-input v-model.trim="item.packet" placeholder="binary data" :style="{ width: 'calc(100% - 32px)' }" />
+                <a-button icon="reload" @click="item.packet = RandomUtil.randomBase64()" />
+              </a-input-group>
+              <a-input v-else v-model.trim="item.packet" placeholder="binary data" />
+            </a-form-item>
+          </template>
+        </template>
+      </template>
+
+    </a-form>
+  </template>
+  </template>
+
+  <template v-if="inbound.protocol == Protocols.HYSTERIA || inbound.stream.network == 'kcp'">
   <a-form-item label="UDP Masks">
     <a-button
       icon="plus"
@@ -64,17 +254,14 @@
             >
             <a-select-option value="xdns">xDNS</a-select-option>
             <a-select-option value="xicmp">xICMP</a-select-option>
-            <a-select-option value="header-custom"
+            <a-select-option value="header-custom">Header Custom</a-select-option>
-              >Header Custom</a-select-option
-            >
             <a-select-option value="noise">Noise</a-select-option>
-            <a-select-option value="sudoku">Sudoku</a-select-option>
           </template>
         </a-select>
       </a-form-item>
       <a-form-item
         label="Password"
-        v-if="['mkcp-aes128gcm', 'salamander', 'sudoku'].includes(mask.type)"
+        v-if="['mkcp-aes128gcm', 'salamander'].includes(mask.type)"
       >
         <a-input
           v-model.trim="mask.settings.password"
@@ -98,96 +285,17 @@
           ></a-select>
         </a-form-item>
       </template>
-      <template v-if="mask.type === 'header-custom'">
-        <a-form-item label="Client">
-          <a-icon
-            type="plus"
-            type="primary"
-            size="small"
-            @click="mask.settings.client.push({rand: 0, randRange: '0-255', type: 'array', packet: []})"
-          />
-        </a-form-item>
-        <template v-for="(c, index) in mask.settings.client" :key="index">
-          <a-divider :style="{ margin: '0' }">
-            Client [[ index + 1 ]]
-            <a-icon
-              type="delete"
-              @click="() => mask.settings.client.splice(index, 1)"
-              :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
-            ></a-icon>
-          </a-divider>
-          <a-form-item label="Rand">
-            <a-input-number v-model.number="c.rand" />
-          </a-form-item>
-          <a-form-item label="Rand Range">
-            <a-input v-model.trim="c.randRange" placeholder="0-255" />
-          </a-form-item>
-          <a-form-item label='{{ i18n "pages.xray.outbound.type" }}'>
-            <a-select
-              v-model="c.type"
-              :dropdown-class-name="themeSwitcher.currentTheme"
-            >
-              <a-select-option value="array">Array</a-select-option>
-              <a-select-option value="str">String</a-select-option>
-              <a-select-option value="hex">Hex</a-select-option>
-              <a-select-option value="base64">Base64</a-select-option>
-            </a-select>
-          </a-form-item>
-          <a-form-item label="Packet">
-            <a-input v-model.trim="c.packet" placeholder="binary data" />
-          </a-form-item>
-        </template>
-        <a-divider :style="{ margin: '0' }"></a-divider>
-        <a-form-item label="Server">
-          <a-icon
-            type="plus"
-            type="primary"
-            size="small"
-            @click="mask.settings.server.push({rand: 0, randRange: '0-255', type: 'array', packet: []})"
-          />
-        </a-form-item>
-        <template v-for="(s, index) in mask.settings.server" :key="index">
-          <a-divider :style="{ margin: '0' }">
-            Server [[ index + 1 ]]
-            <a-icon
-              type="delete"
-              @click="() => mask.settings.server.splice(index, 1)"
-              :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
-            ></a-icon>
-          </a-divider>
-          <a-form-item label="Rand">
-            <a-input-number v-model.number="s.rand" />
-          </a-form-item>
-          <a-form-item label="Rand Range">
-            <a-input v-model.trim="s.randRange" placeholder="0-255" />
-          </a-form-item>
-          <a-form-item label='{{ i18n "pages.xray.outbound.type" }}'>
-            <a-select
-              v-model="s.type"
-              :dropdown-class-name="themeSwitcher.currentTheme"
-            >
-              <a-select-option value="array">Array</a-select-option>
-              <a-select-option value="str">String</a-select-option>
-              <a-select-option value="hex">Hex</a-select-option>
-              <a-select-option value="base64">Base64</a-select-option>
-            </a-select>
-          </a-form-item>
-          <a-form-item label="Packet">
-            <a-input v-model.trim="s.packet" placeholder="binary data" />
-          </a-form-item>
-        </template>
-      </template>
       <template v-if="mask.type === 'noise'">
         <a-form-item label="Reset">
           <a-input-number v-model.number="mask.settings.reset" :min="0" />
         </a-form-item>
         <a-form-item label="Noise">
-          <a-icon
+          <a-button
-            type="plus"
+            icon="plus"
             type="primary"
             size="small"
-            @click="mask.settings.noise.push({rand: '1-8192', randRange: '0-255', type: 'array', packet: '', delay: ''})"
+            @click="mask.settings.noise.push({rand: '1-8192', randRange: '0-255', type: 'array', packet: [], delay: '10-20'})"
-          />
+          ></a-button>
         </a-form-item>
         <template v-for="(n, index) in mask.settings.noise" :key="index">
           <a-divider :style="{ margin: '0' }">
@@ -198,16 +306,11 @@
               :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
             ></a-icon>
           </a-divider>
-          <a-form-item label="Rand">
-            <a-input v-model.trim="n.rand" placeholder="1-8192" />
-          </a-form-item>
-          <a-form-item label="Rand Range">
-            <a-input v-model.trim="n.randRange" placeholder="0-255" />
-          </a-form-item>
           <a-form-item label='{{ i18n "pages.xray.outbound.type" }}'>
             <a-select
               v-model="n.type"
               :dropdown-class-name="themeSwitcher.currentTheme"
+              @change="t => { if(t === 'base64') n.packet = RandomUtil.randomBase64(); else if(t === 'array') n.packet = []; else n.packet = ''; }"
             >
               <a-select-option value="array">Array</a-select-option>
               <a-select-option value="str">String</a-select-option>
@@ -215,36 +318,118 @@
               <a-select-option value="base64">Base64</a-select-option>
             </a-select>
           </a-form-item>
-          <a-form-item label="Packet">
+          <template v-if="n.type === 'array'">
-            <a-input v-model.trim="n.packet" placeholder="binary data" />
+            <a-form-item label="Rand">
+              <a-input v-model.trim="n.rand" placeholder="0 or 1-8192" />
+            </a-form-item>
+            <a-form-item label="Rand Range">
+              <a-input v-model.trim="n.randRange" placeholder="0-255" />
+            </a-form-item>
+          </template>
+          <a-form-item v-else label="Packet">
+            <a-input-group compact v-if="n.type === 'base64'">
+              <a-input v-model.trim="n.packet" placeholder="binary data" :style="{ width: 'calc(100% - 32px)' }" />
+              <a-button icon="reload" @click="n.packet = RandomUtil.randomBase64()" />
+            </a-input-group>
+            <a-input v-else v-model.trim="n.packet" placeholder="binary data" />
           </a-form-item>
           <a-form-item label="Delay">
             <a-input v-model.trim="n.delay" placeholder="10-20" />
           </a-form-item>
         </template>
       </template>
-      <template v-if="mask.type === 'sudoku'">
+      <template v-if="mask.type === 'header-custom'">
-        <a-form-item label="ASCII">
+        <a-form-item label="Client">
-          <a-input v-model.trim="mask.settings.ascii" placeholder="ASCII" />
+          <a-button
+            icon="plus"
+            type="primary"
+            size="small"
+            @click="mask.settings.client.push({rand: 0, randRange: '0-255', type: 'array', packet: []})"
+          ></a-button>
         </a-form-item>
-        <a-form-item label="Custom Table">
+        <template v-for="(c, index) in mask.settings.client" :key="index">
-          <a-input
+          <a-divider :style="{ margin: '0' }">
-            v-model.trim="mask.settings.customTable"
+            Client [[ index + 1 ]]
-            placeholder="Custom Table"
+            <a-icon
-          />
+              type="delete"
-        </a-form-item>
+              @click="mask.settings.client.splice(index, 1)"
-        <a-form-item label="Custom Tables">
+              :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
-          <a-input
+            ></a-icon>
-            v-model.trim="mask.settings.customTables"
+          </a-divider>
-            placeholder="Custom Tables"
+          <a-form-item label='{{ i18n "pages.xray.outbound.type" }}'>
-          />
+            <a-select
-        </a-form-item>
+              v-model="c.type"
-        <a-form-item label="Padding Min">
+              :dropdown-class-name="themeSwitcher.currentTheme"
-          <a-input-number v-model.number="mask.settings.paddingMin" :min="0" />
+              @change="t => { if(t === 'base64') c.packet = RandomUtil.randomBase64(); else if(t === 'array') c.packet = []; else c.packet = ''; }"
-        </a-form-item>
+            >
-        <a-form-item label="Padding Max">
+              <a-select-option value="array">Array</a-select-option>
-          <a-input-number v-model.number="mask.settings.paddingMax" :min="0" />
+              <a-select-option value="str">String</a-select-option>
+              <a-select-option value="hex">Hex</a-select-option>
+              <a-select-option value="base64">Base64</a-select-option>
+            </a-select>
+          </a-form-item>
+          <template v-if="c.type === 'array'">
+            <a-form-item label="Rand">
+              <a-input-number v-model.number="c.rand" />
+            </a-form-item>
+            <a-form-item label="Rand Range">
+              <a-input v-model.trim="c.randRange" placeholder="0-255" />
+            </a-form-item>
+          </template>
+          <a-form-item v-else label="Packet">
+            <a-input-group compact v-if="c.type === 'base64'">
+              <a-input v-model.trim="c.packet" placeholder="binary data" :style="{ width: 'calc(100% - 32px)' }" />
+              <a-button icon="reload" @click="c.packet = RandomUtil.randomBase64()" />
+            </a-input-group>
+            <a-input v-else v-model.trim="c.packet" placeholder="binary data" />
+          </a-form-item>
+        </template>
+        <a-divider :style="{ margin: '0' }"></a-divider>
+        <a-form-item label="Server">
+          <a-button
+            icon="plus"
+            type="primary"
+            size="small"
+            @click="mask.settings.server.push({rand: 0, randRange: '0-255', type: 'array', packet: []})"
+          ></a-button>
         </a-form-item>
+        <template v-for="(s, index) in mask.settings.server" :key="index">
+          <a-divider :style="{ margin: '0' }">
+            Server [[ index + 1 ]]
+            <a-icon
+              type="delete"
+              @click="mask.settings.server.splice(index, 1)"
+              :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"
+            ></a-icon>
+          </a-divider>
+          <a-form-item label='{{ i18n "pages.xray.outbound.type" }}'>
+            <a-select
+              v-model="s.type"
+              :dropdown-class-name="themeSwitcher.currentTheme"
+              @change="t => { if(t === 'base64') s.packet = RandomUtil.randomBase64(); else if(t === 'array') s.packet = []; else s.packet = ''; }"
+            >
+              <a-select-option value="array">Array</a-select-option>
+              <a-select-option value="str">String</a-select-option>
+              <a-select-option value="hex">Hex</a-select-option>
+              <a-select-option value="base64">Base64</a-select-option>
+            </a-select>
+          </a-form-item>
+          <template v-if="s.type === 'array'">
+            <a-form-item label="Rand">
+              <a-input-number v-model.number="s.rand" />
+            </a-form-item>
+            <a-form-item label="Rand Range">
+              <a-input v-model.trim="s.randRange" placeholder="0-255" />
+            </a-form-item>
+          </template>
+          <a-form-item v-else label="Packet">
+            <a-input-group compact v-if="s.type === 'base64'">
+              <a-input v-model.trim="s.packet" placeholder="binary data" :style="{ width: 'calc(100% - 32px)' }" />
+              <a-button icon="reload" @click="s.packet = RandomUtil.randomBase64()" />
+            </a-input-group>
+            <a-input v-else v-model.trim="s.packet" placeholder="binary data" />
+          </a-form-item>
+        </template>
       </template>
       <template v-if="mask.type === 'xicmp'">
         <a-form-item label="IP">
@@ -256,5 +441,72 @@
       </template>
     </a-form>
   </template>
+  </template>
+
+  <!-- quicParams – only for xhttp H3 and hysteria -->
+  <template v-if="inbound.protocol == Protocols.HYSTERIA || inbound.stream.network == 'xhttp'">
+    <a-form-item label="QUIC Params">
+      <a-switch v-model="inbound.stream.finalmask.enableQuicParams"></a-switch>
+    </a-form-item>
+    <template v-if="inbound.stream.finalmask.enableQuicParams">
+      <a-form-item label="Congestion">
+        <a-select
+          v-model="inbound.stream.finalmask.quicParams.congestion"
+          :dropdown-class-name="themeSwitcher.currentTheme"
+        >
+          <a-select-option value="reno">Reno</a-select-option>
+          <a-select-option value="bbr">BBR</a-select-option>
+          <a-select-option value="brutal">Brutal</a-select-option>
+          <a-select-option value="force-brutal">Force Brutal</a-select-option>
+        </a-select>
+      </a-form-item>
+      <a-form-item label="Debug">
+        <a-switch v-model="inbound.stream.finalmask.quicParams.debug"></a-switch>
+      </a-form-item>
+      <template v-if="['brutal','force-brutal'].includes(inbound.stream.finalmask.quicParams.congestion)">
+        <a-form-item label="Brutal Up">
+          <a-input v-model.trim="inbound.stream.finalmask.quicParams.brutalUp" placeholder="e.g. 60 mbps" />
+        </a-form-item>
+        <a-form-item label="Brutal Down">
+          <a-input v-model.trim="inbound.stream.finalmask.quicParams.brutalDown" placeholder="e.g. 60 mbps" />
+        </a-form-item>
+      </template>
+      <a-form-item label="UDP Hop">
+        <a-switch v-model="inbound.stream.finalmask.quicParams.hasUdpHop"></a-switch>
+      </a-form-item>
+      <template v-if="inbound.stream.finalmask.quicParams.hasUdpHop">
+        <a-form-item label="Hop Ports">
+          <a-input v-model.trim="inbound.stream.finalmask.quicParams.udpHop.ports" placeholder="e.g. 20000-50000" />
+        </a-form-item>
+        <a-form-item label="Hop Interval (s)">
+          <a-input-number v-model.number="inbound.stream.finalmask.quicParams.udpHop.interval" :min="5" />
+        </a-form-item>
+      </template>
+      <a-form-item label="Max Idle Timeout (s)">
+        <a-input-number v-model.number="inbound.stream.finalmask.quicParams.maxIdleTimeout" :min="4" :max="120" />
+      </a-form-item>
+      <a-form-item label="Keep Alive Period (s)">
+        <a-input-number v-model.number="inbound.stream.finalmask.quicParams.keepAlivePeriod" :min="0" :max="60" />
+      </a-form-item>
+      <a-form-item label="Disable Path MTU Dis">
+        <a-switch v-model="inbound.stream.finalmask.quicParams.disablePathMTUDiscovery"></a-switch>
+      </a-form-item>
+      <a-form-item label="Max Incoming Streams">
+        <a-input-number v-model.number="inbound.stream.finalmask.quicParams.maxIncomingStreams" :min="0" placeholder="0 = default" />
+      </a-form-item>
+      <a-form-item label="Init Stream Window">
+        <a-input-number v-model.number="inbound.stream.finalmask.quicParams.initStreamReceiveWindow" :min="0" placeholder="0 = default" />
+      </a-form-item>
+      <a-form-item label="Max Stream Window">
+        <a-input-number v-model.number="inbound.stream.finalmask.quicParams.maxStreamReceiveWindow" :min="0" placeholder="0 = default" />
+      </a-form-item>
+      <a-form-item label="Init Conn Window">
+        <a-input-number v-model.number="inbound.stream.finalmask.quicParams.initConnectionReceiveWindow" :min="0" placeholder="0 = default" />
+      </a-form-item>
+      <a-form-item label="Max Conn Window">
+        <a-input-number v-model.number="inbound.stream.finalmask.quicParams.maxConnectionReceiveWindow" :min="0" placeholder="0 = default" />
+      </a-form-item>
+    </template>
+  </template>
 </a-form>
 {{end}}

web/html/index.html

@@ -139,7 +139,7 @@
                       <a-icon type="reload"></a-icon>
                       <span v-if="!isMobile">{{ i18n "pages.index.restartXray" }}</span>
                     </a-space>
-                    <a-space direction="horizontal" @click="openSelectV2rayVersion" class="jc-center">
+                    <a-space direction="horizontal" @click="openSelectV2rayVersion()" class="jc-center">
                       <a-icon type="tool"></a-icon>
                       <span v-if="!isMobile">
                         [[ status.xray.version != 'Unknown' ? `v${status.xray.version}` : '{{ i18n
@@ -169,6 +169,14 @@
               </a-col>
               <a-col :sm="24" :lg="12">
                 <a-card title='3X-UI' hoverable>
+                  <template v-if="panelUpdateModal.info.updateAvailable" #extra>
+                    <a-tooltip :overlay-class-name="themeSwitcher.currentTheme" :title='`{{ i18n "pages.index.updatePanel" }}: ${panelUpdateModal.info.latestVersion}`'>
+                      <a-tag color="orange" style="cursor:pointer;margin:0" @click="openPanelUpdate">
+                        <a-icon type="cloud-download"></a-icon>[[ panelUpdateModal.info.latestVersion ]]
+                      <span v-if="!isMobile">{{ i18n "pages.index.updatePanel" }}</span>
+                      </a-tag>
+                    </a-tooltip>
+                  </template>
                   <a rel="noopener" href="https://github.com/MHSanaei/3x-ui/releases" target="_blank">
                     <a-tag color="green">
                       <span>v{{ .cur_ver }}</span>
@@ -317,9 +325,36 @@
       </a-spin>
     </a-layout-content>
   </a-layout>
-  <a-modal id="version-modal" v-model="versionModal.visible" title='{{ i18n "pages.index.xraySwitch" }}'
+  <a-modal id="panel-update-modal" v-model="panelUpdateModal.visible" title='{{ i18n "pages.index.updatePanel" }}'
+    :closable="true" @ok="() => panelUpdateModal.visible = false" :class="themeSwitcher.currentTheme" footer="">
+    <a-alert type="warning" class="mb-12 w-100" message='{{ i18n "pages.index.panelUpdateDesc" }}'
+      show-icon></a-alert>
+    <a-list class="ant-version-list w-100" bordered>
+      <a-list-item class="ant-version-list-item">
+        <span>{{ i18n "pages.index.currentPanelVersion" }}</span>
+        <a-tag color="green">v[[ panelUpdateModal.info.currentVersion || '{{ .cur_ver }}' ]]</a-tag>
+      </a-list-item>
+      <a-list-item class="ant-version-list-item" v-if="panelUpdateModal.info.updateAvailable">
+        <span>{{ i18n "pages.index.latestPanelVersion" }}</span>
+        <a-tag color="purple">
+          [[ panelUpdateModal.info.latestVersion || '-' ]]
+        </a-tag>
+      </a-list-item>
+      <a-list-item class="ant-version-list-item" v-else>
+        <span>{{ i18n "pages.index.panelUpToDate" }}</span>
+        <a-tag color="green">{{ i18n "pages.index.upToDate" }}</a-tag>
+      </a-list-item>
+    </a-list>
+    <div class="mt-5 d-flex justify-end">
+      <a-button type="primary" icon="cloud-download" :disabled="!panelUpdateModal.info.updateAvailable"
+        @click="updatePanel">
+        {{ i18n "pages.index.updatePanel" }}
+      </a-button>
+    </div>
+  </a-modal>
+  <a-modal id="version-modal" v-model="versionModal.visible" title='{{ i18n "pages.index.xrayUpdates" }}'
     :closable="true" @ok="() => versionModal.visible = false" :class="themeSwitcher.currentTheme" footer="">
-    <a-collapse default-active-key="1">
+    <a-collapse accordion :active-key="versionModal.activeKey" @change="key => versionModal.activeKey = key">
       <a-collapse-panel key="1" header='Xray'>
         <a-alert type="warning" class="mb-12 w-100" message='{{ i18n "pages.index.xraySwitchClickDesk" }}'
           show-icon></a-alert>
@@ -799,9 +834,11 @@
 
   const versionModal = {
     visible: false,
+    activeKey: '1',
     versions: [],
-    show(versions) {
+    show(versions, activeKey = '1') {
       this.visible = true;
+      this.activeKey = activeKey;
       this.versions = versions;
     },
     hide() {
@@ -809,6 +846,24 @@
     },
   };
 
+  const panelUpdateModal = {
+    visible: false,
+    info: {
+      currentVersion: '{{ .cur_ver }}',
+      latestVersion: '',
+      updateAvailable: false,
+    },
+    show(info) {
+      this.visible = true;
+      if (info) {
+        this.info = info;
+      }
+    },
+    hide() {
+      this.visible = false;
+    },
+  };
+
   const logModal = {
     visible: false,
     logs: [],
@@ -958,11 +1013,12 @@
         spinning: false
       },
       status: new Status(),
-  cpuHistory: [], // small live widget history
+      cpuHistory: [], // small live widget history
-  cpuHistoryLong: [], // aggregated points from backend
+      cpuHistoryLong: [], // aggregated points from backend
-  cpuHistoryLabels: [],
+      cpuHistoryLabels: [],
-  cpuHistoryModal: { visible: false, bucket: 2 },
+      cpuHistoryModal: { visible: false, bucket: 2 },
       versionModal,
+      panelUpdateModal,
       logModal,
       xraylogModal,
       backupModal,
@@ -1049,16 +1105,25 @@
           console.error('Failed to fetch bucketed cpu history', e)
         }
       },
-      async openSelectV2rayVersion() {
+      async openSelectV2rayVersion(activeKey = '1') {
         this.loading(true);
         const msg = await HttpUtil.get('/panel/api/server/getXrayVersion');
         this.loading(false);
         if (!msg.success) {
           return;
         }
-        versionModal.show(msg.obj);
+        versionModal.show(msg.obj, activeKey);
         this.loadCustomGeo();
       },
+      async openPanelUpdate() {
+        this.loading(true);
+        const msg = await HttpUtil.get('/panel/api/server/getPanelUpdateInfo');
+        this.loading(false);
+        if (!msg.success) {
+          return;
+        }
+        panelUpdateModal.show(msg.obj);
+      },
       customGeoFormatTime(ts) {
         if (!ts) return '';
         return typeof moment !== 'undefined' ? moment(ts * 1000).format('YYYY-MM-DD HH:mm') : String(ts);
@@ -1195,6 +1260,27 @@
           },
         });
       },
+      updatePanel() {
+        this.$confirm({
+          title: '{{ i18n "pages.index.panelUpdateDialog" }}',
+          content: '{{ i18n "pages.index.panelUpdateDialogDesc" }}'
+            .replace('#version#', panelUpdateModal.info.latestVersion || ''),
+          okText: '{{ i18n "confirm"}}',
+          class: themeSwitcher.currentTheme,
+          cancelText: '{{ i18n "cancel"}}',
+          onOk: async () => {
+            panelUpdateModal.hide();
+            this.loading(true, '{{ i18n "pages.index.dontRefresh"}}');
+            const msg = await HttpUtil.post('/panel/api/server/updatePanel');
+            if (!msg.success) {
+              this.loading(false);
+              return;
+            }
+            await PromiseUtil.sleep(15000);
+            window.location.reload();
+          },
+        });
+      },
       updateGeofile(fileName) {
         const isSingleFile = !!fileName;
         this.$confirm({
@@ -1346,6 +1432,13 @@
       // Initial status fetch
       await this.getStatus();
 
+      // Silently check for panel updates so the indicator shows on load
+      HttpUtil.get('/panel/api/server/getPanelUpdateInfo').then(msg => {
+        if (msg && msg.success && msg.obj) {
+          panelUpdateModal.info = msg.obj;
+        }
+      });
+
       // Setup WebSocket for real-time updates
       if (window.wsClient) {
         window.wsClient.connect();

web/html/modals/inbound_info_modal.html

@@ -513,9 +513,19 @@
                 <div v-html="infoModal.links[index].replaceAll(`\n`,`<br />`)"
                   :style="{ borderRadius: '1rem', padding: '0.5rem' }" class="client-table-odd-row">
                 </div>
+                <a-divider orientation="center">Link</a-divider>
+                <tr-info-title class="tr-info-title">
+                  <a-tag color="green">Link</a-tag>
+                  <a-tooltip title='{{ i18n "copy" }}'>
+                    <a-button :style="{ minWidth: '24px' }" size="small" icon="snippets"
+                      @click="copy(infoModal.wireguardLinks[index])"></a-button>
+                  </a-tooltip>
+                </tr-info-title>
+                <code :style="{ display: 'block', whiteSpace: 'normal', wordBreak: 'break-all' }">[[ infoModal.wireguardLinks[index] ]]</code>
               </tr-info-row>
             </td>
           </tr>
+        </template>
       </table>
     </template>
     </template>
@@ -603,6 +613,7 @@
     upStats: 0,
     downStats: 0,
     links: [],
+    wireguardLinks: [],
     index: null,
     isExpired: false,
     subLink: '',
@@ -633,9 +644,11 @@
         }
       }
       if (this.inbound.protocol == Protocols.WIREGUARD) {
-        this.links = this.inbound.genInboundLinks(dbInbound.remark).split('\r\n')
+        this.links = this.inbound.genWireguardConfigs(dbInbound.remark).split('\r\n')
+        this.wireguardLinks = this.inbound.genWireguardLinks(dbInbound.remark).split('\r\n')
       } else {
         this.links = this.inbound.genAllLinks(this.dbInbound.remark, app.remarkModel, this.clientSettings);
+        this.wireguardLinks = [];
       }
       if (this.clientSettings) {
         if (this.clientSettings.subId) {

web/html/settings/panel/subscription/subpage.html

@@ -6,6 +6,23 @@
 <script src="{{ .base_path }}assets/js/util/index.js?{{ .cur_ver }}"></script>
 <script src="{{ .base_path }}assets/qrcode/qrious2.min.js?{{ .cur_ver }}"></script>
 <style>
+    .subscription-page tr-qr-box.qr-box {
+        display: inline-flex;
+        flex-direction: column;
+        align-items: center;
+        width: 220px;
+    }
+
+    .subscription-page tr-qr-box.qr-box .qr-tag {
+        width: 100%;
+        justify-content: center;
+    }
+
+    .subscription-page tr-qr-box.qr-box .qr-bg,
+    .subscription-page tr-qr-box.qr-box .qr-bg-sub {
+        margin-inline: auto;
+    }
+
     .subscription-page .subscription-link-box {
         cursor: pointer;
         border-radius: 12px;
@@ -193,8 +210,6 @@
                             </div>
                         </div>
                     </div>
-
-                    </div>
                     <br />
 
                     <a-form layout="vertical">

web/html/xray.html

@@ -1077,7 +1077,8 @@
             return;
           }
           if (!msg.obj) return;
-          const { geoip = [], geosite = [] } = msg.obj;
+          const geoip = msg.obj.geoip ?? [];
+          const geosite = msg.obj.geosite ?? [];
           const geoSuffix = this.customGeoAliasLabelSuffix || '';
           geoip.forEach((x) => {
             this.settingsData.IPsOptions.push({

web/service/panel.go

@@ -1,10 +1,19 @@
 package service
 
 import (
+	"encoding/json"
+	"fmt"
+	"net/http"
 	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
 	"syscall"
 	"time"
 
+	"github.com/mhsanaei/3x-ui/v2/config"
 	"github.com/mhsanaei/3x-ui/v2/logger"
 )
 
@@ -12,6 +21,13 @@ import (
 // It handles panel restart, updates, and system-level panel controls.
 type PanelService struct{}
 
+// PanelUpdateInfo contains the current and latest available panel versions.
+type PanelUpdateInfo struct {
+	CurrentVersion  string `json:"currentVersion"`
+	LatestVersion   string `json:"latestVersion"`
+	UpdateAvailable bool   `json:"updateAvailable"`
+}
+
 func (s *PanelService) RestartPanel(delay time.Duration) error {
 	p, err := os.FindProcess(syscall.Getpid())
 	if err != nil {
@@ -26,3 +42,161 @@ func (s *PanelService) RestartPanel(delay time.Duration) error {
 	}()
 	return nil
 }
+
+// GetUpdateInfo checks GitHub for the latest 3x-ui release.
+func (s *PanelService) GetUpdateInfo() (*PanelUpdateInfo, error) {
+	latest, err := fetchLatestPanelVersion()
+	if err != nil {
+		return nil, err
+	}
+	current := config.GetVersion()
+	return &PanelUpdateInfo{
+		CurrentVersion:  current,
+		LatestVersion:   latest,
+		UpdateAvailable: isNewerVersion(latest, current),
+	}, nil
+}
+
+// StartUpdate starts the official updater outside of the current web request.
+func (s *PanelService) StartUpdate() error {
+	if runtime.GOOS != "linux" {
+		return fmt.Errorf("panel web update is supported only on Linux installations")
+	}
+
+	bash, err := exec.LookPath("bash")
+	if err != nil {
+		return fmt.Errorf("bash is required to run the panel updater: %w", err)
+	}
+	curl, err := exec.LookPath("curl")
+	if err != nil {
+		return fmt.Errorf("curl is required to download the panel updater: %w", err)
+	}
+
+	mainFolder, serviceFolder := resolveUpdateFolders()
+	updateScript := fmt.Sprintf("set -o pipefail; %s -fLs https://raw.githubusercontent.com/MHSanaei/3x-ui/main/update.sh | %s", shellQuote(curl), shellQuote(bash))
+
+	if systemdRun, err := exec.LookPath("systemd-run"); err == nil {
+		unitName := fmt.Sprintf("x-ui-web-update-%d", time.Now().Unix())
+		cmd := exec.Command(systemdRun,
+			"--unit", unitName,
+			"--setenv", "XUI_MAIN_FOLDER="+mainFolder,
+			"--setenv", "XUI_SERVICE="+serviceFolder,
+			bash, "-lc", updateScript,
+		)
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			output := strings.TrimSpace(string(out))
+			if !strings.Contains(output, "System has not been booted with systemd") &&
+				!strings.Contains(output, "Failed to connect to bus") {
+				return fmt.Errorf("failed to start panel update job: %w: %s", err, output)
+			}
+			logger.Warning("systemd-run is unavailable, falling back to detached update process:", output)
+		} else {
+			logger.Infof("started panel update job via systemd-run unit %s", unitName)
+			return nil
+		}
+	}
+
+	cmd := exec.Command(bash, "-lc", updateScript)
+	cmd.Env = append(os.Environ(),
+		"XUI_MAIN_FOLDER="+mainFolder,
+		"XUI_SERVICE="+serviceFolder,
+	)
+	setDetachedProcess(cmd)
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("failed to start panel update job: %w", err)
+	}
+	if err := cmd.Process.Release(); err != nil {
+		logger.Warning("failed to release panel update process:", err)
+	}
+	logger.Infof("started panel update job with pid %d", cmd.Process.Pid)
+	return nil
+}
+
+func fetchLatestPanelVersion() (string, error) {
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Get("https://api.github.com/repos/MHSanaei/3x-ui/releases/latest")
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("GitHub API returned status %d: %s", resp.StatusCode, resp.Status)
+	}
+
+	var release Release
+	if err := json.NewDecoder(resp.Body).Decode(&release); err != nil {
+		return "", err
+	}
+	if release.TagName == "" {
+		return "", fmt.Errorf("latest panel release tag is empty")
+	}
+	return release.TagName, nil
+}
+
+func resolveUpdateFolders() (string, string) {
+	mainFolder := os.Getenv("XUI_MAIN_FOLDER")
+	if mainFolder == "" {
+		if exePath, err := os.Executable(); err == nil {
+			mainFolder = filepath.Dir(exePath)
+		}
+	}
+	if mainFolder == "" {
+		mainFolder = "/usr/local/x-ui"
+	}
+
+	serviceFolder := os.Getenv("XUI_SERVICE")
+	if serviceFolder == "" {
+		serviceFolder = "/etc/systemd/system"
+	}
+	return mainFolder, serviceFolder
+}
+
+func isNewerVersion(latest string, current string) bool {
+	cmp, ok := compareVersionStrings(latest, current)
+	if !ok {
+		return normalizeVersionTag(latest) != normalizeVersionTag(current)
+	}
+	return cmp > 0
+}
+
+func compareVersionStrings(a string, b string) (int, bool) {
+	aParts, okA := parseVersionParts(a)
+	bParts, okB := parseVersionParts(b)
+	if !okA || !okB {
+		return 0, false
+	}
+	for i := 0; i < len(aParts); i++ {
+		if aParts[i] > bParts[i] {
+			return 1, true
+		}
+		if aParts[i] < bParts[i] {
+			return -1, true
+		}
+	}
+	return 0, true
+}
+
+func parseVersionParts(version string) ([3]int, bool) {
+	var result [3]int
+	parts := strings.Split(normalizeVersionTag(version), ".")
+	if len(parts) != 3 {
+		return result, false
+	}
+	for i, part := range parts {
+		n, err := strconv.Atoi(part)
+		if err != nil {
+			return result, false
+		}
+		result[i] = n
+	}
+	return result, true
+}
+
+func normalizeVersionTag(version string) string {
+	return strings.TrimPrefix(strings.TrimSpace(version), "v")
+}
+
+func shellQuote(value string) string {
+	return "'" + strings.ReplaceAll(value, "'", "'\\''") + "'"
+}

web/service/panel_other.go

@@ -0,0 +1,7 @@
+//go:build !linux
+
+package service
+
+import "os/exec"
+
+func setDetachedProcess(cmd *exec.Cmd) {}

web/service/panel_test.go

@@ -0,0 +1,41 @@
+package service
+
+import "testing"
+
+func TestIsNewerVersion(t *testing.T) {
+	cases := []struct {
+		latest  string
+		current string
+		want    bool
+	}{
+		{"v2.9.4", "2.9.3", true},
+		{"v2.10.0", "2.9.9", true},
+		{"v2.9.3", "2.9.3", false},
+		{"v2.9.2", "2.9.3", false},
+		{"v3.0.0", "2.9.3", true},
+	}
+
+	for _, tc := range cases {
+		if got := isNewerVersion(tc.latest, tc.current); got != tc.want {
+			t.Fatalf("isNewerVersion(%q, %q) = %v, want %v", tc.latest, tc.current, got, tc.want)
+		}
+	}
+}
+
+func TestCompareVersionStringsRejectsUnexpectedFormats(t *testing.T) {
+	if _, ok := compareVersionStrings("latest", "2.9.3"); ok {
+		t.Fatal("expected non-semver latest tag to be rejected")
+	}
+	if _, ok := compareVersionStrings("v2.9", "2.9.3"); ok {
+		t.Fatal("expected short version to be rejected")
+	}
+}
+
+func TestShellQuote(t *testing.T) {
+	if got := shellQuote("/usr/bin/curl"); got != "'/usr/bin/curl'" {
+		t.Fatalf("unexpected quote result: %s", got)
+	}
+	if got := shellQuote("/tmp/a'b"); got != "'/tmp/a'\\''b'" {
+		t.Fatalf("unexpected quote result with single quote: %s", got)
+	}
+}

web/service/panel_unix.go

@@ -0,0 +1,12 @@
+//go:build linux
+
+package service
+
+import (
+	"os/exec"
+	"syscall"
+)
+
+func setDetachedProcess(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+}

web/service/xray.go

@@ -206,7 +206,10 @@ func (s *XrayService) GetXrayTraffic() ([]*xray.Traffic, []*xray.ClientTraffic,
 		return nil, nil, err
 	}
 	apiPort := p.GetAPIPort()
-	s.xrayAPI.Init(apiPort)
+	if err := s.xrayAPI.Init(apiPort); err != nil {
+		logger.Debug("Failed to initialize Xray API:", err)
+		return nil, nil, err
+	}
 	defer s.xrayAPI.Close()
 
 	traffic, clientTraffic, err := s.xrayAPI.GetTraffic(true)

web/service/xray_setting.go

@@ -24,6 +24,9 @@ func (s *XraySettingService) SaveXraySetting(newXraySettings string) error {
 	if err := s.CheckXrayConfig(newXraySettings); err != nil {
 		return err
 	}
+	if hoisted, err := EnsureStatsRouting(newXraySettings); err == nil {
+		newXraySettings = hoisted
+	}
 	return s.SettingService.saveSetting("xrayTemplateConfig", newXraySettings)
 }
 
@@ -83,3 +86,120 @@ func UnwrapXrayTemplateConfig(raw string) string {
 	}
 	return raw
 }
+
+// EnsureStatsRouting hoists the `api -> api` routing rule to the front
+// of routing.rules so the stats query path is never starved by a
+// catch-all rule the admin may have added or reordered above it.
+//
+// Why this matters (#4113, #2818): an admin who adds a cascade outbound
+// (e.g. vless to another server) and a routing rule sending all inbound
+// traffic to it ends up sending the internal stats inbound's traffic to
+// that cascade too, since rules are evaluated top-to-bottom and the
+// catch-all matches first. The panel's gRPC stats query then can't reach
+// the running xray instance, GetTraffic returns nothing, and every
+// client appears offline with zero traffic even though the actual proxy
+// path works fine.
+//
+// The api inbound is special-cased internal infrastructure for the
+// panel, not something the admin should ever route to a real outbound.
+// Keeping its rule pinned at index 0 is the only correct configuration.
+//
+// If the api rule is already at index 0 the input is returned unchanged.
+// If it exists somewhere else it is moved. If it is missing entirely a
+// default rule (`type=field, inboundTag=[api], outboundTag=api`) is
+// inserted at the front. Other routing entries keep their relative order.
+func EnsureStatsRouting(raw string) (string, error) {
+	var cfg map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(raw), &cfg); err != nil {
+		return raw, err
+	}
+
+	var routing map[string]json.RawMessage
+	if r, ok := cfg["routing"]; ok && len(r) > 0 {
+		if err := json.Unmarshal(r, &routing); err != nil {
+			return raw, err
+		}
+	}
+	if routing == nil {
+		routing = make(map[string]json.RawMessage)
+	}
+
+	var rules []map[string]any
+	if r, ok := routing["rules"]; ok && len(r) > 0 {
+		if err := json.Unmarshal(r, &rules); err != nil {
+			return raw, err
+		}
+	}
+
+	apiIdx := findApiRule(rules)
+	if apiIdx == 0 {
+		return raw, nil // already correct, don't churn the JSON
+	}
+
+	var apiRule map[string]any
+	if apiIdx > 0 {
+		apiRule = rules[apiIdx]
+		rules = append(rules[:apiIdx], rules[apiIdx+1:]...)
+	} else {
+		apiRule = map[string]any{
+			"type":        "field",
+			"inboundTag":  []string{"api"},
+			"outboundTag": "api",
+		}
+	}
+	rules = append([]map[string]any{apiRule}, rules...)
+
+	rulesJSON, err := json.Marshal(rules)
+	if err != nil {
+		return raw, err
+	}
+	routing["rules"] = rulesJSON
+
+	routingJSON, err := json.Marshal(routing)
+	if err != nil {
+		return raw, err
+	}
+	cfg["routing"] = routingJSON
+
+	out, err := json.Marshal(cfg)
+	if err != nil {
+		return raw, err
+	}
+	return string(out), nil
+}
+
+// findApiRule returns the index of the routing rule that targets the
+// internal api inbound (inboundTag contains "api" and outboundTag is
+// "api"), or -1 if no such rule exists.
+func findApiRule(rules []map[string]any) int {
+	for i, rule := range rules {
+		if outTag, _ := rule["outboundTag"].(string); outTag != "api" {
+			continue
+		}
+		raw, ok := rule["inboundTag"]
+		if !ok {
+			continue
+		}
+		// inboundTag is usually []string but can come as []any from a
+		// roundtrip through map[string]any. Accept both shapes.
+		switch tags := raw.(type) {
+		case []any:
+			for _, t := range tags {
+				if s, ok := t.(string); ok && s == "api" {
+					return i
+				}
+			}
+		case []string:
+			for _, s := range tags {
+				if s == "api" {
+					return i
+				}
+			}
+		case string:
+			if tags == "api" {
+				return i
+			}
+		}
+	}
+	return -1
+}

web/service/xray_setting_test.go

@@ -88,3 +88,118 @@ func equalJSON(t *testing.T, a, b string) bool {
 	jb, _ := json.Marshal(vb)
 	return string(ja) == string(jb)
 }
+
+// firstRuleOutbound parses the (post-hoisted) config and returns
+// routing.rules[0].outboundTag, or "" if anything is missing.
+func firstRuleOutbound(t *testing.T, raw string) string {
+	t.Helper()
+	var cfg map[string]any
+	if err := json.Unmarshal([]byte(raw), &cfg); err != nil {
+		t.Fatalf("unmarshal cfg: %v", err)
+	}
+	routing, _ := cfg["routing"].(map[string]any)
+	rules, _ := routing["rules"].([]any)
+	if len(rules) == 0 {
+		return ""
+	}
+	first, _ := rules[0].(map[string]any)
+	tag, _ := first["outboundTag"].(string)
+	return tag
+}
+
+func TestEnsureStatsRouting_HoistsApiRuleFromMiddle(t *testing.T) {
+	// #4113 repro shape: admin added a cascade outbound and put a
+	// catch-all routing rule above the api rule. stats query path
+	// gets starved by the catch-all unless we hoist the api rule.
+	in := `{
+		"routing": {
+			"rules": [
+				{"type":"field","inboundTag":["inbound-vless"],"outboundTag":"vless-cascade"},
+				{"type":"field","inboundTag":["api"],"outboundTag":"api"},
+				{"type":"field","outboundTag":"blocked","ip":["geoip:private"]}
+			]
+		}
+	}`
+	out, err := EnsureStatsRouting(in)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if got := firstRuleOutbound(t, out); got != "api" {
+		t.Fatalf("api rule should be at index 0 after hoist, got first outboundTag = %q\nfull: %s", got, out)
+	}
+}
+
+func TestEnsureStatsRouting_NoOpWhenAlreadyFirst(t *testing.T) {
+	// Don't churn the JSON when nothing needs fixing — same string in,
+	// same string out. Lets the diff in the panel UI stay quiet for
+	// well-formed configs.
+	in := `{"routing":{"rules":[{"type":"field","inboundTag":["api"],"outboundTag":"api"},{"type":"field","outboundTag":"blocked","ip":["geoip:private"]}]}}`
+	out, err := EnsureStatsRouting(in)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if out != in {
+		t.Fatalf("expected unchanged input, got: %s", out)
+	}
+}
+
+func TestEnsureStatsRouting_InsertsDefaultWhenMissing(t *testing.T) {
+	// Some admins delete the api rule by accident. Re-add a default
+	// at the front so stats keep working after the next save.
+	in := `{"routing":{"rules":[{"type":"field","outboundTag":"vless-cascade","inboundTag":["inbound-vless"]}]}}`
+	out, err := EnsureStatsRouting(in)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if got := firstRuleOutbound(t, out); got != "api" {
+		t.Fatalf("default api rule should be inserted at index 0, got %q\nfull: %s", got, out)
+	}
+	// The original rule should still be there, just shifted.
+	var cfg map[string]any
+	json.Unmarshal([]byte(out), &cfg)
+	rules := cfg["routing"].(map[string]any)["rules"].([]any)
+	if len(rules) != 2 {
+		t.Fatalf("expected 2 rules after insert, got %d: %v", len(rules), rules)
+	}
+}
+
+func TestEnsureStatsRouting_NoRoutingBlock(t *testing.T) {
+	// Pathological but possible: empty config or one without a routing
+	// section. Don't crash, and create the section with the api rule.
+	in := `{"log":{}}`
+	out, err := EnsureStatsRouting(in)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if got := firstRuleOutbound(t, out); got != "api" {
+		t.Fatalf("api rule should be created when routing was missing, got %q\nfull: %s", got, out)
+	}
+}
+
+func TestEnsureStatsRouting_InvalidJsonReturnsAsIs(t *testing.T) {
+	// SaveXraySetting calls CheckXrayConfig before this helper, so
+	// invalid JSON shouldn't reach us in practice — but be defensive
+	// about garbage in (return same garbage out plus an error) so the
+	// caller can choose to skip the hoist instead of corrupting input.
+	in := "definitely not json"
+	out, err := EnsureStatsRouting(in)
+	if err == nil {
+		t.Fatalf("expected error for invalid json, got none")
+	}
+	if out != in {
+		t.Fatalf("expected raw passthrough on error, got %q", out)
+	}
+}
+
+func TestEnsureStatsRouting_AcceptsInboundTagAsString(t *testing.T) {
+	// Some manually-edited configs use a single string instead of an
+	// array for inboundTag. Make sure we still recognize the api rule.
+	in := `{"routing":{"rules":[{"type":"field","inboundTag":["other"],"outboundTag":"vless-cascade"},{"type":"field","inboundTag":"api","outboundTag":"api"}]}}`
+	out, err := EnsureStatsRouting(in)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if got := firstRuleOutbound(t, out); got != "api" {
+		t.Fatalf("api rule with string-form inboundTag should hoist to front, got %q\nfull: %s", got, out)
+	}
+}

web/translation/translate.ar_EG.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "النسخة"
 "xraySwitchClick" = "اختار النسخة اللي عايز تتحول لها."
 "xraySwitchClickDesk" = "اختار بحذر، النسخ القديمة ممكن ما تتوافقش مع الإعدادات الحالية."
+"xrayUpdates" = "تحديثات Xray"
+"updatePanel" = "تحديث البانل"
+"panelUpdateDesc" = "ده هيحدث 3X-UI لآخر إصدار وهيعيد تشغيل خدمة البانل."
+"currentPanelVersion" = "إصدار البانل الحالي"
+"latestPanelVersion" = "أحدث إصدار للبانل"
+"panelUpToDate" = "البانل محدث لآخر إصدار"
+"upToDate" = "محدث"
 "xrayStatusUnknown" = "مش معروف"
 "xrayStatusRunning" = "شغالة"
 "xrayStatusStop" = "متوقفة"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "هل تريد حقًا تغيير إصدار Xray؟"
 "xraySwitchVersionDialogDesc" = "سيؤدي هذا إلى تغيير إصدار Xray إلى #version#."
 "xraySwitchVersionPopover" = "تم تحديث Xray بنجاح"
+"panelUpdateDialog" = "هل فعلاً عايز تحدث البانل؟"
+"panelUpdateDialogDesc" = "ده هيحدث 3X-UI للإصدار #version# وهيعيد تشغيل البانل."
+"panelUpdateCheckPopover" = "فشل التحقق من تحديث البانل"
+"panelUpdateStartedPopover" = "بدأ تحديث البانل"
 "geofileUpdateDialog" = "هل تريد حقًا تحديث ملف الجغرافيا؟"
 "geofileUpdateDialogDesc" = "سيؤدي هذا إلى تحديث ملف #filename#."
 "geofilesUpdateDialogDesc" = "سيؤدي هذا إلى تحديث كافة الملفات."

web/translation/translate.en_US.toml

@@ -124,8 +124,15 @@
 "stopXray" = "Stop"
 "restartXray" = "Restart"
 "xraySwitch" = "Version"
+"xrayUpdates" = "Xray Updates"
 "xraySwitchClick" = "Choose the version you want to switch to."
 "xraySwitchClickDesk" = "Choose carefully, as older versions may not be compatible with current configurations."
+"updatePanel" = "Update Panel"
+"panelUpdateDesc" = "This will update 3X-UI itself to the latest release and restart the panel service."
+"currentPanelVersion" = "Current panel version"
+"latestPanelVersion" = "Latest panel version"
+"panelUpToDate" = "Panel is up to date"
+"upToDate" = "Up to date"
 "xrayStatusUnknown" = "Unknown"
 "xrayStatusRunning" = "Running"
 "xrayStatusStop" = "Stop"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "Do you really want to change the Xray version?"
 "xraySwitchVersionDialogDesc" = "This will change the Xray version to #version#."
 "xraySwitchVersionPopover" = "Xray updated successfully"
+"panelUpdateDialog" = "Do you really want to update the panel?"
+"panelUpdateDialogDesc" = "This will update 3X-UI to #version# and restart the panel service."
+"panelUpdateCheckPopover" = "Panel update check failed"
+"panelUpdateStartedPopover" = "Panel update started"
 "geofileUpdateDialog" = "Do you really want to update the geofile?"
 "geofileUpdateDialogDesc" = "This will update the #filename# file."
 "geofilesUpdateDialogDesc" = "This will update all geofiles."

web/translation/translate.es_ES.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "Versión"
 "xraySwitchClick" = "Elige la versión a la que deseas cambiar."
 "xraySwitchClickDesk" = "Elige sabiamente, ya que las versiones anteriores pueden no ser compatibles con las configuraciones actuales."
+"xrayUpdates" = "Actualizaciones de Xray"
+"updatePanel" = "Actualizar panel"
+"panelUpdateDesc" = "Esto actualizará 3X-UI a la última versión y reiniciará el servicio del panel."
+"currentPanelVersion" = "Versión actual del panel"
+"latestPanelVersion" = "Última versión del panel"
+"panelUpToDate" = "El panel está actualizado"
+"upToDate" = "Actualizado"
 "xrayStatusUnknown" = "Desconocido"
 "xrayStatusRunning" = "En ejecución"
 "xrayStatusStop" = "Detenido"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "¿Realmente deseas cambiar la versión de Xray?"
 "xraySwitchVersionDialogDesc" = "Esto cambiará la versión de Xray a #version#."
 "xraySwitchVersionPopover" = "Xray se actualizó correctamente"
+"panelUpdateDialog" = "¿Deseas actualizar el panel?"
+"panelUpdateDialogDesc" = "Esto actualizará 3X-UI a la versión #version# y reiniciará el servicio del panel."
+"panelUpdateCheckPopover" = "Fallo al comprobar actualización del panel"
+"panelUpdateStartedPopover" = "Actualización del panel iniciada"
 "geofileUpdateDialog" = "¿Realmente deseas actualizar el geofichero?"
 "geofileUpdateDialogDesc" = "Esto actualizará el archivo #filename#."
 "geofilesUpdateDialogDesc" = "Esto actualizará todos los archivos."

web/translation/translate.fa_IR.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "‌نسخه"
 "xraySwitchClick" = "نسخه مورد نظر را انتخاب کنید"
 "xraySwitchClickDesk" = "لطفا بادقت انتخاب کنید. درصورت انتخاب نسخه قدیمی‌تر، امکان ناهماهنگی با پیکربندی فعلی وجود دارد"
+"xrayUpdates" = "به‌روزرسانی‌های Xray"
+"updatePanel" = "به‌روزرسانی پنل"
+"panelUpdateDesc" = "این عملیات 3X-UI را به آخرین نسخه به‌روزرسانی می‌کند و سرویس پنل را مجدداً راه‌اندازی می‌کند."
+"currentPanelVersion" = "نسخه فعلی پنل"
+"latestPanelVersion" = "آخرین نسخه پنل"
+"panelUpToDate" = "پنل به‌روز است"
+"upToDate" = "به‌روز"
 "xrayStatusUnknown" = "ناشناخته"
 "xrayStatusRunning" = "در حال اجرا"
 "xrayStatusStop" = "متوقف"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "آیا واقعاً می‌خواهید نسخه Xray را تغییر دهید؟"
 "xraySwitchVersionDialogDesc" = "این کار نسخه Xray را به #version# تغییر می‌دهد."
 "xraySwitchVersionPopover" = "Xray با موفقیت به‌روز شد"
+"panelUpdateDialog" = "آیا مطمئن هستید که می‌خواهید پنل را به‌روزرسانی کنید؟"
+"panelUpdateDialogDesc" = "این 3X-UI را به نسخه #version# به‌روزرسانی کرده و سرویس پنل را مجدداً راه‌اندازی می‌کند."
+"panelUpdateCheckPopover" = "خطا در بررسی به‌روزرسانی پنل"
+"panelUpdateStartedPopover" = "به‌روزرسانی پنل آغاز شد"
 "geofileUpdateDialog" = "آیا واقعاً می‌خواهید فایل جغرافیایی را به‌روز کنید؟"
 "geofileUpdateDialogDesc" = "این عمل فایل #filename# را به‌روز می‌کند."
 "geofilesUpdateDialogDesc" = "با این کار همه فایل‌ها به‌روزرسانی می‌شوند."

web/translation/translate.id_ID.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "Versi"
 "xraySwitchClick" = "Pilih versi yang ingin Anda pindah."
 "xraySwitchClickDesk" = "Pilih dengan hati-hati, karena versi yang lebih lama mungkin tidak kompatibel dengan konfigurasi saat ini."
+"xrayUpdates" = "Pembaruan Xray"
+"updatePanel" = "Perbarui Panel"
+"panelUpdateDesc" = "Ini akan memperbarui 3X-UI ke rilis terbaru dan me-restart layanan panel."
+"currentPanelVersion" = "Versi panel saat ini"
+"latestPanelVersion" = "Versi panel terbaru"
+"panelUpToDate" = "Panel sudah terbaru"
+"upToDate" = "Terbaru"
 "xrayStatusUnknown" = "Tidak diketahui"
 "xrayStatusRunning" = "Berjalan"
 "xrayStatusStop" = "Berhenti"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "Apakah Anda yakin ingin mengubah versi Xray?"
 "xraySwitchVersionDialogDesc" = "Ini akan mengubah versi Xray ke #version#."
 "xraySwitchVersionPopover" = "Xray berhasil diperbarui"
+"panelUpdateDialog" = "Apakah Anda benar-benar ingin memperbarui panel?"
+"panelUpdateDialogDesc" = "Ini akan memperbarui 3X-UI ke #version# dan me-restart layanan panel."
+"panelUpdateCheckPopover" = "Pemeriksaan pembaruan panel gagal"
+"panelUpdateStartedPopover" = "Pembaruan panel dimulai"
 "geofileUpdateDialog" = "Apakah Anda yakin ingin memperbarui geofile?"
 "geofileUpdateDialogDesc" = "Ini akan memperbarui file #filename#."
 "geofilesUpdateDialogDesc" = "Ini akan memperbarui semua berkas."

web/translation/translate.ja_JP.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "バージョン"
 "xraySwitchClick" = "切り替えるバージョンを選択してください"
 "xraySwitchClickDesk" = "慎重に選択してください。古いバージョンは現在の設定と互換性がない可能性があります。"
+"xrayUpdates" = "Xrayの更新"
+"updatePanel" = "パネルを更新"
+"panelUpdateDesc" = "これにより3X-UIが最新リリースに更新され、パネルサービスが再起動されます。"
+"currentPanelVersion" = "現在のパネルバージョン"
+"latestPanelVersion" = "最新のパネルバージョン"
+"panelUpToDate" = "パネルは最新です"
+"upToDate" = "最新"
 "xrayStatusUnknown" = "不明"
 "xrayStatusRunning" = "実行中"
 "xrayStatusStop" = "停止"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "Xrayのバージョンを本当に変更しますか？"
 "xraySwitchVersionDialogDesc" = "Xrayのバージョンが#version#に変更されます。"
 "xraySwitchVersionPopover" = "Xrayの更新が成功しました"
+"panelUpdateDialog" = "本当にパネルを更新しますか？"
+"panelUpdateDialogDesc" = "これにより3X-UIが#version#に更新され、パネルサービスが再起動されます。"
+"panelUpdateCheckPopover" = "パネルの更新確認に失敗しました"
+"panelUpdateStartedPopover" = "パネルの更新を開始しました"
 "geofileUpdateDialog" = "ジオファイルを本当に更新しますか？"
 "geofileUpdateDialogDesc" = "これにより#filename#ファイルが更新されます。"
 "geofilesUpdateDialogDesc" = "これにより、すべてのファイルが更新されます。"

web/translation/translate.pt_BR.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "Versão"
 "xraySwitchClick" = "Escolha a versão para a qual deseja alternar."
 "xraySwitchClickDesk" = "Escolha com cuidado, pois versões mais antigas podem não ser compatíveis com as configurações atuais."
+"xrayUpdates" = "Atualizações do Xray"
+"updatePanel" = "Atualizar painel"
+"panelUpdateDesc" = "Isso atualizará o 3X-UI para a versão mais recente e reiniciará o serviço do painel."
+"currentPanelVersion" = "Versão atual do painel"
+"latestPanelVersion" = "Última versão do painel"
+"panelUpToDate" = "O painel está atualizado"
+"upToDate" = "Atualizado"
 "xrayStatusUnknown" = "Desconhecido"
 "xrayStatusRunning" = "Em execução"
 "xrayStatusStop" = "Parado"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "Você realmente deseja alterar a versão do Xray?"
 "xraySwitchVersionDialogDesc" = "Isso mudará a versão do Xray para #version#."
 "xraySwitchVersionPopover" = "Xray atualizado com sucesso"
+"panelUpdateDialog" = "Deseja realmente atualizar o painel?"
+"panelUpdateDialogDesc" = "Isso atualizará o 3X-UI para #version# e reiniciará o serviço do painel."
+"panelUpdateCheckPopover" = "Falha na verificação de atualização do painel"
+"panelUpdateStartedPopover" = "Atualização do painel iniciada"
 "geofileUpdateDialog" = "Você realmente deseja atualizar o geofile?"
 "geofileUpdateDialogDesc" = "Isso atualizará o arquivo #filename#."
 "geofilesUpdateDialogDesc" = "Isso atualizará todos os arquivos."

web/translation/translate.ru_RU.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "Выбор версии"
 "xraySwitchClick" = "Выберите нужную версию"
 "xraySwitchClickDesk" = "Важно: старые версии могут не поддерживать текущие настройки"
+"xrayUpdates" = "Обновления Xray"
+"updatePanel" = "Обновить панель"
+"panelUpdateDesc" = "Это обновит 3X-UI до последнего релиза и перезапустит сервис панели."
+"currentPanelVersion" = "Текущая версия панели"
+"latestPanelVersion" = "Последняя версия панели"
+"panelUpToDate" = "Панель обновлена"
+"upToDate" = "Обновлено"
 "xrayStatusUnknown" = "Неизвестно"
 "xrayStatusRunning" = "Запущен"
 "xrayStatusStop" = "Остановлен"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "Переключить версию Xray"
 "xraySwitchVersionDialogDesc" = "Вы точно хотите сменить версию Xray?"
 "xraySwitchVersionPopover" = "Xray успешно обновлён"
+"panelUpdateDialog" = "Вы действительно хотите обновить панель?"
+"panelUpdateDialogDesc" = "Это обновит 3X-UI до версии #version# и перезапустит сервис панели."
+"panelUpdateCheckPopover" = "Проверка обновления панели не удалась"
+"panelUpdateStartedPopover" = "Обновление панели началось"
 "geofileUpdateDialog" = "Вы действительно хотите обновить геофайл?"
 "geofileUpdateDialogDesc" = "Это обновит файл #filename#."
 "geofilesUpdateDialogDesc" = "Это обновит все геофайлы."

web/translation/translate.tr_TR.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "Sürüm"
 "xraySwitchClick" = "Geçiş yapmak istediğiniz sürümü seçin."
 "xraySwitchClickDesk" = "Dikkatli seçin, eski sürümler mevcut yapılandırmalarla uyumlu olmayabilir."
+"xrayUpdates" = "Xray Güncellemeleri"
+"updatePanel" = "Paneli Güncelle"
+"panelUpdateDesc" = "Bu, 3X-UI'yi en son sürüme güncelleyecek ve panel servisini yeniden başlatacaktır."
+"currentPanelVersion" = "Mevcut panel sürümü"
+"latestPanelVersion" = "Panelin en son sürümü"
+"panelUpToDate" = "Panel güncel"
+"upToDate" = "Güncel"
 "xrayStatusUnknown" = "Bilinmiyor"
 "xrayStatusRunning" = "Çalışıyor"
 "xrayStatusStop" = "Durduruldu"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "Xray sürümünü gerçekten değiştirmek istiyor musunuz?"
 "xraySwitchVersionDialogDesc" = "Bu işlem Xray sürümünü #version# olarak değiştirecektir."
 "xraySwitchVersionPopover" = "Xray başarıyla güncellendi"
+"panelUpdateDialog" = "Gerçekten paneli güncellemek istiyor musunuz?"
+"panelUpdateDialogDesc" = "Bu, 3X-UI'yi #version# sürümüne güncelleyecek ve panel servisini yeniden başlatacaktır."
+"panelUpdateCheckPopover" = "Panel güncelleme kontrolü başarısız oldu"
+"panelUpdateStartedPopover" = "Panel güncellemesi başlatıldı"
 "geofileUpdateDialog" = "Geofile'ı gerçekten güncellemek istiyor musunuz?"
 "geofileUpdateDialogDesc" = "Bu işlem #filename# dosyasını güncelleyecektir."
 "geofilesUpdateDialogDesc" = "Bu, tüm dosyaları güncelleyecektir."

web/translation/translate.uk_UA.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "Версія"
 "xraySwitchClick" = "Виберіть версію, на яку ви хочете перейти."
 "xraySwitchClickDesk" = "Вибирайте уважно, оскільки старіші версії можуть бути несумісними з поточними конфігураціями."
+"xrayUpdates" = "Оновлення Xray"
+"updatePanel" = "Оновити панель"
+"panelUpdateDesc" = "Це оновить 3X-UI до останнього релізу та перезапустить сервіс панелі."
+"currentPanelVersion" = "Поточна версія панелі"
+"latestPanelVersion" = "Остання версія панелі"
+"panelUpToDate" = "Панель оновлено"
+"upToDate" = "Оновлено"
 "xrayStatusUnknown" = "Невідомо"
 "xrayStatusRunning" = "Запущено"
 "xrayStatusStop" = "Зупинено"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "Ви дійсно хочете змінити версію Xray?"
 "xraySwitchVersionDialogDesc" = "Це змінить версію Xray на #version#."
 "xraySwitchVersionPopover" = "Xray успішно оновлено"
+"panelUpdateDialog" = "Ви дійсно хочете оновити панель?"
+"panelUpdateDialogDesc" = "Це оновить 3X-UI до #version# та перезапустить сервіс панелі."
+"panelUpdateCheckPopover" = "Перевірка оновлення панелі не вдалася"
+"panelUpdateStartedPopover" = "Розпочато оновлення панелі"
 "geofileUpdateDialog" = "Ви дійсно хочете оновити геофайл?"
 "geofileUpdateDialogDesc" = "Це оновить файл #filename#."
 "geofilesUpdateDialogDesc" = "Це оновить усі геофайли."

web/translation/translate.vi_VN.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "Phiên bản"
 "xraySwitchClick" = "Chọn phiên bản mà bạn muốn chuyển đổi sang."
 "xraySwitchClickDesk" = "Hãy lựa chọn thận trọng, vì các phiên bản cũ có thể không tương thích với các cấu hình hiện tại."
+"xrayUpdates" = "Cập nhật Xray"
+"updatePanel" = "Cập nhật Panel"
+"panelUpdateDesc" = "Điều này sẽ cập nhật 3X-UI lên bản phát hành mới nhất và khởi động lại dịch vụ panel."
+"currentPanelVersion" = "Phiên bản panel hiện tại"
+"latestPanelVersion" = "Phiên bản panel mới nhất"
+"panelUpToDate" = "Panel đã được cập nhật"
+"upToDate" = "Đã cập nhật"
 "xrayStatusUnknown" = "Không xác định"
 "xrayStatusRunning" = "Đang chạy"
 "xrayStatusStop" = "Dừng"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "Bạn có chắc chắn muốn thay đổi phiên bản Xray không?"
 "xraySwitchVersionDialogDesc" = "Hành động này sẽ thay đổi phiên bản Xray thành #version#."
 "xraySwitchVersionPopover" = "Xray đã được cập nhật thành công"
+"panelUpdateDialog" = "Bạn có chắc muốn cập nhật panel không?"
+"panelUpdateDialogDesc" = "Điều này sẽ cập nhật 3X-UI lên #version# và khởi động lại dịch vụ panel."
+"panelUpdateCheckPopover" = "Kiểm tra cập nhật panel thất bại"
+"panelUpdateStartedPopover" = "Bắt đầu cập nhật panel"
 "geofileUpdateDialog" = "Bạn có chắc chắn muốn cập nhật geofile không?"
 "geofileUpdateDialogDesc" = "Hành động này sẽ cập nhật tệp #filename#."
 "geofilesUpdateDialogDesc" = "Thao tác này sẽ cập nhật tất cả các tập tin."

web/translation/translate.zh_CN.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "版本"
 "xraySwitchClick" = "选择你要切换到的版本"
 "xraySwitchClickDesk" = "请谨慎选择，因为较旧版本可能与当前配置不兼容"
+"xrayUpdates" = "Xray 更新"
+"updatePanel" = "更新面板"
+"panelUpdateDesc" = "这将把 3X-UI 更新到最新版本并重启面板服务。"
+"currentPanelVersion" = "当前面板版本"
+"latestPanelVersion" = "最新面板版本"
+"panelUpToDate" = "面板已是最新"
+"upToDate" = "已是最新"
 "xrayStatusUnknown" = "未知"
 "xrayStatusRunning" = "运行中"
 "xrayStatusStop" = "停止"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "您确定要更改Xray版本吗？"
 "xraySwitchVersionDialogDesc" = "这将把Xray版本更改为#version#。"
 "xraySwitchVersionPopover" = "Xray 更新成功"
+"panelUpdateDialog" = "您确定要更新面板吗？"
+"panelUpdateDialogDesc" = "这将把 3X-UI 更新到 #version# 并重启面板服务。"
+"panelUpdateCheckPopover" = "面板更新检查失败"
+"panelUpdateStartedPopover" = "已开始更新面板"
 "geofileUpdateDialog" = "您确定要更新地理文件吗？"
 "geofileUpdateDialogDesc" = "这将更新 #filename# 文件。"
 "geofilesUpdateDialogDesc" = "这将更新所有文件。"

web/translation/translate.zh_TW.toml

@@ -126,6 +126,13 @@
 "xraySwitch" = "版本"
 "xraySwitchClick" = "選擇你要切換到的版本"
 "xraySwitchClickDesk" = "請謹慎選擇，因為較舊版本可能與當前配置不相容"
+"xrayUpdates" = "Xray 更新"
+"updatePanel" = "更新面板"
+"panelUpdateDesc" = "這將把 3X-UI 更新到最新版本並重新啟動面板服務。"
+"currentPanelVersion" = "目前面板版本"
+"latestPanelVersion" = "最新面板版本"
+"panelUpToDate" = "面板已是最新"
+"upToDate" = "已是最新"
 "xrayStatusUnknown" = "未知"
 "xrayStatusRunning" = "運行中"
 "xrayStatusStop" = "停止"
@@ -147,6 +154,10 @@
 "xraySwitchVersionDialog" = "您確定要變更Xray版本嗎？"
 "xraySwitchVersionDialogDesc" = "這將會把Xray版本變更為#version#。"
 "xraySwitchVersionPopover" = "Xray 更新成功"
+"panelUpdateDialog" = "您確定要更新面板嗎？"
+"panelUpdateDialogDesc" = "這將把 3X-UI 更新到 #version# 並重新啟動面板服務。"
+"panelUpdateCheckPopover" = "面板更新檢查失敗"
+"panelUpdateStartedPopover" = "面板更新已開始"
 "geofileUpdateDialog" = "您確定要更新地理檔案嗎？"
 "geofileUpdateDialogDesc" = "這將更新 #filename# 檔案。"
 "geofilesUpdateDialogDesc" = "這將更新所有文件。"

web/web.go

@@ -353,14 +353,17 @@ func (s *Server) startTask() {
 	isTgbotenabled, err := s.settingService.GetTgbotEnabled()
 	if (err == nil) && (isTgbotenabled) {
 		runtime, err := s.settingService.GetTgbotRuntime()
-		if err != nil || runtime == "" {
+		if err != nil {
-			logger.Errorf("Add NewStatsNotifyJob error[%s], Runtime[%s] invalid, will run default", err, runtime)
+			logger.Warningf("Add NewStatsNotifyJob: failed to load runtime: %v; using default @daily", err)
+			runtime = "@daily"
+		} else if strings.TrimSpace(runtime) == "" {
+			logger.Warning("Add NewStatsNotifyJob runtime is empty, using default @daily")
 			runtime = "@daily"
 		}
 		logger.Infof("Tg notify enabled,run at %s", runtime)
 		_, err = s.cron.AddJob(runtime, job.NewStatsNotifyJob())
 		if err != nil {
-			logger.Warning("Add NewStatsNotifyJob error", err)
+			logger.Warningf("Add NewStatsNotifyJob: failed to schedule runtime %q: %v", runtime, err)
 			return
 		}